From 05a37ac4b3fdede561981b9c0906c87a0e23ff24 Mon Sep 17 00:00:00 2001 From: mr-tz Date: Wed, 31 Jul 2024 12:56:04 +0000 Subject: [PATCH] use gzipped result document --- ...98038f0b4870b00a27cfca109f8f933476d82.json | 1 - ...38f0b4870b00a27cfca109f8f933476d82.json.gz | Bin 0 -> 1036822 bytes 2 files changed, 1 deletion(-) delete mode 100644 rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json create mode 100644 rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz diff --git a/rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json b/rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json deleted file mode 100644 index 82dbc9a..0000000 --- a/rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json +++ /dev/null @@ -1 +0,0 @@ -{"meta":{"timestamp":"2023-10-20T14:15:23.786418","version":"6.1.0","argv":["tests/data/dynamic/cape/v2.2/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json","--json"],"sample":{"md5":"e2147b5333879f98d515cd9aa905d489","sha1":"ad4d520fb7792b4a5701df973d6bd8a6cbfbb57f","sha256":"0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82","path":"/usr/local/google/home/wballenthin/code/public/capa/tests/data/dynamic/cape/v2.2/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json"},"flavor":"dynamic","analysis":{"format":"unknown","arch":"unknown","os":"unknown","extractor":"CapeExtractor","rules":["/usr/local/google/home/wballenthin/code/public/capa/rules"],"layout":{"processes":[{"address":{"type":"process","value":[2456,3052]},"name":"0000A65749F5902C4D82.exe","matched_threads":[{"address":{"type":"thread","value":[2456,3052,1960]},"matched_calls":[{"address":{"type":"call","value":[2456,3052,1960,1]},"name":"NtDelayExecution(Milliseconds=0x30) -> 0x0"},{"address":{"type":"call","value":[2456,3052,1960,36]},"name":"NtDelayExecution(Milliseconds=0x30) -> 0x0"},{"address":{"type":"call","value":[2456,3052,1960,150]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x313000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[2456,3052,3064]},"matched_calls":[{"address":{"type":"call","value":[2456,3052,3064,16]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x490000, RegionSize=0xc0000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,17]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x490000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,32]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,37]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[2456,3052,3064,43]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,44]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[2456,3052,3064,46]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,47]},"name":"NtOpenKey(KeyHandle=0xd8, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,48]},"name":"NtOpenKey(KeyHandle=0xd4, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,49]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,50]},"name":"NtQueryValueKey(KeyHandle=0xd4, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,115]},"name":"LdrGetProcedureAddress(ModuleName=\"WINSPOOL.DRV\", ModuleHandle=0x744e0000, FunctionName=\"SplDriverUnloadComplete\", Ordinal=0x0, FunctionAddress=0x744ede48) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,145]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[2456,3052,3064,146]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,147]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x360000, RegionSize=0x68000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,148]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,149]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x300000, RegionSize=0x6000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,154]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,158]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5c0000, RegionSize=0x6a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,225]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,274]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x8a000, MemType=0x0, Protection=PAGE_READWRITE, OldProtection=PAGE_READONLY, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[2456,3052,3064,275]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x400, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[2456,3052,3064,277]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x40d000, Size=0x5a30, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[2456,3052,3064,279]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x417000, Size=0x51708, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[2456,3052,3064,280]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x469000, Size=0xe50, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[2456,3052,3064,299]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,363]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x190"},{"address":{"type":"call","value":[2456,3052,3064,366]},"name":"NtQueryValueKey(KeyHandle=0x24, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[2456,3052,3064,370]},"name":"NtCreateFile(FileHandle=0x194, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,371]},"name":"NtCreateSection(SectionHandle=0x198, DesiredAccess=STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ, ObjectAttributes=\"\", FileHandle=0x194) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,372]},"name":"NtMapViewOfSection(SectionHandle=0x198, ProcessHandle=0xffffffff, BaseAddress=0x4910000, SectionOffset=0x18e860, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,480]},"name":"NtOpenProcess(ProcessHandle=0x190, DesiredAccess=PROCESS_DUP_HANDLE, ProcessIdentifier=0x3052) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,481]},"name":"NtQuerySystemInformation(SystemInformationClass=0x16) -> INFO_LENGTH_MISMATCH"},{"address":{"type":"call","value":[2456,3052,3064,482]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4be0000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,483]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4be0000, RegionSize=0x42000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,484]},"name":"NtQuerySystemInformation(SystemInformationClass=0x16) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,711]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\", Handle=0x1a0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,716]},"name":"NtOpenFile(FileHandle=0x1a0, DesiredAccess=SYNCHRONIZE, FileName=\"C:\\\", ShareAccess=0x0) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,717]},"name":"NtQueryInformationFile(FileHandle=0x1a0, HandleName=\"C:\\\", FileInformationClass=FileNameInformation, FileInformation=\"\\x02\\x00\\x00\\x00\\\\x00\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,721]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x1a8, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,725]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\", Handle=0x1a8, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,730]},"name":"NtOpenFile(FileHandle=0x1a8, DesiredAccess=SYNCHRONIZE, FileName=\"C:\\\", ShareAccess=0x0) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,731]},"name":"NtQueryInformationFile(FileHandle=0x1a8, HandleName=\"C:\\\", FileInformationClass=FileNameInformation, FileInformation=\"\\x02\\x00\\x00\\x00\\\\x00\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,734]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\", Handle=0x1a8, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,739]},"name":"NtOpenFile(FileHandle=0x1a8, DesiredAccess=SYNCHRONIZE, FileName=\"C:\\\", ShareAccess=0x0) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,740]},"name":"NtQueryInformationFile(FileHandle=0x1a8, HandleName=\"C:\\\", FileInformationClass=FileNameInformation, FileInformation=\"\\x02\\x00\\x00\\x00\\\\x00\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,746]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\", Handle=0x1b0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,751]},"name":"NtOpenFile(FileHandle=0x1b0, DesiredAccess=SYNCHRONIZE, FileName=\"C:\\\", ShareAccess=0x0) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,752]},"name":"NtQueryInformationFile(FileHandle=0x1b0, HandleName=\"C:\\\", FileInformationClass=FileNameInformation, FileInformation=\"\\x02\\x00\\x00\\x00\\\\x00\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,758]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x1b0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,765]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x1b8, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,775]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"System\\CurrentControlSet\\Control\\LSA\\AccessProviders\", Handle=0x1b4, FullName=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,782]},"name":"NtOpenFile(FileHandle=0x1b4, DesiredAccess=WRITE_DAC, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,803]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4de0000, RegionSize=0x101000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,804]},"name":"NtCreateFile(FileHandle=0x1b4, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,805]},"name":"NtWriteFile(FileHandle=0x1b4, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", Buffer=\"Ne\\xc99\\x11\\xdd6\\xcb\\xceE8[\\xf5F`[\\x0eumVF\\xb4\\xe8!\\xe9A\\x94\\x8c]\\xc0\\x9e\\x9b\\xfe\\xbbJ\\xe03\\xa6\\xbb\\x8d\\x99-\\xba\\xd6\\x98-\\xf2T\\xfb\\x02\\x8aY\\x83m-\\x16\\x16\\xaa\\xe0\\xc3\\x10\\xe5\\xb5x\\xfd\\xd8\\x88\\xbdL*\\x81\\xe0^yd\\xa1\\xb1\\x9d\\x834\\xc2i\\x174*pc\\xe3.\\xe4\", Length=0x90) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,813]},"name":"NtCreateFile(FileHandle=0x1e0, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,814]},"name":"NtQueryInformationFile(FileHandle=0x1e0, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\", FileInformationClass=FileStandardInformation, FileInformation=\"\\x00\\x80\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x08\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,815]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x46d0000, RegionSize=0x89000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,816]},"name":"NtReadFile(FileHandle=0x1e0, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\", Buffer=\"MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x04\\x00 \\xe61[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\\x01\\x0b\\x01\\x0c\\x00\\x00@\\x00\\x00\\x00P\\x08\\x00\\x00\\x00\\x00\\x00\\xe0'\\x00\\x00\\x00\\x10\\x00\\x00\\x00P\\x00\\x00\\x00\\x00@\\x00\\x00\\x10\\x00\\x00\\x00\\x10\\x00\\x00\", Length=0x557056) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,823]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\0000A65749F5902C4D82.exe\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\0000A65749F5902C4D82.exe\") -> 0x2"},{"address":{"type":"call","value":[2456,3052,3064,937]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x982000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,938]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x97b000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,940]},"name":"NtUnmapViewOfSection(ProcessHandle=0xffffffff, BaseAddress=0x4de0000, RegionSize=0x1000) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,942]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x970000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,959]},"name":"NtUnmapViewOfSection(ProcessHandle=0xffffffff, BaseAddress=0x570000, RegionSize=0x1000) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,961]},"name":"NtUnmapViewOfSection(ProcessHandle=0xffffffff, BaseAddress=0x560000, RegionSize=0x2000) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,982]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x922000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,986]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x986000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,993]},"name":"NtUnmapViewOfSection(ProcessHandle=0xffffffff, BaseAddress=0x2080000, RegionSize=0x15000) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,1013]},"name":"NtUnmapViewOfSection(ProcessHandle=0xffffffff, BaseAddress=0x3e0000, RegionSize=0x1000) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,1015]},"name":"NtUnmapViewOfSection(ProcessHandle=0xffffffff, BaseAddress=0x38b0000, RegionSize=0x1000) -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,1022]},"name":"NtOpenKey(KeyHandle=0x5c, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,3064,1023]},"name":"NtQueryValueKey(KeyHandle=0x5c, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[2456,3052,2792]},"matched_calls":[{"address":{"type":"call","value":[2456,3052,2792,828]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x274, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,830]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x944000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,834]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x2ac, TargetProcessHandle=0xffffffff, TargetHandle=0x2b0, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,840]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle=0x2b0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,841]},"name":"RegOpenKeyEx(Registry=0x2b0, SubKey=\"{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\\", Handle=0x2ac, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,843]},"name":"RegQueryValueEx(Handle=0x2ac, ValueName=\"Data\", Data=\"\\x00\\x00\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xbd\\xad\\xdb\\xba\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xbd\\xad\\xdb\\xba\\xbd\\xad\\xdb\\xba\\xbd\\xad\\xdb\\xba\\xbd\\xad\\xdb\\xba\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00I\\x00D\\x00E\\x00#\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x002\\x00.\\x005\\x00+\\x00_\\x00_\\x00_\\x00_\\x00#\\x005\\x00&\\x002\\x007\\x007\\x000\\x00a\\x007\\x00a\\x00f\\x00&\\x000\\x00&\\x000\\x00.\\x000\\x00.\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\Data\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,845]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle=0x2ac, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,846]},"name":"RegOpenKeyEx(Registry=0x2ac, SubKey=\"{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\\", Handle=0x2b0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,848]},"name":"RegQueryValueEx(Handle=0x2b0, ValueName=\"Generation\", Data=0x1, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\Generation\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,850]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x2b0, TargetProcessHandle=0xffffffff, TargetHandle=0x2ac, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,856]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle=0x2ac, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,857]},"name":"RegOpenKeyEx(Registry=0x2ac, SubKey=\"{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\\", Handle=0x2b0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,859]},"name":"RegQueryValueEx(Handle=0x2b0, ValueName=\"Data\", Data=\"\\x00\\x00\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x00\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00W\\xa58\\x08\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x005\\x00f\\x000\\x00c\\x003\\x004\\x007\\x002\\x00-\\x00f\\x001\\x006\\x000\\x00-\\x001\\x001\\x00e\\x00a\\x00-\\x009\\x00f\\x000\\x00e\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\Data\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,861]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle=0x2b0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,862]},"name":"RegOpenKeyEx(Registry=0x2b0, SubKey=\"{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\\", Handle=0x2ac, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,864]},"name":"RegQueryValueEx(Handle=0x2ac, ValueName=\"Generation\", Data=0x1, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\Generation\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,866]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x2ac, TargetProcessHandle=0xffffffff, TargetHandle=0x2b0, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,872]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle=0x2b0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,873]},"name":"RegOpenKeyEx(Registry=0x2b0, SubKey=\"{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\\", Handle=0x2ac, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,875]},"name":"RegQueryValueEx(Handle=0x2ac, ValueName=\"Data\", Data=\"\\x00\\x00\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x00\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00D\\x82:\\\\x04@\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x005\\x00f\\x000\\x00c\\x003\\x004\\x007\\x002\\x00-\\x00f\\x001\\x006\\x000\\x00-\\x001\\x001\\x00e\\x00a\\x00-\\x009\\x00f\\x000\\x00e\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x006\\x005\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\Data\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,877]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\", Handle=0x2ac, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,878]},"name":"RegOpenKeyEx(Registry=0x2ac, SubKey=\"{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\\", Handle=0x2b0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,880]},"name":"RegQueryValueEx(Handle=0x2b0, ValueName=\"Generation\", Data=0x1, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\Generation\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,882]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,883]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,887]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,888]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,892]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,893]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,897]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,898]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,902]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,903]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,906]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,907]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,910]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,911]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2456,3052,2792,915]},"name":"NtQueryInformationFile(FileHandle=0xffffffff, HandleName=\"\", FileInformationClass=FileEaInformation, FileInformation=\"\") -> OBJECT_TYPE_MISMATCH"},{"address":{"type":"call","value":[2456,3052,2792,916]},"name":"NtCreateFile(FileHandle=0x2b0, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\MountPointManager\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"}]}]},{"address":{"type":"process","value":[3052,2192]},"name":"0000A65749F5902C4D82.exe","matched_threads":[{"address":{"type":"thread","value":[3052,2192,1476]},"matched_calls":[{"address":{"type":"call","value":[3052,2192,1476,138]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2c3000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[3052,2192,2204]},"matched_calls":[{"address":{"type":"call","value":[3052,2192,2204,16]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4450000, RegionSize=0xc0000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,17]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4450000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,32]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,33]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,2192,2204,35]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,36]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,2192,2204,38]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,39]},"name":"NtOpenKey(KeyHandle=0xdc, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,40]},"name":"NtOpenKey(KeyHandle=0xd8, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,41]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,42]},"name":"NtQueryValueKey(KeyHandle=0xd8, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,137]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[3052,2192,2204,139]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,140]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1f50000, RegionSize=0x68000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,141]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,142]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2b0000, RegionSize=0x6000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,146]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,150]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x36e0000, RegionSize=0x6a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,217]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,266]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x8a000, MemType=0x0, Protection=PAGE_READWRITE, OldProtection=PAGE_READONLY, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,2192,2204,267]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x400, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,2192,2204,269]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x40d000, Size=0x5a30, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,2192,2204,271]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x417000, Size=0x51708, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,2192,2204,272]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x469000, Size=0xe50, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,2192,2204,291]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,345]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x65f000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,356]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x18c"},{"address":{"type":"call","value":[3052,2192,2204,359]},"name":"NtQueryValueKey(KeyHandle=0x24, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,2192,2204,363]},"name":"NtCreateFile(FileHandle=0x190, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,365]},"name":"NtMapViewOfSection(SectionHandle=0x194, ProcessHandle=0xffffffff, BaseAddress=0x48b0000, SectionOffset=0x18e860, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,475]},"name":"NtOpenProcess(ProcessHandle=0x18c, DesiredAccess=PROCESS_DUP_HANDLE, ProcessIdentifier=0x2192) -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,477]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4b80000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,478]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4b80000, RegionSize=0x42000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,1076]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x2192) -> 0x194"},{"address":{"type":"call","value":[3052,2192,2204,1206]},"name":"NtOpenKey(KeyHandle=0x5c, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[3052,2192,2204,1207]},"name":"NtQueryValueKey(KeyHandle=0x5c, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]}]},{"address":{"type":"process","value":[3052,1180]},"name":"jxoqwn.exe","matched_threads":[{"address":{"type":"thread","value":[3052,1180,500]},"matched_calls":[{"address":{"type":"call","value":[3052,1180,500,15]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1e80000, RegionSize=0xc0000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,16]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1e80000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,31]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,32]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,1180,500,34]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,35]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,1180,500,37]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,38]},"name":"NtOpenKey(KeyHandle=0xdc, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,39]},"name":"NtOpenKey(KeyHandle=0xd8, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,40]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,41]},"name":"NtQueryValueKey(KeyHandle=0xd8, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,136]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[3052,1180,500,137]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,138]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x490000, RegionSize=0x68000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,139]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,140]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2b0000, RegionSize=0x6000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,145]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,149]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5b0000, RegionSize=0x6a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,216]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,265]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x8a000, MemType=0x0, Protection=PAGE_READWRITE, OldProtection=PAGE_READONLY, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,1180,500,266]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x400, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,1180,500,268]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x40d000, Size=0x5a30, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,1180,500,270]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x417000, Size=0x51708, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,1180,500,271]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x469000, Size=0xe50, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,1180,500,290]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,344]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6b7000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,355]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x18c"},{"address":{"type":"call","value":[3052,1180,500,358]},"name":"NtQueryValueKey(KeyHandle=0x24, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,1180,500,362]},"name":"NtCreateFile(FileHandle=0x190, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,364]},"name":"NtMapViewOfSection(SectionHandle=0x194, ProcessHandle=0xffffffff, BaseAddress=0x4930000, SectionOffset=0x18e860, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,476]},"name":"NtOpenProcess(ProcessHandle=0x18c, DesiredAccess=PROCESS_DUP_HANDLE, ProcessIdentifier=0x1180) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,477]},"name":"NtQuerySystemInformation(SystemInformationClass=0x16) -> INFO_LENGTH_MISMATCH"},{"address":{"type":"call","value":[3052,1180,500,478]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4c00000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,479]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4c00000, RegionSize=0x42000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,480]},"name":"NtQuerySystemInformation(SystemInformationClass=0x16) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,690]},"name":"LdrGetProcedureAddress(ModuleName=\"ntdll.dll\", ModuleHandle=0x77d00000, FunctionName=\"NtMapViewOfSection\", Ordinal=0x0, FunctionAddress=0x77d1fc80) -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,693]},"name":"NtMapViewOfSection(SectionHandle=0x1ac, ProcessHandle=0xffffffff, BaseAddress=0x4530000, SectionOffset=0x0, ViewSize=0x6a000, Win32Protect=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,694]},"name":"NtMapViewOfSection(SectionHandle=0x1ac, ProcessHandle=0x1a0, BaseAddress=0xc0000, SectionOffset=0x0, ViewSize=0x6a000, Win32Protect=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,699]},"name":"WriteProcessMemory(ProcessHandle=0x1a0, BaseAddress=0x1f102d, Buffer=\"\\xe9\\xe8\r\\xed\\xff\", BufferLength=0x5, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[3052,1180,500,717]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x692000, RegionSize=0x9000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,742]},"name":"NtOpenKey(KeyHandle=0x5c, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[3052,1180,500,743]},"name":"NtQueryValueKey(KeyHandle=0x5c, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[3052,1180,1692]},"matched_calls":[{"address":{"type":"call","value":[3052,1180,1692,141]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2e3000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]}]},{"address":{"type":"process","value":[3052,2852]},"name":"cmd.exe","matched_threads":[{"address":{"type":"thread","value":[3052,2852,2804]},"matched_calls":[{"address":{"type":"call","value":[3052,2852,2804,1]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[3052,2852,2804,4]},"name":"NtOpenThread(ThreadHandle=0xec, DesiredAccess=THREAD_ALL_ACCESS, ProcessId=0x2852, ThreadId=0x2804) -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,33]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6c0000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,34]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6c1000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,36]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6c2000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,53]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6c3000, RegionSize=0x5000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,55]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,56]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,2852,2804,58]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,59]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,2852,2804,61]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,62]},"name":"NtOpenKey(KeyHandle=0xf0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,63]},"name":"NtOpenKey(KeyHandle=0xf4, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,64]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,65]},"name":"NtQueryValueKey(KeyHandle=0xf4, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,66]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x8e3000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,67]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x8e4000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,68]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4710000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,69]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4710000, RegionSize=0x12000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,80]},"name":"NtQueryValueKey(KeyHandle=0x30, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[3052,2852,2804,84]},"name":"NtCreateFile(FileHandle=0xf8, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,86]},"name":"NtMapViewOfSection(SectionHandle=0xfc, ProcessHandle=0xffffffff, BaseAddress=0x4810000, SectionOffset=0x36edb8, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,110]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6c3000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,115]},"name":"NtCreateFile(FileHandle=0xfc, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Local\\Temp\\0000A65749F5902C4D82.exe\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,118]},"name":"NtCreateFile(FileHandle=0x100, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\System32\\calc.exe\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,119]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FileStandardInformation, FileInformation=\"\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\x0b\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,120]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,129]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,138]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,147]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,156]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,165]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,174]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,183]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,186]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,188]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,190]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,192]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,194]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,196]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,198]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,200]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,202]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,204]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,206]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,208]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,210]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,212]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,214]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,216]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,218]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,220]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,222]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,224]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,226]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,228]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,230]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,232]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,234]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,236]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,238]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,240]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,242]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,244]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,246]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,248]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,250]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,252]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,254]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,256]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,258]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,260]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,262]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,264]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,266]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,268]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,270]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,271]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,272]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,273]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,274]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,275]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,276]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,277]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,278]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,279]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,280]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,281]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,282]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,283]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,284]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,285]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,286]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,287]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,288]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,289]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,290]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,291]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,292]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,293]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,294]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,295]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,296]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,297]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,298]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,299]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,300]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,301]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,302]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,303]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,304]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,305]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,306]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,307]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,308]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,309]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,310]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,311]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,312]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,313]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,314]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,315]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,316]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,317]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,318]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,319]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,320]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,321]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,322]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,323]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,324]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,325]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,326]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,327]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,328]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,329]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,330]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,331]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,332]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,333]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,334]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,335]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,336]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,337]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,338]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,339]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,340]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,341]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,342]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,343]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,344]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,345]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,346]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,347]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,348]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,349]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,350]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,351]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,352]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,353]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,354]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,355]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,356]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,357]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,358]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,359]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,360]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,361]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,362]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,363]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,364]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,365]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,366]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,367]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,368]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,369]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,370]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,371]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,372]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,373]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,374]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,375]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,376]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,377]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,378]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,379]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,380]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,381]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,382]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,383]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,384]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,385]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,386]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,387]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,388]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,389]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,390]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,391]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,392]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,393]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,394]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,395]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,396]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,397]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,398]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,399]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,400]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,401]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,402]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,403]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,404]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,405]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,406]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,407]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,408]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,409]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,410]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,411]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,412]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,413]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,414]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,415]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,416]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,417]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,418]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,419]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,420]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,421]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,422]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,423]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,424]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,425]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,426]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,427]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,428]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,429]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,430]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,431]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,432]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,433]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,434]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,435]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,436]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,437]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,438]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,439]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,440]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,441]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,442]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,443]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,444]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,445]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,446]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,447]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,448]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,449]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,450]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,451]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,452]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,453]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,454]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,455]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,456]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,457]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,458]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,459]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,460]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,461]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,462]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,463]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,464]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,465]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,466]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,467]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,468]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,469]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,470]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,471]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,472]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,473]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,474]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,475]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,476]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,477]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x01\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,478]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,479]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,480]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,481]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,482]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,483]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,484]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,485]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,486]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,487]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,488]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,489]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,490]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,491]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,492]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,493]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,494]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,495]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,496]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,497]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,498]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,499]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,500]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,501]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,502]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,503]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,504]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,505]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,506]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,507]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,508]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,509]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,510]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,511]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,512]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,513]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,514]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,515]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,516]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,517]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,518]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,519]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,520]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,521]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,522]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,523]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,524]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,525]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,526]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,527]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,528]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,529]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,530]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,531]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,532]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,533]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,534]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,535]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,536]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,537]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,538]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,539]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,540]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,541]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,542]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,543]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,544]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,545]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,546]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,547]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,548]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,549]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,550]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,551]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,552]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,553]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,554]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,555]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,556]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,557]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,558]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,559]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,560]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,561]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,562]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,563]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,564]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,565]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,566]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,567]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,568]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,569]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,570]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,576]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,577]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,578]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,579]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,580]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,581]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,582]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,583]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,584]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,585]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,586]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,587]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,588]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,589]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,590]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,591]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,592]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,593]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,594]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,595]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,596]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,597]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,598]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,599]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,600]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,601]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,602]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,603]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,604]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,605]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,606]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,607]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,608]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,609]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,610]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,611]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,612]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x02\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,613]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,614]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,615]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,616]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,617]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,618]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,619]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,620]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,621]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,622]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,623]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,624]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,625]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,626]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,627]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,628]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,629]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,630]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,631]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,632]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,633]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,634]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,635]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,636]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,637]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,638]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,639]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,640]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,641]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,642]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,643]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,644]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,645]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,646]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,647]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,648]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,649]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,650]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,651]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,652]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,653]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,654]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,655]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,656]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,657]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,658]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,659]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,660]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,661]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,662]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,663]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,664]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,665]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,666]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,667]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,668]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,669]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,670]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,671]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,672]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,673]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,674]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,675]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,676]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,677]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,678]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,679]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,680]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,681]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,682]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,683]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,684]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,685]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,686]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,687]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,688]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,689]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,690]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,691]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,692]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,693]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,694]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,695]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,696]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,697]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,698]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,699]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,700]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,701]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,702]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,703]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,704]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,705]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,706]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,707]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,708]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,709]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,710]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,711]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,712]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,713]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,714]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,715]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,716]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,717]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,718]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,719]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,720]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,721]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,722]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,723]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,724]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,725]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,726]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,727]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,728]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,729]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,730]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,731]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,732]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,733]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,734]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,735]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,736]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,737]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,738]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,739]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,740]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x03\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,741]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,742]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,743]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,744]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,745]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,746]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,747]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,748]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,749]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,750]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,751]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,752]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,753]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,754]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,755]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,756]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,757]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,758]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,759]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,760]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,761]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,762]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,763]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,764]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,765]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,766]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,767]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,768]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,769]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,770]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,771]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,772]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,773]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,774]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,775]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,776]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,777]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,778]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,779]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,780]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,781]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,782]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,783]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,784]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,785]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,786]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,787]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,788]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,789]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,790]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,791]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,792]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,793]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,794]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,795]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,796]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,797]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,798]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,799]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,800]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,801]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,802]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,803]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,804]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,805]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,806]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,807]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,808]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,809]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,810]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,811]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,812]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,813]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,814]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,815]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,816]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,817]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,818]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,819]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,820]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,821]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,822]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,823]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,824]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,825]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,826]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,827]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,828]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,829]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,830]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,831]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,832]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,833]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,834]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,835]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,836]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,837]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,838]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,839]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,840]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,841]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,842]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,843]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,844]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,845]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,846]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,847]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,848]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,849]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,850]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,851]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,852]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,853]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,854]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,855]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,856]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,857]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,858]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,859]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,860]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,861]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,862]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,863]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,864]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,865]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,866]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,867]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,868]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x04\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,869]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,870]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,871]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,872]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,873]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,874]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,875]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,876]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,877]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,878]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,879]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,880]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,881]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,882]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,883]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,884]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,885]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,886]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,887]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,888]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,889]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,890]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,891]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,892]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,893]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,894]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,895]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,896]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,897]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,898]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,899]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,900]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,901]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,902]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,903]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,904]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,905]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,906]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,907]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,908]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,909]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,910]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,911]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,912]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,913]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,914]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,915]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,916]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,917]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,918]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,919]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,920]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,921]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,922]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,923]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,924]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,925]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,926]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,927]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,928]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,929]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,930]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,931]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,932]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,933]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,934]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,935]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,936]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,937]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,938]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,939]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,940]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,941]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,942]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,943]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,944]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,945]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,946]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,947]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,948]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,949]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,950]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,951]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,952]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,953]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,954]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,955]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,956]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,957]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,958]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,959]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,960]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,961]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,962]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,963]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,964]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,965]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,966]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,967]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,968]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,969]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,970]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,971]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,972]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,973]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,974]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,975]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,976]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,977]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,978]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,979]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,980]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,981]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,982]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,983]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,984]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,985]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,986]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,987]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,988]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,989]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,990]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,991]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,992]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,993]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,994]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,995]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,996]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x05\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,997]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,998]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,999]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1000]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1001]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1002]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1003]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1004]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1005]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1006]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1007]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1008]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1009]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1010]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1011]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1012]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1013]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1014]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1015]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1016]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1017]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1018]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1019]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1020]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1021]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1022]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1023]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1024]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1025]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1026]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1027]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1028]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1029]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1030]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1031]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1032]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1033]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1034]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1035]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1036]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1037]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1038]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1039]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1040]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1041]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1042]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1043]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1044]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1045]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1046]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1047]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1048]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1049]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1050]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1051]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1052]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1053]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1054]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1055]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1056]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1057]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1058]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1059]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1060]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1061]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1062]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1063]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1064]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1065]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1066]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1067]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1068]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1069]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1070]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1071]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1072]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1073]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1074]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1075]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1076]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1077]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1078]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1079]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1080]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1081]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1082]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1083]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1084]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1085]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1086]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1087]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1088]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1089]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1090]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1091]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1092]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1093]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1094]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1095]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1096]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1097]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1098]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1099]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1100]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1101]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1102]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1103]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1104]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1105]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1106]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1107]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1108]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1109]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1110]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1111]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1112]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1113]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1114]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1115]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1116]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1117]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1118]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1119]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1120]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1121]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1122]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1123]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1124]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x06\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1125]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1126]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1127]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1128]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1129]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1130]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1131]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1132]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1133]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1134]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1135]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1136]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1137]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1138]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1139]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1140]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1141]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1142]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1143]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1144]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1145]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1146]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1147]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1148]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1149]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1150]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1151]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1152]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1153]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1154]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1155]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1156]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1157]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1158]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1159]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1160]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1161]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1162]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1163]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1164]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1165]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1166]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1167]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1168]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1169]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1170]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1171]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1172]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1173]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1174]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1175]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1176]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1177]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1178]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1179]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1180]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1181]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1182]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1183]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1184]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1185]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1186]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1187]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1188]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1189]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1190]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1191]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1192]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1193]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1194]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1195]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1196]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1197]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1198]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1199]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1200]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1201]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1202]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1203]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1204]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1205]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1206]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1207]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1208]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1209]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1210]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1211]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1212]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1213]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1214]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1215]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1216]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1217]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1218]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1219]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1220]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1221]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1222]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1223]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1224]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1225]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1226]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1227]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1228]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1229]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1230]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1231]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1232]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1233]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1234]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1235]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1236]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1237]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1238]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1239]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1240]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1241]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1242]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1243]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1244]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1245]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1246]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1247]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1248]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1249]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1250]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1251]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1252]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1253]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x07\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1254]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1255]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1256]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1257]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1258]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1259]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1260]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1261]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1262]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1263]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1264]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1265]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1266]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1267]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1268]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1269]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1270]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1271]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1272]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1273]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1274]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1275]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1276]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1277]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1278]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1279]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1280]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1281]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1282]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1283]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1284]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1285]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1286]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1287]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1288]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1289]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1290]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1291]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1292]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1293]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1294]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1295]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1296]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1297]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1298]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1299]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1300]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1301]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1302]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1303]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1304]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1305]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1306]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1307]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1308]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1309]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1310]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1311]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1312]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1313]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1314]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1315]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1316]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1317]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1318]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1319]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1320]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1321]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1322]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1323]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1324]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1325]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1326]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1327]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1328]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1329]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1330]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1331]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1332]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1333]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1334]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1335]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1336]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1337]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1338]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1339]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1340]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1341]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1342]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1343]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1344]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1345]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1346]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1347]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1348]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1349]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1351]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1357]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1455]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1457]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1458]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1459]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1460]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1461]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1462]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1463]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1465]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1466]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1471]},"name":"NtSetInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1472]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1473]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1474]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1475]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1476]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1477]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1478]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1479]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1480]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1481]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1482]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1483]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1553]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1554]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1555]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1556]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1557]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1558]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1559]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1560]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1561]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1562]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1563]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1564]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1565]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1568]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\\x08\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1569]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1570]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1571]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1572]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1573]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1574]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1575]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1576]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1577]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1578]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1579]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1580]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1581]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1582]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1583]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1584]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1585]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1586]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1587]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1588]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1589]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1590]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1591]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1592]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1593]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1594]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1595]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1596]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1597]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1598]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1599]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1600]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1601]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1602]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1603]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1604]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1605]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1606]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1607]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1608]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1609]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1610]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1611]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1612]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1613]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1614]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1615]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1616]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1617]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1618]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1619]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1620]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1621]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1622]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1623]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1624]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1625]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1626]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1627]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1628]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1629]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1630]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1631]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1632]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1633]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1634]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1635]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1636]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1637]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1638]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1639]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1640]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1641]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1642]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1643]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1644]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1645]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1646]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1647]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1648]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1649]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1650]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1651]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1652]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1653]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1654]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1655]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1656]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1657]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1658]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1659]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1660]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1661]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1662]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1663]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1664]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1665]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1666]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1667]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1668]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1669]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1670]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1671]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1672]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1673]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1674]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1675]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1676]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1677]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1678]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1679]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1680]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1681]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1682]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1683]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1684]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1685]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1686]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1687]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1688]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1689]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1690]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1691]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1692]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1693]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1694]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1695]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1696]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\t\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1697]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1698]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1699]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1700]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1701]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1702]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1703]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1704]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1705]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1706]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1707]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1708]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1709]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1710]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1711]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1712]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1713]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1714]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1715]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1716]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1717]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1718]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1719]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1720]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1721]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1722]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1723]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1724]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1725]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1726]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1727]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1728]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1729]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1730]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1731]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1732]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1733]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1734]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1735]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1736]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1737]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1738]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1739]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1740]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1741]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1742]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1743]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1744]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1745]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1746]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1747]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1748]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1749]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1750]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1751]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1752]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1753]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1754]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1755]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1756]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1757]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1758]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1759]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1760]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1761]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1762]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1763]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1764]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1765]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1766]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1767]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1768]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1769]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1770]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1771]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1772]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1773]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1774]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1775]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1776]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1777]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1778]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1779]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1780]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1781]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1782]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1783]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1784]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1785]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1786]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1787]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1788]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1789]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1790]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1791]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1792]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1793]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1794]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1795]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1796]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1797]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1798]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1799]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1800]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1801]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1802]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1803]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1804]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1805]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1806]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xda\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1807]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xdc\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1808]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xde\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1809]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe0\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1810]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe2\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1811]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe4\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1812]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe6\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1813]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xe8\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1814]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xea\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1815]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xec\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1816]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xee\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1817]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf0\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1818]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf2\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1819]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf4\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1820]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf6\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1821]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xf8\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1822]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfa\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1823]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfc\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1824]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xfe\n\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1825]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1826]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x02\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1827]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x04\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1828]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x06\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1829]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x08\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1830]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\n\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1831]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0c\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1832]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x0e\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1833]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x10\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1834]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x12\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1835]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x14\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1836]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x16\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1837]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x18\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1838]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1a\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1839]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1c\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1840]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x1e\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1841]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00 \\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1842]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\"\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1843]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00$\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1844]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00&\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1845]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00(\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1846]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00*\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1847]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00,\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1848]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00.\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1849]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x000\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1850]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x002\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1851]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x004\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1852]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x006\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1853]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x008\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1854]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00:\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1855]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00<\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1856]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00>\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1857]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00@\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1858]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00B\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1859]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00D\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1860]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00F\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1861]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00H\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1862]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00J\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1863]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00L\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1864]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00N\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1865]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00P\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1866]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00R\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1867]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00T\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1868]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00V\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1869]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00X\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1870]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00Z\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1871]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1872]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00^\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1873]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00`\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1874]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00b\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1875]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00d\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1876]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00f\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1877]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00h\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1878]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00j\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1879]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00l\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1880]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00n\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1881]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00p\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1882]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00r\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1883]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00t\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1884]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00v\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1885]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00x\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1886]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00z\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1887]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00|\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1888]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00~\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1889]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x80\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1890]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x82\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1891]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x84\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1892]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x86\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1893]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x88\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1894]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8a\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1895]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8c\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1896]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x8e\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1897]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x90\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1898]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x92\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1899]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x94\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1900]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x96\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1901]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x98\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1902]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9a\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1903]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9c\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1904]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x9e\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1905]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa0\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1906]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa2\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1907]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa4\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1908]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1909]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xa8\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1910]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xaa\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1911]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xac\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1912]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xae\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1913]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb0\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1914]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb2\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1915]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb4\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1916]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb6\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1917]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xb8\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1918]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xba\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1919]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbc\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1920]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xbe\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1921]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc0\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1922]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc2\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1923]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc4\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1924]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc6\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1925]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xc8\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1926]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xca\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1927]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1928]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xce\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1929]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd0\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1930]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd2\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1931]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd4\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1932]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd6\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1933]},"name":"NtQueryInformationFile(FileHandle=0x100, HandleName=\"C:\\Windows\\SysWOW64\\calc.exe\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\xd8\\x0b\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1957]},"name":"NtOpenKey(KeyHandle=0x68, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[3052,2852,2804,1958]},"name":"NtQueryValueKey(KeyHandle=0x68, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[3052,2852,2868]},"matched_calls":[{"address":{"type":"call","value":[3052,2852,2868,1382]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[3052,2852,2868,1498]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[3052,2852,2868,1552]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x12c, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[3052,2852,2868,1566]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6ef000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]}]},{"address":{"type":"process","value":[2852,2900]},"name":"PING.EXE","matched_threads":[{"address":{"type":"thread","value":[2852,2900,3000]},"matched_calls":[{"address":{"type":"call","value":[2852,2900,3000,30]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0xa3000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[2852,2900,3004]},"matched_calls":[{"address":{"type":"call","value":[2852,2900,3004,28]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2d2000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[2852,2900,2904]},"matched_calls":[{"address":{"type":"call","value":[2852,2900,2904,16]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[2852,2900,2904,19]},"name":"WSAStartup(VersionRequested=0x2) -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,23]},"name":"getaddrinfo(NodeName=\"127.0.0.1\", ServiceName=\"\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,25]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2d0000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,38]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2d7000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,43]},"name":"NtOpenKey(KeyHandle=0x138, DesiredAccess=KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SQMClient\\Windows\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,44]},"name":"NtQueryValueKey(KeyHandle=0x138, ValueName=\"CEIPEnable\", Type=REG_DWORD, Information=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\\CEIPEnable\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,48]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x44d0000, RegionSize=0x80000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,50]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4510000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,85]},"name":"NtOpenKey(KeyHandle=0x138, DesiredAccess=KEY_QUERY_VALUE, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,86]},"name":"NtQueryValueKey(KeyHandle=0x138, ValueName=\"Disable\", Type=REG_DWORD, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,90]},"name":"NtCreateFile(FileHandle=0x13c, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\Nsi\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,200]},"name":"NtOpenKey(KeyHandle=0x68, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2904,201]},"name":"NtQueryValueKey(KeyHandle=0x68, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[2852,2900,1744]},"matched_calls":[{"address":{"type":"call","value":[2852,2900,1744,27]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x110, Options=0x2) -> 0x0"}]},{"address":{"type":"thread","value":[2852,2900,2032]},"matched_calls":[{"address":{"type":"call","value":[2852,2900,2032,31]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x11c, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2852,2900,2032,32]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2d3000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2852,2900,2032,33]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2d5000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]}]},{"address":{"type":"process","value":[1180,1852]},"name":"explorer.exe","matched_threads":[{"address":{"type":"thread","value":[1180,1852,920]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,920,9]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\OLEAUT\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLEAUT\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,920,11]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventWrite\", Ordinal=0x0, FunctionAddress=0x77d5979d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,12]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventRegister\", Ordinal=0x0, FunctionAddress=0x77d42875) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,13]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventUnregister\", Ordinal=0x0, FunctionAddress=0x77d5923d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,14]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ntdll.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,15]},"name":"LdrGetProcedureAddress(ModuleName=\"ntdll.dll\", ModuleHandle=0x77d00000, FunctionName=\"RtlUnhandledExceptionFilter\", Ordinal=0x0, FunctionAddress=0x77dc911e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,16]},"name":"LdrGetProcedureAddress(ModuleName=\"ntdll.dll\", ModuleHandle=0x77d00000, FunctionName=\"RtlIsThreadWithinLoaderCallout\", Ordinal=0x0, FunctionAddress=0x77d3cc51) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,17]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4f0000, RegionSize=0x20000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,18]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4f0000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,19]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9f0000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,20]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9f1000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,22]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventWrite\", Ordinal=0x0, FunctionAddress=0x77d5979d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,23]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventRegister\", Ordinal=0x0, FunctionAddress=0x77d42875) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,24]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventUnregister\", Ordinal=0x0, FunctionAddress=0x77d5923d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,25]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9f2000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,26]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9f3000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,27]},"name":"HeapCreate(Options=0x0, InitialSize=0x0, MaximumSize=0x0) -> 0x4650000"},{"address":{"type":"call","value":[1180,1852,920,28]},"name":"NtCreateFile(FileHandle=0x114, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\SysWOW64\\en-US\\SETUPAPI.dll.mui\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_DELETE, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,30]},"name":"NtMapViewOfSection(SectionHandle=0x118, ProcessHandle=0xffffffff, BaseAddress=0x510000, SectionOffset=0x5be7c0, ViewSize=0xd000, Win32Protect=PAGE_WRITECOPY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,32]},"name":"NtOpenKey(KeyHandle=0x118, DesiredAccess=KEY_QUERY_VALUE, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,33]},"name":"NtQueryValueKey(KeyHandle=0x118, ValueName=\"Disable\", Type=REG_DWORD, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,35]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Setup\", Handle=0x118, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,36]},"name":"LdrLoadDll(Flags=0x0, FileName=\"API-MS-Win-Core-LocalRegistry-L1-1-0.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,37]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"RegQueryValueExW\", Ordinal=0x0, FunctionAddress=0x75af1dda) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,38]},"name":"RegQueryValueEx(Handle=0x118, ValueName=\"SourcePath\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,920,40]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\", Handle=0x118, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,42]},"name":"NtOpenKey(KeyHandle=0x11c, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,43]},"name":"NtQueryValueKey(KeyHandle=0x11c, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,920,45]},"name":"NtOpenKey(KeyHandle=0x11c, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,46]},"name":"NtQueryValueKey(KeyHandle=0x11c, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,920,49]},"name":"NtCreateMutant(Handle=0x11c, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,50]},"name":"NtCreateMutant(Handle=0x124, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,52]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x533000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,53]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4510000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,54]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4510000, RegionSize=0x12000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,55]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x537000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,65]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ADVAPI32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,66]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegisterTraceGuidsW\", Ordinal=0x0, FunctionAddress=0x77d42983) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,68]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventRegister\", Ordinal=0x0, FunctionAddress=0x77d42875) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,69]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventUnregister\", Ordinal=0x0, FunctionAddress=0x77d5923d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,70]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventEnabled\", Ordinal=0x0, FunctionAddress=0x77d3875f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,71]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EventWrite\", Ordinal=0x0, FunctionAddress=0x77d5979d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,72]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,920,74]},"name":"HeapCreate(Options=0x0, InitialSize=0x80000, MaximumSize=0x0) -> 0x4730000"},{"address":{"type":"call","value":[1180,1852,920,75]},"name":"NtCreateEvent(Handle=0x138, EventName=\"dkncd2gaf\", EventType=0x1, InitialState=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,80]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetModuleHandleA\", Ordinal=0x0, FunctionAddress=0x75af1245) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,82]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,83]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateToolhelp32Snapshot\", Ordinal=0x0, FunctionAddress=0x75b174bf) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,84]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Process32First\", Ordinal=0x0, FunctionAddress=0x75b18c53) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,85]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Process32Next\", Ordinal=0x0, FunctionAddress=0x75b189aa) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,86]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Module32First\", Ordinal=0x0, FunctionAddress=0x75b76571) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,87]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Module32Next\", Ordinal=0x0, FunctionAddress=0x75b7665a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,88]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateRemoteThread\", Ordinal=0x0, FunctionAddress=0x75b749fb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,89]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WriteProcessMemory\", Ordinal=0x0, FunctionAddress=0x75b0da40) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,90]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ReadProcessMemory\", Ordinal=0x0, FunctionAddress=0x75b0d034) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,91]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"OpenProcess\", Ordinal=0x0, FunctionAddress=0x75af1962) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,92]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,93]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualFreeEx\", Ordinal=0x0, FunctionAddress=0x75b0da28) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,94]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualProtect\", Ordinal=0x0, FunctionAddress=0x75af43ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,95]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WaitForSingleObject\", Ordinal=0x0, FunctionAddress=0x75af1136) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,96]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetLastError\", Ordinal=0x0, FunctionAddress=0x75af11a9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,97]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b1bf9e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,98]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetCurrentDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b01874) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,99]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateProcessA\", Ordinal=0x0, FunctionAddress=0x75af1072) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,100]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetModuleFileNameA\", Ordinal=0x0, FunctionAddress=0x75af1491) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,101]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetFilePointer\", Ordinal=0x0, FunctionAddress=0x75af17ad) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,102]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetEndOfFile\", Ordinal=0x0, FunctionAddress=0x75b0ce96) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,103]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindFirstFileA\", Ordinal=0x0, FunctionAddress=0x75afe30e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,104]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindNextFileA\", Ordinal=0x0, FunctionAddress=0x75b1bfe6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,105]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindClose\", Ordinal=0x0, FunctionAddress=0x75af44b1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,106]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateFileA\", Ordinal=0x0, FunctionAddress=0x75af5db6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,107]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateFileW\", Ordinal=0x0, FunctionAddress=0x75af4074) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,108]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ReadFile\", Ordinal=0x0, FunctionAddress=0x75af3fe5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,109]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WriteFile\", Ordinal=0x0, FunctionAddress=0x75af1282) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,110]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CloseHandle\", Ordinal=0x0, FunctionAddress=0x75af13f0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,111]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DeleteFileA\", Ordinal=0x0, FunctionAddress=0x75af5e34) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,112]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LoadLibraryA\", Ordinal=0x0, FunctionAddress=0x75af48d7) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,113]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentThreadId\", Ordinal=0x0, FunctionAddress=0x75af1430) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,114]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"MoveFileA\", Ordinal=0x0, FunctionAddress=0x75b6dfc9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,115]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LocalFree\", Ordinal=0x0, FunctionAddress=0x75af2f4c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,116]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b1bfce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,117]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetVolumeInformationA\", Ordinal=0x0, FunctionAddress=0x75b16f43) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,118]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateThread\", Ordinal=0x0, FunctionAddress=0x75af24e4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,119]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"OpenThread\", Ordinal=0x0, FunctionAddress=0x75b01288) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,120]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ExpandEnvironmentStringsA\", Ordinal=0x0, FunctionAddress=0x75b0eed1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,121]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualProtectEx\", Ordinal=0x0, FunctionAddress=0x75b74e4f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,122]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"InterlockedCompareExchange\", Ordinal=0x0, FunctionAddress=0x75af1464) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,123]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ntdll.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,124]},"name":"LdrGetProcedureAddress(ModuleName=\"ntdll.dll\", ModuleHandle=0x77d00000, FunctionName=\"ZwQueryInformationThread\", Ordinal=0x0, FunctionAddress=0x77d1fc38) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,125]},"name":"LdrLoadDll(Flags=0x0, FileName=\"advapi32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,126]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"AdjustTokenPrivileges\", Ordinal=0x0, FunctionAddress=0x776b40be) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,127]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegOpenKeyExA\", Ordinal=0x0, FunctionAddress=0x776b483b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,128]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegCreateKeyExA\", Ordinal=0x0, FunctionAddress=0x776b1399) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,129]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegQueryInfoKeyA\", Ordinal=0x0, FunctionAddress=0x776ae0ab) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,130]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegEnumValueA\", Ordinal=0x0, FunctionAddress=0x776aceb1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,131]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegEnumKeyExA\", Ordinal=0x0, FunctionAddress=0x776b13b1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,132]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegSetValueExA\", Ordinal=0x0, FunctionAddress=0x776b13e3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,133]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegQueryValueExA\", Ordinal=0x0, FunctionAddress=0x776b4823) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,134]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegCloseKey\", Ordinal=0x0, FunctionAddress=0x776b45cd) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,135]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegDeleteValueA\", Ordinal=0x0, FunctionAddress=0x776ca46a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,136]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"AllocateAndInitializeSid\", Ordinal=0x0, FunctionAddress=0x776b4016) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,137]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"SetEntriesInAclA\", Ordinal=0x0, FunctionAddress=0x776f18f9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,138]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"SetNamedSecurityInfoA\", Ordinal=0x0, FunctionAddress=0x776f18b0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,139]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"FreeSid\", Ordinal=0x0, FunctionAddress=0x776b405e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,140]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"LookupAccountSidA\", Ordinal=0x0, FunctionAddress=0x776e207c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,141]},"name":"LdrLoadDll(Flags=0x0, FileName=\"shell32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,142]},"name":"LdrGetProcedureAddress(ModuleName=\"SHELL32.dll\", ModuleHandle=0x75d70000, FunctionName=\"ShellExecuteA\", Ordinal=0x0, FunctionAddress=0x75fb8790) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,144]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"IsWow64Process\", Ordinal=0x0, FunctionAddress=0x75af193a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,147]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,148]},"name":"LdrLoadDll(Flags=0x0, FileName=\"user32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,149]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"MessageBoxA\", Ordinal=0x0, FunctionAddress=0x777bfdae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,150]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"FindWindowA\", Ordinal=0x0, FunctionAddress=0x7776fffe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,151]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"SendMessageA\", Ordinal=0x0, FunctionAddress=0x777771fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,152]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"PostMessageA\", Ordinal=0x0, FunctionAddress=0x77774bbc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,153]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"GetForegroundWindow\", Ordinal=0x0, FunctionAddress=0x77774458) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,154]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"RegisterClassExA\", Ordinal=0x0, FunctionAddress=0x7776dba8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,155]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"CreateWindowExA\", Ordinal=0x0, FunctionAddress=0x7776d23e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,156]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"ShowWindow\", Ordinal=0x0, FunctionAddress=0x77770e13) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,157]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"UpdateWindow\", Ordinal=0x0, FunctionAddress=0x77773db1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,158]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"GetMessageA\", Ordinal=0x0, FunctionAddress=0x77767bd3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,159]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"TranslateMessage\", Ordinal=0x0, FunctionAddress=0x77767809) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,160]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"DispatchMessageA\", Ordinal=0x0, FunctionAddress=0x77767bbb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,161]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"DestroyWindow\", Ordinal=0x0, FunctionAddress=0x77769a55) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,162]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"UnregisterClassA\", Ordinal=0x0, FunctionAddress=0x7776dcfd) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,163]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"DefWindowProcA\", Ordinal=0x0, FunctionAddress=0x77d3cd12) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,164]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"PostQuitMessage\", Ordinal=0x0, FunctionAddress=0x77769abb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,165]},"name":"NtCreateEvent(Handle=0x140, EventName=\"uIjiFtq\", EventType=0x1, InitialState=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,166]},"name":"CreateThread(StartRoutine=0xc1661, Parameter=0x0, CreationFlags=0x0, ThreadId=0x2596) -> 0x144"},{"address":{"type":"call","value":[1180,1852,920,167]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\uxtheme.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,168]},"name":"LdrGetProcedureAddress(ModuleName=\"UxTheme.dll\", ModuleHandle=0x75230000, FunctionName=\"ThemeInitApiHook\", Ordinal=0x0, FunctionAddress=0x75244571) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,174]},"name":"NtMapViewOfSection(SectionHandle=0x14c, ProcessHandle=0xffffffff, BaseAddress=0x4830000, SectionOffset=0x5befb8, ViewSize=0xdf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,183]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"IsProcessDPIAware\", Ordinal=0x0, FunctionAddress=0x777681a6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,184]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4651000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,185]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4655000, RegionSize=0x11000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,186]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4666000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,195]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4667000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,196]},"name":"LdrLoadDll(Flags=0x0, FileName=\"dwmapi.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,197]},"name":"LdrGetProcedureAddress(ModuleName=\"dwmapi.dll\", ModuleHandle=0x744e0000, FunctionName=\"DwmIsCompositionEnabled\", Ordinal=0x0, FunctionAddress=0x744e1603) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,198]},"name":"LdrLoadDll(Flags=0x0, FileName=\"user32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,199]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"ChangeWindowMessageFilter\", Ordinal=0x0, FunctionAddress=0x7776b6df) -> 0x0"},{"address":{"type":"call","value":[1180,1852,920,200]},"name":"ChangeWindowMessageFilter(message=0x2, dwFlag=0x1) -> 0x1"}]},{"address":{"type":"thread","value":[1180,1852,2596]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2596,170]},"name":"FindResourceEx(Module=0xc0000, Type=\"#10\", Name=0x3, Language=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,171]},"name":"FindResourceEx(Module=0xc0000, Type=\"#3\", Name=0x3, Language=0x0) -> 0xd7128"},{"address":{"type":"call","value":[1180,1852,2596,175]},"name":"FindResourceEx(Module=0xc0000, Type=\"#10\", Name=0x2, Language=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,176]},"name":"FindResourceEx(Module=0xc0000, Type=\"#3\", Name=0x2, Language=0x0) -> 0xd7118"},{"address":{"type":"call","value":[1180,1852,2596,179]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4910000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,180]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4910000, RegionSize=0x10000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,181]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4920000, RegionSize=0x10000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,205]},"name":"FindResourceEx(Module=0xc0000, Type=\"#10\", Name=0x1, Language=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,206]},"name":"FindResourceEx(Module=0xc0000, Type=\"#3\", Name=0x1, Language=0x0) -> 0xd7108"},{"address":{"type":"call","value":[1180,1852,2596,209]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4930000, RegionSize=0x3f000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,210]},"name":"FindResourceEx(Module=0x492f858, Type=\"#10\", Name=0x8, Language=0x0) -> 0x495a900"},{"address":{"type":"call","value":[1180,1852,2596,213]},"name":"NtCreateMutant(Handle=0x154, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,217]},"name":"NtCreateFile(FileHandle=0x150, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,218]},"name":"NtQueryInformationFile(FileHandle=0x150, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", FileInformationClass=FileStandardInformation, FileInformation=\"`\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,221]},"name":"NtClose(Handle=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2596,228]},"name":"LdrGetDllHandle(FileName=\"avcuf32.dll\", ModuleHandle=0x0) -> DLL_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,232]},"name":"CreateThread(StartRoutine=0xc1577, Parameter=0x0, CreationFlags=0x0, ThreadId=0x764) -> 0x150"},{"address":{"type":"call","value":[1180,1852,2596,233]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x158"},{"address":{"type":"call","value":[1180,1852,2596,234]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,235]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,236]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,238]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,239]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,241]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,242]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,244]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,245]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,247]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,248]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,250]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,251]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,253]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,254]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,256]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,257]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,259]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,260]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,262]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,263]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,265]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,266]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,268]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,269]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,271]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,272]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,274]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,275]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,277]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,278]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,280]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{6182725B-398A-45B3-991F-6E4EF92107FC}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,281]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x896) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,283]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,284]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,286]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,287]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,289]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,290]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,292]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,293]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,295]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2C25023A-A136-43A5-9306-02B6D2726D77}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,299]},"name":"NtOpenProcess(ProcessHandle=0x15c, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1140) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,301]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x496f000, RegionSize=0x2d000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,302]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x499c000, RegionSize=0x2d000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,307]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x15c, BaseAddress=0x1c40000, RegionSize=0x2c000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,489]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x15c, BaseAddress=0x1c70000, RegionSize=0x2d000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,492]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x15c, BaseAddress=0x1ca0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,496]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x520000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,497]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x540000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,498]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x990000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,637]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,640]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,642]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{0C65146B-AE86-4F2C-8324-82DB3B6F2B69}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,643]},"name":"NtOpenProcess(ProcessHandle=0x1a4, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1224) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,644]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4969000, RegionSize=0x2d000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,645]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4996000, RegionSize=0x2d000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,646]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x1a4, BaseAddress=0x1ba0000, RegionSize=0x2c000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,701]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x1a4, BaseAddress=0x1e80000, RegionSize=0x2d000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,706]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x1a4, BaseAddress=0x1cf0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,717]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9a0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,718]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9b0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,719]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1ec0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1095]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{36FAD353-ECC1-48FC-9C88-72C90B8BE41B}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1096]},"name":"NtOpenProcess(ProcessHandle=0x470, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1248) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1097]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x36f0000, RegionSize=0x2c000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1231]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x3720000, RegionSize=0x2d000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1234]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x2170000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1237]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x3470000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1238]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x35c0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1239]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x35d0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1246]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1247]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1249]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1250]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1252]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CD3DFDA4-81F2-43D7-849A-029481EB1E7A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1253]},"name":"NtOpenProcess(ProcessHandle=0x470, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1680) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1254]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x100000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1257]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x150000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1260]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x180000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1263]},"name":"CreateRemoteThread(ProcessHandle=0x470, StartRoutine=0x180000, Parameter=0x150000, CreationFlags=0x0, ThreadId=0x3044) -> 0x4ec"},{"address":{"type":"call","value":[1180,1852,2596,1271]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10772024-55D1-484C-AB42-13271D391A3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1272]},"name":"NtOpenProcess(ProcessHandle=0x470, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1712) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1273]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x2860000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1276]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x2890000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1279]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0xa90000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1282]},"name":"CreateRemoteThread(ProcessHandle=0x470, StartRoutine=0xa90000, Parameter=0x2890000, CreationFlags=0x0, ThreadId=0x1592) -> 0x4f0"},{"address":{"type":"call","value":[1180,1852,2596,1288]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1289]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1291]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1292]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1294]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1295]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1297]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1298]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1300]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1301]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1303]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1304]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1306]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1307]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1309]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1310]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1312]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1313]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1315]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{AE6445F6-9FEE-4B6F-85DE-B14739A3A85A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1316]},"name":"NtOpenProcess(ProcessHandle=0x470, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2456) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1317]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x2c80000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1320]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x3330000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1325]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x29e0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1328]},"name":"CreateRemoteThread(ProcessHandle=0x470, StartRoutine=0x29e0000, Parameter=0x3330000, CreationFlags=0x0, ThreadId=0x1948) -> 0x4f4"},{"address":{"type":"call","value":[1180,1852,2596,1334]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FCCC703F-C4A8-4EB7-9282-810A79D129DD}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1335]},"name":"NtOpenProcess(ProcessHandle=0x470, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2852) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1336]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x230000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1339]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x370000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1477]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1d0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1550]},"name":"CreateRemoteThread(ProcessHandle=0x470, StartRoutine=0x1d0000, Parameter=0x370000, CreationFlags=0x0, ThreadId=0x2868) -> 0x4f8"},{"address":{"type":"call","value":[1180,1852,2596,1556]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C72FB551-BE50-451F-86D0-DDBA7123AD9A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1557]},"name":"NtOpenProcess(ProcessHandle=0x470, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1412) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1558]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1b20000, RegionSize=0x2c000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1561]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1ba0000, RegionSize=0x2d000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1564]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1b50000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1567]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x3680000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1568]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x3690000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1571]},"name":"NtFreeVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1b20000, RegionSize=0x0, FreeType=0x8000) -> PROCESS_IS_TERMINATING"},{"address":{"type":"call","value":[1180,1852,2596,1572]},"name":"NtFreeVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1b50000, RegionSize=0x0, FreeType=0x8000) -> PROCESS_IS_TERMINATING"},{"address":{"type":"call","value":[1180,1852,2596,1573]},"name":"NtFreeVirtualMemory(ProcessHandle=0x470, BaseAddress=0x1ba0000, RegionSize=0x0, FreeType=0x8000) -> PROCESS_IS_TERMINATING"},{"address":{"type":"call","value":[1180,1852,2596,1631]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{DD287560-1D3F-450C-ADB8-4D51C15D5E75}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1632]},"name":"NtOpenProcess(ProcessHandle=0x570, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2900) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1633]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x570, BaseAddress=0x0, RegionSize=0x2c000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> PROCESS_IS_TERMINATING"},{"address":{"type":"call","value":[1180,1852,2596,1707]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4760000, RegionSize=0x20000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1714]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x158"},{"address":{"type":"call","value":[1180,1852,2596,1715]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,1716]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1717]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,1719]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1720]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1722]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1723]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1725]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1726]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1728]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1729]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1731]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1732]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1734]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1735]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1737]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1738]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1740]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1741]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1743]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1744]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1746]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1747]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1749]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1750]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1752]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1753]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1755]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1756]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1758]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1759]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1761]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{6182725B-398A-45B3-991F-6E4EF92107FC}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1762]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x896) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1764]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1765]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1767]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1768]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1770]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1771]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1773]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1774]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1779]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1780]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1788]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1789]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1791]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1792]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1800]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1801]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1803]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1804]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1806]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1807]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1809]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1810]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1812]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1813]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1815]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1816]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1818]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1819]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1821]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1822]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1824]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1825]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1831]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E5AFF7DA-261E-4E7C-ADDC-820697EB5A2B}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1832]},"name":"NtOpenProcess(ProcessHandle=0x554, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2420) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1833]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x554, BaseAddress=0x5d0000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1836]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x554, BaseAddress=0x1fe0000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1839]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x554, BaseAddress=0x300000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1842]},"name":"CreateRemoteThread(ProcessHandle=0x554, StartRoutine=0x300000, Parameter=0x1fe0000, CreationFlags=0x0, ThreadId=0x2996) -> 0x560"},{"address":{"type":"call","value":[1180,1852,2596,1848]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1849]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,1851]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8C5456C3-4637-476E-8200-24B510A46035}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,1854]},"name":"NtOpenProcess(ProcessHandle=0x554, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2360) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1855]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x554, BaseAddress=0x9e0000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1858]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x554, BaseAddress=0x1f00000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1861]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x554, BaseAddress=0x930000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1864]},"name":"CreateRemoteThread(ProcessHandle=0x554, StartRoutine=0x930000, Parameter=0x1f00000, CreationFlags=0x0, ThreadId=0x240) -> 0x570"},{"address":{"type":"call","value":[1180,1852,2596,1866]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1887]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x158"},{"address":{"type":"call","value":[1180,1852,2596,1888]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,1935]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4933000, RegionSize=0x24000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,1936]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ac000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2016]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4930000, RegionSize=0x27000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2017]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a11000, RegionSize=0x48000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2018]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x584"},{"address":{"type":"call","value":[1180,1852,2596,2019]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,2020]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2021]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,2023]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2024]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2026]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2027]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2029]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2030]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2032]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2033]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2035]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2036]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2038]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2039]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2041]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2042]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2044]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2045]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2047]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2048]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2050]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2051]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2053]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2054]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2056]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2057]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2059]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2060]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2062]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2063]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2065]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2066]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2068]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2069]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2071]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2072]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2074]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2075]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2080]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2081]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2089]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2090]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2092]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2093]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2101]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2102]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2104]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2105]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2107]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2108]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2110]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2111]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2113]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2114]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2116]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2117]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2119]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2120]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2122]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2123]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2125]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2126]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2132]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2133]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2171]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x49c"},{"address":{"type":"call","value":[1180,1852,2596,2172]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,2173]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2174]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,2176]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2177]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2179]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2180]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2182]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2183]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2185]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2186]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2188]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2189]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2191]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2192]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2194]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2195]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2197]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2198]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2200]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2201]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2203]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2204]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2206]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2207]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2209]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2210]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2212]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2213]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2215]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2216]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2218]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2219]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2221]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2222]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2224]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2225]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2227]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2228]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2233]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2234]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2242]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2243]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2245]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2246]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2254]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2255]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2257]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2258]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2260]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2261]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2263]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2264]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2266]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2267]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2269]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2270]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2272]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2273]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2275]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2276]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2278]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2279]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2285]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2286]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2289]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2290]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x49c"},{"address":{"type":"call","value":[1180,1852,2596,2291]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,2335]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4933000, RegionSize=0x24000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2377]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a11000, RegionSize=0x48000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2378]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x464"},{"address":{"type":"call","value":[1180,1852,2596,2379]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,2380]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2381]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,2383]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2384]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2386]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2387]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2389]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2390]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2392]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2393]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2395]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2396]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2398]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2399]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2401]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2402]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2404]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2405]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2407]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2408]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2410]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2411]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2413]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2414]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2416]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2417]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2419]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2420]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2422]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2423]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2425]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2426]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2428]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2429]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2431]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2432]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2434]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2435]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2440]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2441]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2449]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2450]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2452]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2453]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2461]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2462]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2464]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2465]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2467]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2468]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2470]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2471]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2473]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2474]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2476]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2477]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2479]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2480]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2482]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2483]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2485]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2486]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2492]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2493]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2747]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x600"},{"address":{"type":"call","value":[1180,1852,2596,2748]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,2749]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2750]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,2752]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2753]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2755]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2756]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2758]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2759]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2761]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2762]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2764]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2765]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2767]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2768]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2770]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2771]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2773]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2774]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2776]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2777]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2779]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2780]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2782]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2783]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2785]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2786]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2788]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2789]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2791]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2792]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2794]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2795]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2797]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2798]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2800]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2801]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2803]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2804]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2809]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2810]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2818]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2819]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2821]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2822]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2830]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2831]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2833]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2834]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2836]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2837]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2839]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2840]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2842]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2843]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2845]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2846]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2848]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2849]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2851]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2852]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2854]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2855]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2861]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2862]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,2864]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2E0734F3-983E-4A11-90E4-3D45A3EC902C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,2865]},"name":"NtOpenProcess(ProcessHandle=0x5f8, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2724) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2866]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4734000, RegionSize=0x4c000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2867]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4969000, RegionSize=0x59000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2868]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5f8, BaseAddress=0x6d0000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2873]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5f8, BaseAddress=0x31c0000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2879]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5f8, BaseAddress=0x370000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,2887]},"name":"CreateRemoteThread(ProcessHandle=0x5f8, StartRoutine=0x370000, Parameter=0x31c0000, CreationFlags=0x0, ThreadId=0x2016) -> 0x608"},{"address":{"type":"call","value":[1180,1852,2596,2889]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3115]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{3CA4AFF5-4F76-4722-AE9B-2AB9CAFB0E5D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3116]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1912) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,3118]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{756DFDAD-0A55-41CE-8C73-60F1BCD1ACB5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3119]},"name":"NtOpenProcess(ProcessHandle=0x5b8, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2800) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3120]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5b8, BaseAddress=0x3e0000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3123]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5b8, BaseAddress=0x660000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3190]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5b8, BaseAddress=0x210000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3193]},"name":"CreateRemoteThread(ProcessHandle=0x5b8, StartRoutine=0x210000, Parameter=0x660000, CreationFlags=0x0, ThreadId=0x3044) -> 0x58c"},{"address":{"type":"call","value":[1180,1852,2596,3203]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E3D6183-AF65-47D6-883F-239192228356}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3204]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2660) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,3207]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a3d000, RegionSize=0x1c000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3208]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3209]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x600"},{"address":{"type":"call","value":[1180,1852,2596,3210]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,3254]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4933000, RegionSize=0x24000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3360]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a11000, RegionSize=0x48000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3361]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x644"},{"address":{"type":"call","value":[1180,1852,2596,3362]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,3363]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3364]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,3366]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3367]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3369]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3370]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3372]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3373]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3375]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3376]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3378]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3379]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3381]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3382]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3384]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3385]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3387]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3388]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3390]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3391]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3393]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3394]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3396]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3397]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3399]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3400]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3402]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3403]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3405]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3406]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3408]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3409]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3411]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3412]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3414]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3415]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3417]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3418]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3423]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3424]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3432]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3433]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3435]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3436]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3444]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3445]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3447]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3448]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3450]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3451]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3453]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3454]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3456]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3457]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3459]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3460]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3462]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3463]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3465]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3466]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3468]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3469]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3475]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3476]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3498]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x644"},{"address":{"type":"call","value":[1180,1852,2596,3499]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,3500]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3501]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,3503]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3504]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3506]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3507]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3509]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3510]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3512]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3513]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3515]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3516]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3518]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3519]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3521]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3522]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3524]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3525]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3527]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3528]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3530]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3531]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3533]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3534]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3536]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3537]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3539]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3540]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3542]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3543]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3545]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3546]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3548]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3549]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3551]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3552]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3554]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3555]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3560]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3561]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3569]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3570]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3572]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3573]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3581]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3582]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3584]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3585]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3587]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3588]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3590]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3591]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3593]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3594]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3596]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3597]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3599]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3600]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3602]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3603]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3605]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3606]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3612]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3613]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3616]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3617]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x644"},{"address":{"type":"call","value":[1180,1852,2596,3618]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,3662]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4933000, RegionSize=0x24000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3859]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a11000, RegionSize=0x48000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,3860]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x674"},{"address":{"type":"call","value":[1180,1852,2596,3861]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,3862]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3863]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,3865]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3866]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3868]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3869]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3871]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3872]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3874]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3875]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3877]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3878]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3880]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3881]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3883]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3884]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3886]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3887]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3889]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3890]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3892]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3893]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3895]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3896]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3898]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3899]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3901]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3902]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3904]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3905]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3907]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3908]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3910]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3911]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3913]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3914]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3916]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3917]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3922]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3923]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3931]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3932]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3934]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3935]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3943]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3944]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3946]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3947]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3949]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3950]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3952]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3953]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3955]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3956]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3958]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3959]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3961]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3962]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3964]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3965]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3967]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3968]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,3974]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,3975]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4064]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x688"},{"address":{"type":"call","value":[1180,1852,2596,4065]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,4066]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4067]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,4069]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4070]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4072]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4073]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4075]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4076]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4078]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4079]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4081]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4082]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4084]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4085]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4087]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4088]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4090]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4091]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4093]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4094]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4096]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4097]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4099]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4100]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4102]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4103]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4105]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4106]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4108]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4109]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4111]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4112]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4114]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4115]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4117]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4118]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4120]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4121]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4126]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4127]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4135]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4136]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4138]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4139]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4147]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4148]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4150]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4151]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4153]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4154]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4156]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4157]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4159]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4160]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4162]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4163]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4165]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4166]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4168]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4169]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4171]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4172]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4178]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4179]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4182]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4183]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x688"},{"address":{"type":"call","value":[1180,1852,2596,4184]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,4228]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4933000, RegionSize=0x24000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4588]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a11000, RegionSize=0x48000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4589]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x64c"},{"address":{"type":"call","value":[1180,1852,2596,4590]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,4591]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4592]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,4594]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4595]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4597]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4598]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4600]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4601]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4603]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4604]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4606]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4607]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4609]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4610]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4612]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4613]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4615]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4616]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4618]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4619]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4621]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4622]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4624]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4625]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4627]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4628]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4630]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4631]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4633]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4634]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4636]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4637]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4639]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4640]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4642]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4643]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4645]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4646]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4651]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4652]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4660]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4661]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4663]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4664]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4672]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4673]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4675]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4676]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4678]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4679]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4681]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4682]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4684]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4685]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4687]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4688]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4690]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4691]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4693]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4694]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4696]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4697]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4703]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4704]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4731]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x5c0"},{"address":{"type":"call","value":[1180,1852,2596,4732]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,4733]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CBBA717-D68B-41A2-9229-6F961879276D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4734]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x0) -> INVALID_CID"},{"address":{"type":"call","value":[1180,1852,2596,4736]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{28F0CE01-D1A1-492A-9E0A-F41EDD20D69C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4737]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x4) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4739]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1A6BC459-9186-4191-A527-F20891D84C83}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4740]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x228) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4742]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{7CE010EA-F6F3-4F06-9A1A-FC0B77815501}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4743]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x312) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4745]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2668735D-A435-46F5-8018-1EAC05F8EEC2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4746]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x348) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4748]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{1ECC4A7C-10F7-4FC6-8F7B-8F9DDCC90CE0}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4749]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x356) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4751]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{D7277347-BDFA-458B-8A05-1E3DA361731D}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4752]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x404) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4754]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{E3CE8889-BEEE-4C91-9EE0-1C391988F2DA}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4755]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x432) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4757]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8F46B20B-B0D8-43BC-A24A-925102D3C65F}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4758]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x456) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4760]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9E2D9763-19FB-4581-8024-3A77FE0AEDD5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4761]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x464) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4763]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CB99E21B-3805-43CD-8F5A-46294A19D564}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4764]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x560) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4766]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{A691D25E-3EE1-414B-8277-CF4B9EF54488}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4767]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x628) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4769]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{4C0FB690-CCBB-4503-9D90-913158BE2F01}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4770]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x696) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4772]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{92C5C150-8E5E-45B7-AC64-20679758F82C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4773]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x792) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4775]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C3F9B389-08A6-4613-88FE-338B644B3D24}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4776]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x816) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4778]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49271C9F-3DEC-4558-AE6F-E9737C66CF48}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4779]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x972) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4781]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{786077BC-E071-41BD-A78E-F1A8EDFA24A2}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4782]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x300) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4784]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{78D98CDD-0D6D-48F7-9D70-705E359860FF}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4785]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x276) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4787]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{16B69167-78A1-457E-960C-DF7DFB605A07}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4788]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1064) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4793]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{10FB1D85-D2F1-44DF-AEAB-92623F8A9E42}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4794]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1208) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4802]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F4BF379F-F7C8-4C6A-ADF2-237EDCF7B4AE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4803]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1440) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4805]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{5B66ED90-E8A1-4587-8621-DFA2F52576E5}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4806]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1672) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4814]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{9CCCD2AB-BDEC-479B-93EA-93066C3CDE00}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4815]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2020) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4817]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{29ECE9E4-7D71-41B3-A3E9-BB9894B39F3A}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4818]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1236) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4820]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{49932BC3-8612-4BEB-93B6-A1DF3A59169C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4821]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1104) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4823]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{569B32BE-2FDE-4CE1-A20E-393C4B7AAD18}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4824]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2052) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4826]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{2ADB636D-7EB2-4634-9243-03B3CC9EB530}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4827]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2080) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4829]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{22130FDB-6483-4DF4-AE86-F712E531EA70}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4830]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2212) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4832]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{CEC711BF-FB73-4702-A324-A29FBBAF226C}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4833]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2364) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4835]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F694CB4D-7240-4FDA-A6E5-3085539639BE}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4836]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2956) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4838]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{FB0FB52D-55A0-457B-AC06-3FB7867793B1}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4839]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1060) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4845]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{8228670C-D48E-467A-85FA-444AD4208610}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4846]},"name":"NtOpenProcess(ProcessHandle=0x0, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2820) -> ACCESS_DENIED"},{"address":{"type":"call","value":[1180,1852,2596,4848]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{916A8874-C269-4728-A7A4-74057E286671}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4849]},"name":"NtOpenProcess(ProcessHandle=0x5c8, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x500) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4850]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4734000, RegionSize=0x4c000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4851]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4969000, RegionSize=0x59000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4852]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5c8, BaseAddress=0x590000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4855]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5c8, BaseAddress=0x600000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4858]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5c8, BaseAddress=0x1f10000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4861]},"name":"CreateRemoteThread(ProcessHandle=0x5c8, StartRoutine=0x1f10000, Parameter=0x600000, CreationFlags=0x0, ThreadId=0x2568) -> 0x694"},{"address":{"type":"call","value":[1180,1852,2596,4863]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4868]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{F5C75363-56B6-4DC2-AFF9-A353A46A0BB4}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4869]},"name":"NtOpenProcess(ProcessHandle=0x5c8, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1572) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4870]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5c8, BaseAddress=0x540000, RegionSize=0x28000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4879]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5c8, BaseAddress=0x24d0000, RegionSize=0x29000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4882]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x5c8, BaseAddress=0x1df0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4885]},"name":"CreateRemoteThread(ProcessHandle=0x5c8, StartRoutine=0x1df0000, Parameter=0x24d0000, CreationFlags=0x0, ThreadId=0x2932) -> 0x690"},{"address":{"type":"call","value":[1180,1852,2596,4924]},"name":"NtOpenEvent(Handle=0x0, EventName=\"{C16A09FC-AF49-48E2-8AAA-7B2DBAB9239B}\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2596,4925]},"name":"NtOpenProcess(ProcessHandle=0x57c, DesiredAccess=PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1912) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4926]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4734000, RegionSize=0x4c000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4927]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4969000, RegionSize=0x59000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4928]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x57c, BaseAddress=0x2110000, RegionSize=0x2c000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4932]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x57c, BaseAddress=0x2160000, RegionSize=0x2d000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4935]},"name":"NtAllocateVirtualMemory(ProcessHandle=0x57c, BaseAddress=0x2290000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4938]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x3840000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4939]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4690000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4940]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x46a0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,4943]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ab000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,5080]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a3d000, RegionSize=0x1c000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,5081]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x5c0"},{"address":{"type":"call","value":[1180,1852,2596,5082]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2596,5129]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4933000, RegionSize=0x24000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2596,5130]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x47ac000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,764]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,764,296]},"name":"FindResourceEx(Module=0xc0000, Type=\"#10\", Name=0x1, Language=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,297]},"name":"FindResourceEx(Module=0xc0000, Type=\"#3\", Name=0x1, Language=0x0) -> 0xd7108"},{"address":{"type":"call","value":[1180,1852,764,303]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x49c9000, RegionSize=0x3f000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,304]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a10000, RegionSize=0x200000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,305]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a10000, RegionSize=0x10000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,306]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a20000, RegionSize=0x10000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,313]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a30000, RegionSize=0x2a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,314]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4a11000, RegionSize=0x1e000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,315]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x49ff000, RegionSize=0x8000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,316]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x750000, RegionSize=0x2f000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,318]},"name":"LdrLoadDll(Flags=0x0, FileName=\"IPHLPAPI.DLL\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,320]},"name":"LdrGetProcedureAddress(ModuleName=\"IPHLPAPI.DLL\", ModuleHandle=0x757c0000, FunctionName=\"GetBestRoute\", Ordinal=0x0, FunctionAddress=0x757cec2e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,321]},"name":"LdrGetProcedureAddress(ModuleName=\"IPHLPAPI.DLL\", ModuleHandle=0x757c0000, FunctionName=\"GetIpAddrTable\", Ordinal=0x0, FunctionAddress=0x757c9bb0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,323]},"name":"LdrGetProcedureAddress(ModuleName=\"WS2_32.dll\", ModuleHandle=0x770b0000, FunctionName=\"getnameinfo\", Ordinal=0x0, FunctionAddress=0x770bb8b8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,330]},"name":"LdrGetProcedureAddress(ModuleName=\"WS2_32.dll\", ModuleHandle=0x770b0000, FunctionName=\"\", Ordinal=0x2, FunctionAddress=0x770b4582) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,332]},"name":"LdrGetProcedureAddress(ModuleName=\"WS2_32.dll\", ModuleHandle=0x770b0000, FunctionName=\"getaddrinfo\", Ordinal=0x0, FunctionAddress=0x770b4296) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,334]},"name":"LdrGetProcedureAddress(ModuleName=\"WS2_32.dll\", ModuleHandle=0x770b0000, FunctionName=\"freeaddrinfo\", Ordinal=0x0, FunctionAddress=0x770b4b1b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,336]},"name":"LdrGetProcedureAddress(ModuleName=\"WS2_32.dll\", ModuleHandle=0x770b0000, FunctionName=\"WSAIoctl\", Ordinal=0x0, FunctionAddress=0x770b2fe7) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,352]},"name":"LdrGetProcedureAddress(ModuleName=\"SHLWAPI.dll\", ModuleHandle=0x76a60000, FunctionName=\"StrCmpNA\", Ordinal=0x0, FunctionAddress=0x76a8c57c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,353]},"name":"LdrGetProcedureAddress(ModuleName=\"SHLWAPI.dll\", ModuleHandle=0x76a60000, FunctionName=\"PathCombineA\", Ordinal=0x0, FunctionAddress=0x76a8b136) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,354]},"name":"LdrGetProcedureAddress(ModuleName=\"SHLWAPI.dll\", ModuleHandle=0x76a60000, FunctionName=\"PathMatchSpecA\", Ordinal=0x0, FunctionAddress=0x76a9af13) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,355]},"name":"LdrGetProcedureAddress(ModuleName=\"SHLWAPI.dll\", ModuleHandle=0x76a60000, FunctionName=\"wvnsprintfW\", Ordinal=0x0, FunctionAddress=0x76aa066c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,356]},"name":"LdrGetProcedureAddress(ModuleName=\"SHLWAPI.dll\", ModuleHandle=0x76a60000, FunctionName=\"wvnsprintfA\", Ordinal=0x0, FunctionAddress=0x76a8edfe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,358]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoTaskMemFree\", Ordinal=0x0, FunctionAddress=0x77596f61) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,359]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoCreateInstance\", Ordinal=0x0, FunctionAddress=0x77589c5b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,360]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoInitialize\", Ordinal=0x0, FunctionAddress=0x7755b576) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,361]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoInitializeSecurity\", Ordinal=0x0, FunctionAddress=0x77567179) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,362]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoInitializeEx\", Ordinal=0x0, FunctionAddress=0x7758097d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,363]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoUninitialize\", Ordinal=0x0, FunctionAddress=0x77588623) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,365]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"OpenEventA\", Ordinal=0x0, FunctionAddress=0x75af4945) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,366]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetThreadContext\", Ordinal=0x0, FunctionAddress=0x75b17b34) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,367]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetTickCount\", Ordinal=0x0, FunctionAddress=0x75af110c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,368]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetWindowsDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b12c7a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,369]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetEnvironmentVariableA\", Ordinal=0x0, FunctionAddress=0x75afe371) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,370]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetModuleFileNameA\", Ordinal=0x0, FunctionAddress=0x75af1491) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,371]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetSystemInfo\", Ordinal=0x0, FunctionAddress=0x75af48ca) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,372]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,373]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WriteFile\", Ordinal=0x0, FunctionAddress=0x75af1282) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,374]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FlushFileBuffers\", Ordinal=0x0, FunctionAddress=0x75af5bab) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,375]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LocalAlloc\", Ordinal=0x0, FunctionAddress=0x75af1668) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,376]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcmpW\", Ordinal=0x0, FunctionAddress=0x75af5271) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,377]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetFileAttributesW\", Ordinal=0x0, FunctionAddress=0x75af1af4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,378]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetFileAttributesA\", Ordinal=0x0, FunctionAddress=0x75b0f06b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,379]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CopyFileA\", Ordinal=0x0, FunctionAddress=0x75b15a5d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,380]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ResumeThread\", Ordinal=0x0, FunctionAddress=0x75af445e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,381]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetExitCodeProcess\", Ordinal=0x0, FunctionAddress=0x75b0178d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,382]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcpyW\", Ordinal=0x0, FunctionAddress=0x75b13272) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,383]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcpyA\", Ordinal=0x0, FunctionAddress=0x75b12c0a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,384]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrlenA\", Ordinal=0x0, FunctionAddress=0x75af59d3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,385]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetEvent\", Ordinal=0x0, FunctionAddress=0x75af16a1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,386]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateEventA\", Ordinal=0x0, FunctionAddress=0x75af27ec) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,387]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcmpA\", Ordinal=0x0, FunctionAddress=0x75b0f083) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,388]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ResetEvent\", Ordinal=0x0, FunctionAddress=0x75af16b9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,389]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateMutexA\", Ordinal=0x0, FunctionAddress=0x75af4b6b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,390]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SleepEx\", Ordinal=0x0, FunctionAddress=0x75af1215) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,391]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"TerminateThread\", Ordinal=0x0, FunctionAddress=0x75af7a47) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,392]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetExitCodeThread\", Ordinal=0x0, FunctionAddress=0x75b0d615) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,393]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DuplicateHandle\", Ordinal=0x0, FunctionAddress=0x75af1862) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,394]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentThread\", Ordinal=0x0, FunctionAddress=0x75af17c8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,395]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentProcess\", Ordinal=0x0, FunctionAddress=0x75af17e5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,396]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Sleep\", Ordinal=0x0, FunctionAddress=0x75af10ff) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,397]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcatA\", Ordinal=0x0, FunctionAddress=0x75b12cea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,398]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"MoveFileA\", Ordinal=0x0, FunctionAddress=0x75b6dfc9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,399]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"MoveFileExA\", Ordinal=0x0, FunctionAddress=0x75b1ba61) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,400]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetLastError\", Ordinal=0x0, FunctionAddress=0x75af11c0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,401]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetThreadPriority\", Ordinal=0x0, FunctionAddress=0x75af281b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,402]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetEnvironmentVariableA\", Ordinal=0x0, FunctionAddress=0x75af3423) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,403]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcpynW\", Ordinal=0x0, FunctionAddress=0x75b1bffe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,404]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrlenW\", Ordinal=0x0, FunctionAddress=0x75af16dc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,405]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcatW\", Ordinal=0x0, FunctionAddress=0x75b183ee) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,406]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcmpiW\", Ordinal=0x0, FunctionAddress=0x75b0d62d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,407]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DisconnectNamedPipe\", Ordinal=0x0, FunctionAddress=0x75b74a6f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,408]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ReadFile\", Ordinal=0x0, FunctionAddress=0x75af3fe5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,409]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ConnectNamedPipe\", Ordinal=0x0, FunctionAddress=0x75b7498b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,410]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateNamedPipeA\", Ordinal=0x0, FunctionAddress=0x75b71f17) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,411]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ExitProcess\", Ordinal=0x0, FunctionAddress=0x75af7a28) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,412]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CloseHandle\", Ordinal=0x0, FunctionAddress=0x75af13f0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,413]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WaitForSingleObject\", Ordinal=0x0, FunctionAddress=0x75af1136) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,414]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcessId\", Ordinal=0x0, FunctionAddress=0x75b1b732) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,415]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"TerminateProcess\", Ordinal=0x0, FunctionAddress=0x75b0d862) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,416]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentProcessId\", Ordinal=0x0, FunctionAddress=0x75af11f8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,417]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateThread\", Ordinal=0x0, FunctionAddress=0x75af24e4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,418]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateEventW\", Ordinal=0x0, FunctionAddress=0x75af181a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,419]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateFileA\", Ordinal=0x0, FunctionAddress=0x75af5db6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,420]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetLocalTime\", Ordinal=0x0, FunctionAddress=0x75af5a2e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,421]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LoadLibraryA\", Ordinal=0x0, FunctionAddress=0x75af48d7) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,422]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetComputerNameA\", Ordinal=0x0, FunctionAddress=0x75b0b748) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,423]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DeleteFileA\", Ordinal=0x0, FunctionAddress=0x75af5e34) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,424]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b1bfce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,425]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DeleteFileW\", Ordinal=0x0, FunctionAddress=0x75af89cb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,426]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LeaveCriticalSection\", Ordinal=0x0, FunctionAddress=0x77d222b0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,427]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"EnterCriticalSection\", Ordinal=0x0, FunctionAddress=0x77d222f0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,428]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WaitForMultipleObjects\", Ordinal=0x0, FunctionAddress=0x75af2684) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,429]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"InitializeCriticalSection\", Ordinal=0x0, FunctionAddress=0x77d342f0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,430]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetComputerNameW\", Ordinal=0x0, FunctionAddress=0x75afdd4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,431]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DeleteCriticalSection\", Ordinal=0x0, FunctionAddress=0x77d33d8d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,432]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetVersionExA\", Ordinal=0x0, FunctionAddress=0x75af2528) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,433]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcmpiA\", Ordinal=0x0, FunctionAddress=0x75af3e7c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,434]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"HeapAlloc\", Ordinal=0x0, FunctionAddress=0x77d2e0e6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,435]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcessHeap\", Ordinal=0x0, FunctionAddress=0x75af14c9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,436]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"HeapReAlloc\", Ordinal=0x0, FunctionAddress=0x77d3c7a0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,437]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"HeapFree\", Ordinal=0x0, FunctionAddress=0x75af14a9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,438]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"QueryPerformanceCounter\", Ordinal=0x0, FunctionAddress=0x75af1701) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,439]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"QueryPerformanceFrequency\", Ordinal=0x0, FunctionAddress=0x75af2654) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,440]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetFileSize\", Ordinal=0x0, FunctionAddress=0x75af194a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,441]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetFileAttributesA\", Ordinal=0x0, FunctionAddress=0x75af5e04) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,442]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"HeapCreate\", Ordinal=0x0, FunctionAddress=0x75af492d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,443]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,444]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetSystemTimeAsFileTime\", Ordinal=0x0, FunctionAddress=0x75af2518) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,445]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FreeLibrary\", Ordinal=0x0, FunctionAddress=0x75af24d7) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,446]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SystemTimeToFileTime\", Ordinal=0x0, FunctionAddress=0x75af5a06) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,447]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetSystemTime\", Ordinal=0x0, FunctionAddress=0x75af5a1e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,448]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"MultiByteToWideChar\", Ordinal=0x0, FunctionAddress=0x75af190a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,449]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetModuleHandleA\", Ordinal=0x0, FunctionAddress=0x75af1245) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,450]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WideCharToMultiByte\", Ordinal=0x0, FunctionAddress=0x75af16e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,451]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ReleaseMutex\", Ordinal=0x0, FunctionAddress=0x75af111e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,452]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LoadResource\", Ordinal=0x0, FunctionAddress=0x75af5294) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,453]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SizeofResource\", Ordinal=0x0, FunctionAddress=0x75af5a51) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,454]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindResourceA\", Ordinal=0x0, FunctionAddress=0x75b0e8cb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,455]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"lstrcpynA\", Ordinal=0x0, FunctionAddress=0x75b0196a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,456]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetFilePointer\", Ordinal=0x0, FunctionAddress=0x75af17ad) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,458]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"MessageBoxW\", Ordinal=0x0, FunctionAddress=0x777bfdcf) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,459]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"CharUpperBuffA\", Ordinal=0x0, FunctionAddress=0x7776fe5f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,460]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"MessageBoxA\", Ordinal=0x0, FunctionAddress=0x777bfdae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,461]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"DialogBoxParamA\", Ordinal=0x0, FunctionAddress=0x777acba4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,462]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"DialogBoxParamW\", Ordinal=0x0, FunctionAddress=0x7778daca) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,463]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"GetWindowTextA\", Ordinal=0x0, FunctionAddress=0x77770041) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,464]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"GetWindowTextW\", Ordinal=0x0, FunctionAddress=0x77771e87) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,465]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"GetWindowLongA\", Ordinal=0x0, FunctionAddress=0x7776d166) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,466]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"FindWindowA\", Ordinal=0x0, FunctionAddress=0x7776fffe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,467]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"PostMessageA\", Ordinal=0x0, FunctionAddress=0x77774bbc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,469]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"GetTokenInformation\", Ordinal=0x0, FunctionAddress=0x776b424c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,470]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegCloseKey\", Ordinal=0x0, FunctionAddress=0x776b45cd) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,471]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegQueryInfoKeyA\", Ordinal=0x0, FunctionAddress=0x776ae0ab) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,472]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"InitializeSecurityDescriptor\", Ordinal=0x0, FunctionAddress=0x776b4550) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,473]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"SetSecurityDescriptorDacl\", Ordinal=0x0, FunctionAddress=0x776b408e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,474]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"ConvertStringSecurityDescriptorToSecurityDescriptorW\", Ordinal=0x0, FunctionAddress=0x776b1e89) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,475]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"GetSecurityDescriptorSacl\", Ordinal=0x0, FunctionAddress=0x776b4538) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,476]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"SetSecurityInfo\", Ordinal=0x0, FunctionAddress=0x776a9e47) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,477]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"GetSidSubAuthorityCount\", Ordinal=0x0, FunctionAddress=0x776b0d3f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,478]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"GetSidSubAuthority\", Ordinal=0x0, FunctionAddress=0x776b0d57) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,479]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegEnumKeyExA\", Ordinal=0x0, FunctionAddress=0x776b13b1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,480]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"OpenThreadToken\", Ordinal=0x0, FunctionAddress=0x776b425c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,481]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"OpenProcessToken\", Ordinal=0x0, FunctionAddress=0x776b4234) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,482]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"EqualSid\", Ordinal=0x0, FunctionAddress=0x776b403b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,483]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"CryptAcquireContextA\", Ordinal=0x0, FunctionAddress=0x776a9143) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,484]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"GetUserNameW\", Ordinal=0x0, FunctionAddress=0x776b14aa) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,505]},"name":"HeapCreate(Options=0x0, InitialSize=0x80000, MaximumSize=0x0) -> 0x4d80000"},{"address":{"type":"call","value":[1180,1852,764,506]},"name":"NtCreateEvent(Handle=0x15c, EventName=\"uIjiFtq\", EventType=0x1, InitialState=0x0) -> 0x40000000"},{"address":{"type":"call","value":[1180,1852,764,507]},"name":"NtCreateEvent(Handle=0x168, EventName=\"dkncd2gaf\", EventType=0x1, InitialState=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,512]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetModuleHandleA\", Ordinal=0x0, FunctionAddress=0x75af1245) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,514]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,515]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateToolhelp32Snapshot\", Ordinal=0x0, FunctionAddress=0x75b174bf) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,516]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Process32First\", Ordinal=0x0, FunctionAddress=0x75b18c53) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,517]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Process32Next\", Ordinal=0x0, FunctionAddress=0x75b189aa) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,518]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Module32First\", Ordinal=0x0, FunctionAddress=0x75b76571) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,519]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"Module32Next\", Ordinal=0x0, FunctionAddress=0x75b7665a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,520]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateRemoteThread\", Ordinal=0x0, FunctionAddress=0x75b749fb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,521]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WriteProcessMemory\", Ordinal=0x0, FunctionAddress=0x75b0da40) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,522]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ReadProcessMemory\", Ordinal=0x0, FunctionAddress=0x75b0d034) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,523]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"OpenProcess\", Ordinal=0x0, FunctionAddress=0x75af1962) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,524]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,525]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualFreeEx\", Ordinal=0x0, FunctionAddress=0x75b0da28) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,526]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualProtect\", Ordinal=0x0, FunctionAddress=0x75af43ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,527]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WaitForSingleObject\", Ordinal=0x0, FunctionAddress=0x75af1136) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,528]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetLastError\", Ordinal=0x0, FunctionAddress=0x75af11a9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,529]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b1bf9e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,530]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetCurrentDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b01874) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,531]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateProcessA\", Ordinal=0x0, FunctionAddress=0x75af1072) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,532]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetModuleFileNameA\", Ordinal=0x0, FunctionAddress=0x75af1491) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,533]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetFilePointer\", Ordinal=0x0, FunctionAddress=0x75af17ad) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,534]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SetEndOfFile\", Ordinal=0x0, FunctionAddress=0x75b0ce96) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,535]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindFirstFileA\", Ordinal=0x0, FunctionAddress=0x75afe30e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,536]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindNextFileA\", Ordinal=0x0, FunctionAddress=0x75b1bfe6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,537]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"FindClose\", Ordinal=0x0, FunctionAddress=0x75af44b1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,538]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateFileA\", Ordinal=0x0, FunctionAddress=0x75af5db6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,539]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateFileW\", Ordinal=0x0, FunctionAddress=0x75af4074) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,540]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ReadFile\", Ordinal=0x0, FunctionAddress=0x75af3fe5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,541]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"WriteFile\", Ordinal=0x0, FunctionAddress=0x75af1282) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,542]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CloseHandle\", Ordinal=0x0, FunctionAddress=0x75af13f0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,543]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"DeleteFileA\", Ordinal=0x0, FunctionAddress=0x75af5e34) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,544]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LoadLibraryA\", Ordinal=0x0, FunctionAddress=0x75af48d7) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,545]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetCurrentThreadId\", Ordinal=0x0, FunctionAddress=0x75af1430) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,546]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"MoveFileA\", Ordinal=0x0, FunctionAddress=0x75b6dfc9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,547]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"LocalFree\", Ordinal=0x0, FunctionAddress=0x75af2f4c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,548]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateDirectoryA\", Ordinal=0x0, FunctionAddress=0x75b1bfce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,549]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetVolumeInformationA\", Ordinal=0x0, FunctionAddress=0x75b16f43) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,550]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"CreateThread\", Ordinal=0x0, FunctionAddress=0x75af24e4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,551]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"OpenThread\", Ordinal=0x0, FunctionAddress=0x75b01288) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,552]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"ExpandEnvironmentStringsA\", Ordinal=0x0, FunctionAddress=0x75b0eed1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,553]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualProtectEx\", Ordinal=0x0, FunctionAddress=0x75b74e4f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,554]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"InterlockedCompareExchange\", Ordinal=0x0, FunctionAddress=0x75af1464) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,555]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ntdll.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,556]},"name":"LdrGetProcedureAddress(ModuleName=\"ntdll.dll\", ModuleHandle=0x77d00000, FunctionName=\"ZwQueryInformationThread\", Ordinal=0x0, FunctionAddress=0x77d1fc38) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,557]},"name":"LdrLoadDll(Flags=0x0, FileName=\"advapi32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,558]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"AdjustTokenPrivileges\", Ordinal=0x0, FunctionAddress=0x776b40be) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,559]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegOpenKeyExA\", Ordinal=0x0, FunctionAddress=0x776b483b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,560]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegCreateKeyExA\", Ordinal=0x0, FunctionAddress=0x776b1399) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,561]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegQueryInfoKeyA\", Ordinal=0x0, FunctionAddress=0x776ae0ab) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,562]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegEnumValueA\", Ordinal=0x0, FunctionAddress=0x776aceb1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,563]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegEnumKeyExA\", Ordinal=0x0, FunctionAddress=0x776b13b1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,564]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegSetValueExA\", Ordinal=0x0, FunctionAddress=0x776b13e3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,565]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegQueryValueExA\", Ordinal=0x0, FunctionAddress=0x776b4823) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,566]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegCloseKey\", Ordinal=0x0, FunctionAddress=0x776b45cd) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,567]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegDeleteValueA\", Ordinal=0x0, FunctionAddress=0x776ca46a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,568]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"AllocateAndInitializeSid\", Ordinal=0x0, FunctionAddress=0x776b4016) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,569]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"SetEntriesInAclA\", Ordinal=0x0, FunctionAddress=0x776f18f9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,570]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"SetNamedSecurityInfoA\", Ordinal=0x0, FunctionAddress=0x776f18b0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,571]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"FreeSid\", Ordinal=0x0, FunctionAddress=0x776b405e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,572]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"LookupAccountSidA\", Ordinal=0x0, FunctionAddress=0x776e207c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,573]},"name":"LdrLoadDll(Flags=0x0, FileName=\"shell32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,574]},"name":"LdrGetProcedureAddress(ModuleName=\"SHELL32.dll\", ModuleHandle=0x75d70000, FunctionName=\"ShellExecuteA\", Ordinal=0x0, FunctionAddress=0x75fb8790) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,576]},"name":"LdrLoadDll(Flags=0x0, FileName=\"API-MS-Win-Security-LSALookup-L1-1-0.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,577]},"name":"LdrGetProcedureAddress(ModuleName=\"sechost.dll\", ModuleHandle=0x76d40000, FunctionName=\"LookupAccountSidLocalA\", Ordinal=0x0, FunctionAddress=0x76d504c6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,578]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x170, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,579]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x9fd000, RegionSize=0x7000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,587]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"IsWow64Process\", Ordinal=0x0, FunctionAddress=0x75af193a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,589]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x19c"},{"address":{"type":"call","value":[1180,1852,764,590]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,764,591]},"name":"NtQueryValueKey(KeyHandle=0x2c, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,764,592]},"name":"LdrLoadDll(Flags=0x0, FileName=\"kernel32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,593]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SortGetHandle\", Ordinal=0x0, FunctionAddress=0x75af71b4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,594]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"SortCloseHandle\", Ordinal=0x0, FunctionAddress=0x75b8c410) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,595]},"name":"NtCreateFile(FileHandle=0x1a0, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,597]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4e00000, SectionOffset=0x47ee508, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,731]},"name":"LdrLoadDll(Flags=0x0, FileName=\"msvcrt.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,732]},"name":"LdrGetProcedureAddress(ModuleName=\"msvcrt.dll\", ModuleHandle=0x75cc0000, FunctionName=\"iswlower\", Ordinal=0x0, FunctionAddress=0x75cef796) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,733]},"name":"LdrGetProcedureAddress(ModuleName=\"msvcrt.dll\", ModuleHandle=0x75cc0000, FunctionName=\"_wcsicmp\", Ordinal=0x0, FunctionAddress=0x75cca9e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,764,734]},"name":"CreateThread(StartRoutine=0x75743b, Parameter=0x0, CreationFlags=0x0, ThreadId=0x1156) -> 0x19c"},{"address":{"type":"call","value":[1180,1852,764,741]},"name":"NtTerminateThread(ThreadHandle=0x0, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,1156]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1156,742]},"name":"NtCreateFile(FileHandle=0x16c, DesiredAccess=GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Local\\Temp\\~jxoqwn.tmp\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,745]},"name":"LdrLoadDll(Flags=0x0, FileName=\"CRYPTSP.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,746]},"name":"LdrGetProcedureAddress(ModuleName=\"CRYPTSP.dll\", ModuleHandle=0x73d40000, FunctionName=\"CryptAcquireContextA\", Ordinal=0x0, FunctionAddress=0x73d44a53) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,748]},"name":"NtCreateEvent(Handle=0x1a4, EventName=\"2jxoqwn1852\", EventType=0x1, InitialState=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,750]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,751]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,753]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,754]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,755]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,756]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,757]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,758]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,759]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,760]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,761]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,762]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,763]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,764]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,765]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,766]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,767]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,768]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,769]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,770]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,772]},"name":"FindResourceEx(Module=0x750000, Type=\"#10\", Name=0x8, Language=0x0) -> 0x77b0a8"},{"address":{"type":"call","value":[1180,1852,1156,775]},"name":"NtCreateMutant(Handle=0x1b8, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,779]},"name":"NtCreateFile(FileHandle=0x1bc, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,780]},"name":"NtQueryInformationFile(FileHandle=0x1bc, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", FileInformationClass=FileStandardInformation, FileInformation=\"`\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,783]},"name":"NtClose(Handle=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,1156,790]},"name":"NtCreateMutant(Handle=0x1bc, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,796]},"name":"NtCreateMutant(Handle=0x1e4, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,797]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\", Handle=0x1e8, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,802]},"name":"NtOpenFile(FileHandle=0x1e8, DesiredAccess=SYNCHRONIZE, FileName=\"C:\\\", ShareAccess=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,803]},"name":"NtQueryInformationFile(FileHandle=0x1e8, HandleName=\"C:\\\", FileInformationClass=FileNameInformation, FileInformation=\"\\x02\\x00\\x00\\x00\\\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,806]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x32e0000, RegionSize=0x81000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,807]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"System\\CurrentControlSet\\Control\\LSA\\AccessProviders\", Handle=0x1e8, FullName=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,810]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ntmarta.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,812]},"name":"LdrGetProcedureAddress(ModuleName=\"ntmarta.dll\", ModuleHandle=0x74a20000, FunctionName=\"GetMartaExtensionInterface\", Ordinal=0x0, FunctionAddress=0x74a221f2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,819]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99ba0, CreationFlags=0x0, ThreadId=0x2788) -> 0x224"},{"address":{"type":"call","value":[1180,1852,1156,822]},"name":"NtCreateMutant(Handle=0x22c, MutexName=\"\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,826]},"name":"NtWaitForSingleObject(Handle=0x224, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,828]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99bc0, CreationFlags=0x0, ThreadId=0x828) -> 0x234"},{"address":{"type":"call","value":[1180,1852,1156,834]},"name":"NtWaitForSingleObject(Handle=0x224, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,836]},"name":"NtWaitForSingleObject(Handle=0x234, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,838]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99be0, CreationFlags=0x0, ThreadId=0x1028) -> 0x23c"},{"address":{"type":"call","value":[1180,1852,1156,847]},"name":"NtCreateFile(FileHandle=0x0, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\teoumiow.awt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1156,860]},"name":"NtWaitForSingleObject(Handle=0x224, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,862]},"name":"NtWaitForSingleObject(Handle=0x234, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,864]},"name":"NtWaitForSingleObject(Handle=0x23c, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,866]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c00, CreationFlags=0x0, ThreadId=0x2832) -> 0x244"},{"address":{"type":"call","value":[1180,1852,1156,888]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,889]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,890]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,891]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,892]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,893]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,894]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,895]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,896]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,897]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,898]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,899]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,900]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,901]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,902]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,903]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,904]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,905]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,906]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,907]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,912]},"name":"NtWaitForSingleObject(Handle=0x224, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,914]},"name":"NtWaitForSingleObject(Handle=0x234, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,916]},"name":"NtWaitForSingleObject(Handle=0x23c, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,918]},"name":"NtWaitForSingleObject(Handle=0x244, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,920]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c20, CreationFlags=0x0, ThreadId=0x2828) -> 0x250"},{"address":{"type":"call","value":[1180,1852,1156,929]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5400000, RegionSize=0x101000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,930]},"name":"NtCreateFile(FileHandle=0x254, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,1584]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c60, CreationFlags=0x0, ThreadId=0x1476) -> 0x554"},{"address":{"type":"call","value":[1180,1852,1156,1870]},"name":"FindResourceEx(Module=0x750000, Type=\"#10\", Name=0x10, Language=0x0) -> 0x77b088"},{"address":{"type":"call","value":[1180,1852,1156,1873]},"name":"NtCreateFile(FileHandle=0x0, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Local\\Microsoft\\jxoqwn.wpl\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1156,1877]},"name":"NtCreateFile(FileHandle=0x554, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Local\\Microsoft\\jxoqwn.wpl\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"no\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2344]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5e20000, RegionSize=0x101000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2345]},"name":"NtCreateFile(FileHandle=0x49c, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2351]},"name":"NtOpenKey(KeyHandle=0x4c0, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2353]},"name":"RegOpenKeyEx(Registry=0x4c2, SubKey=\"AppID\\explorer.exe\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\AppID\\explorer.exe\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,1156,2563]},"name":"LdrLoadDll(Flags=0x0, FileName=\"SspiCli.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2564]},"name":"LdrGetProcedureAddress(ModuleName=\"SspiCli.dll\", ModuleHandle=0x75800000, FunctionName=\"GetUserNameExW\", Ordinal=0x0, FunctionAddress=0x7581a412) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2565]},"name":"NtQueryInformationThread(ThreadHandle=0xfffffffe, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x00\\x00\\xfa~<\\x07\\x00\\x00\\x84\\x04\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\", ThreadId=0x1156) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2567]},"name":"NtOpenKey(KeyHandle=0x484, DesiredAccess=KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SQMClient\\Windows\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2568]},"name":"NtQueryValueKey(KeyHandle=0x484, ValueName=\"CEIPEnable\", Type=REG_DWORD, Information=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\\CEIPEnable\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2573]},"name":"NtOpenKey(KeyHandle=0x4bc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2575]},"name":"RegOpenKeyEx(Registry=0x4be, SubKey=\"AppID\\explorer.exe\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\AppID\\explorer.exe\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,1156,2578]},"name":"NtQueryInformationThread(ThreadHandle=0xfffffffe, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x00\\x00\\xfa~<\\x07\\x00\\x00\\x84\\x04\\x00\\x00\\x03\\x00\\x00\\x00\t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\", ThreadId=0x1156) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2592]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c60, CreationFlags=0x0, ThreadId=0x2656) -> 0x3e0"},{"address":{"type":"call","value":[1180,1852,1156,2602]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c80, CreationFlags=0x0, ThreadId=0x1020) -> 0x58c"},{"address":{"type":"call","value":[1180,1852,1156,2612]},"name":"NtOpenFile(FileHandle=0x594, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\comp@adobe[1].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2613]},"name":"NtSetInformationFile(FileHandle=0x594, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\comp@adobe[1].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2639]},"name":"NtOpenFile(FileHandle=0x594, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\comp@win-rar[2].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2640]},"name":"NtSetInformationFile(FileHandle=0x594, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\comp@win-rar[2].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2673]},"name":"NtOpenFile(FileHandle=0x5d4, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2674]},"name":"NtSetInformationFile(FileHandle=0x5d4, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2724]},"name":"NtOpenFile(FileHandle=0x600, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@bing[2].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2725]},"name":"NtSetInformationFile(FileHandle=0x600, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@bing[2].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2729]},"name":"NtOpenFile(FileHandle=0x600, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@google[2].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2730]},"name":"NtSetInformationFile(FileHandle=0x600, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@google[2].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2876]},"name":"NtOpenFile(FileHandle=0x610, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@msn[2].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2877]},"name":"NtSetInformationFile(FileHandle=0x610, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@msn[2].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2884]},"name":"NtOpenFile(FileHandle=0x60c, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@support.microsoft[1].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2885]},"name":"NtSetInformationFile(FileHandle=0x60c, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@support.microsoft[1].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2895]},"name":"NtOpenFile(FileHandle=0x60c, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@www.bing[1].txt\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2896]},"name":"NtSetInformationFile(FileHandle=0x60c, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@www.bing[1].txt\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2900]},"name":"NtOpenFile(FileHandle=0x60c, DesiredAccess=FILE_WRITE_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2901]},"name":"NtSetInformationFile(FileHandle=0x60c, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat\", FileInformationClass=FileBasicInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2933]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c60, CreationFlags=0x0, ThreadId=0x968) -> 0x5fc"},{"address":{"type":"call","value":[1180,1852,1156,2948]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5f30000, RegionSize=0x101000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,2949]},"name":"NtCreateFile(FileHandle=0x5f4, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,3679]},"name":"NtOpenKey(KeyHandle=0x64c, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,3681]},"name":"RegOpenKeyEx(Registry=0x64e, SubKey=\"AppID\\explorer.exe\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\AppID\\explorer.exe\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,1156,3684]},"name":"NtQueryInformationThread(ThreadHandle=0xfffffffe, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x00\\x00\\xfa~<\\x07\\x00\\x00\\x84\\x04\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xff\\xff\\xff\\xff\", ThreadId=0x1156) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,3686]},"name":"LdrLoadDll(Flags=0x0, FileName=\"SHLWAPI.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,3687]},"name":"LdrGetProcedureAddress(ModuleName=\"SHLWAPI.dll\", ModuleHandle=0x76a60000, FunctionName=\"PathFindFileNameW\", Ordinal=0x0, FunctionAddress=0x76a7bb71) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,3696]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c80, CreationFlags=0x0, ThreadId=0x2688) -> 0x650"},{"address":{"type":"call","value":[1180,1852,1156,3712]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99ca0, CreationFlags=0x0, ThreadId=0x1200) -> 0x658"},{"address":{"type":"call","value":[1180,1852,1156,3727]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6070000, RegionSize=0x101000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,3728]},"name":"NtCreateFile(FileHandle=0x65c, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4947]},"name":"FindResourceEx(Module=0x750000, Type=\"#10\", Name=0x10, Language=0x0) -> 0x77b088"},{"address":{"type":"call","value":[1180,1852,1156,4952]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4ded000, RegionSize=0x12000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4953]},"name":"NtCreateFile(FileHandle=0x57c, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Local\\Microsoft\\jxoqwn.wpl\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4956]},"name":"NtOpenKey(KeyHandle=0x5c8, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4958]},"name":"RegOpenKeyEx(Registry=0x5ca, SubKey=\"AppID\\explorer.exe\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\AppID\\explorer.exe\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,1156,4961]},"name":"NtQueryInformationThread(ThreadHandle=0xfffffffe, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x00\\x00\\xfa~<\\x07\\x00\\x00\\x84\\x04\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xff\\xff\\xff\\xff\", ThreadId=0x1156) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4964]},"name":"NtOpenKey(KeyHandle=0x57c, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4966]},"name":"RegOpenKeyEx(Registry=0x57e, SubKey=\"AppID\\explorer.exe\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\AppID\\explorer.exe\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,1156,4969]},"name":"NtQueryInformationThread(ThreadHandle=0xfffffffe, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x00\\x00\\xfa~<\\x07\\x00\\x00\\x84\\x04\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\xff\\xff\\xff\\xff\", ThreadId=0x1156) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,4979]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c80, CreationFlags=0x0, ThreadId=0x1732) -> 0x5c8"},{"address":{"type":"call","value":[1180,1852,1156,4995]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99cc0, CreationFlags=0x0, ThreadId=0x2444) -> 0x698"},{"address":{"type":"call","value":[1180,1852,1156,5010]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x64d0000, RegionSize=0x101000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1156,5026]},"name":"NtCreateFile(FileHandle=0x690, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqw.dat\", CreateDisposition=FILE_OVERWRITE_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,1028]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1028,939]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\", Handle=0x238, FullName=\"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,940]},"name":"RegQueryInfoKey(KeyHandle=0x238, Class=\"\", SubKeyCount=0x0, MaxSubKeyLength=0x0, MaxClassLength=0x0, ValueCount=0x0, MaxValueNameLength=0x0, MaxValueLength=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,944]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4d9e000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,945]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4da3000, RegionSize=0x5c000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,946]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\", Handle=0x238, FullName=\"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,947]},"name":"RegSetValueEx(Handle=0x238, ValueName=\"yfeaxxbea\", Type=REG_SZ, Buffer=\"\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\"\", BufferLength=0x61, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\yfeaxxbea\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,2005]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\", Handle=0x57c, FullName=\"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,2006]},"name":"RegQueryInfoKey(KeyHandle=0x57c, Class=\"\", SubKeyCount=0x0, MaxSubKeyLength=0x0, MaxClassLength=0x0, ValueCount=0x1, MaxValueNameLength=0x9, MaxValueLength=0x122) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,2007]},"name":"RegEnumValue(Handle=0x57c, Index=0x0, ValueName=\"yfeaxxbea\", Data=\"\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\"\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\yfeaxxbea\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,3481]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\", Handle=0x644, FullName=\"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,3482]},"name":"RegQueryInfoKey(KeyHandle=0x644, Class=\"\", SubKeyCount=0x0, MaxSubKeyLength=0x0, MaxClassLength=0x0, ValueCount=0x1, MaxValueNameLength=0x9, MaxValueLength=0x122) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,3483]},"name":"RegEnumValue(Handle=0x644, Index=0x0, ValueName=\"yfeaxxbea\", Data=\"\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\"\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\yfeaxxbea\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,3488]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4de8000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,3489]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4ded000, RegionSize=0x12000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,4873]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\", Handle=0x698, FullName=\"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,4874]},"name":"RegQueryInfoKey(KeyHandle=0x698, Class=\"\", SubKeyCount=0x0, MaxSubKeyLength=0x0, MaxClassLength=0x0, ValueCount=0x1, MaxValueNameLength=0x9, MaxValueLength=0x122) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1028,4875]},"name":"RegEnumValue(Handle=0x698, Index=0x0, ValueName=\"yfeaxxbea\", Data=\"\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn.exe\"\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\yfeaxxbea\") -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,2828]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2828,1046]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0004"},{"address":{"type":"call","value":[1180,1852,2828,1049]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_CONNECT_RETRIES, Buffer=0x3) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,1050]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,1051]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_RECEIVE_TIMEOUT, Buffer=0x61a8) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,1053]},"name":"InternetConnect(InternetHandle=0xcc0004, ServerName=\"www.ip-adress.com\", ServerPort=0x80, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc000c"},{"address":{"type":"call","value":[1180,1852,2828,2364]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x1, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0004"},{"address":{"type":"call","value":[1180,1852,2828,2365]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_CONNECT_RETRIES, Buffer=0x3) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,2366]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,2367]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_RECEIVE_TIMEOUT, Buffer=0x61a8) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,2369]},"name":"InternetConnect(InternetHandle=0xcc0004, ServerName=\"www.ip-adress.com\", ServerPort=0x80, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc000c"},{"address":{"type":"call","value":[1180,1852,2828,4237]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5c92000, RegionSize=0x3e000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2828,4238]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5d13000, RegionSize=0x21000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2828,4239]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x6300000, RegionSize=0x102000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2828,4241]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x4c4"},{"address":{"type":"call","value":[1180,1852,2828,4242]},"name":"Process32First(ProcessName=\"[System Process]\", ProcessId=0x0) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4293]},"name":"Module32First(ModuleName=\"pyw.exe\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4294]},"name":"Module32Next(ModuleName=\"ntdll.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4295]},"name":"Module32Next(ModuleName=\"kernel32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4296]},"name":"Module32Next(ModuleName=\"KERNELBASE.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4297]},"name":"Module32Next(ModuleName=\"VERSION.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4298]},"name":"Module32Next(ModuleName=\"msvcrt.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4299]},"name":"Module32Next(ModuleName=\"USER32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4300]},"name":"Module32Next(ModuleName=\"GDI32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4301]},"name":"Module32Next(ModuleName=\"LPK.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4302]},"name":"Module32Next(ModuleName=\"USP10.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4303]},"name":"Module32Next(ModuleName=\"ADVAPI32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4304]},"name":"Module32Next(ModuleName=\"sechost.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4305]},"name":"Module32Next(ModuleName=\"RPCRT4.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4306]},"name":"Module32Next(ModuleName=\"SspiCli.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4307]},"name":"Module32Next(ModuleName=\"CRYPTBASE.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4308]},"name":"Module32Next(ModuleName=\"SHELL32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4309]},"name":"Module32Next(ModuleName=\"SHLWAPI.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4310]},"name":"Module32Next(ModuleName=\"IMM32.DLL\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4311]},"name":"Module32Next(ModuleName=\"MSCTF.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4312]},"name":"Module32Next(ModuleName=\"api-ms-win-core-synch-l1-2-0.DLL\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4313]},"name":"Module32Next(ModuleName=\"ole32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4314]},"name":"Module32Next(ModuleName=\"apphelp.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4315]},"name":"Module32Next(ModuleName=\"CRYPT32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4316]},"name":"Module32Next(ModuleName=\"MSASN1.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4317]},"name":"Module32Next(ModuleName=\"WS2_32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4318]},"name":"Module32Next(ModuleName=\"NSI.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4319]},"name":"Module32Next(ModuleName=\"PSAPI.DLL\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4320]},"name":"Module32Next(ModuleName=\"bcrypt.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4321]},"name":"Module32Next(ModuleName=\"ntmarta.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4322]},"name":"Module32Next(ModuleName=\"WLDAP32.dll\", ModuleID=0x1, ProcessId=0x1680) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4327]},"name":"Module32First(ModuleName=\"pythonw.exe\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4328]},"name":"Module32Next(ModuleName=\"ntdll.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4329]},"name":"Module32Next(ModuleName=\"kernel32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4330]},"name":"Module32Next(ModuleName=\"KERNELBASE.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4331]},"name":"Module32Next(ModuleName=\"python37.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4332]},"name":"Module32Next(ModuleName=\"VERSION.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4333]},"name":"Module32Next(ModuleName=\"msvcrt.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4334]},"name":"Module32Next(ModuleName=\"SHLWAPI.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4335]},"name":"Module32Next(ModuleName=\"GDI32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4336]},"name":"Module32Next(ModuleName=\"USER32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4337]},"name":"Module32Next(ModuleName=\"ADVAPI32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4338]},"name":"Module32Next(ModuleName=\"sechost.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4339]},"name":"Module32Next(ModuleName=\"RPCRT4.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4340]},"name":"Module32Next(ModuleName=\"SspiCli.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4341]},"name":"Module32Next(ModuleName=\"CRYPTBASE.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4342]},"name":"Module32Next(ModuleName=\"LPK.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4343]},"name":"Module32Next(ModuleName=\"USP10.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4344]},"name":"Module32Next(ModuleName=\"WS2_32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4345]},"name":"Module32Next(ModuleName=\"NSI.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4346]},"name":"Module32Next(ModuleName=\"VCRUNTIME140.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4347]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-runtime-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4348]},"name":"Module32Next(ModuleName=\"ucrtbase.DLL\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4349]},"name":"Module32Next(ModuleName=\"api-ms-win-core-localization-l1-2-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4350]},"name":"Module32Next(ModuleName=\"api-ms-win-core-processthreads-l1-1-1.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4351]},"name":"Module32Next(ModuleName=\"api-ms-win-core-file-l1-2-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4352]},"name":"Module32Next(ModuleName=\"api-ms-win-core-timezone-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4353]},"name":"Module32Next(ModuleName=\"api-ms-win-core-file-l2-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4354]},"name":"Module32Next(ModuleName=\"api-ms-win-core-synch-l1-2-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4355]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-string-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4356]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-heap-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4357]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-stdio-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4358]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-convert-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4359]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-math-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4360]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-locale-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4361]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-time-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4362]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-environment-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4363]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-process-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4364]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-conio-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4365]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-filesystem-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4366]},"name":"Module32Next(ModuleName=\"IMM32.DLL\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4367]},"name":"Module32Next(ModuleName=\"MSCTF.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4368]},"name":"Module32Next(ModuleName=\"CRYPTSP.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4369]},"name":"Module32Next(ModuleName=\"rsaenh.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4370]},"name":"Module32Next(ModuleName=\"python3.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4371]},"name":"Module32Next(ModuleName=\"_hashlib.pyd\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4372]},"name":"Module32Next(ModuleName=\"libcrypto-1_1.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4373]},"name":"Module32Next(ModuleName=\"bcrypt.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4374]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-utility-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4375]},"name":"Module32Next(ModuleName=\"_socket.pyd\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4376]},"name":"Module32Next(ModuleName=\"select.pyd\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4377]},"name":"Module32Next(ModuleName=\"_bz2.pyd\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4378]},"name":"Module32Next(ModuleName=\"_lzma.pyd\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4379]},"name":"Module32Next(ModuleName=\"_ssl.pyd\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4380]},"name":"Module32Next(ModuleName=\"CRYPT32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4381]},"name":"Module32Next(ModuleName=\"MSASN1.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4382]},"name":"Module32Next(ModuleName=\"libssl-1_1.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4383]},"name":"Module32Next(ModuleName=\"mswsock.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4384]},"name":"Module32Next(ModuleName=\"wshtcpip.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4385]},"name":"Module32Next(ModuleName=\"apphelp.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4386]},"name":"Module32Next(ModuleName=\"PSAPI.DLL\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4387]},"name":"Module32Next(ModuleName=\"SHELL32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4388]},"name":"Module32Next(ModuleName=\"ntmarta.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4389]},"name":"Module32Next(ModuleName=\"WLDAP32.dll\", ModuleID=0x1, ProcessId=0x1712) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4412]},"name":"Module32First(ModuleName=\"pythonw.exe\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4413]},"name":"Module32Next(ModuleName=\"ntdll.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4414]},"name":"Module32Next(ModuleName=\"kernel32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4415]},"name":"Module32Next(ModuleName=\"KERNELBASE.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4416]},"name":"Module32Next(ModuleName=\"python37.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4417]},"name":"Module32Next(ModuleName=\"VERSION.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4418]},"name":"Module32Next(ModuleName=\"msvcrt.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4419]},"name":"Module32Next(ModuleName=\"SHLWAPI.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4420]},"name":"Module32Next(ModuleName=\"GDI32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4421]},"name":"Module32Next(ModuleName=\"USER32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4422]},"name":"Module32Next(ModuleName=\"ADVAPI32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4423]},"name":"Module32Next(ModuleName=\"sechost.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4424]},"name":"Module32Next(ModuleName=\"RPCRT4.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4425]},"name":"Module32Next(ModuleName=\"SspiCli.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4426]},"name":"Module32Next(ModuleName=\"CRYPTBASE.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4427]},"name":"Module32Next(ModuleName=\"LPK.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4428]},"name":"Module32Next(ModuleName=\"USP10.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4429]},"name":"Module32Next(ModuleName=\"WS2_32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4430]},"name":"Module32Next(ModuleName=\"NSI.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4431]},"name":"Module32Next(ModuleName=\"VCRUNTIME140.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4432]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-runtime-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4433]},"name":"Module32Next(ModuleName=\"ucrtbase.DLL\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4434]},"name":"Module32Next(ModuleName=\"api-ms-win-core-localization-l1-2-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4435]},"name":"Module32Next(ModuleName=\"api-ms-win-core-processthreads-l1-1-1.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4436]},"name":"Module32Next(ModuleName=\"api-ms-win-core-file-l1-2-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4437]},"name":"Module32Next(ModuleName=\"api-ms-win-core-timezone-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4438]},"name":"Module32Next(ModuleName=\"api-ms-win-core-file-l2-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4439]},"name":"Module32Next(ModuleName=\"api-ms-win-core-synch-l1-2-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4440]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-string-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4441]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-heap-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4442]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-stdio-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4443]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-convert-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4444]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-math-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4445]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-locale-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4446]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-time-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4447]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-environment-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4448]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-process-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4449]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-conio-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4450]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-filesystem-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4451]},"name":"Module32Next(ModuleName=\"IMM32.DLL\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4452]},"name":"Module32Next(ModuleName=\"MSCTF.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4453]},"name":"Module32Next(ModuleName=\"CRYPTSP.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4454]},"name":"Module32Next(ModuleName=\"rsaenh.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4455]},"name":"Module32Next(ModuleName=\"python3.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4456]},"name":"Module32Next(ModuleName=\"_socket.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4457]},"name":"Module32Next(ModuleName=\"select.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4458]},"name":"Module32Next(ModuleName=\"_hashlib.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4459]},"name":"Module32Next(ModuleName=\"libcrypto-1_1.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4460]},"name":"Module32Next(ModuleName=\"bcrypt.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4461]},"name":"Module32Next(ModuleName=\"api-ms-win-crt-utility-l1-1-0.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4462]},"name":"Module32Next(ModuleName=\"_ctypes.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4463]},"name":"Module32Next(ModuleName=\"ole32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4464]},"name":"Module32Next(ModuleName=\"OLEAUT32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4465]},"name":"Module32Next(ModuleName=\"_bz2.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4466]},"name":"Module32Next(ModuleName=\"_lzma.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4467]},"name":"Module32Next(ModuleName=\"_ssl.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4468]},"name":"Module32Next(ModuleName=\"CRYPT32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4469]},"name":"Module32Next(ModuleName=\"MSASN1.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4470]},"name":"Module32Next(ModuleName=\"libssl-1_1.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4471]},"name":"Module32Next(ModuleName=\"pdh.DLL\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4472]},"name":"Module32Next(ModuleName=\"unicodedata.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4473]},"name":"Module32Next(ModuleName=\"mswsock.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4474]},"name":"Module32Next(ModuleName=\"wshtcpip.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4475]},"name":"Module32Next(ModuleName=\"uxtheme.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4476]},"name":"Module32Next(ModuleName=\"_elementtree.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4477]},"name":"Module32Next(ModuleName=\"pyexpat.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4478]},"name":"Module32Next(ModuleName=\"_imaging.cp37-win32.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4479]},"name":"Module32Next(ModuleName=\"apphelp.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4480]},"name":"Module32Next(ModuleName=\"_decimal.pyd\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4481]},"name":"Module32Next(ModuleName=\"PSAPI.DLL\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4482]},"name":"Module32Next(ModuleName=\"SHELL32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4483]},"name":"Module32Next(ModuleName=\"ntmarta.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4484]},"name":"Module32Next(ModuleName=\"WLDAP32.dll\", ModuleID=0x1, ProcessId=0x2456) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4489]},"name":"Module32First(ModuleName=\"explorer.exe\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4490]},"name":"Module32Next(ModuleName=\"ntdll.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4491]},"name":"Module32Next(ModuleName=\"kernel32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4492]},"name":"Module32Next(ModuleName=\"KERNELBASE.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4493]},"name":"Module32Next(ModuleName=\"CRYPT32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4494]},"name":"Module32Next(ModuleName=\"msvcrt.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4495]},"name":"Module32Next(ModuleName=\"MSASN1.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4496]},"name":"Module32Next(ModuleName=\"WS2_32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4497]},"name":"Module32Next(ModuleName=\"RPCRT4.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4498]},"name":"Module32Next(ModuleName=\"SspiCli.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4499]},"name":"Module32Next(ModuleName=\"CRYPTBASE.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4500]},"name":"Module32Next(ModuleName=\"sechost.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4501]},"name":"Module32Next(ModuleName=\"NSI.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4502]},"name":"Module32Next(ModuleName=\"USER32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4503]},"name":"Module32Next(ModuleName=\"GDI32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4504]},"name":"Module32Next(ModuleName=\"LPK.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4505]},"name":"Module32Next(ModuleName=\"USP10.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4506]},"name":"Module32Next(ModuleName=\"ADVAPI32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4507]},"name":"Module32Next(ModuleName=\"ole32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4508]},"name":"Module32Next(ModuleName=\"SHLWAPI.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4509]},"name":"Module32Next(ModuleName=\"PSAPI.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4510]},"name":"Module32Next(ModuleName=\"bcrypt.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4511]},"name":"Module32Next(ModuleName=\"SHELL32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4512]},"name":"Module32Next(ModuleName=\"OLEAUT32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4513]},"name":"Module32Next(ModuleName=\"EXPLORERFRAME.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4514]},"name":"Module32Next(ModuleName=\"DUser.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4515]},"name":"Module32Next(ModuleName=\"DUI70.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4516]},"name":"Module32Next(ModuleName=\"IMM32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4517]},"name":"Module32Next(ModuleName=\"MSCTF.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4518]},"name":"Module32Next(ModuleName=\"UxTheme.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4519]},"name":"Module32Next(ModuleName=\"POWRPROF.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4520]},"name":"Module32Next(ModuleName=\"SETUPAPI.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4521]},"name":"Module32Next(ModuleName=\"CFGMGR32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4522]},"name":"Module32Next(ModuleName=\"DEVOBJ.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4523]},"name":"Module32Next(ModuleName=\"dwmapi.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4524]},"name":"Module32Next(ModuleName=\"slc.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4525]},"name":"Module32Next(ModuleName=\"gdiplus.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4526]},"name":"Module32Next(ModuleName=\"Secur32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4527]},"name":"Module32Next(ModuleName=\"PROPSYS.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4528]},"name":"Module32Next(ModuleName=\"api-ms-win-core-synch-l1-2-0.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4529]},"name":"Module32Next(ModuleName=\"IPHLPAPI.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4530]},"name":"Module32Next(ModuleName=\"WINNSI.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4531]},"name":"Module32Next(ModuleName=\"CRYPTSP.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4532]},"name":"Module32Next(ModuleName=\"rsaenh.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4533]},"name":"Module32Next(ModuleName=\"wininet.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4534]},"name":"Module32Next(ModuleName=\"urlmon.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4535]},"name":"Module32Next(ModuleName=\"XmlLite.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4536]},"name":"Module32Next(ModuleName=\"iertutil.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4537]},"name":"Module32Next(ModuleName=\"ntmarta.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4538]},"name":"Module32Next(ModuleName=\"WLDAP32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4539]},"name":"Module32Next(ModuleName=\"comctl32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4540]},"name":"Module32Next(ModuleName=\"profapi.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4541]},"name":"Module32Next(ModuleName=\"dnsapi.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4542]},"name":"Module32Next(ModuleName=\"RASAPI32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4543]},"name":"Module32Next(ModuleName=\"rasman.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4544]},"name":"Module32Next(ModuleName=\"rtutils.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4545]},"name":"Module32Next(ModuleName=\"sensapi.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4546]},"name":"Module32Next(ModuleName=\"NLAapi.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4547]},"name":"Module32Next(ModuleName=\"USERENV.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4548]},"name":"Module32Next(ModuleName=\"wintrust.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4549]},"name":"Module32Next(ModuleName=\"schannel.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4550]},"name":"Module32Next(ModuleName=\"rasadhlp.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4551]},"name":"Module32Next(ModuleName=\"napinsp.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4552]},"name":"Module32Next(ModuleName=\"pnrpnsp.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4553]},"name":"Module32Next(ModuleName=\"mswsock.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4554]},"name":"Module32Next(ModuleName=\"winrnr.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4555]},"name":"Module32Next(ModuleName=\"wshtcpip.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4556]},"name":"Module32Next(ModuleName=\"wship6.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4557]},"name":"Module32Next(ModuleName=\"fwpuclnt.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4558]},"name":"Module32Next(ModuleName=\"CLBCatQ.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4559]},"name":"Module32Next(ModuleName=\"RpcRtRemote.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4560]},"name":"Module32Next(ModuleName=\"DHCPCSVC.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4561]},"name":"Module32Next(ModuleName=\"dhcpcsvc6.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4562]},"name":"Module32Next(ModuleName=\"VERSION.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4563]},"name":"Module32Next(ModuleName=\"apphelp.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4564]},"name":"Module32Next(ModuleName=\"taskschd.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4565]},"name":"Module32Next(ModuleName=\"mpr.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4566]},"name":"Module32Next(ModuleName=\"netapi32.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4567]},"name":"Module32Next(ModuleName=\"SAMCLI.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4568]},"name":"Module32Next(ModuleName=\"WKSCLI.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4569]},"name":"Module32Next(ModuleName=\"netutils.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4570]},"name":"Module32Next(ModuleName=\"srvcli.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4571]},"name":"Module32Next(ModuleName=\"LOGONCLI.DLL\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4572]},"name":"Module32Next(ModuleName=\"cscapi.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4573]},"name":"Module32Next(ModuleName=\"drprov.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4574]},"name":"Module32Next(ModuleName=\"WINSTA.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4575]},"name":"Module32Next(ModuleName=\"ntlanman.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4576]},"name":"Module32Next(ModuleName=\"davclnt.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4577]},"name":"Module32Next(ModuleName=\"DAVHLPR.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4578]},"name":"Module32Next(ModuleName=\"browcli.dll\", ModuleID=0x1, ProcessId=0x1852) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2828,4585]},"name":"socket(af=AF_INET, type=SOCK_STREAM, protocol=IPPROTO_TCP, socket=0x1220) -> 0x4c4"}]},{"address":{"type":"thread","value":[1180,1852,2832]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2832,965]},"name":"NtWaitForSingleObject(Handle=0x1e4, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,967]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x240, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,986]},"name":"FindResourceEx(Module=0x750000, Type=\"#10\", Name=0x11, Language=0x0) -> 0x77b098"},{"address":{"type":"call","value":[1180,1852,2832,992]},"name":"NtWaitForSingleObject(Handle=0x224, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,994]},"name":"NtWaitForSingleObject(Handle=0x234, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,996]},"name":"NtWaitForSingleObject(Handle=0x23c, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,998]},"name":"NtWaitForSingleObject(Handle=0x244, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,1000]},"name":"NtWaitForSingleObject(Handle=0x250, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,1002]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x2856) -> 0x230"},{"address":{"type":"call","value":[1180,1852,2832,1481]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x00(\\x0b\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,1482]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,1483]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,1491]},"name":"NtWaitForSingleObject(Handle=0x224, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,1496]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x2208) -> 0x540"},{"address":{"type":"call","value":[1180,1852,2832,1942]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x00\\xa0\\x08\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,1943]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,1944]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,1953]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x2616) -> 0x158"},{"address":{"type":"call","value":[1180,1852,2832,2499]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x008\n\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,2500]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,2501]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,2510]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x1400) -> 0x464"},{"address":{"type":"call","value":[1180,1852,2832,3127]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x00x\\x05\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,3128]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,3129]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,3138]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x1876) -> 0x628"},{"address":{"type":"call","value":[1180,1852,2832,3296]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x00T\\x07\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,3297]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,3298]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,3307]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x676) -> 0x600"},{"address":{"type":"call","value":[1180,1852,2832,3796]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x00\\xa4\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,3797]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,3798]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,3807]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x2700) -> 0x660"},{"address":{"type":"call","value":[1180,1852,2832,4000]},"name":"NtQueryInformationThread(ThreadHandle=0x4d99c40, ThreadInformationClass=ThreadBasicInformation, ThreadInformation=\"\\x03\\x01\\x00\\x00\\x99Iv\\x00<\\x07\\x00\\x00\\x8c\n\\x00\\x00\\x03\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\", ThreadId=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,4001]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0x4d99c40, TargetProcessHandle=0xffffffff, TargetHandle=0x0, Options=0x0) -> INVALID_HANDLE"},{"address":{"type":"call","value":[1180,1852,2832,4002]},"name":"NtTerminateThread(ThreadHandle=0x4d99c40, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2832,4011]},"name":"CreateThread(StartRoutine=0x757f20, Parameter=0x4d99c40, CreationFlags=0x0, ThreadId=0x1808) -> 0x674"}]},{"address":{"type":"thread","value":[1180,1852,2856]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2856,1007]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x539000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1022]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1023]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1025]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1026]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1027]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1028]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1029]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1030]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1031]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1032]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1033]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1034]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1035]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1036]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1037]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1038]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1039]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1040]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1041]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1042]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2856,1048]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0008"},{"address":{"type":"call","value":[1180,1852,2856,1055]},"name":"InternetSetOption(InternetHandle=0xcc0008, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2856,1058]},"name":"InternetConnect(InternetHandle=0xcc0008, ServerName=\"216.201.159.118\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0014"},{"address":{"type":"call","value":[1180,1852,2856,3263]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x1, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0008"},{"address":{"type":"call","value":[1180,1852,2856,3265]},"name":"InternetSetOption(InternetHandle=0xcc0008, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2856,3268]},"name":"InternetConnect(InternetHandle=0xcc0008, ServerName=\"216.201.159.118\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0014"}]},{"address":{"type":"thread","value":[1180,1852,2784]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2784,1062]},"name":"LdrGetProcedureAddress(ModuleName=\"RASAPI32.dll\", ModuleHandle=0x72890000, FunctionName=\"RasConnectionNotificationW\", Ordinal=0x0, FunctionAddress=0x728931f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2784,1342]},"name":"getaddrinfo(NodeName=\"wpad\", ServiceName=\"\") -> WSAHOST_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,2784,4721]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5931000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,2836]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2836,1068]},"name":"LdrGetProcedureAddress(ModuleName=\"sechost.dll\", ModuleHandle=0x76d40000, FunctionName=\"NotifyServiceStatusChangeA\", Ordinal=0x0, FunctionAddress=0x76d4a11d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2836,1069]},"name":"LdrLoadDll(Flags=0x0, FileName=\"CRYPTBASE.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2836,1070]},"name":"LdrGetProcedureAddress(ModuleName=\"CRYPTBASE.dll\", ModuleHandle=0x757f0000, FunctionName=\"SystemFunction036\", Ordinal=0x0, FunctionAddress=0x757f12f0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2836,1071]},"name":"NtOpenThread(ThreadHandle=0x34c, DesiredAccess=THREAD_SET_CONTEXT, ProcessId=0x1852, ThreadId=0x2836) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2836,1077]},"name":"NtOpenThread(ThreadHandle=0x378, DesiredAccess=THREAD_SET_CONTEXT, ProcessId=0x1852, ThreadId=0x2836) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,2320]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2320,1080]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x39c, Options=0x2) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,236]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,236,1085]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x53a000, RegionSize=0x6000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1086]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ole32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1087]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoInitializeEx\", Ordinal=0x0, FunctionAddress=0x7758097d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1089]},"name":"NtQuerySystemInformation(SystemInformationClass=FILE_SUPERSEDE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1091]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegDeleteTreeA\", Ordinal=0x0, FunctionAddress=0x776e378f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1092]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegDeleteTreeW\", Ordinal=0x0, FunctionAddress=0x776e377f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1099]},"name":"gethostname(HostName=\"comp-PC\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1101]},"name":"getaddrinfo(NodeName=\"comp-PC\", ServiceName=\"\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1102]},"name":"gethostname(HostName=\"comp-PC\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1103]},"name":"getaddrinfo(NodeName=\"comp-PC\", ServiceName=\"\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1104]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoCreateInstance\", Ordinal=0x0, FunctionAddress=0x77589c5b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1106]},"name":"CoCreateInstance(rclsid=\"DCB00C01-570F-4A9B-8D69-199FDBA5723B\", ClsContext=CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER, riid=\"DCB00000-570F-4A9B-8D69-199FDBA5723B\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1113]},"name":"NtOpenKey(KeyHandle=0x4cc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1121]},"name":"NtOpenKey(KeyHandle=0x4cc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1129]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoTaskMemAlloc\", Ordinal=0x0, FunctionAddress=0x7758e9fc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1130]},"name":"LdrLoadDll(Flags=0x0, FileName=\"OLEAUT32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1133]},"name":"NtOpenKey(KeyHandle=0x4cc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1142]},"name":"RegOpenKeyEx(Registry=0x4ca, SubKey=\"TreatAs\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1143]},"name":"NtQueryKey(KeyHandle=0x4ca, KeyInformation=\"\", KeyInformationClass=0x3) -> BUFFER_TOO_SMALL"},{"address":{"type":"call","value":[1180,1852,236,1144]},"name":"NtQueryKey(KeyHandle=0x4ca, KeyInformation=\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\", KeyInformationClass=0x3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1145]},"name":"RegOpenKeyEx(Registry=0x4ca, SubKey=\"Progid\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1147]},"name":"RegOpenKeyEx(Registry=0x4ce, SubKey=\"Progid\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1157]},"name":"RegOpenKeyEx(Registry=0x4ca, SubKey=\"InprocHandler32\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1158]},"name":"RegOpenKeyEx(Registry=0x4ca, SubKey=\"InprocHandler\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1160]},"name":"NtOpenKey(KeyHandle=0x4cc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1164]},"name":"RegOpenKeyEx(Registry=0x4ca, SubKey=\"TreatAs\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1166]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\SysWOW64\\oleaut32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1167]},"name":"LdrGetProcedureAddress(ModuleName=\"OLEAUT32.dll\", ModuleHandle=0x77880000, FunctionName=\"DllGetClassObject\", Ordinal=0x0, FunctionAddress=0x7788c54d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1168]},"name":"LdrGetProcedureAddress(ModuleName=\"OLEAUT32.dll\", ModuleHandle=0x77880000, FunctionName=\"DllCanUnloadNow\", Ordinal=0x0, FunctionAddress=0x77883fae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1169]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ADVAPI32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1170]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"RegOpenKeyW\", Ordinal=0x0, FunctionAddress=0x776b2389) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1171]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\OleAut\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OleAut\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1173]},"name":"NtOpenKey(KeyHandle=0x4cc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1181]},"name":"NtOpenKey(KeyHandle=0x4cc, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1215]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoTaskMemFree\", Ordinal=0x0, FunctionAddress=0x77596f61) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1216]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"StringFromIID\", Ordinal=0x0, FunctionAddress=0x77553cc6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1217]},"name":"RegOpenKeyEx(Registry=HKEY_CURRENT_USER, SubKey=\"Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad\", Handle=0x4c8, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1218]},"name":"RegOpenKeyEx(Registry=0x4c8, SubKey=\"{E529480E-F7A1-4923-843A-F7D2F243A5B1}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1219]},"name":"RegQueryValueEx(Handle=0x4c8, ValueName=\"WpadLastNetwork\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1220]},"name":"RegQueryValueEx(Handle=0x4c8, ValueName=\"WpadLastNetwork\", Data=\"{B96C99BA-98AE-4228-B27D-94716BF99810}\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1221]},"name":"RegQueryValueEx(Handle=0x270, ValueName=\"AutoProxyDetectType\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,236,1222]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1223]},"name":"LdrLoadDll(Flags=0x0, FileName=\"IPHLPAPI.DLL\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1224]},"name":"LdrGetProcedureAddress(ModuleName=\"IPHLPAPI.DLL\", ModuleHandle=0x757c0000, FunctionName=\"GetAdaptersAddresses\", Ordinal=0x0, FunctionAddress=0x757c6a4d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1225]},"name":"LdrLoadDll(Flags=0x0, FileName=\"DHCPCSVC.DLL\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1226]},"name":"LdrGetProcedureAddress(ModuleName=\"DHCPCSVC.DLL\", ModuleHandle=0x72310000, FunctionName=\"DhcpRequestParams\", Ordinal=0x0, FunctionAddress=0x72313a5c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1228]},"name":"GetAdaptersAddresses() -> 0x6f"},{"address":{"type":"call","value":[1180,1852,236,1346]},"name":"CoCreateInstance(rclsid=\"DCB00C01-570F-4A9B-8D69-199FDBA5723B\", ClsContext=CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER, riid=\"DCB00000-570F-4A9B-8D69-199FDBA5723B\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1349]},"name":"LdrLoadDll(Flags=0x0, FileName=\"OLEAUT32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1350]},"name":"LdrGetProcedureAddress(ModuleName=\"OLEAUT32.dll\", ModuleHandle=0x77880000, FunctionName=\"\", Ordinal=0x2, FunctionAddress=0x77884728) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1351]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoTaskMemFree\", Ordinal=0x0, FunctionAddress=0x77596f61) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1352]},"name":"RegCreateKeyEx(Registry=0x4c8, SubKey=\"{E529480E-F7A1-4923-843A-F7D2F243A5B1}\", Class=\"\", Access=KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS, Handle=0x4e8, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\", Disposition=REG_CREATED_NEW_KEY) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1354]},"name":"RegSetValueEx(Handle=0x4e8, ValueName=\"WpadDecisionReason\", Type=REG_DWORD, Buffer=0x1, BufferLength=0x4, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadDecisionReason\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1355]},"name":"RegSetValueEx(Handle=0x4e8, ValueName=\"WpadDecisionTime\", Type=REG_BINARY, Buffer=\"\\xb0B\\xad\\xa75\\xf5\\xd6\\x01\", BufferLength=0x8, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadDecisionTime\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1356]},"name":"RegSetValueEx(Handle=0x4e8, ValueName=\"WpadDecision\", Type=REG_DWORD, Buffer=0x3, BufferLength=0x4, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadDecision\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1357]},"name":"RegSetValueEx(Handle=0x4e8, ValueName=\"WpadNetworkName\", Type=REG_SZ, Buffer=\"Network 2\", BufferLength=0x22, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadNetworkName\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1359]},"name":"RegOpenKeyEx(Registry=0x4c8, SubKey=\"{E529480E-F7A1-4923-843A-F7D2F243A5B1}\", Handle=0x4e8, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1360]},"name":"RegCreateKeyEx(Registry=0x4e8, SubKey=\"be-56-7b-0a-70-d1\", Class=\"\", Access=KEY_READ, Handle=0x4cc, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\be-56-7b-0a-70-d1\", Disposition=REG_CREATED_NEW_KEY) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1362]},"name":"RegCreateKeyEx(Registry=0x4c8, SubKey=\"be-56-7b-0a-70-d1\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x4cc, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\", Disposition=REG_CREATED_NEW_KEY) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1363]},"name":"RegSetValueEx(Handle=0x4cc, ValueName=\"WpadDecisionReason\", Type=REG_DWORD, Buffer=0x1, BufferLength=0x4, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\\WpadDecisionReason\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1364]},"name":"RegSetValueEx(Handle=0x4cc, ValueName=\"WpadDecisionTime\", Type=REG_BINARY, Buffer=\"\\xb0B\\xad\\xa75\\xf5\\xd6\\x01\", BufferLength=0x8, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\\WpadDecisionTime\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1365]},"name":"RegSetValueEx(Handle=0x4cc, ValueName=\"WpadDecision\", Type=REG_DWORD, Buffer=0x3, BufferLength=0x4, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\\WpadDecision\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1369]},"name":"NtCreateMutant(Handle=0x4e8, MutexName=\"IESQMMUTEX_0_208\", InitialOwner=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1375]},"name":"NtWaitForSingleObject(Handle=0x2e8, Milliseconds=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1376]},"name":"RegQueryValueEx(Handle=0x308, ValueName=\"EnableFileTracing\", Data=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\explorer_RASAPI32\\EnableFileTracing\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1378]},"name":"RegQueryValueEx(Handle=0x308, ValueName=\"EnableConsoleTracing\", Data=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\explorer_RASAPI32\\EnableConsoleTracing\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1382]},"name":"RegNotifyChangeKeyValue(FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\explorer_RASAPI32\\\", NotifyFilter=0xe, WatchSubtree=0x0, Asynchronous=0x1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1383]},"name":"RegQueryValueEx(Handle=0x31c, ValueName=\"EnableFileTracing\", Data=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\explorer_RASMANCS\\EnableFileTracing\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1385]},"name":"RegQueryValueEx(Handle=0x31c, ValueName=\"EnableConsoleTracing\", Data=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\explorer_RASMANCS\\EnableConsoleTracing\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1389]},"name":"RegNotifyChangeKeyValue(FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\explorer_RASMANCS\\\", NotifyFilter=0xe, WatchSubtree=0x0, Asynchronous=0x1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1390]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\", Handle=0x4cc, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1395]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\", Handle=0x4cc, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1403]},"name":"RegOpenKeyEx(Registry=HKEY_USERS, SubKey=\"S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\", Handle=0x4e8, FullName=\"HKEY_USERS\\S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1404]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1405]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", Data=\"%USERPROFILE%\\AppData\\Roaming\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1406]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x4e4, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1412]},"name":"NtCreateFile(FileHandle=0x4cc, DesiredAccess=FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1419]},"name":"NtCreateFile(FileHandle=0x4cc, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_READONLY, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1420]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0xa74000, RegionSize=0x5000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1421]},"name":"NtReadFile(FileHandle=0x4cc, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk\", Buffer=\"\", Length=0x0) -> END_OF_FILE"},{"address":{"type":"call","value":[1180,1852,236,1429]},"name":"RegOpenKeyEx(Registry=HKEY_USERS, SubKey=\"S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\", Handle=0x4e8, FullName=\"HKEY_USERS\\S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1430]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1431]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", Data=\"%USERPROFILE%\\AppData\\Roaming\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1432]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x4e4, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1438]},"name":"RegOpenKeyEx(Registry=HKEY_USERS, SubKey=\"S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\", Handle=0x4e8, FullName=\"HKEY_USERS\\S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1439]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1440]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", Data=\"%USERPROFILE%\\AppData\\Roaming\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1441]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x4e4, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1447]},"name":"RegOpenKeyEx(Registry=HKEY_USERS, SubKey=\"S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\", Handle=0x4e8, FullName=\"HKEY_USERS\\S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1448]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1449]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"AppData\", Data=\"%USERPROFILE%\\AppData\\Roaming\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1450]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\", Handle=0x4e4, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-2237850072-885592287-911325625-1000\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1458]},"name":"NtOpenSection(SectionHandle=0x0, DesiredAccess=0x4, ObjectAttributes=\"SENS Information Cache\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,236,1461]},"name":"gethostname(HostName=\"comp-PC\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1462]},"name":"getaddrinfo(NodeName=\"comp-PC\", ServiceName=\"\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1464]},"name":"RegCreateKeyEx(Registry=0x36c, SubKey=\"Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections\", Class=\"\", Access=KEY_QUERY_VALUE, Handle=0x4e8, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1465]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"DefaultConnectionSettings\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1466]},"name":"RegQueryValueEx(Handle=0x4e8, ValueName=\"DefaultConnectionSettings\", Data=\"F\\x00\\x00\\x00\\x05\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa0\\xc0\\x0en\\x85\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\x80\\x00\\x00\\x00\\x00\\x00\\x00-\\xb8\\x18ACSp\\x01\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x03\\xbd_\\x00\\x00`\\x1e]\\x00\\xb8\\xe8Y\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x01-\\x82_\\x00\\x08P\\x05-v\\x99\\xad\\xde\\x99\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xcf-v\\xdc1]\\x00\\xdc1]\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x002]\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xc0\\xa8z\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xda\\xda\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\xaf\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x2]\\x00x2]\\x00\", FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1467]},"name":"RegCreateKeyEx(Registry=0x36c, SubKey=\"Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x4cc, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1470]},"name":"RegSetValueEx(Handle=0x4cc, ValueName=\"DefaultConnectionSettings\", Type=REG_BINARY, Buffer=\"F\\x00\\x00\\x00\\x06\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x87\\xa8\\xa75\\xf5\\xd6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfe\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x84.\\xc2\\xdb\\x98\\xb1\\xcc\\xb1\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x03\\xbd_\\x00\\x00`\\x1e]\\x00\\xb8\\xe8Y\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x01-\\x82_\\x00\\x08P\\x05-v\\x99\\xad\\xde\\x99\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xcf-v\\xdc1]\\x00\\xdc1]\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x002]\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xac\\x14\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xda\\xda\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\xaf\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x2]\\x00x2]\\x00\", BufferLength=0x312, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,1472]},"name":"RegSetValueEx(Handle=0x4c8, ValueName=\"WpadLastNetwork\", Type=REG_SZ, Buffer=\"{E529480E-F7A1-4923-843A-F7D2F243A5B1}\", BufferLength=0x78, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,2143]},"name":"LdrGetProcedureAddress(ModuleName=\"ole32.dll\", ModuleHandle=0x77540000, FunctionName=\"CoUninitialize\", Ordinal=0x0, FunctionAddress=0x77588623) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,2156]},"name":"LdrLoadDll(Flags=0x0, FileName=\"OLEAUT32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,236,2170]},"name":"NtTerminateThread(ThreadHandle=0x0, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,2284]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2284,2013]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x580, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2284,4920]},"name":"NtTerminateThread(ThreadHandle=0x0, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,2208]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2208,1515]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1516]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1517]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1518]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1519]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1520]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1521]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1522]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1523]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1524]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1525]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1526]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1527]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1528]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1529]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1530]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1531]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1532]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1533]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1534]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2208,1537]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc001c"},{"address":{"type":"call","value":[1180,1852,2208,1539]},"name":"InternetSetOption(InternetHandle=0xcc001c, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2208,1542]},"name":"InternetConnect(InternetHandle=0xcc001c, ServerName=\"65.173.74.217\", ServerPort=0x2083, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0020"},{"address":{"type":"call","value":[1180,1852,2208,3283]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x1, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc001c"},{"address":{"type":"call","value":[1180,1852,2208,3285]},"name":"InternetSetOption(InternetHandle=0xcc001c, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2208,3288]},"name":"InternetConnect(InternetHandle=0xcc001c, ServerName=\"65.173.74.217\", ServerPort=0x2083, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0020"}]},{"address":{"type":"thread","value":[1180,1852,1476]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1476,1599]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5c90000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1600]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5c90000, RegionSize=0x42000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1602]},"name":"NtCreateFile(FileHandle=0x56c, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\comp@adobe[1].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1606]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1607]},"name":"NtQueryInformationFile(FileHandle=0x570, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1608]},"name":"NtSetInformationFile(FileHandle=0x570, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1614]},"name":"NtCreateFile(FileHandle=0x560, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\comp@win-rar[2].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1618]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1619]},"name":"NtQueryInformationFile(FileHandle=0x570, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"h\\x00\\x00\\x00\\x00\\x00\\x00\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1620]},"name":"NtSetInformationFile(FileHandle=0x570, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1637]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@bing[2].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1641]},"name":"NtCreateFile(FileHandle=0x574, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1642]},"name":"NtQueryInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"\\xf8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1643]},"name":"NtSetInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1648]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@google[2].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1652]},"name":"NtCreateFile(FileHandle=0x574, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1653]},"name":"NtQueryInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"0\\x02\\x00\\x00\\x00\\x00\\x00\\x00*\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1654]},"name":"NtSetInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"*\\x02\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1659]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@msn[2].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1663]},"name":"NtCreateFile(FileHandle=0x574, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1664]},"name":"NtQueryInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1665]},"name":"NtSetInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1670]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@support.microsoft[1].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1674]},"name":"NtCreateFile(FileHandle=0x574, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1675]},"name":"NtQueryInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\xb1\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1676]},"name":"NtSetInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"\\xb1\\x04\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1681]},"name":"NtCreateFile(FileHandle=0x570, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\comp@www.bing[1].txt\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1685]},"name":"NtCreateFile(FileHandle=0x574, DesiredAccess=GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", CreateDisposition=FILE_OPEN_IF, ShareAccess=0x0, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1686]},"name":"NtQueryInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FileStandardInformation, FileInformation=\"\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1687]},"name":"NtSetInformationFile(FileHandle=0x574, HandleName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Jxoqwnx\\jxoqwn32.dll\", FileInformationClass=FilePositionInformation, FileInformation=\"\\x99\\x05\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1476,1703]},"name":"NtTerminateThread(ThreadHandle=0x0, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,2616]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2616,1972]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1973]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1974]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1975]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1976]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1977]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1978]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1979]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1980]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1981]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1982]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1983]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1984]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1985]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1986]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1987]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1988]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1989]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1990]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1991]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2616,1994]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0028"},{"address":{"type":"call","value":[1180,1852,2616,1996]},"name":"InternetSetOption(InternetHandle=0xcc0028, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2616,1999]},"name":"InternetConnect(InternetHandle=0xcc0028, ServerName=\"66.222.88.126\", ServerPort=0x995, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc002c"},{"address":{"type":"call","value":[1180,1852,2616,3987]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x1, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0028"},{"address":{"type":"call","value":[1180,1852,2616,3989]},"name":"InternetSetOption(InternetHandle=0xcc0028, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2616,3992]},"name":"InternetConnect(InternetHandle=0xcc0028, ServerName=\"66.222.88.126\", ServerPort=0x995, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc002c"}]},{"address":{"type":"thread","value":[1180,1852,1400]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1400,2529]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2530]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2531]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2532]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2533]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2534]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2535]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2536]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2537]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2538]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2539]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2540]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2541]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2542]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2543]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2544]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2545]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2546]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2547]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2548]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1400,2551]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0034"},{"address":{"type":"call","value":[1180,1852,1400,2553]},"name":"InternetSetOption(InternetHandle=0xcc0034, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,1400,2556]},"name":"InternetConnect(InternetHandle=0xcc0034, ServerName=\"71.190.202.120\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0038"},{"address":{"type":"call","value":[1180,1852,1400,4901]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x1, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0004"},{"address":{"type":"call","value":[1180,1852,1400,4903]},"name":"InternetSetOption(InternetHandle=0xcc0004, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,1400,4906]},"name":"InternetConnect(InternetHandle=0xcc0004, ServerName=\"71.190.202.120\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc000c"}]},{"address":{"type":"thread","value":[1180,1852,1020]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1020,2635]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2636]},"name":"LdrLoadDll(Flags=0x0, FileName=\"mpr.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2642]},"name":"LdrGetProcedureAddress(ModuleName=\"mpr.dll\", ModuleHandle=0x72390000, FunctionName=\"WNetOpenEnumW\", Ordinal=0x0, FunctionAddress=0x72392f06) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2643]},"name":"LdrGetProcedureAddress(ModuleName=\"mpr.dll\", ModuleHandle=0x72390000, FunctionName=\"WNetEnumResourceW\", Ordinal=0x0, FunctionAddress=0x72393058) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2644]},"name":"LdrGetProcedureAddress(ModuleName=\"mpr.dll\", ModuleHandle=0x72390000, FunctionName=\"WNetAddConnection2W\", Ordinal=0x0, FunctionAddress=0x72394744) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2645]},"name":"LdrGetProcedureAddress(ModuleName=\"mpr.dll\", ModuleHandle=0x72390000, FunctionName=\"WNetCloseEnum\", Ordinal=0x0, FunctionAddress=0x72392dd6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2646]},"name":"LdrGetProcedureAddress(ModuleName=\"mpr.dll\", ModuleHandle=0x72390000, FunctionName=\"WNetCancelConnection2W\", Ordinal=0x0, FunctionAddress=0x72398cd1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2647]},"name":"LdrLoadDll(Flags=0x0, FileName=\"advapi32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2648]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"OpenSCManagerW\", Ordinal=0x0, FunctionAddress=0x776ac9cc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2649]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"CreateServiceW\", Ordinal=0x0, FunctionAddress=0x776c70a4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2650]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"StartServiceW\", Ordinal=0x0, FunctionAddress=0x776a78dc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2651]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"DeleteService\", Ordinal=0x0, FunctionAddress=0x776c70d4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2652]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"CloseServiceHandle\", Ordinal=0x0, FunctionAddress=0x776b35cc) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2653]},"name":"LdrLoadDll(Flags=0x0, FileName=\"netapi32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2656]},"name":"LdrGetProcedureAddress(ModuleName=\"netapi32.dll\", ModuleHandle=0x75540000, FunctionName=\"NetApiBufferFree\", Ordinal=0x0, FunctionAddress=0x755313d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2657]},"name":"LdrGetProcedureAddress(ModuleName=\"netapi32.dll\", ModuleHandle=0x75540000, FunctionName=\"NetShareEnum\", Ordinal=0x0, FunctionAddress=0x754c3f33) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2658]},"name":"LdrGetProcedureAddress(ModuleName=\"netapi32.dll\", ModuleHandle=0x75540000, FunctionName=\"NetUserEnum\", Ordinal=0x0, FunctionAddress=0x723859cf) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2659]},"name":"LdrGetProcedureAddress(ModuleName=\"netapi32.dll\", ModuleHandle=0x75540000, FunctionName=\"NetGetDCName\", Ordinal=0x0, FunctionAddress=0x72355eb2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2660]},"name":"LdrGetProcedureAddress(ModuleName=\"netapi32.dll\", ModuleHandle=0x75540000, FunctionName=\"NetWkstaGetInfo\", Ordinal=0x0, FunctionAddress=0x75545570) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2663]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wkscli.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2664]},"name":"LdrGetProcedureAddress(ModuleName=\"WKSCLI.DLL\", ModuleHandle=0x754b0000, FunctionName=\"NetWkstaGetInfo\", Ordinal=0x0, FunctionAddress=0x754b2d9c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2665]},"name":"NtCreateFile(FileHandle=0x5c8, DesiredAccess=GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\PIPE\\wkssvc\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2666]},"name":"NtSetInformationFile(FileHandle=0x5c8, HandleName=\"\\Device\\NamedPipe\\wkssvc\", FileInformationClass=FilePipeInformation, FileInformation=\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2667]},"name":"NtSetInformationFile(FileHandle=0x5c8, HandleName=\"\\Device\\NamedPipe\\wkssvc\", FileInformationClass=FileIoStatusBlockRangeInformation, FileInformation=\"\\x02\\x00\\x00\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2668]},"name":"NtSetInformationFile(FileHandle=0x5c8, HandleName=\"\\Device\\NamedPipe\\wkssvc\", FileInformationClass=FileCompletionInformation, FileInformation=\"|\\x01\\x00\\x00\\xc0\\x92\\xa3\\x00\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2669]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"Software\\Policies\\Microsoft\\Windows NT\\Rpc\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Rpc\") -> 0x2"},{"address":{"type":"call","value":[1180,1852,1020,2672]},"name":"LdrLoadDll(Flags=0x0, FileName=\"cscapi.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2676]},"name":"LdrGetProcedureAddress(ModuleName=\"cscapi.dll\", ModuleHandle=0x72330000, FunctionName=\"CscNetApiGetInterface\", Ordinal=0x0, FunctionAddress=0x72331e45) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2687]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"system\\CurrentControlSet\", Handle=0x5f0, FullName=\"HKEY_LOCAL_MACHINE\\system\\CurrentControlSet\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2714]},"name":"LdrLoadDll(Flags=0x0, FileName=\"USER32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2715]},"name":"LdrGetProcedureAddress(ModuleName=\"USER32.dll\", ModuleHandle=0x77750000, FunctionName=\"LoadStringW\", Ordinal=0x0, FunctionAddress=0x77768eb9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2716]},"name":"NtCreateFile(FileHandle=0x5f0, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\SysWOW64\\en-US\\mpr.dll.mui\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_DELETE, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2718]},"name":"NtMapViewOfSection(SectionHandle=0x5f4, ProcessHandle=0xffffffff, BaseAddress=0x36a0000, SectionOffset=0x5b4ef40, ViewSize=0x1000, Win32Protect=PAGE_WRITECOPY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2720]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\drprov.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2732]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetCaps\", Ordinal=0x0, FunctionAddress=0x722f1568) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2733]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetUser\", Ordinal=0x0, FunctionAddress=0x72392a98) -> ENTRYPOINT_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,2734]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPAddConnection\", Ordinal=0x0, FunctionAddress=0x722f338f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2735]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPAddConnection3\", Ordinal=0x0, FunctionAddress=0x722f1d4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2736]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetReconnectFlags\", Ordinal=0x0, FunctionAddress=0x72392a60) -> ENTRYPOINT_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,2737]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPCancelConnection\", Ordinal=0x0, FunctionAddress=0x722f2d28) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2738]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetConnection\", Ordinal=0x0, FunctionAddress=0x722f2a53) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2739]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetConnection3\", Ordinal=0x0, FunctionAddress=0x72392a28) -> ENTRYPOINT_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,2740]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetUniversalName\", Ordinal=0x0, FunctionAddress=0x722f317f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2741]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPOpenEnum\", Ordinal=0x0, FunctionAddress=0x722f170e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2742]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPEnumResource\", Ordinal=0x0, FunctionAddress=0x722f2897) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2743]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPCloseEnum\", Ordinal=0x0, FunctionAddress=0x722f2916) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2744]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetResourceParent\", Ordinal=0x0, FunctionAddress=0x722f2ef3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2745]},"name":"LdrGetProcedureAddress(ModuleName=\"drprov.dll\", ModuleHandle=0x722f0000, FunctionName=\"NPGetResourceInformation\", Ordinal=0x0, FunctionAddress=0x722f1b21) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2746]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\ntlanman.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2903]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetCaps\", Ordinal=0x0, FunctionAddress=0x722a18b0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2904]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetUser\", Ordinal=0x0, FunctionAddress=0x722aa93c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2905]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPAddConnection\", Ordinal=0x0, FunctionAddress=0x722aa96a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2906]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPAddConnection3\", Ordinal=0x0, FunctionAddress=0x722a327b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2907]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetReconnectFlags\", Ordinal=0x0, FunctionAddress=0x722aa919) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2908]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPCancelConnection\", Ordinal=0x0, FunctionAddress=0x722aabd1) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2909]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetConnection\", Ordinal=0x0, FunctionAddress=0x722aa6e4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2910]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetConnection3\", Ordinal=0x0, FunctionAddress=0x722aa6f4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2911]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetUniversalName\", Ordinal=0x0, FunctionAddress=0x722aa76d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2912]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetConnectionPerformance\", Ordinal=0x0, FunctionAddress=0x722aa8eb) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2913]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPOpenEnum\", Ordinal=0x0, FunctionAddress=0x722a215b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2914]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPEnumResource\", Ordinal=0x0, FunctionAddress=0x722a1e75) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2915]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPCloseEnum\", Ordinal=0x0, FunctionAddress=0x722a1f38) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2916]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPFormatNetworkName\", Ordinal=0x0, FunctionAddress=0x722aa77d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2917]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetResourceParent\", Ordinal=0x0, FunctionAddress=0x722a303a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2918]},"name":"LdrGetProcedureAddress(ModuleName=\"ntlanman.dll\", ModuleHandle=0x722a0000, FunctionName=\"NPGetResourceInformation\", Ordinal=0x0, FunctionAddress=0x722a297f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2919]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\davclnt.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2957]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetCaps\", Ordinal=0x0, FunctionAddress=0x722819d0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2958]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetUser\", Ordinal=0x0, FunctionAddress=0x7228bef9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2959]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPAddConnection\", Ordinal=0x0, FunctionAddress=0x72290755) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2960]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPAddConnection3\", Ordinal=0x0, FunctionAddress=0x722843e8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2961]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetReconnectFlags\", Ordinal=0x0, FunctionAddress=0x72392a60) -> ENTRYPOINT_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,2962]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPCancelConnection\", Ordinal=0x0, FunctionAddress=0x7228c81f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2963]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetConnection\", Ordinal=0x0, FunctionAddress=0x7228c351) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2964]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetConnection3\", Ordinal=0x0, FunctionAddress=0x72392a28) -> ENTRYPOINT_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,2965]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetUniversalName\", Ordinal=0x0, FunctionAddress=0x7228d067) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2966]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPOpenEnum\", Ordinal=0x0, FunctionAddress=0x72282738) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2967]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPEnumResource\", Ordinal=0x0, FunctionAddress=0x72282b75) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2968]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPCloseEnum\", Ordinal=0x0, FunctionAddress=0x72282a19) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2969]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPFormatNetworkName\", Ordinal=0x0, FunctionAddress=0x7228d645) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2970]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetResourceParent\", Ordinal=0x0, FunctionAddress=0x7228cb49) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2971]},"name":"LdrGetProcedureAddress(ModuleName=\"davclnt.dll\", ModuleHandle=0x72280000, FunctionName=\"NPGetResourceInformation\", Ordinal=0x0, FunctionAddress=0x722907a4) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2972]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\drprov.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2973]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\ntlanman.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2974]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\davclnt.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2975]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5c00000, RegionSize=0x81000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2980]},"name":"LdrLoadDll(Flags=0x0, FileName=\"ADVAPI32.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2981]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"LookupAccountSidW\", Ordinal=0x0, FunctionAddress=0x776b47a8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,2982]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x776a0000, FunctionName=\"CreateWellKnownSid\", Ordinal=0x0, FunctionAddress=0x776b4752) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3006]},"name":"LdrLoadDll(Flags=0x0, FileName=\"RPCRT4.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3007]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcStringBindingComposeW\", Ordinal=0x0, FunctionAddress=0x771939f8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3008]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcBindingFromStringBindingW\", Ordinal=0x0, FunctionAddress=0x77193791) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3009]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcStringFreeW\", Ordinal=0x0, FunctionAddress=0x77193c0d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3010]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcBindingSetAuthInfoExW\", Ordinal=0x0, FunctionAddress=0x77193c75) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3014]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"NdrClientCall2\", Ordinal=0x0, FunctionAddress=0x77220005) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3037]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcBindingFree\", Ordinal=0x0, FunctionAddress=0x7718a9a8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3038]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\drprov.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3039]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5f30000, RegionSize=0x81000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3040]},"name":"NtOpenFile(FileHandle=0x0, DesiredAccess=SYNCHRONIZE, FileName=\"\\Device\\RdpDr\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,3043]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wkscli.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3044]},"name":"LdrGetProcedureAddress(ModuleName=\"WKSCLI.DLL\", ModuleHandle=0x754b0000, FunctionName=\"NetWkstaGetInfo\", Ordinal=0x0, FunctionAddress=0x754b2d9c) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3046]},"name":"LdrLoadDll(Flags=0x0, FileName=\"netutils.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3047]},"name":"LdrGetProcedureAddress(ModuleName=\"netutils.dll\", ModuleHandle=0x75530000, FunctionName=\"NetApiBufferFree\", Ordinal=0x0, FunctionAddress=0x755313d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3049]},"name":"LdrLoadDll(Flags=0x0, FileName=\"browcli.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3050]},"name":"LdrGetProcedureAddress(ModuleName=\"browcli.dll\", ModuleHandle=0x72260000, FunctionName=\"NetServerEnum\", Ordinal=0x0, FunctionAddress=0x72262f61) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3051]},"name":"LdrLoadDll(Flags=0x0, FileName=\"API-MS-WIN-Service-Management-L1-1-0.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3052]},"name":"LdrGetProcedureAddress(ModuleName=\"sechost.dll\", ModuleHandle=0x76d40000, FunctionName=\"OpenSCManagerW\", Ordinal=0x0, FunctionAddress=0x76d463ad) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3054]},"name":"LdrGetProcedureAddress(ModuleName=\"sechost.dll\", ModuleHandle=0x76d40000, FunctionName=\"OpenServiceW\", Ordinal=0x0, FunctionAddress=0x76d4714b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3056]},"name":"LdrLoadDll(Flags=0x0, FileName=\"API-MS-WIN-Service-winsvc-L1-1-0.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3057]},"name":"LdrGetProcedureAddress(ModuleName=\"sechost.dll\", ModuleHandle=0x76d40000, FunctionName=\"QueryServiceStatus\", Ordinal=0x0, FunctionAddress=0x76d44e4b) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3058]},"name":"LdrGetProcedureAddress(ModuleName=\"sechost.dll\", ModuleHandle=0x76d40000, FunctionName=\"CloseServiceHandle\", Ordinal=0x0, FunctionAddress=0x76d44dc3) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3059]},"name":"LdrLoadDll(Flags=0x0, FileName=\"cscapi.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3060]},"name":"LdrGetProcedureAddress(ModuleName=\"cscapi.dll\", ModuleHandle=0x72330000, FunctionName=\"CscNetApiGetInterface\", Ordinal=0x0, FunctionAddress=0x72331e45) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3061]},"name":"LdrLoadDll(Flags=0x0, FileName=\"netutils.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3062]},"name":"LdrGetProcedureAddress(ModuleName=\"netutils.dll\", ModuleHandle=0x75530000, FunctionName=\"NetApiBufferAllocate\", Ordinal=0x0, FunctionAddress=0x75531415) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3063]},"name":"NtOpenFile(FileHandle=0x628, DesiredAccess=GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE, FileName=\"\\Device\\LanmanDatagramReceiver\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3067]},"name":"LdrGetProcedureAddress(ModuleName=\"netutils.dll\", ModuleHandle=0x75530000, FunctionName=\"NetApiBufferFree\", Ordinal=0x0, FunctionAddress=0x755313d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3068]},"name":"LdrGetProcedureAddress(ModuleName=\"WKSCLI.DLL\", ModuleHandle=0x754b0000, FunctionName=\"NetWkstaUserGetInfo\", Ordinal=0x0, FunctionAddress=0x754b372f) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3070]},"name":"LdrGetProcedureAddress(ModuleName=\"netutils.dll\", ModuleHandle=0x75530000, FunctionName=\"NetpwNameCompare\", Ordinal=0x0, FunctionAddress=0x75531f31) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3071]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\ntlanman.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3072]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5f30000, RegionSize=0x81000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3073]},"name":"RegOpenKeyEx(Registry=HKEY_LOCAL_MACHINE, SubKey=\"System\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider\", Handle=0x628, FullName=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3081]},"name":"LdrGetProcedureAddress(ModuleName=\"netutils.dll\", ModuleHandle=0x75530000, FunctionName=\"NetpwNameCanonicalize\", Ordinal=0x0, FunctionAddress=0x75531c30) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3082]},"name":"NtOpenFile(FileHandle=0x628, DesiredAccess=GENERIC_READ|GENERIC_WRITE|SYNCHRONIZE, FileName=\"\\Device\\LanmanDatagramReceiver\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3086]},"name":"LdrLoadDll(Flags=0x0, FileName=\"C:\\Windows\\System32\\ntlanman.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3087]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5fc0000, RegionSize=0x81000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3091]},"name":"LdrLoadDll(Flags=0x0, FileName=\"RPCRT4.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3092]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcStringBindingComposeW\", Ordinal=0x0, FunctionAddress=0x771939f8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3093]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcBindingFromStringBindingW\", Ordinal=0x0, FunctionAddress=0x77193791) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3094]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcStringFreeW\", Ordinal=0x0, FunctionAddress=0x77193c0d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3095]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"NdrClientCall2\", Ordinal=0x0, FunctionAddress=0x77220005) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3096]},"name":"NtCreateFile(FileHandle=0x0, DesiredAccess=GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"\\??\\PIPE\\DAV RPC SERVICE\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1180,1852,1020,3099]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"I_RpcExceptionFilter\", Ordinal=0x0, FunctionAddress=0x77197e79) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3100]},"name":"LdrGetProcedureAddress(ModuleName=\"RPCRT4.dll\", ModuleHandle=0x77170000, FunctionName=\"RpcBindingFree\", Ordinal=0x0, FunctionAddress=0x7718a9a8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1020,3113]},"name":"NtTerminateThread(ThreadHandle=0x0, ExitStatus=0x0, ThreadId=0x0, ProcessId=0x0) -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,968]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,968,3004]},"name":"LdrLoadDll(Flags=0x0, FileName=\"msvcrt.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,968,3005]},"name":"LdrGetProcedureAddress(ModuleName=\"msvcrt.dll\", ModuleHandle=0x75cc0000, FunctionName=\"qsort\", Ordinal=0x0, FunctionAddress=0x75ccd3e6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,968,3029]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0040"},{"address":{"type":"call","value":[1180,1852,968,3031]},"name":"InternetSetOption(InternetHandle=0xcc0040, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,968,3034]},"name":"InternetConnect(InternetHandle=0xcc0040, ServerName=\"www.ip-adress.com\", ServerPort=0x80, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0044"}]},{"address":{"type":"thread","value":[1180,1852,1876]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1876,3155]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3156]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3157]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3158]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3159]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3160]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3161]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3162]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3163]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3164]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3165]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3166]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3167]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3168]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3169]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3170]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3171]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3172]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3173]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3174]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,3179]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc004c"},{"address":{"type":"call","value":[1180,1852,1876,3181]},"name":"InternetSetOption(InternetHandle=0xcc004c, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,1876,3184]},"name":"InternetConnect(InternetHandle=0xcc004c, ServerName=\"216.109.9.227\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0050"},{"address":{"type":"call","value":[1180,1852,1876,5139]},"name":"NtCreateSection(SectionHandle=0x5c0, DesiredAccess=STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE, ObjectAttributes=\"\", FileHandle=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1876,5140]},"name":"NtMapViewOfSection(SectionHandle=0x5c0, ProcessHandle=0xffffffff, BaseAddress=0x47b0000, SectionOffset=0x5f6e438, ViewSize=0x1000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[1180,1852,676]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,676,3326]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3327]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3328]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3329]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3330]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3331]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3332]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3333]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3334]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3335]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3336]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3337]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3338]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3339]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3340]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3341]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3342]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3343]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3344]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3345]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,676,3348]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0058"},{"address":{"type":"call","value":[1180,1852,676,3350]},"name":"InternetSetOption(InternetHandle=0xcc0058, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,676,3353]},"name":"InternetConnect(InternetHandle=0xcc0058, ServerName=\"47.40.29.239\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc005c"}]},{"address":{"type":"thread","value":[1180,1852,1200]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1200,3769]},"name":"LdrLoadDll(Flags=0x0, FileName=\"msvcrt.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1200,3770]},"name":"LdrGetProcedureAddress(ModuleName=\"msvcrt.dll\", ModuleHandle=0x75cc0000, FunctionName=\"qsort\", Ordinal=0x0, FunctionAddress=0x75ccd3e6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1200,3783]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5cd2000, RegionSize=0x41000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,1200,3788]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0064"},{"address":{"type":"call","value":[1180,1852,1200,3790]},"name":"InternetSetOption(InternetHandle=0xcc0064, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,1200,3793]},"name":"InternetConnect(InternetHandle=0xcc0064, ServerName=\"www.ip-adress.com\", ServerPort=0x80, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0068"}]},{"address":{"type":"thread","value":[1180,1852,2700]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2700,3826]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3827]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3828]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3829]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3830]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3831]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3832]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3833]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3834]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3835]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3836]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3837]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3838]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3839]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3840]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3841]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3842]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3843]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3844]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3845]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2700,3848]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0070"},{"address":{"type":"call","value":[1180,1852,2700,3850]},"name":"InternetSetOption(InternetHandle=0xcc0070, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2700,3853]},"name":"InternetConnect(InternetHandle=0xcc0070, ServerName=\"185.219.83.73\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0074"}]},{"address":{"type":"thread","value":[1180,1852,1808]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,1808,4030]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x75af1222) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4031]},"name":"LdrLoadDll(Flags=0x0, FileName=\"wininet.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4032]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenA\", Ordinal=0x0, FunctionAddress=0x76d9f18e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4033]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetOpenUrlA\", Ordinal=0x0, FunctionAddress=0x76db30e9) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4034]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCloseHandle\", Ordinal=0x0, FunctionAddress=0x76d8ab41) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4035]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpQueryInfoA\", Ordinal=0x0, FunctionAddress=0x76d8a336) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4036]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetReadFile\", Ordinal=0x0, FunctionAddress=0x76d8b3fe) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4037]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetSetOptionA\", Ordinal=0x0, FunctionAddress=0x76d875e0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4038]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetQueryOptionA\", Ordinal=0x0, FunctionAddress=0x76d81b4e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4039]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetConnectA\", Ordinal=0x0, FunctionAddress=0x76d949ea) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4040]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpOpenRequestA\", Ordinal=0x0, FunctionAddress=0x76d94c7e) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4041]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"HttpSendRequestA\", Ordinal=0x0, FunctionAddress=0x76e01ab8) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4042]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetCrackUrlA\", Ordinal=0x0, FunctionAddress=0x76d7d07d) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4043]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpDeleteFileA\", Ordinal=0x0, FunctionAddress=0x76df80f5) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4044]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetWriteFile\", Ordinal=0x0, FunctionAddress=0x76da46d2) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4045]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpOpenFileA\", Ordinal=0x0, FunctionAddress=0x76df92ce) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4046]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"FtpGetFileA\", Ordinal=0x0, FunctionAddress=0x76df6835) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4047]},"name":"LdrGetProcedureAddress(ModuleName=\"wininet.dll\", ModuleHandle=0x76d70000, FunctionName=\"InternetGetLastResponseInfoA\", Ordinal=0x0, FunctionAddress=0x76deaaae) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4048]},"name":"LdrLoadDll(Flags=0x0, FileName=\"urlmon.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4049]},"name":"LdrGetProcedureAddress(ModuleName=\"urlmon.dll\", ModuleHandle=0x76c00000, FunctionName=\"ObtainUserAgentString\", Ordinal=0x0, FunctionAddress=0x76c2d01a) -> 0x0"},{"address":{"type":"call","value":[1180,1852,1808,4052]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc007c"},{"address":{"type":"call","value":[1180,1852,1808,4054]},"name":"InternetSetOption(InternetHandle=0xcc007c, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,1808,4057]},"name":"InternetConnect(InternetHandle=0xcc007c, ServerName=\"63.140.135.35\", ServerPort=0x443, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0080"}]},{"address":{"type":"thread","value":[1180,1852,2444]},"matched_calls":[{"address":{"type":"call","value":[1180,1852,2444,5051]},"name":"LdrLoadDll(Flags=0x0, FileName=\"msvcrt.dll\", BaseAddress=0x0) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2444,5052]},"name":"LdrGetProcedureAddress(ModuleName=\"msvcrt.dll\", ModuleHandle=0x75cc0000, FunctionName=\"qsort\", Ordinal=0x0, FunctionAddress=0x75ccd3e6) -> 0x0"},{"address":{"type":"call","value":[1180,1852,2444,5065]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5d34000, RegionSize=0x41000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1180,1852,2444,5070]},"name":"InternetOpen(Agent=\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\", AccessType=0x0, ProxyName=\"\", ProxyBypass=\"\", Flags=0x0) -> 0xcc0034"},{"address":{"type":"call","value":[1180,1852,2444,5072]},"name":"InternetSetOption(InternetHandle=0xcc0034, Option=INTERNET_OPTION_CONNECT_TIMEOUT, Buffer=0x3a98) -> 0x1"},{"address":{"type":"call","value":[1180,1852,2444,5075]},"name":"InternetConnect(InternetHandle=0xcc0034, ServerName=\"www.ip-adress.com\", ServerPort=0x80, Username=\"\", Password=\"\", Service=0x3, Flags=0x0) -> 0xcc0038"}]}]},{"address":{"type":"process","value":[792,1224]},"name":"dwm.exe","matched_threads":[{"address":{"type":"thread","value":[792,1224,1660]},"matched_calls":[{"address":{"type":"call","value":[792,1224,1660,8]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x1b9b000, RegionSize=0x5000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[792,1224,2540]},"matched_calls":[{"address":{"type":"call","value":[792,1224,2540,38]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x77a35980) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,130]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x77a6bf30) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,183]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0x174, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,213]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x77910000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,726]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x7feff390000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,748]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,751]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,753]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,755]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,757]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,759]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,761]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,763]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,765]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,767]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,769]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,771]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,773]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,775]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,777]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,779]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,781]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,783]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,785]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,787]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,789]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,791]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,793]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,795]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,797]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,799]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,801]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,803]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,805]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,807]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,809]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,811]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,813]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,815]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,817]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,819]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,821]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,823]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,825]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,827]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,829]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,831]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,833]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,835]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,837]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,839]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,841]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,843]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,845]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,847]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,849]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,851]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,853]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,855]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,857]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,859]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,861]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,863]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,865]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,867]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,869]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,871]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,873]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,875]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,877]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,879]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,881]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,883]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,885]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,887]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,889]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,891]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,893]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,895]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,897]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,899]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,901]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,903]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,905]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,907]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,909]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,911]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,913]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,915]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,917]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,919]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,921]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,923]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,925]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,927]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,929]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,931]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,933]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,935]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,937]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,939]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,941]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,943]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,945]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,947]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,949]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,951]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,953]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,955]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,957]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,959]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,961]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,963]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,965]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,967]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,969]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,971]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,973]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,975]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,977]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,979]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,981]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,983]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,985]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,987]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,989]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,991]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,993]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,995]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,997]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,999]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1001]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1003]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1005]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1007]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1009]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1011]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1013]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1015]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1017]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1019]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1021]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1023]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1025]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1027]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1029]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1031]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1033]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1035]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1037]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1039]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1041]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1043]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1045]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1047]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1049]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1051]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1053]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1055]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1057]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1059]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1061]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1063]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1065]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1067]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1069]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1071]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1073]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1075]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1077]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1079]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1081]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1083]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1085]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1087]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1089]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1091]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1093]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1095]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1097]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1099]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1101]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1103]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1105]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1107]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1109]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1111]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1113]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1115]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1117]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1119]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1121]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1123]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1125]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1127]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1129]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1131]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1133]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1135]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1137]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1139]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1141]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1143]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1145]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1147]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1149]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1151]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1153]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1155]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1157]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1159]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1161]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1163]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1165]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1167]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1169]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1171]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1173]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1175]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1177]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1179]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1181]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1183]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1185]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1187]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1189]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1191]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1193]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1195]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1197]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1199]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1201]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1203]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1205]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1207]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1209]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1211]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1213]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1215]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1217]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1219]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1221]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1223]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1225]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1227]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1229]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1231]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1233]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1235]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1237]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1239]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1241]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1243]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1245]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1247]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1249]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1251]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1253]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1255]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1257]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1259]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1261]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1263]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1265]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1267]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1269]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1271]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1273]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1275]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1277]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1279]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1281]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1283]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1285]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1287]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1289]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1291]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1293]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1295]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1297]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1299]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1301]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1303]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1305]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1307]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1309]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1311]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1313]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1315]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1317]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1319]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1321]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1323]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1325]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1327]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1329]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1331]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1333]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1335]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1337]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1339]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1341]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1343]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1345]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1347]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1349]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1351]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1353]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1355]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1357]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1359]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1361]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1363]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1365]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1367]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1369]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1371]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1373]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1375]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1377]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1379]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1381]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1383]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1385]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1387]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1389]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1391]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1393]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1395]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1397]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1399]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1401]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1403]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1405]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1407]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1409]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1411]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1413]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1415]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1417]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1419]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1421]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1423]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1425]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1427]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1429]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1431]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1433]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1435]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1437]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1439]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1441]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1443]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1445]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1447]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1449]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1451]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1453]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1455]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1457]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1459]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1461]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1463]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1465]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1467]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1469]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1471]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1473]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1475]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1477]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1479]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1481]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1483]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1485]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1487]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1489]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1491]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1493]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1495]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1497]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1499]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1501]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1503]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1505]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1507]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1509]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1511]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1513]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1515]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1517]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1519]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1521]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1523]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1525]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1527]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1529]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1531]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1533]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1535]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1537]},"name":"NtMapViewOfSection(SectionHandle=0x1d0, ProcessHandle=0xffffffffffffffff, BaseAddress=0x1eb0000, SectionOffset=0x4a1fc00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1540]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1228) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1544]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1240) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1548]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1244) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1552]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1528) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1556]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1108) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1559]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1660) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1562]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1328) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1565]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x2772) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1585]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1228) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1589]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1240) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1593]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1244) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1597]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1528) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1601]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1108) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1605]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1660) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1609]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x1328) -> 0x0"},{"address":{"type":"call","value":[792,1224,2540,1613]},"name":"NtOpenThread(ThreadHandle=0x1d0, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1224, ThreadId=0x2772) -> 0x0"}]},{"address":{"type":"thread","value":[792,1224,1504]},"matched_calls":[{"address":{"type":"call","value":[792,1224,1504,1634]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0x1e8, Options=0x2) -> 0x0"}]}]},{"address":{"type":"process","value":[1200,1248]},"name":"explorer.exe","matched_threads":[{"address":{"type":"thread","value":[1200,1248,1460]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,1460,28]},"name":"NtMapViewOfSection(SectionHandle=0x63c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x2720000, SectionOffset=0x2aff460, ViewSize=0x1000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,31]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"WerRegisterMemoryBlock\", Ordinal=0x0, FunctionAddress=0x77aae4c0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5894]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5910]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5916]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5922]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5926]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5939]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5943]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5947]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5951]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5955]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5959]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5963]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5967]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5971]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5977]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5981]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5986]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5990]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,5996]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,6065]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"SOFTWARE\\Microsoft\\CTF\\KnownClasses\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1460,6147]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,6155]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,6161]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1460,6167]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"}]},{"address":{"type":"thread","value":[1200,1248,2544]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,2544,53]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x77a41de0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,67]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x77a35980) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,147]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"GetProcAddress\", Ordinal=0x0, FunctionAddress=0x77a41de0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,157]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x77a6bf30) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,191]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegOpenKeyExA\", Ordinal=0x0, FunctionAddress=0x7feff3bd6b0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,192]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegCreateKeyExA\", Ordinal=0x0, FunctionAddress=0x7feff3b4390) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,193]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegQueryInfoKeyA\", Ordinal=0x0, FunctionAddress=0x7feff3c5cb0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,194]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegEnumValueA\", Ordinal=0x0, FunctionAddress=0x7feff3affa0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,195]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegEnumKeyExA\", Ordinal=0x0, FunctionAddress=0x7feff3b43f0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,196]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegSetValueExA\", Ordinal=0x0, FunctionAddress=0x7feff3b4440) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,197]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegQueryValueExA\", Ordinal=0x0, FunctionAddress=0x7feff3c4060) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,198]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegCloseKey\", Ordinal=0x0, FunctionAddress=0x7feff3c4240) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,199]},"name":"LdrGetProcedureAddress(ModuleName=\"ADVAPI32.dll\", ModuleHandle=0x7feff3a0000, FunctionName=\"RegDeleteValueA\", Ordinal=0x0, FunctionAddress=0x7feff3b0590) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,209]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0x228, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,254]},"name":"LdrGetProcedureAddress(ModuleName=\"WININET.dll\", ModuleHandle=0x7feffac0000, FunctionName=\"HttpAddRequestHeadersA\", Ordinal=0x0, FunctionAddress=0x7feffaedec0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,282]},"name":"LdrGetProcedureAddress(ModuleName=\"WININET.dll\", ModuleHandle=0x7feffac0000, FunctionName=\"HttpAddRequestHeadersA\", Ordinal=0x0, FunctionAddress=0x7feffaedec0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,292]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x77910000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,294]},"name":"LdrGetProcedureAddress(ModuleName=\"ntdll.dll\", ModuleHandle=0x77b40000, FunctionName=\"LdrLoadDll\", Ordinal=0x0, FunctionAddress=0x77c2ada0) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,312]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x7fefe0b0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,442]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1010]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1012]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1014]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1016]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1018]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1020]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1022]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1024]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1026]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1028]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1030]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1032]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1034]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1036]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1038]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1040]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1042]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1044]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1046]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1048]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1050]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1052]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1054]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1056]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1058]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1060]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1062]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1064]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1066]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1068]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1070]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1072]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1074]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1076]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1078]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1080]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1082]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1084]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1086]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1088]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1090]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1092]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1094]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1096]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1098]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1100]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1102]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1104]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1106]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1108]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1110]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1112]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1114]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1116]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1118]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1120]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1122]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1124]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1126]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1128]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1130]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1132]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1134]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1136]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1138]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1140]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1142]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1144]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1146]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1148]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1150]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1152]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1154]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1156]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1158]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1160]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1162]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1164]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1166]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1168]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1170]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1172]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1174]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1176]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1178]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1180]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1182]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1184]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1186]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1188]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1190]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1192]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1194]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1196]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1198]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1200]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1202]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1204]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1206]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1208]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1210]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1212]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1214]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1216]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1218]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1220]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1222]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1224]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1226]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1228]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1230]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1232]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1234]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1236]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1238]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1240]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1242]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1244]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1246]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1248]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1250]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1252]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1254]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1256]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1258]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1260]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1262]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1264]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1266]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1268]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1270]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1272]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1274]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1276]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1278]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1280]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1282]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1284]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1286]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1288]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1290]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1292]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1294]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1296]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1298]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1300]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1302]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1304]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1306]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1308]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1310]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1312]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1314]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1316]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1318]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1320]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1322]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1324]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1326]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1328]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1330]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1332]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1334]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1336]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1338]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1340]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1342]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1344]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1346]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1348]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1350]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1352]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1354]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1356]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1358]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1360]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1362]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1364]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1366]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1368]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1370]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1372]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1374]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1376]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1378]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1380]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1382]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1384]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1386]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1388]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1390]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1392]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1394]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1396]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1398]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1400]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1402]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1404]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1406]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1408]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1410]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1412]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1414]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1416]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1418]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1420]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1422]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1424]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1426]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1428]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1430]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1432]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1434]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1436]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1438]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1440]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1442]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1444]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1446]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1448]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1450]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1452]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1454]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1456]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1458]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1460]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1462]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1464]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1466]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1468]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1470]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1472]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1474]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1476]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1478]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1480]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1482]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1484]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1486]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1488]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1490]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1492]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1494]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1496]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1498]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1500]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1502]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1504]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1506]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1508]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1510]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1512]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1514]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1516]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1518]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1520]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1522]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1524]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1526]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1528]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1530]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1532]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1534]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1536]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1538]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1541]},"name":"NtMapViewOfSection(SectionHandle=0x40c, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x731fb00, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1543]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1252) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1547]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1276) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1551]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1432) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1555]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1460) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1559]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1468) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1563]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1560) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1567]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1656) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1571]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1720) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1575]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1724) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1579]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1860) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1583]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1700) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1587]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x844) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1591]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2304) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1595]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2324) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1599]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2328) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1603]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2352) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1607]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2416) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1611]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2508) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1615]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2516) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1619]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2572) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1623]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x424) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1627]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x3036) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1630]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2012) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1633]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2716) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1636]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2196) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1676]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1252) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1680]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1276) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1684]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1432) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1688]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1460) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1692]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1468) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1696]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1560) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1700]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1656) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1704]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1720) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1708]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1724) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1712]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1860) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1716]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x1700) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1720]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x844) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1724]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2304) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1728]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2324) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1732]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2328) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1736]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2352) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1740]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2416) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1744]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2508) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1748]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2516) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1752]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2572) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1756]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x424) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1760]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x3036) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1764]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2012) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1768]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2716) -> 0x0"},{"address":{"type":"call","value":[1200,1248,2544,1772]},"name":"NtOpenThread(ThreadHandle=0x40c, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1248, ThreadId=0x2196) -> 0x0"}]},{"address":{"type":"thread","value":[1200,1248,1860]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,1860,1812]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.001\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1815]},"name":"RegEnumKey(Handle=0xffffffff80000000, Index=0x2, Name=\".386\", FullName=\"HKEY_CLASSES_ROOT\\.386\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1818]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"system\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.386\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1824]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.3g2\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3g2\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1826]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".3g2\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3g2\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1827]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.3g2\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3g2\\OpenWithProgids\\VLC.3g2\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1832]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3ga\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1839]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.3gp\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gp\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1841]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".3gp\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1842]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.3gp\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp\\OpenWithProgids\\VLC.3gp\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1848]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.3gp2\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gp2\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1850]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".3gp2\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp2\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1851]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.3gp2\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp2\\OpenWithProgids\\VLC.3gp2\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1857]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.3gpp\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gpp\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1859]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".3gpp\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gpp\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1860]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.3gpp\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gpp\\OpenWithProgids\\VLC.3gpp\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1865]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.669\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1871]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.7z\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1877]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.a\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1883]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.a52\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1889]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"audio\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.AAC\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1894]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.aac\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.AAC\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1896]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".AAC\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.AAC\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1897]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.aac\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.AAC\\OpenWithProgids\\VLC.aac\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1902]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ac3\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1908]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"audio\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADT\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1913]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.adt\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADT\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1915]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ADT\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADT\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1916]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.adt\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADT\\OpenWithProgids\\VLC.adt\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1921]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"audio\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADTS\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1926]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.adts\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADTS\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1928]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ADTS\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADTS\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1929]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.adts\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADTS\\OpenWithProgids\\VLC.adts\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1934]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ai\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1942]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.aif\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aif\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1944]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".aif\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aif\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1945]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.aif\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aif\\OpenWithProgids\\VLC.aif\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1952]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.aifc\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aifc\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1954]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".aifc\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aifc\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1955]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.aifc\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aifc\\OpenWithProgids\\VLC.aifc\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1962]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.aiff\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aiff\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1964]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".aiff\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aiff\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1965]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.aiff\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aiff\\OpenWithProgids\\VLC.aiff\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,1970]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.amr\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1976]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.amv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1982]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ani\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1988]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ans\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,1994]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aob\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2000]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ape\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2006]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.application\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2012]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.appref-ms\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2018]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aps\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2024]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.arj\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2030]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.art\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2036]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asa\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2042]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2048]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ascx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2055]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.asf\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2057]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".asf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2058]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.asf\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asf\\OpenWithProgids\\VLC.asf\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2063]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asm\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2068]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asm\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2073]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asmx\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2078]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asmx\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2083]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2089]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aspx\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2094]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aspx\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2101]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.asx\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2103]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".asx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2104]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.asx\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asx\\OpenWithProgids\\VLC.asx\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2111]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.au\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.au\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2113]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".au\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.au\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2114]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.au\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.au\\OpenWithProgids\\VLC.au\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2120]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.avi\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.avi\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2122]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".avi\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.avi\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2123]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.avi\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.avi\\OpenWithProgids\\VLC.avi\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2128]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.b4s\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2140]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bcp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2146]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bik\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2152]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bin\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2158]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bkf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2164]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.blg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2171]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Paint.Picture\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bmp\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2173]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".bmp\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2174]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Paint.Picture\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids\\Paint.Picture\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2179]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bsc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2185]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2191]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bz2\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2197]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.c\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2202]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.c\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2207]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.c2r\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2214]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"WinRAR\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cab\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2216]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".cab\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2217]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"WinRAR\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids\\WinRAR\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2222]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.caf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2228]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.camp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2234]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cat\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2240]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2246]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cda\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2252]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cdmp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2258]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cdx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2264]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cer\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2270]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cgm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2276]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"system\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.chk\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2281]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.chm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2287]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cls\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2296]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cod\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2305]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.compositefont\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2312]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"contact_wab_auto_file\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.contact\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2314]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".contact\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2315]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"contact_wab_auto_file\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids\\contact_wab_auto_file\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2322]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cpp\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2327]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cpp\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2332]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2338]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crds\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2344]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2350]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2356]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cs\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2362]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csa\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2368]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csproj\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2374]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.css\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2379]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"CSSfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.css\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2381]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".css\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2382]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"CSSfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids\\CSSfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2387]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csv\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2392]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csv\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2397]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cue\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2403]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cur\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2409]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cxx\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2414]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cxx\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2419]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dat\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2425]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.db\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2431]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dbg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2437]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dbs\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2443]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dct\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2449]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.def\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2454]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.def\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2459]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.der\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2465]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.desklink\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2471]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diagcab\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2477]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diagcfg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2483]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diagpkg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2490]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Paint.Picture\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dib\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2492]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".dib\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2493]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Paint.Picture\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids\\Paint.Picture\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2498]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dic\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2504]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.divx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2510]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diz\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2515]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diz\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2521]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"dllfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2523]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".dll\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2524]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"dllfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids\\dllfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2529]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dl_\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2536]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.doc\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2542]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"docxfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.docx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2544]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".docx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2545]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"docxfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids\\docxfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2550]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dos\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2557]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dot\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2562]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.drc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2568]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"system\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.drv\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2573]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dsn\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2579]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dsp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2585]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dsw\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2591]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dts\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2597]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2603]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"video\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.DVR\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2608]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"MediaCenter.DVR\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.DVR\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2610]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".DVR\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2611]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"MediaCenter.DVR\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR\\OpenWithProgids\\MediaCenter.DVR\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2617]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.dvr-ms\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.DVR-MS\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2619]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".DVR-MS\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR-MS\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2620]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.dvr-ms\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR-MS\\OpenWithProgids\\VLC.dvr-ms\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2626]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Windows.XPSReachViewer\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dwfx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2628]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".dwfx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2629]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Windows.XPSReachViewer\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids\\Windows.XPSReachViewer\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2635]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Windows.XPSReachViewer\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.easmx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2637]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".easmx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2638]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Windows.XPSReachViewer\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids\\Windows.XPSReachViewer\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2644]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Windows.XPSReachViewer\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.edrwx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2646]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".edrwx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2647]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Windows.XPSReachViewer\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids\\Windows.XPSReachViewer\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2654]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"emffile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.emf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2656]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".emf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2657]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"emffile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids\\emffile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2663]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Windows.XPSReachViewer\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.eprtx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2665]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".eprtx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2666]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Windows.XPSReachViewer\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids\\Windows.XPSReachViewer\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2671]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.eps\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2677]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.etp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2683]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.evo\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2689]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.evt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2695]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.evtx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2702]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"exefile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2704]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".exe\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2705]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"exefile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids\\exefile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2710]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2716]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ext\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2722]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ex_\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2728]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.eyb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2734]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.f4v\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2740]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.faq\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2746]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fif\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2752]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fky\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2758]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.flac\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2764]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.flv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2770]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fnd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2776]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fnt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2783]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"fonfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fon\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2785]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".fon\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2786]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"fonfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids\\fonfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2791]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gadget\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2797]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ghi\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2804]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"giffile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gif\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2806]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".gif\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2807]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"giffile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids\\giffile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2812]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gmmp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2818]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.group\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2824]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.grp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2830]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gvi\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2836]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gxf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2842]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"compressed\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gz\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2848]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.h\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2853]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.h\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2858]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1C\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2864]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1D\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2870]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1F\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2876]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1H\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2882]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1K\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2888]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1Q\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2894]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1S\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2900]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1T\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2906]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1V\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2912]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1W\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2918]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hdp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2924]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hhc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2930]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hlp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2936]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hpp\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2941]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hpp\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2946]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hqx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2955]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2962]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"ChromeHTML\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\.htm\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2964]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".htm\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2965]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"ChromeHTML\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids\\ChromeHTML\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2971]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"ChromeHTML\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\.html\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2973]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".html\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2974]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"ChromeHTML\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids\\ChromeHTML\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,2979]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2985]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htw\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2991]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,2997]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hxx\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3002]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hxx\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3007]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.i\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3013]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ibq\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3019]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.icc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3025]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.icl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3031]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.icm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3038]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"icofile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ico\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3040]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ico\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3041]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"icofile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids\\icofile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3046]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ics\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3052]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.idl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3058]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.idq\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3064]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ifo\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3070]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ilk\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3076]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.imc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3082]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.img\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3088]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inc\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3093]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inc\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3098]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3104]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3109]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"inifile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3111]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ini\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3112]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"inifile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids\\inifile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3117]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3123]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3129]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3135]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.in_\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3141]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.iso\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3147]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.it\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3155]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.IVF\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3160]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jav\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3166]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.java\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3171]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.java\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3176]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jbf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3183]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"pjpegfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jfif\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3185]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".jfif\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3186]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"pjpegfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids\\pjpegfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3191]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.Job\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3197]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jod\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3204]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"jpegfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpe\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3206]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".jpe\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3207]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"jpegfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids\\jpegfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3213]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"jpegfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpeg\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3215]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".jpeg\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3216]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"jpegfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids\\jpegfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3222]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"jpegfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpg\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3224]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".jpg\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3225]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"jpegfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids\\jpegfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3230]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.js\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3236]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.JSE\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3243]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Windows.XPSReachViewer\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jtx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3245]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".jtx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3246]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Windows.XPSReachViewer\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids\\Windows.XPSReachViewer\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3251]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.kci\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3257]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.label\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3263]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.latex\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3269]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lgn\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3275]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lha\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3281]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lib\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3287]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.library-ms\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3294]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"lnkfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3296]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".lnk\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3297]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"lnkfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids\\lnkfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3302]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"system\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.local\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3307]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.log\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3313]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lst\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3319]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3325]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lzh\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3331]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m14\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3338]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m1v\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m1v\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3340]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".m1v\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m1v\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3341]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m1v\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m1v\\OpenWithProgids\\VLC.m1v\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3347]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m2t\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2T\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3349]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".M2T\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2T\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3350]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m2t\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2T\\OpenWithProgids\\VLC.m2t\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3356]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m2ts\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2TS\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3358]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".M2TS\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2TS\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3359]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m2ts\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2TS\\OpenWithProgids\\VLC.m2ts\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3365]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m2v\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2V\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3367]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".M2V\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2V\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3368]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m2v\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2V\\OpenWithProgids\\VLC.m2v\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3375]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m3u\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m3u\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3377]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".m3u\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m3u\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3378]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m3u\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m3u\\OpenWithProgids\\VLC.m3u\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3383]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m3u8\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3390]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m4a\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4a\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3392]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".m4a\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4a\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3393]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m4a\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4a\\OpenWithProgids\\VLC.m4a\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3399]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4b\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3405]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m4p\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4p\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3407]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".m4p\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4p\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3408]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m4p\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4p\\OpenWithProgids\\VLC.m4p\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3414]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.m4v\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4v\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3416]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".m4v\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4v\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3417]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.m4v\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4v\\OpenWithProgids\\VLC.m4v\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3422]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mak\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3428]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.man\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3434]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"system\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.manifest\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3439]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mapimail\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3445]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mcl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3452]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"mhtmlfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mht\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3454]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mht\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3455]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"mhtmlfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids\\mhtmlfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3461]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"mhtmlfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mhtml\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3463]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mhtml\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3464]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"mhtmlfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids\\mhtmlfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3471]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mid\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mid\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3473]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mid\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mid\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3474]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mid\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mid\\OpenWithProgids\\VLC.mid\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3481]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"WMP11.AssocFile.MIDI\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.midi\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3483]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".midi\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.midi\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3484]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"WMP11.AssocFile.MIDI\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.midi\\OpenWithProgids\\WMP11.AssocFile.MIDI\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3489]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mig\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3495]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mk\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3501]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mka\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3507]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mkv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3513]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mlc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3519]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mlp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3525]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mmf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3532]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mod\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.MOD\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3534]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".MOD\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MOD\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3535]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mod\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MOD\\OpenWithProgids\\VLC.mod\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3541]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mov\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mov\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3543]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mov\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mov\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3544]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mov\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mov\\OpenWithProgids\\VLC.mov\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3549]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.movie\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3555]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp1\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3562]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mp2\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp2\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3564]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mp2\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3565]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mp2\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2\\OpenWithProgids\\VLC.mp2\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3571]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mp2v\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp2v\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3573]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mp2v\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2v\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3574]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mp2v\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2v\\OpenWithProgids\\VLC.mp2v\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3580]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mp3\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp3\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3582]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mp3\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp3\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3583]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mp3\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp3\\OpenWithProgids\\VLC.mp3\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3589]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mp4\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp4\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3591]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mp4\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3592]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mp4\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4\\OpenWithProgids\\VLC.mp4\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3598]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mp4v\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp4v\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3600]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mp4v\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4v\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3601]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mp4v\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4v\\OpenWithProgids\\VLC.mp4v\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3608]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mpa\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpa\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3610]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mpa\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpa\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3611]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mpa\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpa\\OpenWithProgids\\VLC.mpa\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3616]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3623]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mpe\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpe\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3625]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mpe\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpe\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3626]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mpe\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpe\\OpenWithProgids\\VLC.mpe\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3632]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mpeg\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3634]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mpeg\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpeg\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3635]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mpeg\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpeg\\OpenWithProgids\\VLC.mpeg\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3640]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg1\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3646]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg2\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3652]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg4\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3659]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mpg\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpg\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3661]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mpg\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpg\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3662]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mpg\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpg\\OpenWithProgids\\VLC.mpg\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3667]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpga\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3674]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mpv2\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpv2\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3676]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".mpv2\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpv2\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3677]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mpv2\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpv2\\OpenWithProgids\\VLC.mpv2\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3682]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3688]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msdvd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3695]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msg\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3703]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3709]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msrcincident\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3715]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msstyles\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3721]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msu\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3728]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.mts\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.MTS\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3730]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".MTS\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MTS\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3731]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.mts\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MTS\\OpenWithProgids\\VLC.mts\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3736]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mtv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3742]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3748]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mxf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3754]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mydocs\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3760]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ncb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3766]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nfo\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3772]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nls\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3778]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nsv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3784]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nuv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3790]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nvr\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3795]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nvr\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3800]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.obj\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3807]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"ocxfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ocx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3809]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ocx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3810]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"ocxfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids\\ocxfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3815]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oc_\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3821]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3827]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odh\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3833]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3840]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"odtfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odt\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3842]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".odt\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3843]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"odtfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids\\odtfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3848]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oga\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3854]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3860]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3866]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3872]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3878]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oma\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3884]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.opus\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3890]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.osdx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3897]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"otffile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.otf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3899]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".otf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3900]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"otffile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids\\otffile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,3905]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oxps\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3911]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p10\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3917]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p12\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3923]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7b\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3929]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7c\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3935]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7m\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3941]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7r\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3947]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7s\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3953]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pbk\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3959]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pch\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3965]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pdb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3971]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pdf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3977]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pds\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3983]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.perfmoncfg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3989]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pfm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,3995]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pfx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4001]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.php3\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4006]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.php3\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4011]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pic\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4020]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pko\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4026]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pl\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4031]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pl\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4036]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.plg\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4041]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.plg\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4046]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pls\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4052]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pma\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4058]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pmc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4064]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pml\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4070]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pmr\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4076]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pnf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4083]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"pngfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.png\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4085]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".png\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4086]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"pngfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids\\pngfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4092]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pot\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4097]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ppk\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4103]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pps\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4110]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ppt\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4115]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.prc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4121]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.prf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4127]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.printerExport\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4133]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4139]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps1\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4145]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"Text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps1xml\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4150]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Microsoft.PowerShellXMLData.1\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps1xml\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4152]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ps1xml\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4153]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Microsoft.PowerShellXMLData.1\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids\\Microsoft.PowerShellXMLData.1\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4158]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psc1\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4164]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4170]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psd1\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4176]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psm1\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4182]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.py\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4188]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4194]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4200]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyo\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4206]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyw\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4212]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4218]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyzw\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4224]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.qcp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4230]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.qds\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4236]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r00\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4242]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r01\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4248]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r02\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4254]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r03\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4260]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r04\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4266]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r05\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4272]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r06\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4278]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r07\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4284]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r08\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4290]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r09\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4296]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r10\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4302]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r11\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4308]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r12\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4314]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r13\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4320]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r14\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4326]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r15\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4332]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r16\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4338]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r17\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4344]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r18\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4350]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r19\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4356]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r20\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4362]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r21\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4368]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r22\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4374]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r23\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4380]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r24\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4386]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r25\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4392]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r26\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4398]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r27\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4404]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r28\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4410]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r29\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4416]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ra\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4422]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ram\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4428]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rar\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4434]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rat\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4440]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4446]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rc2\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4452]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rct\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4458]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.RDP\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4464]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rec\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4467]},"name":"RegEnumKey(Handle=0xffffffff80000000, Index=0x395, Name=\".reg\", FullName=\"HKEY_CLASSES_ROOT\\.reg\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4468]},"name":"RegOpenKeyEx(Registry=0xffffffff80000000, SubKey=\"SystemFileAssociations\\.reg\", Handle=0x0, FullName=\"HKEY_CLASSES_ROOT\\SystemFileAssociations\\.reg\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4473]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.res\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4479]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.resmoncfg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4485]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rev\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4491]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rgs\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4498]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"rlefile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rle\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4500]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".rle\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4501]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"rlefile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids\\rlefile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4506]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rll\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4512]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4520]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.rmi\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rmi\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4522]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".rmi\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rmi\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4523]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.rmi\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rmi\\OpenWithProgids\\VLC.rmi\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4528]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rmvb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4534]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rpc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4540]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rpl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4546]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rsp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4553]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"rtffile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rtf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4555]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".rtf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4556]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"rtffile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids\\rtffile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4561]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rul\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4567]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.s\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4573]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.s3m\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4579]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sbr\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4585]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sc2\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4591]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4597]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4604]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"SHCmdFile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4606]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".scf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4607]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"SHCmdFile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids\\SHCmdFile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4612]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sch\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4618]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4627]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sct\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4633]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sdp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4640]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"SearchFolder\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.search-ms\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4642]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".search-ms\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4643]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"SearchFolder\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids\\SearchFolder\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4648]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.searchConnector-ms\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4654]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sed\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4659]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sed\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4664]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sfcache\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4670]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.shtm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4676]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\.shtml\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4681]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"ChromeHTML\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\.shtml\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4683]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".shtml\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4684]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"ChromeHTML\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids\\ChromeHTML\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4689]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sit\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4695]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.slupkg-ms\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4703]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.snd\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.snd\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4705]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".snd\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.snd\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4706]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.snd\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.snd\\OpenWithProgids\\VLC.snd\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4711]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sol\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4717]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sor\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4723]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.spc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4729]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.spx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4735]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sql\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4740]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sql\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4745]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.srf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4751]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sr_\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4757]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sst\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4763]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.stl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4769]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.stm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4775]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.svg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4781]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.swf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4787]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sym\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4793]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.symlink\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4800]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"sysfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sys\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4802]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".sys\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4803]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"sysfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids\\sysfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4808]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sy_\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4814]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tab\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4820]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"compressed\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tar\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4826]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.taz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4832]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tbz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4838]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tbz2\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4844]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tdl\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4851]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.text\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4856]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"compressed\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tgz\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4862]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.theme\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4868]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.themepack\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4874]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.thp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4881]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"TIFImage.Document\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tif\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4883]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".tif\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4884]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"TIFImage.Document\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids\\TIFImage.Document\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4890]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"TIFImage.Document\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tiff\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4892]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".tiff\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4893]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"TIFImage.Document\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids\\TIFImage.Document\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4898]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tlb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4904]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tlh\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4910]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tli\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4916]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tlz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4922]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tod\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4928]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4934]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.trg\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4941]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.ts\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.TS\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4943]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".TS\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TS\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4944]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.ts\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TS\\OpenWithProgids\\VLC.ts\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4949]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tsp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4955]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tsv\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4960]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tsv\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4965]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tta\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,4972]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"ttcfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ttc\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4974]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ttc\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4975]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"ttcfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids\\ttcfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4981]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"ttffile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ttf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4983]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".ttf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4984]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"ttffile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids\\ttffile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4990]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.tts\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.TTS\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4992]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".TTS\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TTS\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4993]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.tts\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TTS\\OpenWithProgids\\VLC.tts\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,4999]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"txtfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.txt\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5001]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".txt\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5002]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"txtfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids\\txtfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5007]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.txz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5013]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.udf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5019]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.UDL\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5025]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.udt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5031]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5037]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.user\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5043]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.usr\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5049]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.uu\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5055]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.uue\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5061]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.VBE\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5067]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vbproj\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5073]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vbs\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5079]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vbx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5085]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vcf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5091]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vcproj\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5097]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.viw\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5103]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vlc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5110]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.vob\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vob\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5112]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".vob\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vob\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5113]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.vob\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vob\\OpenWithProgids\\VLC.vob\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5118]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.voc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5124]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vqf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5130]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vro\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5136]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vspscc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5142]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vsscc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5148]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vssscc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5154]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"system\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vxd\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5159]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.w64\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5165]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wab\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5172]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.wav\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wav\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5174]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wav\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wav\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5175]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.wav\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wav\\OpenWithProgids\\VLC.wav\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5182]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"WMP11.AssocFile.WAX\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wax\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5184]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wax\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wax\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5185]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"WMP11.AssocFile.WAX\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wax\\OpenWithProgids\\WMP11.AssocFile.WAX\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5190]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wbcat\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5196]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wcx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5203]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"wdpfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wdp\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5205]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wdp\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5206]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"wdpfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids\\wdpfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5211]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.webm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5217]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.webp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5223]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.webpnp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5229]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wll\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5235]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wlt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5243]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"WMP11.AssocFile.ASF\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wm\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5245]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wm\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wm\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5246]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"WMP11.AssocFile.ASF\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wm\\OpenWithProgids\\WMP11.AssocFile.ASF\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5252]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.wma\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wma\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5254]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wma\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wma\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5255]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.wma\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wma\\OpenWithProgids\\VLC.wma\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5260]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WMD\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5266]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmdb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5274]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"wmffile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmf\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5276]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wmf\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5277]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"wmffile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids\\wmffile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5282]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmp\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5288]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WMS\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5295]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.wmv\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmv\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5297]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wmv\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmv\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5298]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.wmv\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmv\\OpenWithProgids\\VLC.wmv\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5305]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"WMP11.AssocFile.ASX\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5307]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wmx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5308]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"WMP11.AssocFile.ASX\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmx\\OpenWithProgids\\WMP11.AssocFile.ASX\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5313]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"compressed\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmz\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5319]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"audio\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wpl\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5324]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.wpl\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wpl\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5326]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wpl\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wpl\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5327]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.wpl\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wpl\\OpenWithProgids\\VLC.wpl\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5333]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wri\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5338]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wsc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5344]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WSF\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5350]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WSH\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5356]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"compressed\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wsz\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5363]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.wtv\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WTV\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5365]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".WTV\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.WTV\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5366]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.wtv\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.WTV\\OpenWithProgids\\VLC.wtv\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5371]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wtx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5377]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wv\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5385]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"VLC.wvx\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wvx\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5387]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".wvx\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wvx\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5388]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"VLC.wvx\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wvx\\OpenWithProgids\\VLC.wvx\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5393]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.x\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5398]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.x\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5403]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xa\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5409]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xaml\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5415]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xbap\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5421]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xesc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5427]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\.xht\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5433]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\.xhtml\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5439]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xix\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5445]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xlb\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5451]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xlc\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5458]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xls\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5464]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xlt\\(Default)\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5469]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xm\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5476]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"xmlfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xml\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5478]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".xml\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5479]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"xmlfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids\\xmlfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5485]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"Windows.XPSReachViewer\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xps\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5487]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".xps\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5488]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"Windows.XPSReachViewer\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids\\Windows.XPSReachViewer\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5493]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xrm-ms\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5499]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xsd\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5505]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"text\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xsl\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5510]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"xslfile\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xsl\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5512]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".xsl\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5513]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"xslfile\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids\\xslfile\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5518]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xslt\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5524]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xspf\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5530]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xxe\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5536]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xz\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5542]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", Data=\"compressed\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.z\\PerceivedType\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5548]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.z96\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5554]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zfsendtotarget\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5561]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"\", Data=\"WinRAR.ZIP\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zip\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5563]},"name":"RegCreateKeyEx(Registry=0x308, SubKey=\".zip\\OpenWithProgids\", Class=\"\", Access=KEY_SET_VALUE, Handle=0x40c, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids\", Disposition=REG_OPENED_EXISTING_KEY) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5564]},"name":"RegSetValueEx(Handle=0x40c, ValueName=\"WinRAR.ZIP\", Type=REG_NONE, Buffer=\"\", BufferLength=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids\\WinRAR.ZIP\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1860,5569]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zipx\\PerceivedType\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1860,5575]},"name":"RegQueryValueEx(Handle=0x40e, ValueName=\"PerceivedType\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zpl\\PerceivedType\") -> 0x2"}]},{"address":{"type":"thread","value":[1200,1248,1656]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,1656,5602]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,5605]},"name":"NtOpenProcess(ProcessHandle=0x140, DesiredAccess=PROCESS_QUERY_LIMITED_INFORMATION, ProcessIdentifier=0x2360) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,5615]},"name":"NtOpenProcess(ProcessHandle=0x140, DesiredAccess=PROCESS_QUERY_LIMITED_INFORMATION, ProcessIdentifier=0x2360) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,5617]},"name":"NtOpenProcess(ProcessHandle=0x140, DesiredAccess=PROCESS_QUERY_LIMITED_INFORMATION, ProcessIdentifier=0x2360) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,5626]},"name":"NtOpenProcess(ProcessHandle=0x140, DesiredAccess=PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2360) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,6112]},"name":"CoCreateInstance(rclsid=\"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8\", ClsContext=CLSCTX_INPROC_SERVER, riid=\"BBD20037-BC0E-42F1-913F-E2936BB0EA0C\", ProgID=\"\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,6115]},"name":"NtOpenProcess(ProcessHandle=0xac0, DesiredAccess=PROCESS_QUERY_LIMITED_INFORMATION, ProcessIdentifier=0x1572) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,6125]},"name":"NtOpenProcess(ProcessHandle=0xac0, DesiredAccess=PROCESS_QUERY_LIMITED_INFORMATION, ProcessIdentifier=0x1572) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,6127]},"name":"NtOpenProcess(ProcessHandle=0xac0, DesiredAccess=PROCESS_QUERY_LIMITED_INFORMATION, ProcessIdentifier=0x1572) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1656,6136]},"name":"NtOpenProcess(ProcessHandle=0xac0, DesiredAccess=PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1572) -> 0x0"}]},{"address":{"type":"thread","value":[1200,1248,732]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,732,5904]},"name":"NtCreateFile(FileHandle=0x544, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\SysWOW64\\WerFault.exe\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_DELETE, FileAttributes=0x0, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,732,5906]},"name":"NtMapViewOfSection(SectionHandle=0x588, ProcessHandle=0xffffffffffffffff, BaseAddress=0x3760000, SectionOffset=0x0, ViewSize=0x5b000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x4000000e"},{"address":{"type":"call","value":[1200,1248,732,6171]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0xac0, Options=0x2) -> 0x0"}]},{"address":{"type":"thread","value":[1200,1248,2304]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,2304,6012]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Control Panel\\Personalization\\Desktop Slideshow\", Handle=0x564, FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2304,6019]},"name":"NtCreateFile(FileHandle=0x1, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Users\\comp\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\slideshow.ini\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE, FileAttributes=0x0, ExistedBefore=\"no\", StackPivoted=\"no\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1200,1248,2304,6020]},"name":"RegQueryValueEx(Handle=0x564, ValueName=\"Interval\", FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\Interval\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,2304,6021]},"name":"RegQueryValueEx(Handle=0x564, ValueName=\"Shuffle\", FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\Shuffle\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,2304,6022]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Control Panel\\Personalization\\Desktop Slideshow\", Handle=0x544, FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2304,6023]},"name":"RegQueryValueEx(Handle=0x544, ValueName=\"AnimationDuration\", FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\AnimationDuration\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,2304,6025]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"Control Panel\\Personalization\\Desktop Slideshow\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Control Panel\\Personalization\\Desktop Slideshow\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,2304,6026]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Control Panel\\Personalization\\Desktop Slideshow\", Handle=0x544, FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,2304,6027]},"name":"RegQueryValueEx(Handle=0x544, ValueName=\"Flags\", FullName=\"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\Flags\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,2304,6029]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"Control Panel\\Personalization\\Desktop Slideshow\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Control Panel\\Personalization\\Desktop Slideshow\") -> 0x2"}]},{"address":{"type":"thread","value":[1200,1248,1560]},"matched_calls":[{"address":{"type":"call","value":[1200,1248,1560,6221]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"\", Data=\"%SystemRoot%\\System32\\netshell.dll\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\InProcServer32\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6222]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"LoadWithoutCOM\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\InProcServer32\\LoadWithoutCOM\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6225]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6227]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"SortOrderIndex\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\\SortOrderIndex\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6229]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6230]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6232]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"SortOrderIndex\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\SortOrderIndex\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6234]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6235]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6237]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"System.ItemNameDisplay\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\System.ItemNameDisplay\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6240]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6242]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6243]},"name":"NtOpenProcess(ProcessHandle=0x544, DesiredAccess=PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1248) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6245]},"name":"RegOpenKeyEx(Registry=0x168, SubKey=\"SessionInfo\\1\", Handle=0x544, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6246]},"name":"RegOpenKeyEx(Registry=0x544, SubKey=\"ControlPanel\\NameSpace\\NameCustomizations\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ControlPanel\\NameSpace\\NameCustomizations\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6248]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6250]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"LocalizedString\", Data=\"@%SystemRoot%\\system32\\prnfldr.dll,-8036\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\LocalizedString\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6251]},"name":"NtOpenKey(KeyHandle=0x588, DesiredAccess=KEY_QUERY_VALUE, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6252]},"name":"NtQueryValueKey(KeyHandle=0x588, ValueName=\"StringCacheGeneration\", Type=REG_DWORD, Information=0x7, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6254]},"name":"NtOpenKey(KeyHandle=0x588, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000\", ObjectAttributes=\"HKEY_CURRENT_USER\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6255]},"name":"NtOpenKey(KeyHandle=0x548, DesiredAccess=KEY_READ|KEY_WRITE, ObjectAttributesHandle=0x588, ObjectAttributesName=\"Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6257]},"name":"NtSetValueKey(KeyHandle=0x548, ValueName=\"LanguageList\", Type=REG_MULTI_SZ, Buffer=\"\\x00\\x00\", BufferLength=0x20, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\LanguageList\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6258]},"name":"NtQueryValueKey(KeyHandle=0x548, ValueName=\"@C:\\Windows\\system32\\prnfldr.dll,-8036\", Type=REG_SZ, Information=\"Printers\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\@C:\\Windows\\system32\\prnfldr.dll,-8036\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6262]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"System.ItemNameDisplay\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\System.ItemNameDisplay\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6265]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6267]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6268]},"name":"NtOpenProcess(ProcessHandle=0x544, DesiredAccess=PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x1248) -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6270]},"name":"RegOpenKeyEx(Registry=0x168, SubKey=\"SessionInfo\\1\", Handle=0x544, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6271]},"name":"RegOpenKeyEx(Registry=0x544, SubKey=\"ControlPanel\\NameSpace\\NameCustomizations\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ControlPanel\\NameSpace\\NameCustomizations\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6273]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6275]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"LocalizedString\", Data=\"@%SystemRoot%\\system32\\netshell.dll,-1200\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\LocalizedString\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6276]},"name":"NtOpenKey(KeyHandle=0x548, DesiredAccess=KEY_QUERY_VALUE, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6277]},"name":"NtQueryValueKey(KeyHandle=0x548, ValueName=\"StringCacheGeneration\", Type=REG_DWORD, Information=0x7, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6279]},"name":"NtOpenKey(KeyHandle=0x548, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000\", ObjectAttributes=\"HKEY_CURRENT_USER\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6280]},"name":"NtOpenKey(KeyHandle=0x588, DesiredAccess=KEY_READ|KEY_WRITE, ObjectAttributesHandle=0x548, ObjectAttributesName=\"Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6282]},"name":"NtSetValueKey(KeyHandle=0x588, ValueName=\"LanguageList\", Type=REG_MULTI_SZ, Buffer=\"\\x00\\x00\", BufferLength=0x20, FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\LanguageList\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6283]},"name":"NtQueryValueKey(KeyHandle=0x588, ValueName=\"@C:\\Windows\\system32\\netshell.dll,-1200\", Type=REG_SZ, Information=\"Network Connections\", FullName=\"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\@C:\\Windows\\system32\\netshell.dll,-1200\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6287]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"\", Data=\"%SystemRoot%\\System32\\netshell.dll\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\InProcServer32\\(Default)\") -> 0x0"},{"address":{"type":"call","value":[1200,1248,1560,6288]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"LoadWithoutCOM\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\InProcServer32\\LoadWithoutCOM\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6291]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6293]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"SortOrderIndex\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\\SortOrderIndex\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6295]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6296]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6298]},"name":"RegQueryValueEx(Handle=0x546, ValueName=\"SortOrderIndex\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\SortOrderIndex\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6300]},"name":"RegOpenKeyEx(Registry=0xffffffff80000002, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"},{"address":{"type":"call","value":[1200,1248,1560,6301]},"name":"RegOpenKeyEx(Registry=0xffffffff80000001, SubKey=\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\", Handle=0x0, FullName=\"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\") -> 0x2"}]}]},{"address":{"type":"process","value":[1248,1680]},"name":"pyw.exe","matched_threads":[{"address":{"type":"thread","value":[1248,1680,3044]},"matched_calls":[{"address":{"type":"call","value":[1248,1680,3044,37]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,129]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,183]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x11c, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,215]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x190000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,238]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf884, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,242]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,244]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,246]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,248]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,250]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,252]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,254]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,256]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,258]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,260]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,262]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,264]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,266]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,268]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,270]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,272]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,274]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,276]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,278]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,280]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,282]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,284]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,286]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,288]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,290]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,292]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,294]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,296]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,298]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,300]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,302]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,304]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,306]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,308]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,310]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,312]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,314]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,316]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,318]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,320]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,322]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,324]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,326]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,328]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,330]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,332]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,334]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,336]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,338]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,340]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,342]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,344]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,346]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,348]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,350]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,352]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,354]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,356]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,358]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,360]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,362]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,364]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,366]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,368]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,370]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,372]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,374]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,376]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,378]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,380]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,382]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,384]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,386]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,388]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,390]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,392]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,394]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,396]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,398]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,400]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,402]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,404]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,406]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,408]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,410]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,412]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,414]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,416]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,418]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,420]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,422]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,424]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,426]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,428]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,430]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,432]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,434]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,436]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,438]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,440]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,442]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,444]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,446]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,448]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,450]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,452]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,454]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,456]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,458]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,460]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,462]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,464]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,466]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,468]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,470]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,472]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,474]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,476]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,478]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,480]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,482]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,484]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,486]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,488]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,490]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,492]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,494]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,496]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,498]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,500]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,502]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,504]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,506]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,508]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,510]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,512]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,514]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,516]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,518]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,520]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,522]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,524]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,526]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,528]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,530]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,532]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,534]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,536]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,538]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,540]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,542]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,544]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,546]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,548]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,550]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,552]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,554]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,556]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,558]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,560]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,562]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,564]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,566]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,568]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,570]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,572]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,574]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,576]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,578]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,580]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,582]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,584]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,586]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,588]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,590]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,592]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,594]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,596]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,598]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,600]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,602]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,604]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,606]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,608]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,610]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,612]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,614]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,616]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,618]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,620]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,622]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,624]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,626]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,628]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,630]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,632]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,634]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,636]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,638]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,640]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,642]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,644]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,646]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,648]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,650]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,652]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,654]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,656]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,658]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,660]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,662]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,664]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,666]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,668]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,670]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,672]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,674]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,676]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,678]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,680]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,682]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,684]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,686]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,688]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,690]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,692]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,694]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,696]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,698]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,700]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,702]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,704]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,706]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,708]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,710]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,712]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,714]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,716]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,718]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,720]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,722]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,724]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,726]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,728]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,730]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,732]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,734]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,736]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,738]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,740]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,742]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,744]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,746]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,748]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,750]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,752]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,754]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,756]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,758]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,760]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,762]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,764]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,766]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,768]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,770]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,772]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,774]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,776]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,778]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,780]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,782]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,784]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,786]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,788]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,790]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,792]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,794]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,796]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,798]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,800]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,802]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,804]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,806]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,808]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,810]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,812]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,814]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,816]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,818]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,820]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,822]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,824]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,826]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,828]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,830]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,832]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,834]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,836]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,838]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,840]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,842]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,844]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,846]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,848]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,850]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,852]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,854]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,856]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,858]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,860]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,862]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,864]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,866]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,868]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,870]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,872]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,874]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,876]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,878]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,880]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,882]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,884]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,886]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,888]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,890]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,892]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,894]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,896]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,898]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,900]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,902]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,904]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,906]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,908]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,910]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,912]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,914]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,916]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,918]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,920]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,922]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,924]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,926]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,928]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,930]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,932]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,934]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,936]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,938]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,940]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,942]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,944]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,946]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,948]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,950]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,952]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,954]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,956]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,958]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,960]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,962]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,964]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,966]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,968]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,970]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,972]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,974]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,976]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,978]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,980]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,982]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,984]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,986]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,988]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,990]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,992]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,994]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,996]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,998]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1000]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1002]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1004]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1006]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1008]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1010]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1012]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1014]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1016]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1018]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1020]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1022]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1024]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1026]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1028]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1030]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1032]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1034]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1036]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1038]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1040]},"name":"NtMapViewOfSection(SectionHandle=0x178, ProcessHandle=0xffffffff, BaseAddress=0x2e0000, SectionOffset=0x6cf888, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1042]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x1684) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1046]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2632) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1050]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2628) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1054]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2880) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1058]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2600) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1062]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2128) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1066]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2864) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1086]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x1684) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1090]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2632) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1094]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2628) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1098]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2880) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1102]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2600) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1106]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2128) -> 0x0"},{"address":{"type":"call","value":[1248,1680,3044,1110]},"name":"NtOpenThread(ThreadHandle=0x178, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1680, ThreadId=0x2864) -> 0x0"}]},{"address":{"type":"thread","value":[1248,1680,552]},"matched_calls":[{"address":{"type":"call","value":[1248,1680,552,1138]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x11c, Options=0x2) -> 0x0"}]}]},{"address":{"type":"process","value":[1852,2420]},"name":"jxoqwn.exe","matched_threads":[{"address":{"type":"thread","value":[1852,2420,2524]},"matched_calls":[{"address":{"type":"call","value":[1852,2420,2524,8]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x44a0000, RegionSize=0xc0000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,9]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x44a0000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,24]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,25]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2420,2524,27]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,28]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2420,2524,30]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,31]},"name":"NtOpenKey(KeyHandle=0xdc, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,32]},"name":"NtOpenKey(KeyHandle=0xd8, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,33]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,34]},"name":"NtQueryValueKey(KeyHandle=0xd8, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,129]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[1852,2420,2524,130]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,131]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x800000, RegionSize=0x68000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,132]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,133]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x270000, RegionSize=0x6000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,137]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,141]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x3730000, RegionSize=0x6a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,208]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2420,2524,258]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x8a000, MemType=0x0, Protection=PAGE_READWRITE, OldProtection=PAGE_READONLY, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2420,2524,259]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x400, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2420,2524,261]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x40d000, Size=0x5a30, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2420,2524,263]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x417000, Size=0x51708, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2420,2524,264]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x469000, Size=0xe50, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2420,2524,283]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"}]}]},{"address":{"type":"process","value":[2820,2360]},"name":"WerFault.exe","matched_threads":[{"address":{"type":"thread","value":[2820,2360,1884]},"matched_calls":[{"address":{"type":"call","value":[2820,2360,1884,50]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x533000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[2820,2360,1788]},"matched_calls":[{"address":{"type":"call","value":[2820,2360,1788,92]},"name":"NtOpenProcess(ProcessHandle=0x118, DesiredAccess=PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x2420) -> 0x0"},{"address":{"type":"call","value":[2820,2360,1788,128]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x5d9000, RegionSize=0x11000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,2360,1788,165]},"name":"NtOpenKey(KeyHandle=0x60, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[2820,2360,1788,166]},"name":"NtQueryValueKey(KeyHandle=0x60, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]}]},{"address":{"type":"process","value":[1852,2724]},"name":"schtasks.exe","matched_threads":[{"address":{"type":"thread","value":[1852,2724,1816]},"matched_calls":[{"address":{"type":"call","value":[1852,2724,1816,18]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[1852,2724,1816,22]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x173000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,25]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x174000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,26]},"name":"NtOpenKey(KeyHandle=0xec, DesiredAccess=KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SQMClient\\Windows\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,27]},"name":"NtQueryValueKey(KeyHandle=0xec, ValueName=\"CEIPEnable\", Type=REG_DWORD, Information=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\\CEIPEnable\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,35]},"name":"NtQueryValueKey(KeyHandle=0x30, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2724,1816,39]},"name":"NtCreateFile(FileHandle=0xec, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,41]},"name":"NtMapViewOfSection(SectionHandle=0xe4, ProcessHandle=0xffffffff, BaseAddress=0x3fc0000, SectionOffset=0x1ef500, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,44]},"name":"NtOpenKey(KeyHandle=0xec, DesiredAccess=KEY_QUERY_VALUE, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,45]},"name":"NtQueryValueKey(KeyHandle=0xec, ValueName=\"Disable\", Type=REG_DWORD, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,54]},"name":"NtOpenFile(FileHandle=0xe0, DesiredAccess=FILE_READ_ACCESS|SYNCHRONIZE, FileName=\"\\Device\\KsecDD\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,55]},"name":"DeviceIoControl(DeviceHandle=0xe0, IoControlCode=IOCTL_KSEC_RANDOM_FILL_BUFFER, InBuffer=\"\", OutBuffer=\"\n\\xf6\\xae\\xcc\\xb9\\xf4\\xf0H\\xb8^\\xa2\\x8b\\x00C|p\\xa8\\x89\\xe52\\xae\\xf1\\xcb\\xc8\\x11\\xba\\x8eC\\xde\\x7f\\xb2\\xe4\\x8b\\x1c\\xae*\\x1b\\xf5\\xee\\x02\\xfa\\xe3\\xf77\\xeeE\\x8dD\") -> 0x1"},{"address":{"type":"call","value":[1852,2724,1816,56]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x608000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,60]},"name":"NtMapViewOfSection(SectionHandle=0xfc, ProcessHandle=0xffffffff, BaseAddress=0x4290000, SectionOffset=0x1ec9ec, ViewSize=0xdf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,63]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4461000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,64]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4465000, RegionSize=0x11000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,65]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4476000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,66]},"name":"DeviceIoControl(DeviceHandle=0xe0, IoControlCode=IOCTL_KSEC_RANDOM_FILL_BUFFER, InBuffer=\"\", OutBuffer=\"(#\"\\xe3\\x18\\xa6wT\\xf9l\\xc00\\xbc~\\x04X\\xf3<\\xd4I7\\x92\\xd4\\x9d\\x90n0W\\x18\\x0b\\x84\\xf6\\x13\\xe4\\xd4\\xd6\\xd1\\xff\\xa6[\\x1bD\\xd4m\\xb7\\xd8\\xa3!\") -> 0x1"},{"address":{"type":"call","value":[1852,2724,1816,76]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x616000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,77]},"name":"NtOpenKey(KeyHandle=0x134, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,85]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x617000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,86]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x618000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,95]},"name":"NtOpenKey(KeyHandle=0x144, DesiredAccess=KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SQMClient\\Windows\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,96]},"name":"NtQueryValueKey(KeyHandle=0x144, ValueName=\"CEIPEnable\", Type=REG_DWORD, Information=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\\CEIPEnable\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,106]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x175000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,969]},"name":"NtOpenKey(KeyHandle=0x68, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,1816,970]},"name":"NtQueryValueKey(KeyHandle=0x68, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[1852,2724,2016]},"matched_calls":[{"address":{"type":"call","value":[1852,2724,2016,138]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,231]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,284]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x160, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,285]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x643000, RegionSize=0x6000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,314]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x740000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,337]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6cc, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,339]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,341]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,343]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,345]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,347]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,349]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,351]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,353]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,355]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,357]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,359]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,361]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,363]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,365]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,367]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,369]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,371]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,373]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,375]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,377]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,379]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,381]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,383]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,385]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,387]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,389]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,391]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,393]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,395]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,397]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,399]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,401]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,403]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,405]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,407]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,409]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,411]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,413]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,415]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,417]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,419]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,421]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,423]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,425]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,427]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,429]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,431]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,433]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,435]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,437]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,439]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,441]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,443]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,445]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,447]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,449]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,451]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,453]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,455]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,457]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,459]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,461]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,463]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,465]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,467]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,469]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,471]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,473]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,475]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,477]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,479]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,481]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,483]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,485]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,487]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,489]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,491]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,493]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,495]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,497]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,499]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,501]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,503]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,505]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,507]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,509]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,511]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,513]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,515]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,517]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,519]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,521]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,523]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,525]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,527]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,529]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,531]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,533]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,535]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,537]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,539]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,541]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,543]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,545]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,547]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,549]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,551]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,553]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,555]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,557]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,559]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,561]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,563]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,565]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,567]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,569]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,571]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,573]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,575]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,577]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,579]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,581]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,583]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,585]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,587]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,589]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,591]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,593]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,595]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,597]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,599]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,601]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,603]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,605]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,607]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,609]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,611]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,613]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,615]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,617]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,619]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,621]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,623]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,625]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,627]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,629]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,631]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,633]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,635]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,637]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,639]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,641]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,643]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,645]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,647]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,649]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,651]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,653]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,655]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,657]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,659]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,661]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,663]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,665]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,667]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,669]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,671]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,673]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,675]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,677]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,679]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,681]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,683]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,685]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,687]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,689]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,691]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,693]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,695]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,697]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,699]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,701]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,703]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,705]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,707]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,709]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,711]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,713]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,715]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,717]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,719]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,721]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,723]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,725]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,727]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,729]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,731]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,733]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,735]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,737]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,739]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,741]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,743]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,745]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,747]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,749]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,751]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,753]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,755]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,757]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,759]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,761]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,763]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,765]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,767]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,769]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,771]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,773]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,775]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,777]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,779]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,781]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,783]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,785]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,787]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,789]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,791]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,793]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,795]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,797]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,799]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,801]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,803]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,805]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,807]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,809]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,811]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,813]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,815]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,817]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,819]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,821]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,823]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,825]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,827]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,829]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,831]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,833]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,835]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,837]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,839]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,841]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,843]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,845]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,847]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,849]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,851]},"name":"NtMapViewOfSection(SectionHandle=0x1a8, ProcessHandle=0xffffffff, BaseAddress=0x750000, SectionOffset=0x451f6d0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,853]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1816) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,857]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x3008) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,861]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x2988) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,865]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1428) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,869]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1640) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,873]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x2308) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,877]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1896) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,897]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1816) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,901]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x3008) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,905]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x2988) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,909]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1428) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,913]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1640) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,917]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x2308) -> 0x0"},{"address":{"type":"call","value":[1852,2724,2016,921]},"name":"NtOpenThread(ThreadHandle=0x1a8, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2724, ThreadId=0x1896) -> 0x0"}]}]},{"address":{"type":"process","value":[1852,2800]},"name":"schtasks.exe","matched_threads":[{"address":{"type":"thread","value":[1852,2800,640]},"matched_calls":[{"address":{"type":"call","value":[1852,2800,640,11]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[1852,2800,640,15]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4c3000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,17]},"name":"NtOpenKey(KeyHandle=0xec, DesiredAccess=KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SQMClient\\Windows\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,18]},"name":"NtQueryValueKey(KeyHandle=0xec, ValueName=\"CEIPEnable\", Type=REG_DWORD, Information=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\\CEIPEnable\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,27]},"name":"NtQueryValueKey(KeyHandle=0x30, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2800,640,31]},"name":"NtCreateFile(FileHandle=0xec, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,33]},"name":"NtMapViewOfSection(SectionHandle=0xe8, ProcessHandle=0xffffffff, BaseAddress=0x41b0000, SectionOffset=0x1df720, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,36]},"name":"NtOpenKey(KeyHandle=0xec, DesiredAccess=KEY_QUERY_VALUE, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\WMR\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,37]},"name":"NtQueryValueKey(KeyHandle=0xec, ValueName=\"Disable\", Type=REG_DWORD, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\WMR\\Disable\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,46]},"name":"NtOpenFile(FileHandle=0xe4, DesiredAccess=FILE_READ_ACCESS|SYNCHRONIZE, FileName=\"\\Device\\KsecDD\", ShareAccess=FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE) -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,47]},"name":"DeviceIoControl(DeviceHandle=0xe4, IoControlCode=IOCTL_KSEC_RANDOM_FILL_BUFFER, InBuffer=\"\", OutBuffer=\"\\x8bnx2\\xd9\\xb71t\\x963zh6\\x88\\x18\\xc82\\xeaC\\xa3{\\x01C\\x91\\x8f\\x855+\t\\xb7\\xdfR\\xcd\\x00\\x01_\\xfcQ\\x90N7\\xa7f\\xb8\\x14\\xb3w|\") -> 0x1"},{"address":{"type":"call","value":[1852,2800,640,48]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x318000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,52]},"name":"NtMapViewOfSection(SectionHandle=0xfc, ProcessHandle=0xffffffff, BaseAddress=0x4480000, SectionOffset=0x1dcc0c, ViewSize=0xdf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,55]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x45c1000, RegionSize=0x4000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,56]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x45c5000, RegionSize=0x11000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,57]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x45d6000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,58]},"name":"DeviceIoControl(DeviceHandle=0xe4, IoControlCode=IOCTL_KSEC_RANDOM_FILL_BUFFER, InBuffer=\"\", OutBuffer=\"]\\xfa\\xfe\\x02\\xcd\\xbf\\x8a\\xbfb=\\xe1\\xb0AfZa\\xb8A\\xd3\\xec\\xbaA\\xab\\xb04\\xecx\\x00\\xabV\\x10k \\x1f\\xc7QH\\x06e\\xb6W\\xb1\\x9a\\x03\\x9a\\xb7\\xf2\\x16\") -> 0x1"},{"address":{"type":"call","value":[1852,2800,640,68]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x326000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,69]},"name":"NtOpenKey(KeyHandle=0x134, DesiredAccess=MAXIMUM_ALLOWED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\User\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\", ObjectAttributes=\"HKEY_CURRENT_USER\\Software\\Classes\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,77]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x327000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,78]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x328000, RegionSize=0x2000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,87]},"name":"NtOpenKey(KeyHandle=0x144, DesiredAccess=KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\SQMClient\\Windows\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,88]},"name":"NtQueryValueKey(KeyHandle=0x144, ValueName=\"CEIPEnable\", Type=REG_DWORD, Information=0x0, FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\\CEIPEnable\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,90]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4c4000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,99]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4c5000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,1236]},"name":"NtOpenKey(KeyHandle=0x68, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,640,1237]},"name":"NtQueryValueKey(KeyHandle=0x68, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[1852,2800,3044]},"matched_calls":[{"address":{"type":"call","value":[1852,2800,3044,131]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,224]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,277]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x160, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,304]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x410000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,327]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f61c, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,331]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,333]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,335]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,337]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,339]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,341]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,343]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,345]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,347]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,349]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,351]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,353]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,355]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,357]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,359]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,361]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,363]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,365]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,367]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,369]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,371]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,373]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,375]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,377]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,379]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,381]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,383]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,385]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,387]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,389]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,391]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,393]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,395]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,397]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,399]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,401]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,403]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,405]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,407]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,409]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,411]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,413]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,415]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,417]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,419]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,421]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,423]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,425]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,427]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,429]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,431]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,433]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,435]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,437]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,439]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,441]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,443]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,445]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,447]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,449]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,451]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,453]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,455]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,457]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,459]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,461]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,463]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,465]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,467]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,469]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,471]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,473]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,475]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,477]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,479]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,481]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,483]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,485]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,487]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,489]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,491]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,493]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,495]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,497]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,499]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,501]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,503]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,505]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,507]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,509]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,511]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,513]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,515]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,517]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,519]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,521]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,523]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,525]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,527]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,529]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,531]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,533]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,535]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,537]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,539]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,541]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,543]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,545]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,547]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,549]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,551]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,553]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,555]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,557]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,559]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,561]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,563]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,565]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,567]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,569]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,571]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,573]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,575]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,577]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,579]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,581]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,583]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,585]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,587]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,589]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,591]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,593]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,595]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,597]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,599]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,601]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,603]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,605]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,607]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,609]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,611]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,613]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,615]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,617]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,619]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,621]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,623]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,625]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,627]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,629]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,631]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,633]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,635]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,637]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,639]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,641]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,643]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,645]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,647]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,649]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,651]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,653]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,655]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,657]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,659]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,661]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,663]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,665]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,667]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,669]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,671]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,673]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,675]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,677]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,679]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,681]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,683]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,685]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,687]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,689]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,691]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,693]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,695]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,697]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,699]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,701]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,703]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,705]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,707]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,709]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,711]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,713]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,715]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,717]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,719]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,721]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,723]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,725]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,727]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,729]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,731]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,733]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,735]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,737]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,739]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,741]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,743]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,745]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,747]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,749]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,751]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,753]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,755]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,757]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,759]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,761]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,763]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,765]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,767]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,769]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,771]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,773]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,775]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,777]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,779]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,781]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,783]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,785]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,787]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,789]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,791]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,793]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,795]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,797]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,799]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,801]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,803]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,805]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,807]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,809]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,811]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,813]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,815]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,817]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,819]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,821]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,823]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,825]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,827]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,829]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,831]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,833]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,835]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,837]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,839]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,841]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,843]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,845]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,847]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,849]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,851]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,853]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,855]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,857]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,859]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,861]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,863]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,865]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,867]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,869]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,871]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,873]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,875]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,877]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,879]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,881]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,883]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,885]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,887]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,889]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,891]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,893]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,895]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,897]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,899]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,901]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,903]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,905]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,907]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,909]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,911]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,913]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,915]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,917]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,919]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,921]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,923]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,925]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,927]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,929]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,931]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,933]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,935]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,937]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,939]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,941]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,943]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,945]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,947]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,949]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,951]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,953]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,955]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,957]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,959]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,961]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,963]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,965]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,967]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,969]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,971]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,973]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,975]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,977]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,979]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,981]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,983]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,985]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,987]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,989]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,991]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,993]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,995]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,997]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,999]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1001]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1003]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1005]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1007]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1009]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1011]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1013]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1015]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1017]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1019]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1021]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1023]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1025]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1027]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1029]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1031]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1033]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1035]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1037]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1039]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1041]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1043]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1045]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1047]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1049]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1051]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1053]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1055]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1057]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1059]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1061]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1063]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1065]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1067]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1069]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1071]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1073]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1075]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1077]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1079]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1081]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1083]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1085]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1087]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1089]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1091]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1093]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1095]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1097]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1099]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1101]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1103]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1105]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1107]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1109]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1111]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1113]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1115]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1117]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1119]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1121]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1123]},"name":"NtMapViewOfSection(SectionHandle=0x1a4, ProcessHandle=0xffffffff, BaseAddress=0x4a0000, SectionOffset=0x325f620, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1126]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x640) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1130]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x2780) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1134]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x868) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1138]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x1748) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1142]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x1320) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1146]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x2796) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1150]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x1592) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1170]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x640) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1174]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x2780) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1178]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x868) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1182]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x1748) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1186]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x1320) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1190]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x2796) -> 0x0"},{"address":{"type":"call","value":[1852,2800,3044,1194]},"name":"NtOpenThread(ThreadHandle=0x1a4, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x2800, ThreadId=0x1592) -> 0x0"}]}]},{"address":{"type":"process","value":[1852,2744]},"name":"jxoqwn.exe","matched_threads":[{"address":{"type":"thread","value":[1852,2744,2916]},"matched_calls":[{"address":{"type":"call","value":[1852,2744,2916,15]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1e90000, RegionSize=0xc0000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,16]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1e90000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,31]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,32]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2744,2916,34]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,35]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2744,2916,37]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,38]},"name":"NtOpenKey(KeyHandle=0xdc, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,39]},"name":"NtOpenKey(KeyHandle=0xd8, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,40]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,41]},"name":"NtQueryValueKey(KeyHandle=0xd8, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,136]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[1852,2744,2916,137]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,138]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4490000, RegionSize=0x68000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,139]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,140]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x230000, RegionSize=0x6000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,146]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,150]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4500000, RegionSize=0x6a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,217]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,266]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x8a000, MemType=0x0, Protection=PAGE_READWRITE, OldProtection=PAGE_READONLY, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2744,2916,267]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x400, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2744,2916,269]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x40d000, Size=0x5a30, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2744,2916,271]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x417000, Size=0x51708, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2744,2916,272]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x469000, Size=0xe50, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,2744,2916,291]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,355]},"name":"CreateToolhelp32Snapshot(Flags=TH32CS_SNAPPROCESS, ProcessId=0x0) -> 0x190"},{"address":{"type":"call","value":[1852,2744,2916,358]},"name":"NtQueryValueKey(KeyHandle=0x24, ValueName=\"00060101.00060101\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\00060101.00060101\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,2744,2916,362]},"name":"NtCreateFile(FileHandle=0x194, DesiredAccess=GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE, FileName=\"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\", CreateDisposition=FILE_OPEN, ShareAccess=FILE_SHARE_READ, FileAttributes=FILE_ATTRIBUTE_NORMAL, ExistedBefore=\"yes\", StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,364]},"name":"NtMapViewOfSection(SectionHandle=0x198, ProcessHandle=0xffffffff, BaseAddress=0x47f0000, SectionOffset=0x18e860, ViewSize=0x2cf000, Win32Protect=PAGE_READONLY, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,478]},"name":"NtOpenProcess(ProcessHandle=0x190, DesiredAccess=PROCESS_DUP_HANDLE, ProcessIdentifier=0x2744) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,480]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4ac0000, RegionSize=0x100000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,481]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4ac0000, RegionSize=0x42000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,688]},"name":"FindResourceEx(Module=0x400000, Type=\"#10\", Name=0x2, Language=0x0) -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,689]},"name":"FindResourceEx(Module=0x400000, Type=\"#3\", Name=0x2, Language=0x0) -> 0x417118"},{"address":{"type":"call","value":[1852,2744,2916,711]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x56d000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,732]},"name":"NtOpenKey(KeyHandle=0x5c, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[1852,2744,2916,733]},"name":"NtQueryValueKey(KeyHandle=0x5c, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]},{"address":{"type":"thread","value":[1852,2744,2672]},"matched_calls":[{"address":{"type":"call","value":[1852,2744,2672,141]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x243000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]}]},{"address":{"type":"process","value":[1852,500]},"name":"jxoqwn.exe","matched_threads":[{"address":{"type":"thread","value":[1852,500,240]},"matched_calls":[{"address":{"type":"call","value":[1852,500,240,8]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1e50000, RegionSize=0xc0000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,9]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x1e50000, RegionSize=0x3000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,24]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,25]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,500,240,27]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,28]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=\"en-US\", FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US\") -> OBJECT_NAME_NOT_FOUND"},{"address":{"type":"call","value":[1852,500,240,30]},"name":"NtOpenKey(KeyHandle=0xe0, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,31]},"name":"NtOpenKey(KeyHandle=0xdc, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Locale\\Alternate Sorts\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,32]},"name":"NtOpenKey(KeyHandle=0xd8, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Language Groups\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,33]},"name":"NtQueryValueKey(KeyHandle=0xe0, ValueName=0x409, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Locale\\00000409\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,34]},"name":"NtQueryValueKey(KeyHandle=0xd8, ValueName=0x1, Type=REG_SZ, Information=0x1, FullName=\"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Language Groups\\1\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,129]},"name":"NtQueryValueKey(KeyHandle=0x0, ValueName=\"DisableUserModeCallbackFilter\", FullName=\"DisableUserModeCallbackFilter\") -> INVALID_HANDLE"},{"address":{"type":"call","value":[1852,500,240,132]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,500,240,133]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x4400000, RegionSize=0x68000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,134]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,500,240,135]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2b0000, RegionSize=0x6000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,139]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,500,240,143]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x44b0000, RegionSize=0x6a000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[1852,500,240,210]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[1852,500,240,259]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x8a000, MemType=0x0, Protection=PAGE_READWRITE, OldProtection=PAGE_READONLY, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,500,240,260]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x400000, Size=0x400, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,500,240,262]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x40d000, Size=0x5a30, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,500,240,264]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x417000, Size=0x51708, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,500,240,265]},"name":"VirtualProtectEx(ProcessHandle=0xffffffff, Address=0x469000, Size=0xe50, MemType=0x0, Protection=PAGE_READONLY, OldProtection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x1"},{"address":{"type":"call","value":[1852,500,240,284]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[1852,500,240,338]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x687000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]},{"address":{"type":"thread","value":[1852,500,900]},"matched_calls":[{"address":{"type":"call","value":[1852,500,900,130]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2c3000, RegionSize=0x1000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"}]}]},{"address":{"type":"process","value":[2820,1572]},"name":"WerFault.exe","matched_threads":[{"address":{"type":"thread","value":[2820,1572,2932]},"matched_calls":[{"address":{"type":"call","value":[2820,1572,2932,38]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x75af1832) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,130]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x75ae0000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x75b0da10) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,184]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffff, SourceHandle=0xfffffffe, TargetProcessHandle=0xffffffff, TargetHandle=0x25c, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,212]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x2580000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,235]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df84c, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,237]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,239]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,241]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,243]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,245]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,247]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,249]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,251]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,253]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,255]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,257]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,259]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,261]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,263]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,265]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,267]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,269]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,271]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,273]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,275]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,277]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,279]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,281]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,283]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,285]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,287]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,289]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,291]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,293]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,295]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,297]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,299]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,301]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,303]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,305]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,307]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,309]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,311]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,313]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,315]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,317]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,319]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,321]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,323]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,325]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,327]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,329]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,331]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,333]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,335]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,337]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,339]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,341]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,343]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,345]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,347]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,349]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,351]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,353]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,355]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,357]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,359]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,361]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,363]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,365]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,367]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,369]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,371]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,373]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,375]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,377]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,379]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,381]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,383]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,385]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,387]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,389]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,391]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,393]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,395]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,397]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,399]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,401]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,403]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,405]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,407]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,409]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,411]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,413]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,415]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,417]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,419]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,421]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,423]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,425]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,427]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,429]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,431]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,433]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,435]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,437]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,439]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,441]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,443]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,445]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,447]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,449]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,451]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,453]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,455]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,457]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,459]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,461]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,463]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,465]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,467]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,469]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,471]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,473]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,475]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,477]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,479]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,481]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,483]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,485]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,487]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,489]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,491]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,493]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,495]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,497]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,499]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,501]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,503]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,505]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,507]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,509]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,511]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,513]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,515]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,517]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,519]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,521]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,523]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,525]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,527]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,529]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,531]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,533]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,535]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,537]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,539]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,541]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,543]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,545]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,547]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,549]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,551]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,553]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,555]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,557]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,559]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,561]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,563]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,565]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,567]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,569]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,571]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,573]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,575]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,577]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,579]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,581]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,583]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,585]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,587]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,589]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,591]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,593]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,595]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,597]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,599]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,601]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,603]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,605]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,607]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,609]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,611]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,613]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,615]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,617]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,619]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,621]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,623]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,625]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,627]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,629]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,631]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,633]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,635]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,637]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,639]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,641]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,643]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,645]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,647]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,649]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,651]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,653]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,655]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,657]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,659]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,661]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,663]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,665]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,667]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,669]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,671]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,673]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,675]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,677]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,679]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,681]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,683]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,685]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,687]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,689]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,691]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,693]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,695]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,697]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,699]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,701]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,703]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,705]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,707]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,709]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,711]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,713]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,715]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,717]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,719]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,721]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,723]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,725]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,727]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,729]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,731]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,733]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,735]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,737]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,739]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,741]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,743]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,745]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,747]},"name":"NtMapViewOfSection(SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x2590000, SectionOffset=0x25df850, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,752]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2804) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,756]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2408) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,760]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x1640) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,764]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2308) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,768]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2336) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,772]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2780) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,776]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x1748) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,780]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x1320) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,784]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2760) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,804]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2804) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,808]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2408) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,812]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x1640) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,816]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2308) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,820]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2336) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,824]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2780) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,828]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x1748) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,832]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x1320) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2932,836]},"name":"NtOpenThread(ThreadHandle=0x290, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1572, ThreadId=0x2760) -> 0x0"}]},{"address":{"type":"thread","value":[2820,1572,2804]},"matched_calls":[{"address":{"type":"call","value":[2820,1572,2804,937]},"name":"NtOpenProcess(ProcessHandle=0x118, DesiredAccess=PROCESS_QUERY_INFORMATION, ProcessIdentifier=0x500) -> 0x0"},{"address":{"type":"call","value":[2820,1572,2804,972]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffff, BaseAddress=0x594a000, RegionSize=0x11000, Protection=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2804,1016]},"name":"NtOpenKey(KeyHandle=0x60, DesiredAccess=KEY_READ, ObjectAttributesHandle=0x0, ObjectAttributesName=\"\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\", ObjectAttributes=\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\") -> 0x0"},{"address":{"type":"call","value":[2820,1572,2804,1017]},"name":"NtQueryValueKey(KeyHandle=0x60, ValueName=\"DisableMetaFiles\", FullName=\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles\") -> OBJECT_NAME_NOT_FOUND"}]}]},{"address":{"type":"process","value":[2820,1912]},"name":"WerFault.exe","matched_threads":[{"address":{"type":"thread","value":[2820,1912,1216]},"matched_calls":[{"address":{"type":"call","value":[2820,1912,1216,39]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"VirtualAlloc\", Ordinal=0x0, FunctionAddress=0x77a35980) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,129]},"name":"LdrGetProcedureAddress(ModuleName=\"kernel32.dll\", ModuleHandle=0x77a20000, FunctionName=\"VirtualAllocEx\", Ordinal=0x0, FunctionAddress=0x77a6bf30) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,182]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0x24c, Options=0x2) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,211]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x77910000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,218]},"name":"NtAllocateVirtualMemory(ProcessHandle=0xffffffffffffffff, BaseAddress=0x7fefe0b0000, RegionSize=0x1000, Protection=PAGE_EXECUTE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,240]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,330]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,332]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,336]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,340]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,344]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,354]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,360]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,366]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,370]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,376]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,380]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,386]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,390]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,394]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,398]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,402]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,406]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,412]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,418]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,422]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,428]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,434]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,446]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,452]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,456]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,460]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,464]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,468]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,474]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,478]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,482]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,488]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,494]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,498]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,503]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,508]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,512]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,518]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,522]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,528]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,532]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,538]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,542]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,546]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,552]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,558]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,562]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,566]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,574]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,578]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,582]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,586]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,590]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,594]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,602]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,606]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,612]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,618]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,624]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,630]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,636]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,644]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,650]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,656]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,660]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,666]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,672]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,684]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,690]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,694]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,704]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,710]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,714]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,718]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,726]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,734]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,740]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,746]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,754]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,758]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,764]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,770]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,776]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,782]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,788]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,792]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,798]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,804]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,810]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,814]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,820]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,824]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,830]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,834]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,840]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,846]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,852]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,862]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,866]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,872]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,878]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,884]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,890]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,900]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,908]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,912]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,918]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,926]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,930]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,936]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,942]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,948]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,953]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,956]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,962]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,966]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,974]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,980]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,988]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,998]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1006]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1012]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1018]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1022]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1026]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1030]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1034]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1042]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1048]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1054]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1058]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1064]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1070]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1076]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1082]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1086]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1094]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1098]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1104]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1108]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1112]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1118]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1124]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1128]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1132]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1134]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1136]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1138]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1140]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1142]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1144]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1146]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1148]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1150]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1152]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1154]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1156]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1158]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1160]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1162]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1164]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1166]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1168]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1170]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1172]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1174]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1176]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1178]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1180]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1182]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1184]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1186]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1188]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1190]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1192]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1194]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1196]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1198]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1200]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1202]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1204]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1206]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1208]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1210]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1212]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1214]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1216]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1218]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1220]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1222]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1224]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1226]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1228]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1230]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1232]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1234]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1236]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1238]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1240]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1242]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1244]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1246]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1248]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1250]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1252]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1254]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1256]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1258]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1260]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1262]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1264]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1266]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1268]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1270]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1272]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1274]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1276]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1278]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1280]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1282]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1284]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1286]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1288]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1290]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1292]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1294]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1296]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1298]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1300]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1302]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1304]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1306]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1308]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1310]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1312]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1314]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1316]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1318]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1320]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1322]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1324]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1326]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1328]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1330]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1332]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1334]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1336]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1338]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1340]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1342]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1344]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1346]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1348]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1350]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1352]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1354]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1356]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1358]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1360]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1362]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1364]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1366]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1368]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1370]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1372]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1374]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1376]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1378]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1380]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1382]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1384]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1386]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1388]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1390]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1392]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1394]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1396]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1398]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1400]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1402]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1404]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1406]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1408]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1410]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1412]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1414]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1416]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1418]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1420]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1422]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1424]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1426]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1428]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1430]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1432]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1434]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1436]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1438]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1440]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1442]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1444]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1446]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1448]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1450]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1452]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1454]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1456]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1458]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1460]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1462]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1464]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1466]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1468]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1470]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1472]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1474]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1476]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1478]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1480]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1482]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1484]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1486]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1488]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1490]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1492]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1494]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1496]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1498]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1500]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1502]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1504]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1506]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1508]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1510]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1512]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1514]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1516]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1518]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1520]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1522]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1524]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1526]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1528]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1530]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1532]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1534]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1536]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1538]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1540]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1542]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1544]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1546]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1548]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1550]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1552]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1554]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1556]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1558]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1560]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1562]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1564]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1566]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1568]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1570]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1572]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1574]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1576]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1578]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1580]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1582]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1584]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1586]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1588]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1590]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1592]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1594]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1596]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1598]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1600]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1602]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1604]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1606]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1608]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1610]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1612]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1614]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1616]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1618]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1620]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1622]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1624]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1626]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1628]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1630]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1632]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1634]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1636]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1638]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1640]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1642]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1644]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1646]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1648]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1650]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1652]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1654]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1656]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1658]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1660]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1662]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1664]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1666]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1668]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1670]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1672]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1674]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1676]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1678]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1680]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1682]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1684]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1686]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1688]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1690]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1692]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1694]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1696]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1698]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1700]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1702]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1704]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1706]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1708]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1710]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1712]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1714]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1716]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1718]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1720]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1722]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1724]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1726]},"name":"NtMapViewOfSection(SectionHandle=0x278, ProcessHandle=0xffffffffffffffff, BaseAddress=0x22a0000, SectionOffset=0x5ddf5e0, ViewSize=0x4000, Win32Protect=PAGE_READWRITE, StackPivoted=\"no\") -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1728]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x492) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1732]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2520) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1736]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2100) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1740]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x1652) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1744]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2356) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1748]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x1884) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1751]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2332) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1754]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2588) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1757]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x860) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1777]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x492) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1781]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2520) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1785]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2100) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1789]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x1652) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1793]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2356) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1797]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x1884) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1801]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2332) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1805]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x2588) -> 0x0"},{"address":{"type":"call","value":[2820,1912,1216,1809]},"name":"NtOpenThread(ThreadHandle=0x278, DesiredAccess=THREAD_SUSPEND_RESUME|THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, ProcessId=0x1912, ThreadId=0x860) -> 0x0"}]},{"address":{"type":"thread","value":[2820,1912,3068]},"matched_calls":[{"address":{"type":"call","value":[2820,1912,3068,1825]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0x24c, Options=0x2) -> 0x0"}]},{"address":{"type":"thread","value":[2820,1912,1368]},"matched_calls":[{"address":{"type":"call","value":[2820,1912,1368,1827]},"name":"NtDuplicateObject(SourceProcessHandle=0xffffffffffffffff, SourceHandle=0xfffffffffffffffe, TargetProcessHandle=0xffffffffffffffff, TargetHandle=0x288, Options=0x2) -> 0x0"}]}]}]},"feature_counts":{"file":4891,"processes":[{"address":{"type":"process","value":[2456,3052]},"count":1144},{"address":{"type":"process","value":[3052,2192]},"count":1097},{"address":{"type":"process","value":[3052,1180]},"count":934},{"address":{"type":"process","value":[3052,2852]},"count":2195},{"address":{"type":"process","value":[2852,2900]},"count":212},{"address":{"type":"process","value":[1180,1852]},"count":2033},{"address":{"type":"process","value":[792,1224]},"count":495},{"address":{"type":"process","value":[1200,1248]},"count":4633},{"address":{"type":"process","value":[1248,1680]},"count":482},{"address":{"type":"process","value":[1852,2420]},"count":648},{"address":{"type":"process","value":[2820,2360]},"count":256},{"address":{"type":"process","value":[1852,2724]},"count":669},{"address":{"type":"process","value":[1852,2800]},"count":649},{"address":{"type":"process","value":[1852,2744]},"count":906},{"address":{"type":"process","value":[1852,500]},"count":650},{"address":{"type":"process","value":[2820,1572]},"count":675},{"address":{"type":"process","value":[2820,1912]},"count":486}]}}},"rules":{"delay execution":{"meta":{"name":"delay execution","authors":["michael.hunhoff@mandiant.com","@ramen0x3f"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Anti-Behavioral Analysis","Dynamic Analysis Evasion","Delayed Execution"],"objective":"Anti-Behavioral Analysis","behavior":"Dynamic Analysis Evasion","method":"Delayed Execution","id":"B0003.003"}],"references":["https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions","https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp"],"examples":["al-khaser_x86.exe_:0x449770","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: delay execution\n authors:\n - michael.hunhoff@mandiant.com\n - \"@ramen0x3f\"\n lib: 'true'\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution [B0003.003]\n references:\n - https://docs.microsoft.com/en-us/windows/win32/sync/wait-functions\n - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/TimingAttacks/timing.cpp\n examples:\n - al-khaser_x86.exe_:0x449770\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402FA6\n features:\n - or:\n - and:\n - os: windows\n - or:\n - api: kernel32.Sleep\n - api: kernel32.SleepEx\n - api: kernel32.WaitForSingleObject\n - api: kernel32.SignalObjectAndWait\n - api: kernel32.WaitForSingleObjectEx\n - api: kernel32.WaitForMultipleObjects\n - api: kernel32.WaitForMultipleObjectsEx\n - api: kernel32.RegisterWaitForSingleObject\n - api: WaitOnAddress\n - api: user32.MsgWaitForMultipleObjects\n - api: user32.MsgWaitForMultipleObjectsEx\n - api: NtDelayExecution\n - api: KeWaitForSingleObject\n - api: KeDelayExecutionThread\n - and:\n - os: linux\n - or:\n - api: sleep\n - api: usleep\n","matches":[[{"type":"thread","value":[2456,3052,1960]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"os","os":"linux"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"usleep"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.Sleep"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.SleepEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.WaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.SignalObjectAndWait"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.WaitForSingleObjectEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.WaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.WaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.RegisterWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"WaitOnAddress"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"user32.MsgWaitForMultipleObjects"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"user32.MsgWaitForMultipleObjectsEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtDelayExecution"}},"children":[],"locations":[{"type":"call","value":[2456,3052,1960,1]},{"type":"call","value":[2456,3052,1960,36]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeWaitForSingleObject"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"KeDelayExecutionThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"allocate memory":{"meta":{"name":"allocate memory","authors":["0x534a@mailbox.org","@mr-tz"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Memory","Allocate Memory"],"objective":"Memory","behavior":"Allocate Memory","method":"","id":"C0007"}],"references":[],"examples":["Practical Malware Analysis Lab 03-03.exe_:0x4010EA","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: allocate memory\n authors:\n - 0x534a@mailbox.org\n - \"@mr-tz\"\n lib: 'true'\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Memory::Allocate Memory [C0007]\n examples:\n - Practical Malware Analysis Lab 03-03.exe_:0x4010EA\n - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA # ntdll.NtAllocateVirtualMemory\n features:\n - or:\n - api: kernel32.VirtualAlloc\n - api: kernel32.VirtualAllocEx\n - api: kernel32.VirtualAllocExNuma\n - api: NtAllocateVirtualMemory\n - api: ZwAllocateVirtualMemory\n - api: NtMapViewOfSection\n - api: ZwMapViewOfSection\n - and:\n - match: link function at runtime on Windows\n - or:\n - string: \"VirtualAlloc\"\n - string: \"VirtualAllocEx\"\n - string: \"VirtualAllocExNuma\"\n - string: \"NtAllocateVirtualMemory\"\n - string: \"ZwAllocateVirtualMemory\"\n - string: \"NtMapViewOfSection\"\n - string: \"ZwMapViewOfSection\"\n","matches":[[{"type":"thread","value":[2456,3052,1960]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2456,3052,1960,150]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2456,3052,3064]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,17]},{"type":"call","value":[2456,3052,3064,149]},{"type":"call","value":[2456,3052,3064,483]},{"type":"call","value":[2456,3052,3064,982]},{"type":"call","value":[2456,3052,3064,158]},{"type":"call","value":[2456,3052,3064,942]},{"type":"call","value":[2456,3052,3064,482]},{"type":"call","value":[2456,3052,3064,16]},{"type":"call","value":[2456,3052,3064,803]},{"type":"call","value":[2456,3052,3064,938]},{"type":"call","value":[2456,3052,3064,147]},{"type":"call","value":[2456,3052,3064,986]},{"type":"call","value":[2456,3052,3064,815]},{"type":"call","value":[2456,3052,3064,937]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,372]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,225]},{"type":"call","value":[2456,3052,3064,146]},{"type":"call","value":[2456,3052,3064,148]},{"type":"call","value":[2456,3052,3064,154]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,299]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2456,3052,2792]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,830]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2192,1476]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[3052,2192,1476,138]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2192,2204]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,142]},{"type":"call","value":[3052,2192,2204,345]},{"type":"call","value":[3052,2192,2204,150]},{"type":"call","value":[3052,2192,2204,477]},{"type":"call","value":[3052,2192,2204,140]},{"type":"call","value":[3052,2192,2204,478]},{"type":"call","value":[3052,2192,2204,16]},{"type":"call","value":[3052,2192,2204,17]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,365]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,217]},{"type":"call","value":[3052,2192,2204,139]},{"type":"call","value":[3052,2192,2204,146]},{"type":"call","value":[3052,2192,2204,141]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,291]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,1180,500]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,149]},{"type":"call","value":[3052,1180,500,479]},{"type":"call","value":[3052,1180,500,344]},{"type":"call","value":[3052,1180,500,717]},{"type":"call","value":[3052,1180,500,138]},{"type":"call","value":[3052,1180,500,16]},{"type":"call","value":[3052,1180,500,140]},{"type":"call","value":[3052,1180,500,15]},{"type":"call","value":[3052,1180,500,478]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,693]},{"type":"call","value":[3052,1180,500,694]},{"type":"call","value":[3052,1180,500,364]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,137]},{"type":"call","value":[3052,1180,500,216]},{"type":"call","value":[3052,1180,500,139]},{"type":"call","value":[3052,1180,500,145]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,290]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,690]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,1180,1692]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[3052,1180,1692,141]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2852,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,36]},{"type":"call","value":[3052,2852,2804,67]},{"type":"call","value":[3052,2852,2804,34]},{"type":"call","value":[3052,2852,2804,53]},{"type":"call","value":[3052,2852,2804,66]},{"type":"call","value":[3052,2852,2804,69]},{"type":"call","value":[3052,2852,2804,110]},{"type":"call","value":[3052,2852,2804,33]},{"type":"call","value":[3052,2852,2804,68]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,86]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2852,2868]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2868,1566]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2868,1382]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2868,1498]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2852,2900,3000]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2852,2900,3000,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2852,2900,3004]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2852,2900,3004,28]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2852,2900,2904]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,38]},{"type":"call","value":[2852,2900,2904,50]},{"type":"call","value":[2852,2900,2904,48]},{"type":"call","value":[2852,2900,2904,25]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2852,2900,2032]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2032,32]},{"type":"call","value":[2852,2900,2032,33]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,920]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,19]},{"type":"call","value":[1180,1852,920,54]},{"type":"call","value":[1180,1852,920,186]},{"type":"call","value":[1180,1852,920,25]},{"type":"call","value":[1180,1852,920,195]},{"type":"call","value":[1180,1852,920,185]},{"type":"call","value":[1180,1852,920,18]},{"type":"call","value":[1180,1852,920,53]},{"type":"call","value":[1180,1852,920,17]},{"type":"call","value":[1180,1852,920,184]},{"type":"call","value":[1180,1852,920,52]},{"type":"call","value":[1180,1852,920,20]},{"type":"call","value":[1180,1852,920,26]},{"type":"call","value":[1180,1852,920,55]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,30]},{"type":"call","value":[1180,1852,920,174]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,92]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2596]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2596,4870]},{"type":"call","value":[1180,1852,2596,1935]},{"type":"call","value":[1180,1852,2596,492]},{"type":"call","value":[1180,1852,2596,1279]},{"type":"call","value":[1180,1852,2596,4879]},{"type":"call","value":[1180,1852,2596,1276]},{"type":"call","value":[1180,1852,2596,4943]},{"type":"call","value":[1180,1852,2596,3207]},{"type":"call","value":[1180,1852,2596,4940]},{"type":"call","value":[1180,1852,2596,1239]},{"type":"call","value":[1180,1852,2596,1477]},{"type":"call","value":[1180,1852,2596,1855]},{"type":"call","value":[1180,1852,2596,1254]},{"type":"call","value":[1180,1852,2596,717]},{"type":"call","value":[1180,1852,2596,4863]},{"type":"call","value":[1180,1852,2596,302]},{"type":"call","value":[1180,1852,2596,1568]},{"type":"call","value":[1180,1852,2596,1861]},{"type":"call","value":[1180,1852,2596,4927]},{"type":"call","value":[1180,1852,2596,497]},{"type":"call","value":[1180,1852,2596,1336]},{"type":"call","value":[1180,1852,2596,1833]},{"type":"call","value":[1180,1852,2596,2016]},{"type":"call","value":[1180,1852,2596,1839]},{"type":"call","value":[1180,1852,2596,1238]},{"type":"call","value":[1180,1852,2596,4182]},{"type":"call","value":[1180,1852,2596,646]},{"type":"call","value":[1180,1852,2596,2873]},{"type":"call","value":[1180,1852,2596,1561]},{"type":"call","value":[1180,1852,2596,3120]},{"type":"call","value":[1180,1852,2596,1320]},{"type":"call","value":[1180,1852,2596,719]},{"type":"call","value":[1180,1852,2596,1558]},{"type":"call","value":[1180,1852,2596,1866]},{"type":"call","value":[1180,1852,2596,2879]},{"type":"call","value":[1180,1852,2596,1567]},{"type":"call","value":[1180,1852,2596,4926]},{"type":"call","value":[1180,1852,2596,4938]},{"type":"call","value":[1180,1852,2596,1097]},{"type":"call","value":[1180,1852,2596,496]},{"type":"call","value":[1180,1852,2596,1936]},{"type":"call","value":[1180,1852,2596,4935]},{"type":"call","value":[1180,1852,2596,5130]},{"type":"call","value":[1180,1852,2596,209]},{"type":"call","value":[1180,1852,2596,3208]},{"type":"call","value":[1180,1852,2596,1234]},{"type":"call","value":[1180,1852,2596,1231]},{"type":"call","value":[1180,1852,2596,706]},{"type":"call","value":[1180,1852,2596,2866]},{"type":"call","value":[1180,1852,2596,4858]},{"type":"call","value":[1180,1852,2596,4855]},{"type":"call","value":[1180,1852,2596,3360]},{"type":"call","value":[1180,1852,2596,489]},{"type":"call","value":[1180,1852,2596,2289]},{"type":"call","value":[1180,1852,2596,4928]},{"type":"call","value":[1180,1852,2596,1273]},{"type":"call","value":[1180,1852,2596,1633]},{"type":"call","value":[1180,1852,2596,498]},{"type":"call","value":[1180,1852,2596,3616]},{"type":"call","value":[1180,1852,2596,4882]},{"type":"call","value":[1180,1852,2596,5129]},{"type":"call","value":[1180,1852,2596,644]},{"type":"call","value":[1180,1852,2596,2017]},{"type":"call","value":[1180,1852,2596,2377]},{"type":"call","value":[1180,1852,2596,2868]},{"type":"call","value":[1180,1852,2596,5080]},{"type":"call","value":[1180,1852,2596,4851]},{"type":"call","value":[1180,1852,2596,180]},{"type":"call","value":[1180,1852,2596,1260]},{"type":"call","value":[1180,1852,2596,1858]},{"type":"call","value":[1180,1852,2596,1257]},{"type":"call","value":[1180,1852,2596,2889]},{"type":"call","value":[1180,1852,2596,1339]},{"type":"call","value":[1180,1852,2596,3859]},{"type":"call","value":[1180,1852,2596,4939]},{"type":"call","value":[1180,1852,2596,4228]},{"type":"call","value":[1180,1852,2596,4588]},{"type":"call","value":[1180,1852,2596,1836]},{"type":"call","value":[1180,1852,2596,701]},{"type":"call","value":[1180,1852,2596,2867]},{"type":"call","value":[1180,1852,2596,1317]},{"type":"call","value":[1180,1852,2596,4850]},{"type":"call","value":[1180,1852,2596,301]},{"type":"call","value":[1180,1852,2596,179]},{"type":"call","value":[1180,1852,2596,1564]},{"type":"call","value":[1180,1852,2596,3190]},{"type":"call","value":[1180,1852,2596,3123]},{"type":"call","value":[1180,1852,2596,307]},{"type":"call","value":[1180,1852,2596,3254]},{"type":"call","value":[1180,1852,2596,4932]},{"type":"call","value":[1180,1852,2596,1707]},{"type":"call","value":[1180,1852,2596,1237]},{"type":"call","value":[1180,1852,2596,645]},{"type":"call","value":[1180,1852,2596,2335]},{"type":"call","value":[1180,1852,2596,4852]},{"type":"call","value":[1180,1852,2596,718]},{"type":"call","value":[1180,1852,2596,3662]},{"type":"call","value":[1180,1852,2596,181]},{"type":"call","value":[1180,1852,2596,1325]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,764]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,764,304]},{"type":"call","value":[1180,1852,764,313]},{"type":"call","value":[1180,1852,764,316]},{"type":"call","value":[1180,1852,764,306]},{"type":"call","value":[1180,1852,764,303]},{"type":"call","value":[1180,1852,764,579]},{"type":"call","value":[1180,1852,764,315]},{"type":"call","value":[1180,1852,764,305]},{"type":"call","value":[1180,1852,764,314]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1180,1852,764,597]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1180,1852,764,372]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1180,1852,764,524]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1156]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,929]},{"type":"call","value":[1180,1852,1156,2344]},{"type":"call","value":[1180,1852,1156,5010]},{"type":"call","value":[1180,1852,1156,2948]},{"type":"call","value":[1180,1852,1156,806]},{"type":"call","value":[1180,1852,1156,4952]},{"type":"call","value":[1180,1852,1156,3727]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1028]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1028,944]},{"type":"call","value":[1180,1852,1028,945]},{"type":"call","value":[1180,1852,1028,3488]},{"type":"call","value":[1180,1852,1028,3489]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2828]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,4238]},{"type":"call","value":[1180,1852,2828,4239]},{"type":"call","value":[1180,1852,2828,4237]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2856]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2856,1007]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2784]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2784,4721]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,236]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1420]},{"type":"call","value":[1180,1852,236,1085]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1476]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1476,1599]},{"type":"call","value":[1180,1852,1476,1600]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1020]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1020,3087]},{"type":"call","value":[1180,1852,1020,2975]},{"type":"call","value":[1180,1852,1020,3072]},{"type":"call","value":[1180,1852,1020,3039]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1020,2718]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1876]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1876,5140]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1200]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1200,3783]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2444]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2444,5065]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[792,1224,1660]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[792,1224,1660,8]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[792,1224,2540]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[792,1224,2540,213]},{"type":"call","value":[792,1224,2540,726]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[792,1224,2540,865]},{"type":"call","value":[792,1224,2540,1411]},{"type":"call","value":[792,1224,2540,755]},{"type":"call","value":[792,1224,2540,993]},{"type":"call","value":[792,1224,2540,883]},{"type":"call","value":[792,1224,2540,1121]},{"type":"call","value":[792,1224,2540,1011]},{"type":"call","value":[792,1224,2540,1249]},{"type":"call","value":[792,1224,2540,1139]},{"type":"call","value":[792,1224,2540,1377]},{"type":"call","value":[792,1224,2540,1267]},{"type":"call","value":[792,1224,2540,1505]},{"type":"call","value":[792,1224,2540,849]},{"type":"call","value":[792,1224,2540,1395]},{"type":"call","value":[792,1224,2540,977]},{"type":"call","value":[792,1224,2540,1523]},{"type":"call","value":[792,1224,2540,748]},{"type":"call","value":[792,1224,2540,867]},{"type":"call","value":[792,1224,2540,1105]},{"type":"call","value":[792,1224,2540,995]},{"type":"call","value":[792,1224,2540,1233]},{"type":"call","value":[792,1224,2540,885]},{"type":"call","value":[792,1224,2540,1123]},{"type":"call","value":[792,1224,2540,1361]},{"type":"call","value":[792,1224,2540,1013]},{"type":"call","value":[792,1224,2540,1251]},{"type":"call","value":[792,1224,2540,1141]},{"type":"call","value":[792,1224,2540,1379]},{"type":"call","value":[792,1224,2540,1269]},{"type":"call","value":[792,1224,2540,1507]},{"type":"call","value":[792,1224,2540,851]},{"type":"call","value":[792,1224,2540,1397]},{"type":"call","value":[792,1224,2540,979]},{"type":"call","value":[792,1224,2540,1525]},{"type":"call","value":[792,1224,2540,869]},{"type":"call","value":[792,1224,2540,1107]},{"type":"call","value":[792,1224,2540,997]},{"type":"call","value":[792,1224,2540,1235]},{"type":"call","value":[792,1224,2540,1125]},{"type":"call","value":[792,1224,2540,1363]},{"type":"call","value":[792,1224,2540,1253]},{"type":"call","value":[792,1224,2540,1491]},{"type":"call","value":[792,1224,2540,835]},{"type":"call","value":[792,1224,2540,1381]},{"type":"call","value":[792,1224,2540,963]},{"type":"call","value":[792,1224,2540,1509]},{"type":"call","value":[792,1224,2540,853]},{"type":"call","value":[792,1224,2540,1399]},{"type":"call","value":[792,1224,2540,1091]},{"type":"call","value":[792,1224,2540,981]},{"type":"call","value":[792,1224,2540,1527]},{"type":"call","value":[792,1224,2540,871]},{"type":"call","value":[792,1224,2540,1109]},{"type":"call","value":[792,1224,2540,999]},{"type":"call","value":[792,1224,2540,1237]},{"type":"call","value":[792,1224,2540,1127]},{"type":"call","value":[792,1224,2540,1365]},{"type":"call","value":[792,1224,2540,1255]},{"type":"call","value":[792,1224,2540,1493]},{"type":"call","value":[792,1224,2540,837]},{"type":"call","value":[792,1224,2540,1383]},{"type":"call","value":[792,1224,2540,965]},{"type":"call","value":[792,1224,2540,1511]},{"type":"call","value":[792,1224,2540,855]},{"type":"call","value":[792,1224,2540,1093]},{"type":"call","value":[792,1224,2540,983]},{"type":"call","value":[792,1224,2540,1221]},{"type":"call","value":[792,1224,2540,1111]},{"type":"call","value":[792,1224,2540,1349]},{"type":"call","value":[792,1224,2540,1239]},{"type":"call","value":[792,1224,2540,1477]},{"type":"call","value":[792,1224,2540,1129]},{"type":"call","value":[792,1224,2540,821]},{"type":"call","value":[792,1224,2540,1367]},{"type":"call","value":[792,1224,2540,1257]},{"type":"call","value":[792,1224,2540,1495]},{"type":"call","value":[792,1224,2540,839]},{"type":"call","value":[792,1224,2540,1385]},{"type":"call","value":[792,1224,2540,967]},{"type":"call","value":[792,1224,2540,1513]},{"type":"call","value":[792,1224,2540,857]},{"type":"call","value":[792,1224,2540,1095]},{"type":"call","value":[792,1224,2540,985]},{"type":"call","value":[792,1224,2540,1223]},{"type":"call","value":[792,1224,2540,1113]},{"type":"call","value":[792,1224,2540,1351]},{"type":"call","value":[792,1224,2540,1241]},{"type":"call","value":[792,1224,2540,1479]},{"type":"call","value":[792,1224,2540,823]},{"type":"call","value":[792,1224,2540,1369]},{"type":"call","value":[792,1224,2540,951]},{"type":"call","value":[792,1224,2540,1497]},{"type":"call","value":[792,1224,2540,841]},{"type":"call","value":[792,1224,2540,1079]},{"type":"call","value":[792,1224,2540,969]},{"type":"call","value":[792,1224,2540,1207]},{"type":"call","value":[792,1224,2540,859]},{"type":"call","value":[792,1224,2540,1097]},{"type":"call","value":[792,1224,2540,1335]},{"type":"call","value":[792,1224,2540,987]},{"type":"call","value":[792,1224,2540,1225]},{"type":"call","value":[792,1224,2540,1115]},{"type":"call","value":[792,1224,2540,1353]},{"type":"call","value":[792,1224,2540,1243]},{"type":"call","value":[792,1224,2540,1481]},{"type":"call","value":[792,1224,2540,825]},{"type":"call","value":[792,1224,2540,1371]},{"type":"call","value":[792,1224,2540,953]},{"type":"call","value":[792,1224,2540,1499]},{"type":"call","value":[792,1224,2540,843]},{"type":"call","value":[792,1224,2540,1081]},{"type":"call","value":[792,1224,2540,971]},{"type":"call","value":[792,1224,2540,1209]},{"type":"call","value":[792,1224,2540,1099]},{"type":"call","value":[792,1224,2540,1337]},{"type":"call","value":[792,1224,2540,1227]},{"type":"call","value":[792,1224,2540,1465]},{"type":"call","value":[792,1224,2540,809]},{"type":"call","value":[792,1224,2540,1355]},{"type":"call","value":[792,1224,2540,937]},{"type":"call","value":[792,1224,2540,1483]},{"type":"call","value":[792,1224,2540,827]},{"type":"call","value":[792,1224,2540,1373]},{"type":"call","value":[792,1224,2540,1065]},{"type":"call","value":[792,1224,2540,955]},{"type":"call","value":[792,1224,2540,1501]},{"type":"call","value":[792,1224,2540,845]},{"type":"call","value":[792,1224,2540,1083]},{"type":"call","value":[792,1224,2540,973]},{"type":"call","value":[792,1224,2540,1211]},{"type":"call","value":[792,1224,2540,1101]},{"type":"call","value":[792,1224,2540,1339]},{"type":"call","value":[792,1224,2540,1229]},{"type":"call","value":[792,1224,2540,1467]},{"type":"call","value":[792,1224,2540,811]},{"type":"call","value":[792,1224,2540,1357]},{"type":"call","value":[792,1224,2540,939]},{"type":"call","value":[792,1224,2540,1485]},{"type":"call","value":[792,1224,2540,829]},{"type":"call","value":[792,1224,2540,1067]},{"type":"call","value":[792,1224,2540,957]},{"type":"call","value":[792,1224,2540,1195]},{"type":"call","value":[792,1224,2540,1085]},{"type":"call","value":[792,1224,2540,1323]},{"type":"call","value":[792,1224,2540,975]},{"type":"call","value":[792,1224,2540,1213]},{"type":"call","value":[792,1224,2540,1451]},{"type":"call","value":[792,1224,2540,1103]},{"type":"call","value":[792,1224,2540,1341]},{"type":"call","value":[792,1224,2540,1231]},{"type":"call","value":[792,1224,2540,1469]},{"type":"call","value":[792,1224,2540,813]},{"type":"call","value":[792,1224,2540,1359]},{"type":"call","value":[792,1224,2540,941]},{"type":"call","value":[792,1224,2540,1487]},{"type":"call","value":[792,1224,2540,831]},{"type":"call","value":[792,1224,2540,1069]},{"type":"call","value":[792,1224,2540,959]},{"type":"call","value":[792,1224,2540,1197]},{"type":"call","value":[792,1224,2540,1087]},{"type":"call","value":[792,1224,2540,1325]},{"type":"call","value":[792,1224,2540,1215]},{"type":"call","value":[792,1224,2540,1453]},{"type":"call","value":[792,1224,2540,797]},{"type":"call","value":[792,1224,2540,1343]},{"type":"call","value":[792,1224,2540,925]},{"type":"call","value":[792,1224,2540,1471]},{"type":"call","value":[792,1224,2540,815]},{"type":"call","value":[792,1224,2540,1053]},{"type":"call","value":[792,1224,2540,943]},{"type":"call","value":[792,1224,2540,1489]},{"type":"call","value":[792,1224,2540,1181]},{"type":"call","value":[792,1224,2540,833]},{"type":"call","value":[792,1224,2540,1071]},{"type":"call","value":[792,1224,2540,961]},{"type":"call","value":[792,1224,2540,1199]},{"type":"call","value":[792,1224,2540,1089]},{"type":"call","value":[792,1224,2540,1327]},{"type":"call","value":[792,1224,2540,1217]},{"type":"call","value":[792,1224,2540,1455]},{"type":"call","value":[792,1224,2540,799]},{"type":"call","value":[792,1224,2540,1345]},{"type":"call","value":[792,1224,2540,927]},{"type":"call","value":[792,1224,2540,1473]},{"type":"call","value":[792,1224,2540,817]},{"type":"call","value":[792,1224,2540,1055]},{"type":"call","value":[792,1224,2540,945]},{"type":"call","value":[792,1224,2540,1183]},{"type":"call","value":[792,1224,2540,1073]},{"type":"call","value":[792,1224,2540,1311]},{"type":"call","value":[792,1224,2540,1201]},{"type":"call","value":[792,1224,2540,1439]},{"type":"call","value":[792,1224,2540,783]},{"type":"call","value":[792,1224,2540,1329]},{"type":"call","value":[792,1224,2540,1219]},{"type":"call","value":[792,1224,2540,911]},{"type":"call","value":[792,1224,2540,1457]},{"type":"call","value":[792,1224,2540,801]},{"type":"call","value":[792,1224,2540,1347]},{"type":"call","value":[792,1224,2540,929]},{"type":"call","value":[792,1224,2540,1475]},{"type":"call","value":[792,1224,2540,819]},{"type":"call","value":[792,1224,2540,1057]},{"type":"call","value":[792,1224,2540,947]},{"type":"call","value":[792,1224,2540,1185]},{"type":"call","value":[792,1224,2540,1075]},{"type":"call","value":[792,1224,2540,1313]},{"type":"call","value":[792,1224,2540,1203]},{"type":"call","value":[792,1224,2540,1441]},{"type":"call","value":[792,1224,2540,785]},{"type":"call","value":[792,1224,2540,1331]},{"type":"call","value":[792,1224,2540,913]},{"type":"call","value":[792,1224,2540,1459]},{"type":"call","value":[792,1224,2540,803]},{"type":"call","value":[792,1224,2540,1041]},{"type":"call","value":[792,1224,2540,931]},{"type":"call","value":[792,1224,2540,1169]},{"type":"call","value":[792,1224,2540,1059]},{"type":"call","value":[792,1224,2540,1297]},{"type":"call","value":[792,1224,2540,949]},{"type":"call","value":[792,1224,2540,1187]},{"type":"call","value":[792,1224,2540,1425]},{"type":"call","value":[792,1224,2540,1077]},{"type":"call","value":[792,1224,2540,1315]},{"type":"call","value":[792,1224,2540,1205]},{"type":"call","value":[792,1224,2540,1443]},{"type":"call","value":[792,1224,2540,787]},{"type":"call","value":[792,1224,2540,1333]},{"type":"call","value":[792,1224,2540,915]},{"type":"call","value":[792,1224,2540,1461]},{"type":"call","value":[792,1224,2540,805]},{"type":"call","value":[792,1224,2540,1043]},{"type":"call","value":[792,1224,2540,933]},{"type":"call","value":[792,1224,2540,1171]},{"type":"call","value":[792,1224,2540,1061]},{"type":"call","value":[792,1224,2540,1299]},{"type":"call","value":[792,1224,2540,1189]},{"type":"call","value":[792,1224,2540,1427]},{"type":"call","value":[792,1224,2540,771]},{"type":"call","value":[792,1224,2540,1317]},{"type":"call","value":[792,1224,2540,899]},{"type":"call","value":[792,1224,2540,1445]},{"type":"call","value":[792,1224,2540,789]},{"type":"call","value":[792,1224,2540,1027]},{"type":"call","value":[792,1224,2540,917]},{"type":"call","value":[792,1224,2540,1463]},{"type":"call","value":[792,1224,2540,1155]},{"type":"call","value":[792,1224,2540,807]},{"type":"call","value":[792,1224,2540,1045]},{"type":"call","value":[792,1224,2540,935]},{"type":"call","value":[792,1224,2540,1173]},{"type":"call","value":[792,1224,2540,1063]},{"type":"call","value":[792,1224,2540,1301]},{"type":"call","value":[792,1224,2540,1191]},{"type":"call","value":[792,1224,2540,1429]},{"type":"call","value":[792,1224,2540,773]},{"type":"call","value":[792,1224,2540,1319]},{"type":"call","value":[792,1224,2540,901]},{"type":"call","value":[792,1224,2540,1447]},{"type":"call","value":[792,1224,2540,791]},{"type":"call","value":[792,1224,2540,1029]},{"type":"call","value":[792,1224,2540,919]},{"type":"call","value":[792,1224,2540,1157]},{"type":"call","value":[792,1224,2540,1047]},{"type":"call","value":[792,1224,2540,1285]},{"type":"call","value":[792,1224,2540,1175]},{"type":"call","value":[792,1224,2540,1413]},{"type":"call","value":[792,1224,2540,757]},{"type":"call","value":[792,1224,2540,1303]},{"type":"call","value":[792,1224,2540,1193]},{"type":"call","value":[792,1224,2540,1431]},{"type":"call","value":[792,1224,2540,775]},{"type":"call","value":[792,1224,2540,1321]},{"type":"call","value":[792,1224,2540,903]},{"type":"call","value":[792,1224,2540,1449]},{"type":"call","value":[792,1224,2540,793]},{"type":"call","value":[792,1224,2540,1031]},{"type":"call","value":[792,1224,2540,921]},{"type":"call","value":[792,1224,2540,1159]},{"type":"call","value":[792,1224,2540,1049]},{"type":"call","value":[792,1224,2540,1287]},{"type":"call","value":[792,1224,2540,1177]},{"type":"call","value":[792,1224,2540,1415]},{"type":"call","value":[792,1224,2540,759]},{"type":"call","value":[792,1224,2540,1305]},{"type":"call","value":[792,1224,2540,887]},{"type":"call","value":[792,1224,2540,1433]},{"type":"call","value":[792,1224,2540,777]},{"type":"call","value":[792,1224,2540,1015]},{"type":"call","value":[792,1224,2540,905]},{"type":"call","value":[792,1224,2540,1143]},{"type":"call","value":[792,1224,2540,795]},{"type":"call","value":[792,1224,2540,1033]},{"type":"call","value":[792,1224,2540,1271]},{"type":"call","value":[792,1224,2540,923]},{"type":"call","value":[792,1224,2540,1161]},{"type":"call","value":[792,1224,2540,1051]},{"type":"call","value":[792,1224,2540,1289]},{"type":"call","value":[792,1224,2540,1179]},{"type":"call","value":[792,1224,2540,1417]},{"type":"call","value":[792,1224,2540,761]},{"type":"call","value":[792,1224,2540,1307]},{"type":"call","value":[792,1224,2540,889]},{"type":"call","value":[792,1224,2540,1435]},{"type":"call","value":[792,1224,2540,779]},{"type":"call","value":[792,1224,2540,1017]},{"type":"call","value":[792,1224,2540,907]},{"type":"call","value":[792,1224,2540,1145]},{"type":"call","value":[792,1224,2540,1035]},{"type":"call","value":[792,1224,2540,1273]},{"type":"call","value":[792,1224,2540,1163]},{"type":"call","value":[792,1224,2540,1401]},{"type":"call","value":[792,1224,2540,1291]},{"type":"call","value":[792,1224,2540,1529]},{"type":"call","value":[792,1224,2540,873]},{"type":"call","value":[792,1224,2540,1419]},{"type":"call","value":[792,1224,2540,763]},{"type":"call","value":[792,1224,2540,1309]},{"type":"call","value":[792,1224,2540,1001]},{"type":"call","value":[792,1224,2540,891]},{"type":"call","value":[792,1224,2540,1437]},{"type":"call","value":[792,1224,2540,781]},{"type":"call","value":[792,1224,2540,1019]},{"type":"call","value":[792,1224,2540,909]},{"type":"call","value":[792,1224,2540,1147]},{"type":"call","value":[792,1224,2540,1037]},{"type":"call","value":[792,1224,2540,1275]},{"type":"call","value":[792,1224,2540,1165]},{"type":"call","value":[792,1224,2540,1403]},{"type":"call","value":[792,1224,2540,1293]},{"type":"call","value":[792,1224,2540,1531]},{"type":"call","value":[792,1224,2540,875]},{"type":"call","value":[792,1224,2540,1421]},{"type":"call","value":[792,1224,2540,765]},{"type":"call","value":[792,1224,2540,1003]},{"type":"call","value":[792,1224,2540,893]},{"type":"call","value":[792,1224,2540,1131]},{"type":"call","value":[792,1224,2540,1021]},{"type":"call","value":[792,1224,2540,1259]},{"type":"call","value":[792,1224,2540,1149]},{"type":"call","value":[792,1224,2540,1387]},{"type":"call","value":[792,1224,2540,1039]},{"type":"call","value":[792,1224,2540,1277]},{"type":"call","value":[792,1224,2540,1515]},{"type":"call","value":[792,1224,2540,1167]},{"type":"call","value":[792,1224,2540,1405]},{"type":"call","value":[792,1224,2540,1295]},{"type":"call","value":[792,1224,2540,1533]},{"type":"call","value":[792,1224,2540,877]},{"type":"call","value":[792,1224,2540,1423]},{"type":"call","value":[792,1224,2540,767]},{"type":"call","value":[792,1224,2540,1005]},{"type":"call","value":[792,1224,2540,895]},{"type":"call","value":[792,1224,2540,1133]},{"type":"call","value":[792,1224,2540,1023]},{"type":"call","value":[792,1224,2540,1261]},{"type":"call","value":[792,1224,2540,1151]},{"type":"call","value":[792,1224,2540,1389]},{"type":"call","value":[792,1224,2540,1279]},{"type":"call","value":[792,1224,2540,1517]},{"type":"call","value":[792,1224,2540,861]},{"type":"call","value":[792,1224,2540,1407]},{"type":"call","value":[792,1224,2540,751]},{"type":"call","value":[792,1224,2540,989]},{"type":"call","value":[792,1224,2540,1535]},{"type":"call","value":[792,1224,2540,879]},{"type":"call","value":[792,1224,2540,1117]},{"type":"call","value":[792,1224,2540,769]},{"type":"call","value":[792,1224,2540,1007]},{"type":"call","value":[792,1224,2540,1245]},{"type":"call","value":[792,1224,2540,897]},{"type":"call","value":[792,1224,2540,1135]},{"type":"call","value":[792,1224,2540,1025]},{"type":"call","value":[792,1224,2540,1263]},{"type":"call","value":[792,1224,2540,1153]},{"type":"call","value":[792,1224,2540,1391]},{"type":"call","value":[792,1224,2540,1281]},{"type":"call","value":[792,1224,2540,1519]},{"type":"call","value":[792,1224,2540,863]},{"type":"call","value":[792,1224,2540,1409]},{"type":"call","value":[792,1224,2540,753]},{"type":"call","value":[792,1224,2540,991]},{"type":"call","value":[792,1224,2540,1537]},{"type":"call","value":[792,1224,2540,881]},{"type":"call","value":[792,1224,2540,1119]},{"type":"call","value":[792,1224,2540,1009]},{"type":"call","value":[792,1224,2540,1247]},{"type":"call","value":[792,1224,2540,1137]},{"type":"call","value":[792,1224,2540,1375]},{"type":"call","value":[792,1224,2540,1265]},{"type":"call","value":[792,1224,2540,1503]},{"type":"call","value":[792,1224,2540,847]},{"type":"call","value":[792,1224,2540,1393]},{"type":"call","value":[792,1224,2540,1283]},{"type":"call","value":[792,1224,2540,1521]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[792,1224,2540,38]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[792,1224,2540,130]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,1460]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1460,28]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,2544]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2544,312]},{"type":"call","value":[1200,1248,2544,292]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2544,1138]},{"type":"call","value":[1200,1248,2544,1376]},{"type":"call","value":[1200,1248,2544,1202]},{"type":"call","value":[1200,1248,2544,1440]},{"type":"call","value":[1200,1248,2544,1266]},{"type":"call","value":[1200,1248,2544,1504]},{"type":"call","value":[1200,1248,2544,1330]},{"type":"call","value":[1200,1248,2544,1394]},{"type":"call","value":[1200,1248,2544,1458]},{"type":"call","value":[1200,1248,2544,1522]},{"type":"call","value":[1200,1248,2544,1040]},{"type":"call","value":[1200,1248,2544,1104]},{"type":"call","value":[1200,1248,2544,1168]},{"type":"call","value":[1200,1248,2544,1232]},{"type":"call","value":[1200,1248,2544,1058]},{"type":"call","value":[1200,1248,2544,1296]},{"type":"call","value":[1200,1248,2544,1122]},{"type":"call","value":[1200,1248,2544,1360]},{"type":"call","value":[1200,1248,2544,1186]},{"type":"call","value":[1200,1248,2544,1012]},{"type":"call","value":[1200,1248,2544,1424]},{"type":"call","value":[1200,1248,2544,1250]},{"type":"call","value":[1200,1248,2544,1076]},{"type":"call","value":[1200,1248,2544,1488]},{"type":"call","value":[1200,1248,2544,1314]},{"type":"call","value":[1200,1248,2544,1140]},{"type":"call","value":[1200,1248,2544,1378]},{"type":"call","value":[1200,1248,2544,1204]},{"type":"call","value":[1200,1248,2544,1442]},{"type":"call","value":[1200,1248,2544,1268]},{"type":"call","value":[1200,1248,2544,1506]},{"type":"call","value":[1200,1248,2544,1332]},{"type":"call","value":[1200,1248,2544,1396]},{"type":"call","value":[1200,1248,2544,1460]},{"type":"call","value":[1200,1248,2544,1524]},{"type":"call","value":[1200,1248,2544,1042]},{"type":"call","value":[1200,1248,2544,1106]},{"type":"call","value":[1200,1248,2544,1170]},{"type":"call","value":[1200,1248,2544,1234]},{"type":"call","value":[1200,1248,2544,1060]},{"type":"call","value":[1200,1248,2544,1298]},{"type":"call","value":[1200,1248,2544,1124]},{"type":"call","value":[1200,1248,2544,1362]},{"type":"call","value":[1200,1248,2544,1188]},{"type":"call","value":[1200,1248,2544,1426]},{"type":"call","value":[1200,1248,2544,1252]},{"type":"call","value":[1200,1248,2544,1490]},{"type":"call","value":[1200,1248,2544,1316]},{"type":"call","value":[1200,1248,2544,1380]},{"type":"call","value":[1200,1248,2544,1444]},{"type":"call","value":[1200,1248,2544,1508]},{"type":"call","value":[1200,1248,2544,1026]},{"type":"call","value":[1200,1248,2544,1090]},{"type":"call","value":[1200,1248,2544,1462]},{"type":"call","value":[1200,1248,2544,1154]},{"type":"call","value":[1200,1248,2544,1526]},{"type":"call","value":[1200,1248,2544,1218]},{"type":"call","value":[1200,1248,2544,1044]},{"type":"call","value":[1200,1248,2544,1108]},{"type":"call","value":[1200,1248,2544,1172]},{"type":"call","value":[1200,1248,2544,1236]},{"type":"call","value":[1200,1248,2544,1062]},{"type":"call","value":[1200,1248,2544,1300]},{"type":"call","value":[1200,1248,2544,1126]},{"type":"call","value":[1200,1248,2544,1364]},{"type":"call","value":[1200,1248,2544,1190]},{"type":"call","value":[1200,1248,2544,1428]},{"type":"call","value":[1200,1248,2544,1254]},{"type":"call","value":[1200,1248,2544,1492]},{"type":"call","value":[1200,1248,2544,1318]},{"type":"call","value":[1200,1248,2544,1382]},{"type":"call","value":[1200,1248,2544,1446]},{"type":"call","value":[1200,1248,2544,1510]},{"type":"call","value":[1200,1248,2544,1028]},{"type":"call","value":[1200,1248,2544,1092]},{"type":"call","value":[1200,1248,2544,1156]},{"type":"call","value":[1200,1248,2544,1220]},{"type":"call","value":[1200,1248,2544,1046]},{"type":"call","value":[1200,1248,2544,1284]},{"type":"call","value":[1200,1248,2544,1110]},{"type":"call","value":[1200,1248,2544,1348]},{"type":"call","value":[1200,1248,2544,1174]},{"type":"call","value":[1200,1248,2544,1412]},{"type":"call","value":[1200,1248,2544,1238]},{"type":"call","value":[1200,1248,2544,1476]},{"type":"call","value":[1200,1248,2544,1302]},{"type":"call","value":[1200,1248,2544,1366]},{"type":"call","value":[1200,1248,2544,1192]},{"type":"call","value":[1200,1248,2544,1430]},{"type":"call","value":[1200,1248,2544,1256]},{"type":"call","value":[1200,1248,2544,1494]},{"type":"call","value":[1200,1248,2544,1320]},{"type":"call","value":[1200,1248,2544,1384]},{"type":"call","value":[1200,1248,2544,1448]},{"type":"call","value":[1200,1248,2544,1512]},{"type":"call","value":[1200,1248,2544,1030]},{"type":"call","value":[1200,1248,2544,1094]},{"type":"call","value":[1200,1248,2544,1158]},{"type":"call","value":[1200,1248,2544,1222]},{"type":"call","value":[1200,1248,2544,1048]},{"type":"call","value":[1200,1248,2544,1286]},{"type":"call","value":[1200,1248,2544,1112]},{"type":"call","value":[1200,1248,2544,1350]},{"type":"call","value":[1200,1248,2544,1176]},{"type":"call","value":[1200,1248,2544,1414]},{"type":"call","value":[1200,1248,2544,1240]},{"type":"call","value":[1200,1248,2544,1478]},{"type":"call","value":[1200,1248,2544,1304]},{"type":"call","value":[1200,1248,2544,1368]},{"type":"call","value":[1200,1248,2544,1432]},{"type":"call","value":[1200,1248,2544,1496]},{"type":"call","value":[1200,1248,2544,1014]},{"type":"call","value":[1200,1248,2544,1078]},{"type":"call","value":[1200,1248,2544,1142]},{"type":"call","value":[1200,1248,2544,1206]},{"type":"call","value":[1200,1248,2544,1032]},{"type":"call","value":[1200,1248,2544,1270]},{"type":"call","value":[1200,1248,2544,1096]},{"type":"call","value":[1200,1248,2544,1334]},{"type":"call","value":[1200,1248,2544,1160]},{"type":"call","value":[1200,1248,2544,1398]},{"type":"call","value":[1200,1248,2544,1224]},{"type":"call","value":[1200,1248,2544,1050]},{"type":"call","value":[1200,1248,2544,1288]},{"type":"call","value":[1200,1248,2544,1114]},{"type":"call","value":[1200,1248,2544,1352]},{"type":"call","value":[1200,1248,2544,1178]},{"type":"call","value":[1200,1248,2544,1416]},{"type":"call","value":[1200,1248,2544,1242]},{"type":"call","value":[1200,1248,2544,1480]},{"type":"call","value":[1200,1248,2544,1306]},{"type":"call","value":[1200,1248,2544,1370]},{"type":"call","value":[1200,1248,2544,1434]},{"type":"call","value":[1200,1248,2544,1498]},{"type":"call","value":[1200,1248,2544,1016]},{"type":"call","value":[1200,1248,2544,1080]},{"type":"call","value":[1200,1248,2544,1144]},{"type":"call","value":[1200,1248,2544,1208]},{"type":"call","value":[1200,1248,2544,1034]},{"type":"call","value":[1200,1248,2544,1272]},{"type":"call","value":[1200,1248,2544,1098]},{"type":"call","value":[1200,1248,2544,1336]},{"type":"call","value":[1200,1248,2544,442]},{"type":"call","value":[1200,1248,2544,1162]},{"type":"call","value":[1200,1248,2544,1400]},{"type":"call","value":[1200,1248,2544,1226]},{"type":"call","value":[1200,1248,2544,1464]},{"type":"call","value":[1200,1248,2544,1290]},{"type":"call","value":[1200,1248,2544,1528]},{"type":"call","value":[1200,1248,2544,1354]},{"type":"call","value":[1200,1248,2544,1418]},{"type":"call","value":[1200,1248,2544,1482]},{"type":"call","value":[1200,1248,2544,1372]},{"type":"call","value":[1200,1248,2544,1064]},{"type":"call","value":[1200,1248,2544,1436]},{"type":"call","value":[1200,1248,2544,1128]},{"type":"call","value":[1200,1248,2544,1500]},{"type":"call","value":[1200,1248,2544,1018]},{"type":"call","value":[1200,1248,2544,1082]},{"type":"call","value":[1200,1248,2544,1146]},{"type":"call","value":[1200,1248,2544,1210]},{"type":"call","value":[1200,1248,2544,1036]},{"type":"call","value":[1200,1248,2544,1274]},{"type":"call","value":[1200,1248,2544,1100]},{"type":"call","value":[1200,1248,2544,1338]},{"type":"call","value":[1200,1248,2544,1164]},{"type":"call","value":[1200,1248,2544,1402]},{"type":"call","value":[1200,1248,2544,1228]},{"type":"call","value":[1200,1248,2544,1466]},{"type":"call","value":[1200,1248,2544,1292]},{"type":"call","value":[1200,1248,2544,1530]},{"type":"call","value":[1200,1248,2544,1356]},{"type":"call","value":[1200,1248,2544,1420]},{"type":"call","value":[1200,1248,2544,1484]},{"type":"call","value":[1200,1248,2544,1066]},{"type":"call","value":[1200,1248,2544,1130]},{"type":"call","value":[1200,1248,2544,1194]},{"type":"call","value":[1200,1248,2544,1020]},{"type":"call","value":[1200,1248,2544,1258]},{"type":"call","value":[1200,1248,2544,1084]},{"type":"call","value":[1200,1248,2544,1322]},{"type":"call","value":[1200,1248,2544,1148]},{"type":"call","value":[1200,1248,2544,1386]},{"type":"call","value":[1200,1248,2544,1212]},{"type":"call","value":[1200,1248,2544,1450]},{"type":"call","value":[1200,1248,2544,1276]},{"type":"call","value":[1200,1248,2544,1102]},{"type":"call","value":[1200,1248,2544,1514]},{"type":"call","value":[1200,1248,2544,1340]},{"type":"call","value":[1200,1248,2544,1166]},{"type":"call","value":[1200,1248,2544,1404]},{"type":"call","value":[1200,1248,2544,1230]},{"type":"call","value":[1200,1248,2544,1468]},{"type":"call","value":[1200,1248,2544,1294]},{"type":"call","value":[1200,1248,2544,1532]},{"type":"call","value":[1200,1248,2544,1358]},{"type":"call","value":[1200,1248,2544,1422]},{"type":"call","value":[1200,1248,2544,1541]},{"type":"call","value":[1200,1248,2544,1486]},{"type":"call","value":[1200,1248,2544,1068]},{"type":"call","value":[1200,1248,2544,1132]},{"type":"call","value":[1200,1248,2544,1196]},{"type":"call","value":[1200,1248,2544,1022]},{"type":"call","value":[1200,1248,2544,1260]},{"type":"call","value":[1200,1248,2544,1086]},{"type":"call","value":[1200,1248,2544,1324]},{"type":"call","value":[1200,1248,2544,1150]},{"type":"call","value":[1200,1248,2544,1388]},{"type":"call","value":[1200,1248,2544,1214]},{"type":"call","value":[1200,1248,2544,1452]},{"type":"call","value":[1200,1248,2544,1278]},{"type":"call","value":[1200,1248,2544,1516]},{"type":"call","value":[1200,1248,2544,1342]},{"type":"call","value":[1200,1248,2544,1406]},{"type":"call","value":[1200,1248,2544,1470]},{"type":"call","value":[1200,1248,2544,1534]},{"type":"call","value":[1200,1248,2544,1052]},{"type":"call","value":[1200,1248,2544,1116]},{"type":"call","value":[1200,1248,2544,1180]},{"type":"call","value":[1200,1248,2544,1244]},{"type":"call","value":[1200,1248,2544,1070]},{"type":"call","value":[1200,1248,2544,1308]},{"type":"call","value":[1200,1248,2544,1134]},{"type":"call","value":[1200,1248,2544,1198]},{"type":"call","value":[1200,1248,2544,1024]},{"type":"call","value":[1200,1248,2544,1262]},{"type":"call","value":[1200,1248,2544,1088]},{"type":"call","value":[1200,1248,2544,1326]},{"type":"call","value":[1200,1248,2544,1152]},{"type":"call","value":[1200,1248,2544,1390]},{"type":"call","value":[1200,1248,2544,1216]},{"type":"call","value":[1200,1248,2544,1454]},{"type":"call","value":[1200,1248,2544,1280]},{"type":"call","value":[1200,1248,2544,1518]},{"type":"call","value":[1200,1248,2544,1344]},{"type":"call","value":[1200,1248,2544,1408]},{"type":"call","value":[1200,1248,2544,1472]},{"type":"call","value":[1200,1248,2544,1536]},{"type":"call","value":[1200,1248,2544,1054]},{"type":"call","value":[1200,1248,2544,1118]},{"type":"call","value":[1200,1248,2544,1182]},{"type":"call","value":[1200,1248,2544,1246]},{"type":"call","value":[1200,1248,2544,1072]},{"type":"call","value":[1200,1248,2544,1310]},{"type":"call","value":[1200,1248,2544,1136]},{"type":"call","value":[1200,1248,2544,1374]},{"type":"call","value":[1200,1248,2544,1200]},{"type":"call","value":[1200,1248,2544,1438]},{"type":"call","value":[1200,1248,2544,1264]},{"type":"call","value":[1200,1248,2544,1502]},{"type":"call","value":[1200,1248,2544,1328]},{"type":"call","value":[1200,1248,2544,1392]},{"type":"call","value":[1200,1248,2544,1456]},{"type":"call","value":[1200,1248,2544,1282]},{"type":"call","value":[1200,1248,2544,1520]},{"type":"call","value":[1200,1248,2544,1346]},{"type":"call","value":[1200,1248,2544,1038]},{"type":"call","value":[1200,1248,2544,1410]},{"type":"call","value":[1200,1248,2544,1474]},{"type":"call","value":[1200,1248,2544,1538]},{"type":"call","value":[1200,1248,2544,1056]},{"type":"call","value":[1200,1248,2544,1120]},{"type":"call","value":[1200,1248,2544,1184]},{"type":"call","value":[1200,1248,2544,1010]},{"type":"call","value":[1200,1248,2544,1248]},{"type":"call","value":[1200,1248,2544,1074]},{"type":"call","value":[1200,1248,2544,1312]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2544,67]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2544,157]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,732]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1200,1248,732,5906]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1248,1680,3044]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1248,1680,3044,215]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1248,1680,3044,254]},{"type":"call","value":[1248,1680,3044,492]},{"type":"call","value":[1248,1680,3044,1038]},{"type":"call","value":[1248,1680,3044,382]},{"type":"call","value":[1248,1680,3044,620]},{"type":"call","value":[1248,1680,3044,510]},{"type":"call","value":[1248,1680,3044,748]},{"type":"call","value":[1248,1680,3044,638]},{"type":"call","value":[1248,1680,3044,876]},{"type":"call","value":[1248,1680,3044,766]},{"type":"call","value":[1248,1680,3044,1004]},{"type":"call","value":[1248,1680,3044,348]},{"type":"call","value":[1248,1680,3044,894]},{"type":"call","value":[1248,1680,3044,238]},{"type":"call","value":[1248,1680,3044,476]},{"type":"call","value":[1248,1680,3044,1022]},{"type":"call","value":[1248,1680,3044,366]},{"type":"call","value":[1248,1680,3044,604]},{"type":"call","value":[1248,1680,3044,494]},{"type":"call","value":[1248,1680,3044,732]},{"type":"call","value":[1248,1680,3044,622]},{"type":"call","value":[1248,1680,3044,860]},{"type":"call","value":[1248,1680,3044,512]},{"type":"call","value":[1248,1680,3044,750]},{"type":"call","value":[1248,1680,3044,988]},{"type":"call","value":[1248,1680,3044,640]},{"type":"call","value":[1248,1680,3044,878]},{"type":"call","value":[1248,1680,3044,768]},{"type":"call","value":[1248,1680,3044,1006]},{"type":"call","value":[1248,1680,3044,350]},{"type":"call","value":[1248,1680,3044,896]},{"type":"call","value":[1248,1680,3044,478]},{"type":"call","value":[1248,1680,3044,1024]},{"type":"call","value":[1248,1680,3044,368]},{"type":"call","value":[1248,1680,3044,606]},{"type":"call","value":[1248,1680,3044,496]},{"type":"call","value":[1248,1680,3044,734]},{"type":"call","value":[1248,1680,3044,624]},{"type":"call","value":[1248,1680,3044,862]},{"type":"call","value":[1248,1680,3044,752]},{"type":"call","value":[1248,1680,3044,990]},{"type":"call","value":[1248,1680,3044,334]},{"type":"call","value":[1248,1680,3044,880]},{"type":"call","value":[1248,1680,3044,462]},{"type":"call","value":[1248,1680,3044,1008]},{"type":"call","value":[1248,1680,3044,352]},{"type":"call","value":[1248,1680,3044,590]},{"type":"call","value":[1248,1680,3044,242]},{"type":"call","value":[1248,1680,3044,480]},{"type":"call","value":[1248,1680,3044,1026]},{"type":"call","value":[1248,1680,3044,718]},{"type":"call","value":[1248,1680,3044,370]},{"type":"call","value":[1248,1680,3044,608]},{"type":"call","value":[1248,1680,3044,498]},{"type":"call","value":[1248,1680,3044,736]},{"type":"call","value":[1248,1680,3044,626]},{"type":"call","value":[1248,1680,3044,864]},{"type":"call","value":[1248,1680,3044,754]},{"type":"call","value":[1248,1680,3044,992]},{"type":"call","value":[1248,1680,3044,336]},{"type":"call","value":[1248,1680,3044,882]},{"type":"call","value":[1248,1680,3044,464]},{"type":"call","value":[1248,1680,3044,1010]},{"type":"call","value":[1248,1680,3044,354]},{"type":"call","value":[1248,1680,3044,592]},{"type":"call","value":[1248,1680,3044,482]},{"type":"call","value":[1248,1680,3044,720]},{"type":"call","value":[1248,1680,3044,610]},{"type":"call","value":[1248,1680,3044,848]},{"type":"call","value":[1248,1680,3044,738]},{"type":"call","value":[1248,1680,3044,976]},{"type":"call","value":[1248,1680,3044,320]},{"type":"call","value":[1248,1680,3044,866]},{"type":"call","value":[1248,1680,3044,756]},{"type":"call","value":[1248,1680,3044,448]},{"type":"call","value":[1248,1680,3044,994]},{"type":"call","value":[1248,1680,3044,338]},{"type":"call","value":[1248,1680,3044,884]},{"type":"call","value":[1248,1680,3044,466]},{"type":"call","value":[1248,1680,3044,1012]},{"type":"call","value":[1248,1680,3044,356]},{"type":"call","value":[1248,1680,3044,594]},{"type":"call","value":[1248,1680,3044,484]},{"type":"call","value":[1248,1680,3044,722]},{"type":"call","value":[1248,1680,3044,612]},{"type":"call","value":[1248,1680,3044,850]},{"type":"call","value":[1248,1680,3044,740]},{"type":"call","value":[1248,1680,3044,978]},{"type":"call","value":[1248,1680,3044,322]},{"type":"call","value":[1248,1680,3044,868]},{"type":"call","value":[1248,1680,3044,450]},{"type":"call","value":[1248,1680,3044,996]},{"type":"call","value":[1248,1680,3044,340]},{"type":"call","value":[1248,1680,3044,578]},{"type":"call","value":[1248,1680,3044,468]},{"type":"call","value":[1248,1680,3044,706]},{"type":"call","value":[1248,1680,3044,596]},{"type":"call","value":[1248,1680,3044,834]},{"type":"call","value":[1248,1680,3044,486]},{"type":"call","value":[1248,1680,3044,724]},{"type":"call","value":[1248,1680,3044,962]},{"type":"call","value":[1248,1680,3044,614]},{"type":"call","value":[1248,1680,3044,852]},{"type":"call","value":[1248,1680,3044,742]},{"type":"call","value":[1248,1680,3044,980]},{"type":"call","value":[1248,1680,3044,324]},{"type":"call","value":[1248,1680,3044,870]},{"type":"call","value":[1248,1680,3044,452]},{"type":"call","value":[1248,1680,3044,998]},{"type":"call","value":[1248,1680,3044,342]},{"type":"call","value":[1248,1680,3044,580]},{"type":"call","value":[1248,1680,3044,470]},{"type":"call","value":[1248,1680,3044,708]},{"type":"call","value":[1248,1680,3044,598]},{"type":"call","value":[1248,1680,3044,836]},{"type":"call","value":[1248,1680,3044,726]},{"type":"call","value":[1248,1680,3044,964]},{"type":"call","value":[1248,1680,3044,308]},{"type":"call","value":[1248,1680,3044,854]},{"type":"call","value":[1248,1680,3044,436]},{"type":"call","value":[1248,1680,3044,982]},{"type":"call","value":[1248,1680,3044,326]},{"type":"call","value":[1248,1680,3044,564]},{"type":"call","value":[1248,1680,3044,454]},{"type":"call","value":[1248,1680,3044,1000]},{"type":"call","value":[1248,1680,3044,344]},{"type":"call","value":[1248,1680,3044,582]},{"type":"call","value":[1248,1680,3044,472]},{"type":"call","value":[1248,1680,3044,710]},{"type":"call","value":[1248,1680,3044,600]},{"type":"call","value":[1248,1680,3044,838]},{"type":"call","value":[1248,1680,3044,728]},{"type":"call","value":[1248,1680,3044,966]},{"type":"call","value":[1248,1680,3044,310]},{"type":"call","value":[1248,1680,3044,856]},{"type":"call","value":[1248,1680,3044,438]},{"type":"call","value":[1248,1680,3044,984]},{"type":"call","value":[1248,1680,3044,328]},{"type":"call","value":[1248,1680,3044,566]},{"type":"call","value":[1248,1680,3044,456]},{"type":"call","value":[1248,1680,3044,694]},{"type":"call","value":[1248,1680,3044,584]},{"type":"call","value":[1248,1680,3044,822]},{"type":"call","value":[1248,1680,3044,712]},{"type":"call","value":[1248,1680,3044,950]},{"type":"call","value":[1248,1680,3044,602]},{"type":"call","value":[1248,1680,3044,294]},{"type":"call","value":[1248,1680,3044,840]},{"type":"call","value":[1248,1680,3044,730]},{"type":"call","value":[1248,1680,3044,968]},{"type":"call","value":[1248,1680,3044,312]},{"type":"call","value":[1248,1680,3044,858]},{"type":"call","value":[1248,1680,3044,440]},{"type":"call","value":[1248,1680,3044,986]},{"type":"call","value":[1248,1680,3044,330]},{"type":"call","value":[1248,1680,3044,568]},{"type":"call","value":[1248,1680,3044,458]},{"type":"call","value":[1248,1680,3044,696]},{"type":"call","value":[1248,1680,3044,586]},{"type":"call","value":[1248,1680,3044,824]},{"type":"call","value":[1248,1680,3044,714]},{"type":"call","value":[1248,1680,3044,952]},{"type":"call","value":[1248,1680,3044,296]},{"type":"call","value":[1248,1680,3044,842]},{"type":"call","value":[1248,1680,3044,424]},{"type":"call","value":[1248,1680,3044,970]},{"type":"call","value":[1248,1680,3044,314]},{"type":"call","value":[1248,1680,3044,552]},{"type":"call","value":[1248,1680,3044,442]},{"type":"call","value":[1248,1680,3044,680]},{"type":"call","value":[1248,1680,3044,332]},{"type":"call","value":[1248,1680,3044,570]},{"type":"call","value":[1248,1680,3044,808]},{"type":"call","value":[1248,1680,3044,460]},{"type":"call","value":[1248,1680,3044,698]},{"type":"call","value":[1248,1680,3044,588]},{"type":"call","value":[1248,1680,3044,826]},{"type":"call","value":[1248,1680,3044,716]},{"type":"call","value":[1248,1680,3044,954]},{"type":"call","value":[1248,1680,3044,298]},{"type":"call","value":[1248,1680,3044,844]},{"type":"call","value":[1248,1680,3044,426]},{"type":"call","value":[1248,1680,3044,972]},{"type":"call","value":[1248,1680,3044,316]},{"type":"call","value":[1248,1680,3044,554]},{"type":"call","value":[1248,1680,3044,444]},{"type":"call","value":[1248,1680,3044,682]},{"type":"call","value":[1248,1680,3044,572]},{"type":"call","value":[1248,1680,3044,810]},{"type":"call","value":[1248,1680,3044,700]},{"type":"call","value":[1248,1680,3044,938]},{"type":"call","value":[1248,1680,3044,282]},{"type":"call","value":[1248,1680,3044,828]},{"type":"call","value":[1248,1680,3044,410]},{"type":"call","value":[1248,1680,3044,956]},{"type":"call","value":[1248,1680,3044,300]},{"type":"call","value":[1248,1680,3044,846]},{"type":"call","value":[1248,1680,3044,538]},{"type":"call","value":[1248,1680,3044,428]},{"type":"call","value":[1248,1680,3044,974]},{"type":"call","value":[1248,1680,3044,318]},{"type":"call","value":[1248,1680,3044,556]},{"type":"call","value":[1248,1680,3044,446]},{"type":"call","value":[1248,1680,3044,684]},{"type":"call","value":[1248,1680,3044,574]},{"type":"call","value":[1248,1680,3044,812]},{"type":"call","value":[1248,1680,3044,702]},{"type":"call","value":[1248,1680,3044,940]},{"type":"call","value":[1248,1680,3044,284]},{"type":"call","value":[1248,1680,3044,830]},{"type":"call","value":[1248,1680,3044,412]},{"type":"call","value":[1248,1680,3044,958]},{"type":"call","value":[1248,1680,3044,302]},{"type":"call","value":[1248,1680,3044,540]},{"type":"call","value":[1248,1680,3044,430]},{"type":"call","value":[1248,1680,3044,668]},{"type":"call","value":[1248,1680,3044,558]},{"type":"call","value":[1248,1680,3044,796]},{"type":"call","value":[1248,1680,3044,686]},{"type":"call","value":[1248,1680,3044,924]},{"type":"call","value":[1248,1680,3044,576]},{"type":"call","value":[1248,1680,3044,268]},{"type":"call","value":[1248,1680,3044,814]},{"type":"call","value":[1248,1680,3044,704]},{"type":"call","value":[1248,1680,3044,942]},{"type":"call","value":[1248,1680,3044,286]},{"type":"call","value":[1248,1680,3044,832]},{"type":"call","value":[1248,1680,3044,414]},{"type":"call","value":[1248,1680,3044,960]},{"type":"call","value":[1248,1680,3044,304]},{"type":"call","value":[1248,1680,3044,542]},{"type":"call","value":[1248,1680,3044,432]},{"type":"call","value":[1248,1680,3044,670]},{"type":"call","value":[1248,1680,3044,560]},{"type":"call","value":[1248,1680,3044,798]},{"type":"call","value":[1248,1680,3044,688]},{"type":"call","value":[1248,1680,3044,926]},{"type":"call","value":[1248,1680,3044,270]},{"type":"call","value":[1248,1680,3044,816]},{"type":"call","value":[1248,1680,3044,398]},{"type":"call","value":[1248,1680,3044,944]},{"type":"call","value":[1248,1680,3044,288]},{"type":"call","value":[1248,1680,3044,526]},{"type":"call","value":[1248,1680,3044,416]},{"type":"call","value":[1248,1680,3044,654]},{"type":"call","value":[1248,1680,3044,306]},{"type":"call","value":[1248,1680,3044,544]},{"type":"call","value":[1248,1680,3044,782]},{"type":"call","value":[1248,1680,3044,434]},{"type":"call","value":[1248,1680,3044,672]},{"type":"call","value":[1248,1680,3044,562]},{"type":"call","value":[1248,1680,3044,800]},{"type":"call","value":[1248,1680,3044,690]},{"type":"call","value":[1248,1680,3044,928]},{"type":"call","value":[1248,1680,3044,272]},{"type":"call","value":[1248,1680,3044,818]},{"type":"call","value":[1248,1680,3044,400]},{"type":"call","value":[1248,1680,3044,946]},{"type":"call","value":[1248,1680,3044,290]},{"type":"call","value":[1248,1680,3044,528]},{"type":"call","value":[1248,1680,3044,418]},{"type":"call","value":[1248,1680,3044,656]},{"type":"call","value":[1248,1680,3044,546]},{"type":"call","value":[1248,1680,3044,784]},{"type":"call","value":[1248,1680,3044,674]},{"type":"call","value":[1248,1680,3044,912]},{"type":"call","value":[1248,1680,3044,256]},{"type":"call","value":[1248,1680,3044,802]},{"type":"call","value":[1248,1680,3044,1040]},{"type":"call","value":[1248,1680,3044,692]},{"type":"call","value":[1248,1680,3044,384]},{"type":"call","value":[1248,1680,3044,930]},{"type":"call","value":[1248,1680,3044,274]},{"type":"call","value":[1248,1680,3044,820]},{"type":"call","value":[1248,1680,3044,402]},{"type":"call","value":[1248,1680,3044,948]},{"type":"call","value":[1248,1680,3044,292]},{"type":"call","value":[1248,1680,3044,530]},{"type":"call","value":[1248,1680,3044,420]},{"type":"call","value":[1248,1680,3044,658]},{"type":"call","value":[1248,1680,3044,548]},{"type":"call","value":[1248,1680,3044,786]},{"type":"call","value":[1248,1680,3044,676]},{"type":"call","value":[1248,1680,3044,914]},{"type":"call","value":[1248,1680,3044,258]},{"type":"call","value":[1248,1680,3044,804]},{"type":"call","value":[1248,1680,3044,386]},{"type":"call","value":[1248,1680,3044,932]},{"type":"call","value":[1248,1680,3044,276]},{"type":"call","value":[1248,1680,3044,514]},{"type":"call","value":[1248,1680,3044,404]},{"type":"call","value":[1248,1680,3044,642]},{"type":"call","value":[1248,1680,3044,532]},{"type":"call","value":[1248,1680,3044,770]},{"type":"call","value":[1248,1680,3044,422]},{"type":"call","value":[1248,1680,3044,660]},{"type":"call","value":[1248,1680,3044,898]},{"type":"call","value":[1248,1680,3044,550]},{"type":"call","value":[1248,1680,3044,788]},{"type":"call","value":[1248,1680,3044,678]},{"type":"call","value":[1248,1680,3044,916]},{"type":"call","value":[1248,1680,3044,260]},{"type":"call","value":[1248,1680,3044,806]},{"type":"call","value":[1248,1680,3044,388]},{"type":"call","value":[1248,1680,3044,934]},{"type":"call","value":[1248,1680,3044,278]},{"type":"call","value":[1248,1680,3044,516]},{"type":"call","value":[1248,1680,3044,406]},{"type":"call","value":[1248,1680,3044,644]},{"type":"call","value":[1248,1680,3044,534]},{"type":"call","value":[1248,1680,3044,772]},{"type":"call","value":[1248,1680,3044,662]},{"type":"call","value":[1248,1680,3044,900]},{"type":"call","value":[1248,1680,3044,244]},{"type":"call","value":[1248,1680,3044,790]},{"type":"call","value":[1248,1680,3044,1028]},{"type":"call","value":[1248,1680,3044,372]},{"type":"call","value":[1248,1680,3044,918]},{"type":"call","value":[1248,1680,3044,262]},{"type":"call","value":[1248,1680,3044,500]},{"type":"call","value":[1248,1680,3044,390]},{"type":"call","value":[1248,1680,3044,936]},{"type":"call","value":[1248,1680,3044,628]},{"type":"call","value":[1248,1680,3044,280]},{"type":"call","value":[1248,1680,3044,518]},{"type":"call","value":[1248,1680,3044,408]},{"type":"call","value":[1248,1680,3044,646]},{"type":"call","value":[1248,1680,3044,536]},{"type":"call","value":[1248,1680,3044,774]},{"type":"call","value":[1248,1680,3044,664]},{"type":"call","value":[1248,1680,3044,902]},{"type":"call","value":[1248,1680,3044,246]},{"type":"call","value":[1248,1680,3044,792]},{"type":"call","value":[1248,1680,3044,1030]},{"type":"call","value":[1248,1680,3044,374]},{"type":"call","value":[1248,1680,3044,920]},{"type":"call","value":[1248,1680,3044,264]},{"type":"call","value":[1248,1680,3044,502]},{"type":"call","value":[1248,1680,3044,392]},{"type":"call","value":[1248,1680,3044,630]},{"type":"call","value":[1248,1680,3044,520]},{"type":"call","value":[1248,1680,3044,758]},{"type":"call","value":[1248,1680,3044,648]},{"type":"call","value":[1248,1680,3044,886]},{"type":"call","value":[1248,1680,3044,776]},{"type":"call","value":[1248,1680,3044,1014]},{"type":"call","value":[1248,1680,3044,666]},{"type":"call","value":[1248,1680,3044,358]},{"type":"call","value":[1248,1680,3044,904]},{"type":"call","value":[1248,1680,3044,248]},{"type":"call","value":[1248,1680,3044,794]},{"type":"call","value":[1248,1680,3044,1032]},{"type":"call","value":[1248,1680,3044,376]},{"type":"call","value":[1248,1680,3044,922]},{"type":"call","value":[1248,1680,3044,266]},{"type":"call","value":[1248,1680,3044,504]},{"type":"call","value":[1248,1680,3044,394]},{"type":"call","value":[1248,1680,3044,632]},{"type":"call","value":[1248,1680,3044,522]},{"type":"call","value":[1248,1680,3044,760]},{"type":"call","value":[1248,1680,3044,650]},{"type":"call","value":[1248,1680,3044,888]},{"type":"call","value":[1248,1680,3044,778]},{"type":"call","value":[1248,1680,3044,1016]},{"type":"call","value":[1248,1680,3044,360]},{"type":"call","value":[1248,1680,3044,906]},{"type":"call","value":[1248,1680,3044,250]},{"type":"call","value":[1248,1680,3044,488]},{"type":"call","value":[1248,1680,3044,1034]},{"type":"call","value":[1248,1680,3044,378]},{"type":"call","value":[1248,1680,3044,616]},{"type":"call","value":[1248,1680,3044,506]},{"type":"call","value":[1248,1680,3044,744]},{"type":"call","value":[1248,1680,3044,396]},{"type":"call","value":[1248,1680,3044,634]},{"type":"call","value":[1248,1680,3044,872]},{"type":"call","value":[1248,1680,3044,524]},{"type":"call","value":[1248,1680,3044,762]},{"type":"call","value":[1248,1680,3044,652]},{"type":"call","value":[1248,1680,3044,890]},{"type":"call","value":[1248,1680,3044,780]},{"type":"call","value":[1248,1680,3044,1018]},{"type":"call","value":[1248,1680,3044,362]},{"type":"call","value":[1248,1680,3044,908]},{"type":"call","value":[1248,1680,3044,252]},{"type":"call","value":[1248,1680,3044,490]},{"type":"call","value":[1248,1680,3044,1036]},{"type":"call","value":[1248,1680,3044,380]},{"type":"call","value":[1248,1680,3044,618]},{"type":"call","value":[1248,1680,3044,508]},{"type":"call","value":[1248,1680,3044,746]},{"type":"call","value":[1248,1680,3044,636]},{"type":"call","value":[1248,1680,3044,874]},{"type":"call","value":[1248,1680,3044,764]},{"type":"call","value":[1248,1680,3044,1002]},{"type":"call","value":[1248,1680,3044,346]},{"type":"call","value":[1248,1680,3044,892]},{"type":"call","value":[1248,1680,3044,474]},{"type":"call","value":[1248,1680,3044,1020]},{"type":"call","value":[1248,1680,3044,364]},{"type":"call","value":[1248,1680,3044,910]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1248,1680,3044,37]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1248,1680,3044,129]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2420,2524]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2420,2524,141]},{"type":"call","value":[1852,2420,2524,8]},{"type":"call","value":[1852,2420,2524,9]},{"type":"call","value":[1852,2420,2524,133]},{"type":"call","value":[1852,2420,2524,131]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1852,2420,2524,208]},{"type":"call","value":[1852,2420,2524,130]},{"type":"call","value":[1852,2420,2524,137]},{"type":"call","value":[1852,2420,2524,132]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1852,2420,2524,283]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,2360,1884]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2820,2360,1884,50]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,2360,1788]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2820,2360,1788,128]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2724,1816]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,86]},{"type":"call","value":[1852,2724,1816,25]},{"type":"call","value":[1852,2724,1816,76]},{"type":"call","value":[1852,2724,1816,85]},{"type":"call","value":[1852,2724,1816,63]},{"type":"call","value":[1852,2724,1816,56]},{"type":"call","value":[1852,2724,1816,65]},{"type":"call","value":[1852,2724,1816,106]},{"type":"call","value":[1852,2724,1816,64]},{"type":"call","value":[1852,2724,1816,22]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,41]},{"type":"call","value":[1852,2724,1816,60]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2724,2016]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2724,2016,285]},{"type":"call","value":[1852,2724,2016,314]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1852,2724,2016,713]},{"type":"call","value":[1852,2724,2016,539]},{"type":"call","value":[1852,2724,2016,365]},{"type":"call","value":[1852,2724,2016,603]},{"type":"call","value":[1852,2724,2016,429]},{"type":"call","value":[1852,2724,2016,667]},{"type":"call","value":[1852,2724,2016,493]},{"type":"call","value":[1852,2724,2016,731]},{"type":"call","value":[1852,2724,2016,557]},{"type":"call","value":[1852,2724,2016,795]},{"type":"call","value":[1852,2724,2016,621]},{"type":"call","value":[1852,2724,2016,685]},{"type":"call","value":[1852,2724,2016,749]},{"type":"call","value":[1852,2724,2016,813]},{"type":"call","value":[1852,2724,2016,395]},{"type":"call","value":[1852,2724,2016,459]},{"type":"call","value":[1852,2724,2016,523]},{"type":"call","value":[1852,2724,2016,349]},{"type":"call","value":[1852,2724,2016,587]},{"type":"call","value":[1852,2724,2016,413]},{"type":"call","value":[1852,2724,2016,651]},{"type":"call","value":[1852,2724,2016,477]},{"type":"call","value":[1852,2724,2016,715]},{"type":"call","value":[1852,2724,2016,541]},{"type":"call","value":[1852,2724,2016,779]},{"type":"call","value":[1852,2724,2016,605]},{"type":"call","value":[1852,2724,2016,843]},{"type":"call","value":[1852,2724,2016,669]},{"type":"call","value":[1852,2724,2016,733]},{"type":"call","value":[1852,2724,2016,797]},{"type":"call","value":[1852,2724,2016,687]},{"type":"call","value":[1852,2724,2016,379]},{"type":"call","value":[1852,2724,2016,751]},{"type":"call","value":[1852,2724,2016,443]},{"type":"call","value":[1852,2724,2016,815]},{"type":"call","value":[1852,2724,2016,397]},{"type":"call","value":[1852,2724,2016,461]},{"type":"call","value":[1852,2724,2016,525]},{"type":"call","value":[1852,2724,2016,351]},{"type":"call","value":[1852,2724,2016,589]},{"type":"call","value":[1852,2724,2016,415]},{"type":"call","value":[1852,2724,2016,653]},{"type":"call","value":[1852,2724,2016,479]},{"type":"call","value":[1852,2724,2016,717]},{"type":"call","value":[1852,2724,2016,543]},{"type":"call","value":[1852,2724,2016,781]},{"type":"call","value":[1852,2724,2016,607]},{"type":"call","value":[1852,2724,2016,845]},{"type":"call","value":[1852,2724,2016,671]},{"type":"call","value":[1852,2724,2016,735]},{"type":"call","value":[1852,2724,2016,799]},{"type":"call","value":[1852,2724,2016,381]},{"type":"call","value":[1852,2724,2016,445]},{"type":"call","value":[1852,2724,2016,509]},{"type":"call","value":[1852,2724,2016,573]},{"type":"call","value":[1852,2724,2016,399]},{"type":"call","value":[1852,2724,2016,637]},{"type":"call","value":[1852,2724,2016,463]},{"type":"call","value":[1852,2724,2016,701]},{"type":"call","value":[1852,2724,2016,527]},{"type":"call","value":[1852,2724,2016,765]},{"type":"call","value":[1852,2724,2016,591]},{"type":"call","value":[1852,2724,2016,417]},{"type":"call","value":[1852,2724,2016,829]},{"type":"call","value":[1852,2724,2016,655]},{"type":"call","value":[1852,2724,2016,481]},{"type":"call","value":[1852,2724,2016,719]},{"type":"call","value":[1852,2724,2016,545]},{"type":"call","value":[1852,2724,2016,783]},{"type":"call","value":[1852,2724,2016,609]},{"type":"call","value":[1852,2724,2016,847]},{"type":"call","value":[1852,2724,2016,673]},{"type":"call","value":[1852,2724,2016,737]},{"type":"call","value":[1852,2724,2016,801]},{"type":"call","value":[1852,2724,2016,383]},{"type":"call","value":[1852,2724,2016,447]},{"type":"call","value":[1852,2724,2016,511]},{"type":"call","value":[1852,2724,2016,337]},{"type":"call","value":[1852,2724,2016,575]},{"type":"call","value":[1852,2724,2016,401]},{"type":"call","value":[1852,2724,2016,639]},{"type":"call","value":[1852,2724,2016,465]},{"type":"call","value":[1852,2724,2016,703]},{"type":"call","value":[1852,2724,2016,529]},{"type":"call","value":[1852,2724,2016,767]},{"type":"call","value":[1852,2724,2016,593]},{"type":"call","value":[1852,2724,2016,831]},{"type":"call","value":[1852,2724,2016,657]},{"type":"call","value":[1852,2724,2016,721]},{"type":"call","value":[1852,2724,2016,785]},{"type":"call","value":[1852,2724,2016,849]},{"type":"call","value":[1852,2724,2016,367]},{"type":"call","value":[1852,2724,2016,431]},{"type":"call","value":[1852,2724,2016,495]},{"type":"call","value":[1852,2724,2016,559]},{"type":"call","value":[1852,2724,2016,385]},{"type":"call","value":[1852,2724,2016,623]},{"type":"call","value":[1852,2724,2016,449]},{"type":"call","value":[1852,2724,2016,513]},{"type":"call","value":[1852,2724,2016,339]},{"type":"call","value":[1852,2724,2016,577]},{"type":"call","value":[1852,2724,2016,403]},{"type":"call","value":[1852,2724,2016,641]},{"type":"call","value":[1852,2724,2016,467]},{"type":"call","value":[1852,2724,2016,705]},{"type":"call","value":[1852,2724,2016,531]},{"type":"call","value":[1852,2724,2016,769]},{"type":"call","value":[1852,2724,2016,595]},{"type":"call","value":[1852,2724,2016,833]},{"type":"call","value":[1852,2724,2016,659]},{"type":"call","value":[1852,2724,2016,723]},{"type":"call","value":[1852,2724,2016,787]},{"type":"call","value":[1852,2724,2016,851]},{"type":"call","value":[1852,2724,2016,369]},{"type":"call","value":[1852,2724,2016,433]},{"type":"call","value":[1852,2724,2016,497]},{"type":"call","value":[1852,2724,2016,561]},{"type":"call","value":[1852,2724,2016,387]},{"type":"call","value":[1852,2724,2016,625]},{"type":"call","value":[1852,2724,2016,451]},{"type":"call","value":[1852,2724,2016,689]},{"type":"call","value":[1852,2724,2016,515]},{"type":"call","value":[1852,2724,2016,753]},{"type":"call","value":[1852,2724,2016,579]},{"type":"call","value":[1852,2724,2016,817]},{"type":"call","value":[1852,2724,2016,643]},{"type":"call","value":[1852,2724,2016,707]},{"type":"call","value":[1852,2724,2016,771]},{"type":"call","value":[1852,2724,2016,597]},{"type":"call","value":[1852,2724,2016,835]},{"type":"call","value":[1852,2724,2016,661]},{"type":"call","value":[1852,2724,2016,353]},{"type":"call","value":[1852,2724,2016,725]},{"type":"call","value":[1852,2724,2016,789]},{"type":"call","value":[1852,2724,2016,371]},{"type":"call","value":[1852,2724,2016,435]},{"type":"call","value":[1852,2724,2016,499]},{"type":"call","value":[1852,2724,2016,563]},{"type":"call","value":[1852,2724,2016,389]},{"type":"call","value":[1852,2724,2016,627]},{"type":"call","value":[1852,2724,2016,453]},{"type":"call","value":[1852,2724,2016,691]},{"type":"call","value":[1852,2724,2016,517]},{"type":"call","value":[1852,2724,2016,755]},{"type":"call","value":[1852,2724,2016,581]},{"type":"call","value":[1852,2724,2016,819]},{"type":"call","value":[1852,2724,2016,645]},{"type":"call","value":[1852,2724,2016,709]},{"type":"call","value":[1852,2724,2016,773]},{"type":"call","value":[1852,2724,2016,837]},{"type":"call","value":[1852,2724,2016,355]},{"type":"call","value":[1852,2724,2016,419]},{"type":"call","value":[1852,2724,2016,483]},{"type":"call","value":[1852,2724,2016,547]},{"type":"call","value":[1852,2724,2016,373]},{"type":"call","value":[1852,2724,2016,611]},{"type":"call","value":[1852,2724,2016,437]},{"type":"call","value":[1852,2724,2016,675]},{"type":"call","value":[1852,2724,2016,501]},{"type":"call","value":[1852,2724,2016,739]},{"type":"call","value":[1852,2724,2016,565]},{"type":"call","value":[1852,2724,2016,391]},{"type":"call","value":[1852,2724,2016,803]},{"type":"call","value":[1852,2724,2016,629]},{"type":"call","value":[1852,2724,2016,455]},{"type":"call","value":[1852,2724,2016,693]},{"type":"call","value":[1852,2724,2016,519]},{"type":"call","value":[1852,2724,2016,757]},{"type":"call","value":[1852,2724,2016,583]},{"type":"call","value":[1852,2724,2016,821]},{"type":"call","value":[1852,2724,2016,647]},{"type":"call","value":[1852,2724,2016,711]},{"type":"call","value":[1852,2724,2016,775]},{"type":"call","value":[1852,2724,2016,839]},{"type":"call","value":[1852,2724,2016,357]},{"type":"call","value":[1852,2724,2016,421]},{"type":"call","value":[1852,2724,2016,485]},{"type":"call","value":[1852,2724,2016,549]},{"type":"call","value":[1852,2724,2016,375]},{"type":"call","value":[1852,2724,2016,613]},{"type":"call","value":[1852,2724,2016,439]},{"type":"call","value":[1852,2724,2016,677]},{"type":"call","value":[1852,2724,2016,503]},{"type":"call","value":[1852,2724,2016,741]},{"type":"call","value":[1852,2724,2016,567]},{"type":"call","value":[1852,2724,2016,805]},{"type":"call","value":[1852,2724,2016,631]},{"type":"call","value":[1852,2724,2016,695]},{"type":"call","value":[1852,2724,2016,759]},{"type":"call","value":[1852,2724,2016,823]},{"type":"call","value":[1852,2724,2016,341]},{"type":"call","value":[1852,2724,2016,405]},{"type":"call","value":[1852,2724,2016,777]},{"type":"call","value":[1852,2724,2016,469]},{"type":"call","value":[1852,2724,2016,841]},{"type":"call","value":[1852,2724,2016,533]},{"type":"call","value":[1852,2724,2016,359]},{"type":"call","value":[1852,2724,2016,423]},{"type":"call","value":[1852,2724,2016,487]},{"type":"call","value":[1852,2724,2016,551]},{"type":"call","value":[1852,2724,2016,377]},{"type":"call","value":[1852,2724,2016,615]},{"type":"call","value":[1852,2724,2016,441]},{"type":"call","value":[1852,2724,2016,679]},{"type":"call","value":[1852,2724,2016,505]},{"type":"call","value":[1852,2724,2016,743]},{"type":"call","value":[1852,2724,2016,569]},{"type":"call","value":[1852,2724,2016,807]},{"type":"call","value":[1852,2724,2016,633]},{"type":"call","value":[1852,2724,2016,697]},{"type":"call","value":[1852,2724,2016,761]},{"type":"call","value":[1852,2724,2016,825]},{"type":"call","value":[1852,2724,2016,343]},{"type":"call","value":[1852,2724,2016,407]},{"type":"call","value":[1852,2724,2016,471]},{"type":"call","value":[1852,2724,2016,535]},{"type":"call","value":[1852,2724,2016,361]},{"type":"call","value":[1852,2724,2016,599]},{"type":"call","value":[1852,2724,2016,425]},{"type":"call","value":[1852,2724,2016,663]},{"type":"call","value":[1852,2724,2016,489]},{"type":"call","value":[1852,2724,2016,727]},{"type":"call","value":[1852,2724,2016,553]},{"type":"call","value":[1852,2724,2016,791]},{"type":"call","value":[1852,2724,2016,617]},{"type":"call","value":[1852,2724,2016,681]},{"type":"call","value":[1852,2724,2016,507]},{"type":"call","value":[1852,2724,2016,745]},{"type":"call","value":[1852,2724,2016,571]},{"type":"call","value":[1852,2724,2016,809]},{"type":"call","value":[1852,2724,2016,635]},{"type":"call","value":[1852,2724,2016,699]},{"type":"call","value":[1852,2724,2016,763]},{"type":"call","value":[1852,2724,2016,827]},{"type":"call","value":[1852,2724,2016,345]},{"type":"call","value":[1852,2724,2016,409]},{"type":"call","value":[1852,2724,2016,473]},{"type":"call","value":[1852,2724,2016,537]},{"type":"call","value":[1852,2724,2016,363]},{"type":"call","value":[1852,2724,2016,601]},{"type":"call","value":[1852,2724,2016,427]},{"type":"call","value":[1852,2724,2016,665]},{"type":"call","value":[1852,2724,2016,491]},{"type":"call","value":[1852,2724,2016,729]},{"type":"call","value":[1852,2724,2016,555]},{"type":"call","value":[1852,2724,2016,793]},{"type":"call","value":[1852,2724,2016,619]},{"type":"call","value":[1852,2724,2016,683]},{"type":"call","value":[1852,2724,2016,747]},{"type":"call","value":[1852,2724,2016,811]},{"type":"call","value":[1852,2724,2016,393]},{"type":"call","value":[1852,2724,2016,457]},{"type":"call","value":[1852,2724,2016,521]},{"type":"call","value":[1852,2724,2016,347]},{"type":"call","value":[1852,2724,2016,585]},{"type":"call","value":[1852,2724,2016,411]},{"type":"call","value":[1852,2724,2016,649]},{"type":"call","value":[1852,2724,2016,475]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1852,2724,2016,138]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1852,2724,2016,231]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2800,640]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,15]},{"type":"call","value":[1852,2800,640,56]},{"type":"call","value":[1852,2800,640,78]},{"type":"call","value":[1852,2800,640,68]},{"type":"call","value":[1852,2800,640,55]},{"type":"call","value":[1852,2800,640,77]},{"type":"call","value":[1852,2800,640,90]},{"type":"call","value":[1852,2800,640,48]},{"type":"call","value":[1852,2800,640,99]},{"type":"call","value":[1852,2800,640,57]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,33]},{"type":"call","value":[1852,2800,640,52]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2800,3044]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2800,3044,304]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1852,2800,3044,383]},{"type":"call","value":[1852,2800,3044,621]},{"type":"call","value":[1852,2800,3044,511]},{"type":"call","value":[1852,2800,3044,749]},{"type":"call","value":[1852,2800,3044,401]},{"type":"call","value":[1852,2800,3044,639]},{"type":"call","value":[1852,2800,3044,877]},{"type":"call","value":[1852,2800,3044,529]},{"type":"call","value":[1852,2800,3044,767]},{"type":"call","value":[1852,2800,3044,657]},{"type":"call","value":[1852,2800,3044,895]},{"type":"call","value":[1852,2800,3044,785]},{"type":"call","value":[1852,2800,3044,1023]},{"type":"call","value":[1852,2800,3044,367]},{"type":"call","value":[1852,2800,3044,913]},{"type":"call","value":[1852,2800,3044,495]},{"type":"call","value":[1852,2800,3044,1041]},{"type":"call","value":[1852,2800,3044,385]},{"type":"call","value":[1852,2800,3044,623]},{"type":"call","value":[1852,2800,3044,513]},{"type":"call","value":[1852,2800,3044,751]},{"type":"call","value":[1852,2800,3044,641]},{"type":"call","value":[1852,2800,3044,879]},{"type":"call","value":[1852,2800,3044,769]},{"type":"call","value":[1852,2800,3044,1007]},{"type":"call","value":[1852,2800,3044,351]},{"type":"call","value":[1852,2800,3044,897]},{"type":"call","value":[1852,2800,3044,479]},{"type":"call","value":[1852,2800,3044,1025]},{"type":"call","value":[1852,2800,3044,369]},{"type":"call","value":[1852,2800,3044,915]},{"type":"call","value":[1852,2800,3044,607]},{"type":"call","value":[1852,2800,3044,497]},{"type":"call","value":[1852,2800,3044,1043]},{"type":"call","value":[1852,2800,3044,387]},{"type":"call","value":[1852,2800,3044,625]},{"type":"call","value":[1852,2800,3044,515]},{"type":"call","value":[1852,2800,3044,753]},{"type":"call","value":[1852,2800,3044,643]},{"type":"call","value":[1852,2800,3044,881]},{"type":"call","value":[1852,2800,3044,771]},{"type":"call","value":[1852,2800,3044,1009]},{"type":"call","value":[1852,2800,3044,353]},{"type":"call","value":[1852,2800,3044,899]},{"type":"call","value":[1852,2800,3044,481]},{"type":"call","value":[1852,2800,3044,1027]},{"type":"call","value":[1852,2800,3044,371]},{"type":"call","value":[1852,2800,3044,609]},{"type":"call","value":[1852,2800,3044,499]},{"type":"call","value":[1852,2800,3044,737]},{"type":"call","value":[1852,2800,3044,627]},{"type":"call","value":[1852,2800,3044,865]},{"type":"call","value":[1852,2800,3044,755]},{"type":"call","value":[1852,2800,3044,993]},{"type":"call","value":[1852,2800,3044,645]},{"type":"call","value":[1852,2800,3044,883]},{"type":"call","value":[1852,2800,3044,773]},{"type":"call","value":[1852,2800,3044,1011]},{"type":"call","value":[1852,2800,3044,355]},{"type":"call","value":[1852,2800,3044,901]},{"type":"call","value":[1852,2800,3044,483]},{"type":"call","value":[1852,2800,3044,1029]},{"type":"call","value":[1852,2800,3044,373]},{"type":"call","value":[1852,2800,3044,611]},{"type":"call","value":[1852,2800,3044,501]},{"type":"call","value":[1852,2800,3044,739]},{"type":"call","value":[1852,2800,3044,629]},{"type":"call","value":[1852,2800,3044,867]},{"type":"call","value":[1852,2800,3044,757]},{"type":"call","value":[1852,2800,3044,995]},{"type":"call","value":[1852,2800,3044,339]},{"type":"call","value":[1852,2800,3044,885]},{"type":"call","value":[1852,2800,3044,1123]},{"type":"call","value":[1852,2800,3044,467]},{"type":"call","value":[1852,2800,3044,1013]},{"type":"call","value":[1852,2800,3044,357]},{"type":"call","value":[1852,2800,3044,595]},{"type":"call","value":[1852,2800,3044,485]},{"type":"call","value":[1852,2800,3044,1031]},{"type":"call","value":[1852,2800,3044,723]},{"type":"call","value":[1852,2800,3044,375]},{"type":"call","value":[1852,2800,3044,613]},{"type":"call","value":[1852,2800,3044,503]},{"type":"call","value":[1852,2800,3044,741]},{"type":"call","value":[1852,2800,3044,631]},{"type":"call","value":[1852,2800,3044,869]},{"type":"call","value":[1852,2800,3044,759]},{"type":"call","value":[1852,2800,3044,997]},{"type":"call","value":[1852,2800,3044,341]},{"type":"call","value":[1852,2800,3044,887]},{"type":"call","value":[1852,2800,3044,469]},{"type":"call","value":[1852,2800,3044,1015]},{"type":"call","value":[1852,2800,3044,359]},{"type":"call","value":[1852,2800,3044,597]},{"type":"call","value":[1852,2800,3044,487]},{"type":"call","value":[1852,2800,3044,725]},{"type":"call","value":[1852,2800,3044,615]},{"type":"call","value":[1852,2800,3044,853]},{"type":"call","value":[1852,2800,3044,743]},{"type":"call","value":[1852,2800,3044,981]},{"type":"call","value":[1852,2800,3044,871]},{"type":"call","value":[1852,2800,3044,1109]},{"type":"call","value":[1852,2800,3044,761]},{"type":"call","value":[1852,2800,3044,453]},{"type":"call","value":[1852,2800,3044,999]},{"type":"call","value":[1852,2800,3044,343]},{"type":"call","value":[1852,2800,3044,889]},{"type":"call","value":[1852,2800,3044,471]},{"type":"call","value":[1852,2800,3044,1017]},{"type":"call","value":[1852,2800,3044,361]},{"type":"call","value":[1852,2800,3044,599]},{"type":"call","value":[1852,2800,3044,489]},{"type":"call","value":[1852,2800,3044,727]},{"type":"call","value":[1852,2800,3044,617]},{"type":"call","value":[1852,2800,3044,855]},{"type":"call","value":[1852,2800,3044,745]},{"type":"call","value":[1852,2800,3044,983]},{"type":"call","value":[1852,2800,3044,327]},{"type":"call","value":[1852,2800,3044,873]},{"type":"call","value":[1852,2800,3044,1111]},{"type":"call","value":[1852,2800,3044,455]},{"type":"call","value":[1852,2800,3044,1001]},{"type":"call","value":[1852,2800,3044,345]},{"type":"call","value":[1852,2800,3044,583]},{"type":"call","value":[1852,2800,3044,473]},{"type":"call","value":[1852,2800,3044,711]},{"type":"call","value":[1852,2800,3044,601]},{"type":"call","value":[1852,2800,3044,839]},{"type":"call","value":[1852,2800,3044,491]},{"type":"call","value":[1852,2800,3044,729]},{"type":"call","value":[1852,2800,3044,967]},{"type":"call","value":[1852,2800,3044,619]},{"type":"call","value":[1852,2800,3044,857]},{"type":"call","value":[1852,2800,3044,747]},{"type":"call","value":[1852,2800,3044,985]},{"type":"call","value":[1852,2800,3044,875]},{"type":"call","value":[1852,2800,3044,1113]},{"type":"call","value":[1852,2800,3044,457]},{"type":"call","value":[1852,2800,3044,1003]},{"type":"call","value":[1852,2800,3044,347]},{"type":"call","value":[1852,2800,3044,585]},{"type":"call","value":[1852,2800,3044,475]},{"type":"call","value":[1852,2800,3044,713]},{"type":"call","value":[1852,2800,3044,603]},{"type":"call","value":[1852,2800,3044,841]},{"type":"call","value":[1852,2800,3044,731]},{"type":"call","value":[1852,2800,3044,969]},{"type":"call","value":[1852,2800,3044,859]},{"type":"call","value":[1852,2800,3044,1097]},{"type":"call","value":[1852,2800,3044,441]},{"type":"call","value":[1852,2800,3044,987]},{"type":"call","value":[1852,2800,3044,331]},{"type":"call","value":[1852,2800,3044,569]},{"type":"call","value":[1852,2800,3044,1115]},{"type":"call","value":[1852,2800,3044,459]},{"type":"call","value":[1852,2800,3044,1005]},{"type":"call","value":[1852,2800,3044,697]},{"type":"call","value":[1852,2800,3044,349]},{"type":"call","value":[1852,2800,3044,587]},{"type":"call","value":[1852,2800,3044,477]},{"type":"call","value":[1852,2800,3044,715]},{"type":"call","value":[1852,2800,3044,605]},{"type":"call","value":[1852,2800,3044,843]},{"type":"call","value":[1852,2800,3044,733]},{"type":"call","value":[1852,2800,3044,971]},{"type":"call","value":[1852,2800,3044,861]},{"type":"call","value":[1852,2800,3044,1099]},{"type":"call","value":[1852,2800,3044,443]},{"type":"call","value":[1852,2800,3044,989]},{"type":"call","value":[1852,2800,3044,333]},{"type":"call","value":[1852,2800,3044,571]},{"type":"call","value":[1852,2800,3044,1117]},{"type":"call","value":[1852,2800,3044,461]},{"type":"call","value":[1852,2800,3044,699]},{"type":"call","value":[1852,2800,3044,589]},{"type":"call","value":[1852,2800,3044,827]},{"type":"call","value":[1852,2800,3044,717]},{"type":"call","value":[1852,2800,3044,955]},{"type":"call","value":[1852,2800,3044,845]},{"type":"call","value":[1852,2800,3044,1083]},{"type":"call","value":[1852,2800,3044,735]},{"type":"call","value":[1852,2800,3044,427]},{"type":"call","value":[1852,2800,3044,973]},{"type":"call","value":[1852,2800,3044,863]},{"type":"call","value":[1852,2800,3044,1101]},{"type":"call","value":[1852,2800,3044,445]},{"type":"call","value":[1852,2800,3044,991]},{"type":"call","value":[1852,2800,3044,335]},{"type":"call","value":[1852,2800,3044,573]},{"type":"call","value":[1852,2800,3044,1119]},{"type":"call","value":[1852,2800,3044,463]},{"type":"call","value":[1852,2800,3044,701]},{"type":"call","value":[1852,2800,3044,591]},{"type":"call","value":[1852,2800,3044,829]},{"type":"call","value":[1852,2800,3044,719]},{"type":"call","value":[1852,2800,3044,957]},{"type":"call","value":[1852,2800,3044,847]},{"type":"call","value":[1852,2800,3044,1085]},{"type":"call","value":[1852,2800,3044,429]},{"type":"call","value":[1852,2800,3044,975]},{"type":"call","value":[1852,2800,3044,557]},{"type":"call","value":[1852,2800,3044,1103]},{"type":"call","value":[1852,2800,3044,447]},{"type":"call","value":[1852,2800,3044,685]},{"type":"call","value":[1852,2800,3044,337]},{"type":"call","value":[1852,2800,3044,575]},{"type":"call","value":[1852,2800,3044,1121]},{"type":"call","value":[1852,2800,3044,813]},{"type":"call","value":[1852,2800,3044,465]},{"type":"call","value":[1852,2800,3044,703]},{"type":"call","value":[1852,2800,3044,593]},{"type":"call","value":[1852,2800,3044,831]},{"type":"call","value":[1852,2800,3044,721]},{"type":"call","value":[1852,2800,3044,959]},{"type":"call","value":[1852,2800,3044,849]},{"type":"call","value":[1852,2800,3044,1087]},{"type":"call","value":[1852,2800,3044,431]},{"type":"call","value":[1852,2800,3044,977]},{"type":"call","value":[1852,2800,3044,559]},{"type":"call","value":[1852,2800,3044,1105]},{"type":"call","value":[1852,2800,3044,449]},{"type":"call","value":[1852,2800,3044,687]},{"type":"call","value":[1852,2800,3044,577]},{"type":"call","value":[1852,2800,3044,815]},{"type":"call","value":[1852,2800,3044,705]},{"type":"call","value":[1852,2800,3044,943]},{"type":"call","value":[1852,2800,3044,833]},{"type":"call","value":[1852,2800,3044,1071]},{"type":"call","value":[1852,2800,3044,415]},{"type":"call","value":[1852,2800,3044,961]},{"type":"call","value":[1852,2800,3044,851]},{"type":"call","value":[1852,2800,3044,543]},{"type":"call","value":[1852,2800,3044,1089]},{"type":"call","value":[1852,2800,3044,433]},{"type":"call","value":[1852,2800,3044,979]},{"type":"call","value":[1852,2800,3044,561]},{"type":"call","value":[1852,2800,3044,1107]},{"type":"call","value":[1852,2800,3044,451]},{"type":"call","value":[1852,2800,3044,689]},{"type":"call","value":[1852,2800,3044,579]},{"type":"call","value":[1852,2800,3044,817]},{"type":"call","value":[1852,2800,3044,707]},{"type":"call","value":[1852,2800,3044,945]},{"type":"call","value":[1852,2800,3044,835]},{"type":"call","value":[1852,2800,3044,1073]},{"type":"call","value":[1852,2800,3044,417]},{"type":"call","value":[1852,2800,3044,963]},{"type":"call","value":[1852,2800,3044,545]},{"type":"call","value":[1852,2800,3044,1091]},{"type":"call","value":[1852,2800,3044,435]},{"type":"call","value":[1852,2800,3044,673]},{"type":"call","value":[1852,2800,3044,563]},{"type":"call","value":[1852,2800,3044,801]},{"type":"call","value":[1852,2800,3044,691]},{"type":"call","value":[1852,2800,3044,929]},{"type":"call","value":[1852,2800,3044,581]},{"type":"call","value":[1852,2800,3044,819]},{"type":"call","value":[1852,2800,3044,1057]},{"type":"call","value":[1852,2800,3044,709]},{"type":"call","value":[1852,2800,3044,947]},{"type":"call","value":[1852,2800,3044,837]},{"type":"call","value":[1852,2800,3044,1075]},{"type":"call","value":[1852,2800,3044,419]},{"type":"call","value":[1852,2800,3044,965]},{"type":"call","value":[1852,2800,3044,547]},{"type":"call","value":[1852,2800,3044,1093]},{"type":"call","value":[1852,2800,3044,437]},{"type":"call","value":[1852,2800,3044,675]},{"type":"call","value":[1852,2800,3044,565]},{"type":"call","value":[1852,2800,3044,803]},{"type":"call","value":[1852,2800,3044,693]},{"type":"call","value":[1852,2800,3044,931]},{"type":"call","value":[1852,2800,3044,821]},{"type":"call","value":[1852,2800,3044,1059]},{"type":"call","value":[1852,2800,3044,403]},{"type":"call","value":[1852,2800,3044,949]},{"type":"call","value":[1852,2800,3044,531]},{"type":"call","value":[1852,2800,3044,1077]},{"type":"call","value":[1852,2800,3044,421]},{"type":"call","value":[1852,2800,3044,659]},{"type":"call","value":[1852,2800,3044,549]},{"type":"call","value":[1852,2800,3044,1095]},{"type":"call","value":[1852,2800,3044,787]},{"type":"call","value":[1852,2800,3044,439]},{"type":"call","value":[1852,2800,3044,677]},{"type":"call","value":[1852,2800,3044,567]},{"type":"call","value":[1852,2800,3044,805]},{"type":"call","value":[1852,2800,3044,695]},{"type":"call","value":[1852,2800,3044,933]},{"type":"call","value":[1852,2800,3044,823]},{"type":"call","value":[1852,2800,3044,1061]},{"type":"call","value":[1852,2800,3044,405]},{"type":"call","value":[1852,2800,3044,951]},{"type":"call","value":[1852,2800,3044,533]},{"type":"call","value":[1852,2800,3044,1079]},{"type":"call","value":[1852,2800,3044,423]},{"type":"call","value":[1852,2800,3044,661]},{"type":"call","value":[1852,2800,3044,551]},{"type":"call","value":[1852,2800,3044,789]},{"type":"call","value":[1852,2800,3044,679]},{"type":"call","value":[1852,2800,3044,917]},{"type":"call","value":[1852,2800,3044,807]},{"type":"call","value":[1852,2800,3044,1045]},{"type":"call","value":[1852,2800,3044,389]},{"type":"call","value":[1852,2800,3044,935]},{"type":"call","value":[1852,2800,3044,825]},{"type":"call","value":[1852,2800,3044,517]},{"type":"call","value":[1852,2800,3044,1063]},{"type":"call","value":[1852,2800,3044,407]},{"type":"call","value":[1852,2800,3044,953]},{"type":"call","value":[1852,2800,3044,535]},{"type":"call","value":[1852,2800,3044,1081]},{"type":"call","value":[1852,2800,3044,425]},{"type":"call","value":[1852,2800,3044,663]},{"type":"call","value":[1852,2800,3044,553]},{"type":"call","value":[1852,2800,3044,791]},{"type":"call","value":[1852,2800,3044,681]},{"type":"call","value":[1852,2800,3044,919]},{"type":"call","value":[1852,2800,3044,809]},{"type":"call","value":[1852,2800,3044,1047]},{"type":"call","value":[1852,2800,3044,391]},{"type":"call","value":[1852,2800,3044,937]},{"type":"call","value":[1852,2800,3044,519]},{"type":"call","value":[1852,2800,3044,1065]},{"type":"call","value":[1852,2800,3044,409]},{"type":"call","value":[1852,2800,3044,647]},{"type":"call","value":[1852,2800,3044,537]},{"type":"call","value":[1852,2800,3044,775]},{"type":"call","value":[1852,2800,3044,665]},{"type":"call","value":[1852,2800,3044,903]},{"type":"call","value":[1852,2800,3044,555]},{"type":"call","value":[1852,2800,3044,793]},{"type":"call","value":[1852,2800,3044,683]},{"type":"call","value":[1852,2800,3044,921]},{"type":"call","value":[1852,2800,3044,811]},{"type":"call","value":[1852,2800,3044,1049]},{"type":"call","value":[1852,2800,3044,393]},{"type":"call","value":[1852,2800,3044,939]},{"type":"call","value":[1852,2800,3044,521]},{"type":"call","value":[1852,2800,3044,1067]},{"type":"call","value":[1852,2800,3044,411]},{"type":"call","value":[1852,2800,3044,649]},{"type":"call","value":[1852,2800,3044,539]},{"type":"call","value":[1852,2800,3044,777]},{"type":"call","value":[1852,2800,3044,667]},{"type":"call","value":[1852,2800,3044,905]},{"type":"call","value":[1852,2800,3044,795]},{"type":"call","value":[1852,2800,3044,1033]},{"type":"call","value":[1852,2800,3044,377]},{"type":"call","value":[1852,2800,3044,923]},{"type":"call","value":[1852,2800,3044,505]},{"type":"call","value":[1852,2800,3044,1051]},{"type":"call","value":[1852,2800,3044,395]},{"type":"call","value":[1852,2800,3044,941]},{"type":"call","value":[1852,2800,3044,633]},{"type":"call","value":[1852,2800,3044,523]},{"type":"call","value":[1852,2800,3044,1069]},{"type":"call","value":[1852,2800,3044,413]},{"type":"call","value":[1852,2800,3044,651]},{"type":"call","value":[1852,2800,3044,541]},{"type":"call","value":[1852,2800,3044,779]},{"type":"call","value":[1852,2800,3044,669]},{"type":"call","value":[1852,2800,3044,907]},{"type":"call","value":[1852,2800,3044,797]},{"type":"call","value":[1852,2800,3044,1035]},{"type":"call","value":[1852,2800,3044,379]},{"type":"call","value":[1852,2800,3044,925]},{"type":"call","value":[1852,2800,3044,507]},{"type":"call","value":[1852,2800,3044,1053]},{"type":"call","value":[1852,2800,3044,397]},{"type":"call","value":[1852,2800,3044,635]},{"type":"call","value":[1852,2800,3044,525]},{"type":"call","value":[1852,2800,3044,763]},{"type":"call","value":[1852,2800,3044,653]},{"type":"call","value":[1852,2800,3044,891]},{"type":"call","value":[1852,2800,3044,781]},{"type":"call","value":[1852,2800,3044,1019]},{"type":"call","value":[1852,2800,3044,671]},{"type":"call","value":[1852,2800,3044,363]},{"type":"call","value":[1852,2800,3044,909]},{"type":"call","value":[1852,2800,3044,799]},{"type":"call","value":[1852,2800,3044,1037]},{"type":"call","value":[1852,2800,3044,381]},{"type":"call","value":[1852,2800,3044,927]},{"type":"call","value":[1852,2800,3044,509]},{"type":"call","value":[1852,2800,3044,1055]},{"type":"call","value":[1852,2800,3044,399]},{"type":"call","value":[1852,2800,3044,637]},{"type":"call","value":[1852,2800,3044,527]},{"type":"call","value":[1852,2800,3044,765]},{"type":"call","value":[1852,2800,3044,655]},{"type":"call","value":[1852,2800,3044,893]},{"type":"call","value":[1852,2800,3044,783]},{"type":"call","value":[1852,2800,3044,1021]},{"type":"call","value":[1852,2800,3044,365]},{"type":"call","value":[1852,2800,3044,911]},{"type":"call","value":[1852,2800,3044,493]},{"type":"call","value":[1852,2800,3044,1039]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1852,2800,3044,131]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1852,2800,3044,224]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2744,2916]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,138]},{"type":"call","value":[1852,2744,2916,16]},{"type":"call","value":[1852,2744,2916,480]},{"type":"call","value":[1852,2744,2916,150]},{"type":"call","value":[1852,2744,2916,481]},{"type":"call","value":[1852,2744,2916,15]},{"type":"call","value":[1852,2744,2916,711]},{"type":"call","value":[1852,2744,2916,140]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,364]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,217]},{"type":"call","value":[1852,2744,2916,139]},{"type":"call","value":[1852,2744,2916,146]},{"type":"call","value":[1852,2744,2916,137]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,291]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2744,2672]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2672,141]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,500,240]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,500,240,338]},{"type":"call","value":[1852,500,240,8]},{"type":"call","value":[1852,500,240,143]},{"type":"call","value":[1852,500,240,133]},{"type":"call","value":[1852,500,240,135]},{"type":"call","value":[1852,500,240,9]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[1852,500,240,210]},{"type":"call","value":[1852,500,240,132]},{"type":"call","value":[1852,500,240,139]},{"type":"call","value":[1852,500,240,134]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[1852,500,240,284]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,500,900]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[1852,500,900,130]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1572,2932]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2932,212]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2932,595]},{"type":"call","value":[2820,1572,2932,659]},{"type":"call","value":[2820,1572,2932,723]},{"type":"call","value":[2820,1572,2932,241]},{"type":"call","value":[2820,1572,2932,305]},{"type":"call","value":[2820,1572,2932,369]},{"type":"call","value":[2820,1572,2932,433]},{"type":"call","value":[2820,1572,2932,259]},{"type":"call","value":[2820,1572,2932,497]},{"type":"call","value":[2820,1572,2932,323]},{"type":"call","value":[2820,1572,2932,561]},{"type":"call","value":[2820,1572,2932,387]},{"type":"call","value":[2820,1572,2932,625]},{"type":"call","value":[2820,1572,2932,451]},{"type":"call","value":[2820,1572,2932,689]},{"type":"call","value":[2820,1572,2932,515]},{"type":"call","value":[2820,1572,2932,341]},{"type":"call","value":[2820,1572,2932,579]},{"type":"call","value":[2820,1572,2932,405]},{"type":"call","value":[2820,1572,2932,643]},{"type":"call","value":[2820,1572,2932,469]},{"type":"call","value":[2820,1572,2932,707]},{"type":"call","value":[2820,1572,2932,533]},{"type":"call","value":[2820,1572,2932,597]},{"type":"call","value":[2820,1572,2932,661]},{"type":"call","value":[2820,1572,2932,725]},{"type":"call","value":[2820,1572,2932,243]},{"type":"call","value":[2820,1572,2932,307]},{"type":"call","value":[2820,1572,2932,371]},{"type":"call","value":[2820,1572,2932,435]},{"type":"call","value":[2820,1572,2932,261]},{"type":"call","value":[2820,1572,2932,499]},{"type":"call","value":[2820,1572,2932,325]},{"type":"call","value":[2820,1572,2932,563]},{"type":"call","value":[2820,1572,2932,389]},{"type":"call","value":[2820,1572,2932,627]},{"type":"call","value":[2820,1572,2932,453]},{"type":"call","value":[2820,1572,2932,691]},{"type":"call","value":[2820,1572,2932,517]},{"type":"call","value":[2820,1572,2932,581]},{"type":"call","value":[2820,1572,2932,645]},{"type":"call","value":[2820,1572,2932,709]},{"type":"call","value":[2820,1572,2932,291]},{"type":"call","value":[2820,1572,2932,355]},{"type":"call","value":[2820,1572,2932,419]},{"type":"call","value":[2820,1572,2932,245]},{"type":"call","value":[2820,1572,2932,483]},{"type":"call","value":[2820,1572,2932,309]},{"type":"call","value":[2820,1572,2932,547]},{"type":"call","value":[2820,1572,2932,373]},{"type":"call","value":[2820,1572,2932,437]},{"type":"call","value":[2820,1572,2932,263]},{"type":"call","value":[2820,1572,2932,501]},{"type":"call","value":[2820,1572,2932,327]},{"type":"call","value":[2820,1572,2932,565]},{"type":"call","value":[2820,1572,2932,391]},{"type":"call","value":[2820,1572,2932,629]},{"type":"call","value":[2820,1572,2932,455]},{"type":"call","value":[2820,1572,2932,693]},{"type":"call","value":[2820,1572,2932,519]},{"type":"call","value":[2820,1572,2932,583]},{"type":"call","value":[2820,1572,2932,647]},{"type":"call","value":[2820,1572,2932,711]},{"type":"call","value":[2820,1572,2932,293]},{"type":"call","value":[2820,1572,2932,357]},{"type":"call","value":[2820,1572,2932,421]},{"type":"call","value":[2820,1572,2932,247]},{"type":"call","value":[2820,1572,2932,485]},{"type":"call","value":[2820,1572,2932,311]},{"type":"call","value":[2820,1572,2932,549]},{"type":"call","value":[2820,1572,2932,375]},{"type":"call","value":[2820,1572,2932,613]},{"type":"call","value":[2820,1572,2932,439]},{"type":"call","value":[2820,1572,2932,677]},{"type":"call","value":[2820,1572,2932,503]},{"type":"call","value":[2820,1572,2932,741]},{"type":"call","value":[2820,1572,2932,567]},{"type":"call","value":[2820,1572,2932,631]},{"type":"call","value":[2820,1572,2932,695]},{"type":"call","value":[2820,1572,2932,521]},{"type":"call","value":[2820,1572,2932,585]},{"type":"call","value":[2820,1572,2932,277]},{"type":"call","value":[2820,1572,2932,649]},{"type":"call","value":[2820,1572,2932,713]},{"type":"call","value":[2820,1572,2932,295]},{"type":"call","value":[2820,1572,2932,359]},{"type":"call","value":[2820,1572,2932,423]},{"type":"call","value":[2820,1572,2932,249]},{"type":"call","value":[2820,1572,2932,487]},{"type":"call","value":[2820,1572,2932,313]},{"type":"call","value":[2820,1572,2932,551]},{"type":"call","value":[2820,1572,2932,377]},{"type":"call","value":[2820,1572,2932,615]},{"type":"call","value":[2820,1572,2932,441]},{"type":"call","value":[2820,1572,2932,679]},{"type":"call","value":[2820,1572,2932,505]},{"type":"call","value":[2820,1572,2932,743]},{"type":"call","value":[2820,1572,2932,569]},{"type":"call","value":[2820,1572,2932,633]},{"type":"call","value":[2820,1572,2932,697]},{"type":"call","value":[2820,1572,2932,279]},{"type":"call","value":[2820,1572,2932,343]},{"type":"call","value":[2820,1572,2932,407]},{"type":"call","value":[2820,1572,2932,471]},{"type":"call","value":[2820,1572,2932,297]},{"type":"call","value":[2820,1572,2932,535]},{"type":"call","value":[2820,1572,2932,361]},{"type":"call","value":[2820,1572,2932,599]},{"type":"call","value":[2820,1572,2932,425]},{"type":"call","value":[2820,1572,2932,251]},{"type":"call","value":[2820,1572,2932,663]},{"type":"call","value":[2820,1572,2932,489]},{"type":"call","value":[2820,1572,2932,315]},{"type":"call","value":[2820,1572,2932,727]},{"type":"call","value":[2820,1572,2932,553]},{"type":"call","value":[2820,1572,2932,379]},{"type":"call","value":[2820,1572,2932,617]},{"type":"call","value":[2820,1572,2932,443]},{"type":"call","value":[2820,1572,2932,681]},{"type":"call","value":[2820,1572,2932,507]},{"type":"call","value":[2820,1572,2932,745]},{"type":"call","value":[2820,1572,2932,571]},{"type":"call","value":[2820,1572,2932,635]},{"type":"call","value":[2820,1572,2932,699]},{"type":"call","value":[2820,1572,2932,281]},{"type":"call","value":[2820,1572,2932,345]},{"type":"call","value":[2820,1572,2932,409]},{"type":"call","value":[2820,1572,2932,235]},{"type":"call","value":[2820,1572,2932,473]},{"type":"call","value":[2820,1572,2932,299]},{"type":"call","value":[2820,1572,2932,537]},{"type":"call","value":[2820,1572,2932,363]},{"type":"call","value":[2820,1572,2932,601]},{"type":"call","value":[2820,1572,2932,427]},{"type":"call","value":[2820,1572,2932,665]},{"type":"call","value":[2820,1572,2932,491]},{"type":"call","value":[2820,1572,2932,729]},{"type":"call","value":[2820,1572,2932,555]},{"type":"call","value":[2820,1572,2932,619]},{"type":"call","value":[2820,1572,2932,683]},{"type":"call","value":[2820,1572,2932,747]},{"type":"call","value":[2820,1572,2932,265]},{"type":"call","value":[2820,1572,2932,329]},{"type":"call","value":[2820,1572,2932,701]},{"type":"call","value":[2820,1572,2932,393]},{"type":"call","value":[2820,1572,2932,457]},{"type":"call","value":[2820,1572,2932,283]},{"type":"call","value":[2820,1572,2932,347]},{"type":"call","value":[2820,1572,2932,411]},{"type":"call","value":[2820,1572,2932,237]},{"type":"call","value":[2820,1572,2932,475]},{"type":"call","value":[2820,1572,2932,301]},{"type":"call","value":[2820,1572,2932,539]},{"type":"call","value":[2820,1572,2932,365]},{"type":"call","value":[2820,1572,2932,603]},{"type":"call","value":[2820,1572,2932,429]},{"type":"call","value":[2820,1572,2932,667]},{"type":"call","value":[2820,1572,2932,493]},{"type":"call","value":[2820,1572,2932,731]},{"type":"call","value":[2820,1572,2932,557]},{"type":"call","value":[2820,1572,2932,621]},{"type":"call","value":[2820,1572,2932,685]},{"type":"call","value":[2820,1572,2932,267]},{"type":"call","value":[2820,1572,2932,331]},{"type":"call","value":[2820,1572,2932,395]},{"type":"call","value":[2820,1572,2932,459]},{"type":"call","value":[2820,1572,2932,285]},{"type":"call","value":[2820,1572,2932,523]},{"type":"call","value":[2820,1572,2932,349]},{"type":"call","value":[2820,1572,2932,587]},{"type":"call","value":[2820,1572,2932,413]},{"type":"call","value":[2820,1572,2932,651]},{"type":"call","value":[2820,1572,2932,477]},{"type":"call","value":[2820,1572,2932,715]},{"type":"call","value":[2820,1572,2932,541]},{"type":"call","value":[2820,1572,2932,605]},{"type":"call","value":[2820,1572,2932,431]},{"type":"call","value":[2820,1572,2932,669]},{"type":"call","value":[2820,1572,2932,495]},{"type":"call","value":[2820,1572,2932,733]},{"type":"call","value":[2820,1572,2932,559]},{"type":"call","value":[2820,1572,2932,623]},{"type":"call","value":[2820,1572,2932,687]},{"type":"call","value":[2820,1572,2932,269]},{"type":"call","value":[2820,1572,2932,333]},{"type":"call","value":[2820,1572,2932,397]},{"type":"call","value":[2820,1572,2932,461]},{"type":"call","value":[2820,1572,2932,287]},{"type":"call","value":[2820,1572,2932,525]},{"type":"call","value":[2820,1572,2932,351]},{"type":"call","value":[2820,1572,2932,589]},{"type":"call","value":[2820,1572,2932,415]},{"type":"call","value":[2820,1572,2932,653]},{"type":"call","value":[2820,1572,2932,479]},{"type":"call","value":[2820,1572,2932,717]},{"type":"call","value":[2820,1572,2932,543]},{"type":"call","value":[2820,1572,2932,607]},{"type":"call","value":[2820,1572,2932,671]},{"type":"call","value":[2820,1572,2932,735]},{"type":"call","value":[2820,1572,2932,253]},{"type":"call","value":[2820,1572,2932,317]},{"type":"call","value":[2820,1572,2932,381]},{"type":"call","value":[2820,1572,2932,445]},{"type":"call","value":[2820,1572,2932,271]},{"type":"call","value":[2820,1572,2932,509]},{"type":"call","value":[2820,1572,2932,335]},{"type":"call","value":[2820,1572,2932,573]},{"type":"call","value":[2820,1572,2932,399]},{"type":"call","value":[2820,1572,2932,637]},{"type":"call","value":[2820,1572,2932,463]},{"type":"call","value":[2820,1572,2932,289]},{"type":"call","value":[2820,1572,2932,527]},{"type":"call","value":[2820,1572,2932,353]},{"type":"call","value":[2820,1572,2932,591]},{"type":"call","value":[2820,1572,2932,417]},{"type":"call","value":[2820,1572,2932,655]},{"type":"call","value":[2820,1572,2932,481]},{"type":"call","value":[2820,1572,2932,719]},{"type":"call","value":[2820,1572,2932,545]},{"type":"call","value":[2820,1572,2932,609]},{"type":"call","value":[2820,1572,2932,673]},{"type":"call","value":[2820,1572,2932,737]},{"type":"call","value":[2820,1572,2932,255]},{"type":"call","value":[2820,1572,2932,319]},{"type":"call","value":[2820,1572,2932,383]},{"type":"call","value":[2820,1572,2932,447]},{"type":"call","value":[2820,1572,2932,273]},{"type":"call","value":[2820,1572,2932,511]},{"type":"call","value":[2820,1572,2932,337]},{"type":"call","value":[2820,1572,2932,575]},{"type":"call","value":[2820,1572,2932,401]},{"type":"call","value":[2820,1572,2932,639]},{"type":"call","value":[2820,1572,2932,465]},{"type":"call","value":[2820,1572,2932,703]},{"type":"call","value":[2820,1572,2932,529]},{"type":"call","value":[2820,1572,2932,593]},{"type":"call","value":[2820,1572,2932,657]},{"type":"call","value":[2820,1572,2932,721]},{"type":"call","value":[2820,1572,2932,239]},{"type":"call","value":[2820,1572,2932,611]},{"type":"call","value":[2820,1572,2932,303]},{"type":"call","value":[2820,1572,2932,675]},{"type":"call","value":[2820,1572,2932,367]},{"type":"call","value":[2820,1572,2932,739]},{"type":"call","value":[2820,1572,2932,257]},{"type":"call","value":[2820,1572,2932,321]},{"type":"call","value":[2820,1572,2932,385]},{"type":"call","value":[2820,1572,2932,449]},{"type":"call","value":[2820,1572,2932,275]},{"type":"call","value":[2820,1572,2932,513]},{"type":"call","value":[2820,1572,2932,339]},{"type":"call","value":[2820,1572,2932,577]},{"type":"call","value":[2820,1572,2932,403]},{"type":"call","value":[2820,1572,2932,641]},{"type":"call","value":[2820,1572,2932,467]},{"type":"call","value":[2820,1572,2932,705]},{"type":"call","value":[2820,1572,2932,531]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2932,38]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2932,130]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1572,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2804,972]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1912,1216]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAlloc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtAllocateVirtualMemory"}},"children":[],"locations":[{"type":"call","value":[2820,1912,1216,211]},{"type":"call","value":[2820,1912,1216,218]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[2820,1912,1216,980]},{"type":"call","value":[2820,1912,1216,1526]},{"type":"call","value":[2820,1912,1216,1108]},{"type":"call","value":[2820,1912,1216,1654]},{"type":"call","value":[2820,1912,1216,452]},{"type":"call","value":[2820,1912,1216,998]},{"type":"call","value":[2820,1912,1216,1236]},{"type":"call","value":[2820,1912,1216,1364]},{"type":"call","value":[2820,1912,1216,1254]},{"type":"call","value":[2820,1912,1216,1492]},{"type":"call","value":[2820,1912,1216,1382]},{"type":"call","value":[2820,1912,1216,1620]},{"type":"call","value":[2820,1912,1216,726]},{"type":"call","value":[2820,1912,1216,1272]},{"type":"call","value":[2820,1912,1216,1510]},{"type":"call","value":[2820,1912,1216,1400]},{"type":"call","value":[2820,1912,1216,1638]},{"type":"call","value":[2820,1912,1216,1528]},{"type":"call","value":[2820,1912,1216,872]},{"type":"call","value":[2820,1912,1216,1656]},{"type":"call","value":[2820,1912,1216,1238]},{"type":"call","value":[2820,1912,1216,344]},{"type":"call","value":[2820,1912,1216,582]},{"type":"call","value":[2820,1912,1216,1128]},{"type":"call","value":[2820,1912,1216,1366]},{"type":"call","value":[2820,1912,1216,710]},{"type":"call","value":[2820,1912,1216,1256]},{"type":"call","value":[2820,1912,1216,1494]},{"type":"call","value":[2820,1912,1216,1384]},{"type":"call","value":[2820,1912,1216,1622]},{"type":"call","value":[2820,1912,1216,966]},{"type":"call","value":[2820,1912,1216,1512]},{"type":"call","value":[2820,1912,1216,1094]},{"type":"call","value":[2820,1912,1216,1640]},{"type":"call","value":[2820,1912,1216,1222]},{"type":"call","value":[2820,1912,1216,566]},{"type":"call","value":[2820,1912,1216,1112]},{"type":"call","value":[2820,1912,1216,1350]},{"type":"call","value":[2820,1912,1216,456]},{"type":"call","value":[2820,1912,1216,694]},{"type":"call","value":[2820,1912,1216,1240]},{"type":"call","value":[2820,1912,1216,1478]},{"type":"call","value":[2820,1912,1216,1368]},{"type":"call","value":[2820,1912,1216,474]},{"type":"call","value":[2820,1912,1216,1258]},{"type":"call","value":[2820,1912,1216,1496]},{"type":"call","value":[2820,1912,1216,602]},{"type":"call","value":[2820,1912,1216,840]},{"type":"call","value":[2820,1912,1216,1386]},{"type":"call","value":[2820,1912,1216,1624]},{"type":"call","value":[2820,1912,1216,1514]},{"type":"call","value":[2820,1912,1216,1642]},{"type":"call","value":[2820,1912,1216,1224]},{"type":"call","value":[2820,1912,1216,330]},{"type":"call","value":[2820,1912,1216,1352]},{"type":"call","value":[2820,1912,1216,1242]},{"type":"call","value":[2820,1912,1216,1480]},{"type":"call","value":[2820,1912,1216,586]},{"type":"call","value":[2820,1912,1216,824]},{"type":"call","value":[2820,1912,1216,1370]},{"type":"call","value":[2820,1912,1216,1608]},{"type":"call","value":[2820,1912,1216,714]},{"type":"call","value":[2820,1912,1216,1498]},{"type":"call","value":[2820,1912,1216,1626]},{"type":"call","value":[2820,1912,1216,1516]},{"type":"call","value":[2820,1912,1216,1208]},{"type":"call","value":[2820,1912,1216,1098]},{"type":"call","value":[2820,1912,1216,1644]},{"type":"call","value":[2820,1912,1216,988]},{"type":"call","value":[2820,1912,1216,1226]},{"type":"call","value":[2820,1912,1216,332]},{"type":"call","value":[2820,1912,1216,1354]},{"type":"call","value":[2820,1912,1216,460]},{"type":"call","value":[2820,1912,1216,1244]},{"type":"call","value":[2820,1912,1216,1482]},{"type":"call","value":[2820,1912,1216,1372]},{"type":"call","value":[2820,1912,1216,1610]},{"type":"call","value":[2820,1912,1216,1500]},{"type":"call","value":[2820,1912,1216,1082]},{"type":"call","value":[2820,1912,1216,1628]},{"type":"call","value":[2820,1912,1216,1210]},{"type":"call","value":[2820,1912,1216,1338]},{"type":"call","value":[2820,1912,1216,1228]},{"type":"call","value":[2820,1912,1216,1466]},{"type":"call","value":[2820,1912,1216,810]},{"type":"call","value":[2820,1912,1216,1356]},{"type":"call","value":[2820,1912,1216,1594]},{"type":"call","value":[2820,1912,1216,1246]},{"type":"call","value":[2820,1912,1216,1484]},{"type":"call","value":[2820,1912,1216,590]},{"type":"call","value":[2820,1912,1216,1722]},{"type":"call","value":[2820,1912,1216,1374]},{"type":"call","value":[2820,1912,1216,1612]},{"type":"call","value":[2820,1912,1216,718]},{"type":"call","value":[2820,1912,1216,956]},{"type":"call","value":[2820,1912,1216,1502]},{"type":"call","value":[2820,1912,1216,846]},{"type":"call","value":[2820,1912,1216,1630]},{"type":"call","value":[2820,1912,1216,428]},{"type":"call","value":[2820,1912,1216,974]},{"type":"call","value":[2820,1912,1216,1212]},{"type":"call","value":[2820,1912,1216,1340]},{"type":"call","value":[2820,1912,1216,446]},{"type":"call","value":[2820,1912,1216,684]},{"type":"call","value":[2820,1912,1216,1230]},{"type":"call","value":[2820,1912,1216,1468]},{"type":"call","value":[2820,1912,1216,574]},{"type":"call","value":[2820,1912,1216,1358]},{"type":"call","value":[2820,1912,1216,1596]},{"type":"call","value":[2820,1912,1216,1486]},{"type":"call","value":[2820,1912,1216,1724]},{"type":"call","value":[2820,1912,1216,830]},{"type":"call","value":[2820,1912,1216,1614]},{"type":"call","value":[2820,1912,1216,412]},{"type":"call","value":[2820,1912,1216,1196]},{"type":"call","value":[2820,1912,1216,1086]},{"type":"call","value":[2820,1912,1216,1324]},{"type":"call","value":[2820,1912,1216,1214]},{"type":"call","value":[2820,1912,1216,1452]},{"type":"call","value":[2820,1912,1216,558]},{"type":"call","value":[2820,1912,1216,1104]},{"type":"call","value":[2820,1912,1216,1342]},{"type":"call","value":[2820,1912,1216,1232]},{"type":"call","value":[2820,1912,1216,1470]},{"type":"call","value":[2820,1912,1216,814]},{"type":"call","value":[2820,1912,1216,1360]},{"type":"call","value":[2820,1912,1216,1598]},{"type":"call","value":[2820,1912,1216,704]},{"type":"call","value":[2820,1912,1216,942]},{"type":"call","value":[2820,1912,1216,1488]},{"type":"call","value":[2820,1912,1216,1726]},{"type":"call","value":[2820,1912,1216,1070]},{"type":"call","value":[2820,1912,1216,1616]},{"type":"call","value":[2820,1912,1216,1198]},{"type":"call","value":[2820,1912,1216,542]},{"type":"call","value":[2820,1912,1216,1326]},{"type":"call","value":[2820,1912,1216,1216]},{"type":"call","value":[2820,1912,1216,1454]},{"type":"call","value":[2820,1912,1216,798]},{"type":"call","value":[2820,1912,1216,1344]},{"type":"call","value":[2820,1912,1216,1582]},{"type":"call","value":[2820,1912,1216,926]},{"type":"call","value":[2820,1912,1216,1472]},{"type":"call","value":[2820,1912,1216,1710]},{"type":"call","value":[2820,1912,1216,1362]},{"type":"call","value":[2820,1912,1216,1054]},{"type":"call","value":[2820,1912,1216,1600]},{"type":"call","value":[2820,1912,1216,398]},{"type":"call","value":[2820,1912,1216,1490]},{"type":"call","value":[2820,1912,1216,834]},{"type":"call","value":[2820,1912,1216,953]},{"type":"call","value":[2820,1912,1216,1618]},{"type":"call","value":[2820,1912,1216,962]},{"type":"call","value":[2820,1912,1216,1200]},{"type":"call","value":[2820,1912,1216,1328]},{"type":"call","value":[2820,1912,1216,434]},{"type":"call","value":[2820,1912,1216,672]},{"type":"call","value":[2820,1912,1216,1218]},{"type":"call","value":[2820,1912,1216,1456]},{"type":"call","value":[2820,1912,1216,562]},{"type":"call","value":[2820,1912,1216,1346]},{"type":"call","value":[2820,1912,1216,1584]},{"type":"call","value":[2820,1912,1216,690]},{"type":"call","value":[2820,1912,1216,1474]},{"type":"call","value":[2820,1912,1216,1712]},{"type":"call","value":[2820,1912,1216,1602]},{"type":"call","value":[2820,1912,1216,1184]},{"type":"call","value":[2820,1912,1216,528]},{"type":"call","value":[2820,1912,1216,1312]},{"type":"call","value":[2820,1912,1216,418]},{"type":"call","value":[2820,1912,1216,656]},{"type":"call","value":[2820,1912,1216,1202]},{"type":"call","value":[2820,1912,1216,1440]},{"type":"call","value":[2820,1912,1216,546]},{"type":"call","value":[2820,1912,1216,1330]},{"type":"call","value":[2820,1912,1216,1568]},{"type":"call","value":[2820,1912,1216,1220]},{"type":"call","value":[2820,1912,1216,1458]},{"type":"call","value":[2820,1912,1216,1348]},{"type":"call","value":[2820,1912,1216,1586]},{"type":"call","value":[2820,1912,1216,930]},{"type":"call","value":[2820,1912,1216,1476]},{"type":"call","value":[2820,1912,1216,1714]},{"type":"call","value":[2820,1912,1216,820]},{"type":"call","value":[2820,1912,1216,1058]},{"type":"call","value":[2820,1912,1216,1604]},{"type":"call","value":[2820,1912,1216,402]},{"type":"call","value":[2820,1912,1216,948]},{"type":"call","value":[2820,1912,1216,1186]},{"type":"call","value":[2820,1912,1216,1076]},{"type":"call","value":[2820,1912,1216,1314]},{"type":"call","value":[2820,1912,1216,1204]},{"type":"call","value":[2820,1912,1216,1442]},{"type":"call","value":[2820,1912,1216,1332]},{"type":"call","value":[2820,1912,1216,1570]},{"type":"call","value":[2820,1912,1216,1460]},{"type":"call","value":[2820,1912,1216,1698]},{"type":"call","value":[2820,1912,1216,804]},{"type":"call","value":[2820,1912,1216,1042]},{"type":"call","value":[2820,1912,1216,1588]},{"type":"call","value":[2820,1912,1216,386]},{"type":"call","value":[2820,1912,1216,1170]},{"type":"call","value":[2820,1912,1216,1716]},{"type":"call","value":[2820,1912,1216,1606]},{"type":"call","value":[2820,1912,1216,1298]},{"type":"call","value":[2820,1912,1216,1188]},{"type":"call","value":[2820,1912,1216,532]},{"type":"call","value":[2820,1912,1216,1316]},{"type":"call","value":[2820,1912,1216,422]},{"type":"call","value":[2820,1912,1216,660]},{"type":"call","value":[2820,1912,1216,1206]},{"type":"call","value":[2820,1912,1216,1444]},{"type":"call","value":[2820,1912,1216,788]},{"type":"call","value":[2820,1912,1216,1334]},{"type":"call","value":[2820,1912,1216,1572]},{"type":"call","value":[2820,1912,1216,1462]},{"type":"call","value":[2820,1912,1216,1700]},{"type":"call","value":[2820,1912,1216,1590]},{"type":"call","value":[2820,1912,1216,1172]},{"type":"call","value":[2820,1912,1216,1718]},{"type":"call","value":[2820,1912,1216,1300]},{"type":"call","value":[2820,1912,1216,406]},{"type":"call","value":[2820,1912,1216,644]},{"type":"call","value":[2820,1912,1216,1190]},{"type":"call","value":[2820,1912,1216,1428]},{"type":"call","value":[2820,1912,1216,1318]},{"type":"call","value":[2820,1912,1216,1556]},{"type":"call","value":[2820,1912,1216,900]},{"type":"call","value":[2820,1912,1216,1446]},{"type":"call","value":[2820,1912,1216,552]},{"type":"call","value":[2820,1912,1216,1684]},{"type":"call","value":[2820,1912,1216,1336]},{"type":"call","value":[2820,1912,1216,1574]},{"type":"call","value":[2820,1912,1216,918]},{"type":"call","value":[2820,1912,1216,1464]},{"type":"call","value":[2820,1912,1216,1702]},{"type":"call","value":[2820,1912,1216,1592]},{"type":"call","value":[2820,1912,1216,390]},{"type":"call","value":[2820,1912,1216,936]},{"type":"call","value":[2820,1912,1216,1174]},{"type":"call","value":[2820,1912,1216,1720]},{"type":"call","value":[2820,1912,1216,518]},{"type":"call","value":[2820,1912,1216,1064]},{"type":"call","value":[2820,1912,1216,1302]},{"type":"call","value":[2820,1912,1216,1192]},{"type":"call","value":[2820,1912,1216,1430]},{"type":"call","value":[2820,1912,1216,1320]},{"type":"call","value":[2820,1912,1216,1558]},{"type":"call","value":[2820,1912,1216,1448]},{"type":"call","value":[2820,1912,1216,1686]},{"type":"call","value":[2820,1912,1216,792]},{"type":"call","value":[2820,1912,1216,1030]},{"type":"call","value":[2820,1912,1216,1576]},{"type":"call","value":[2820,1912,1216,1158]},{"type":"call","value":[2820,1912,1216,1704]},{"type":"call","value":[2820,1912,1216,1048]},{"type":"call","value":[2820,1912,1216,1286]},{"type":"call","value":[2820,1912,1216,630]},{"type":"call","value":[2820,1912,1216,1176]},{"type":"call","value":[2820,1912,1216,1414]},{"type":"call","value":[2820,1912,1216,758]},{"type":"call","value":[2820,1912,1216,1304]},{"type":"call","value":[2820,1912,1216,1542]},{"type":"call","value":[2820,1912,1216,1194]},{"type":"call","value":[2820,1912,1216,1432]},{"type":"call","value":[2820,1912,1216,538]},{"type":"call","value":[2820,1912,1216,776]},{"type":"call","value":[2820,1912,1216,1322]},{"type":"call","value":[2820,1912,1216,1560]},{"type":"call","value":[2820,1912,1216,666]},{"type":"call","value":[2820,1912,1216,1450]},{"type":"call","value":[2820,1912,1216,1688]},{"type":"call","value":[2820,1912,1216,1578]},{"type":"call","value":[2820,1912,1216,376]},{"type":"call","value":[2820,1912,1216,1160]},{"type":"call","value":[2820,1912,1216,1706]},{"type":"call","value":[2820,1912,1216,1288]},{"type":"call","value":[2820,1912,1216,394]},{"type":"call","value":[2820,1912,1216,1178]},{"type":"call","value":[2820,1912,1216,1416]},{"type":"call","value":[2820,1912,1216,522]},{"type":"call","value":[2820,1912,1216,1306]},{"type":"call","value":[2820,1912,1216,1544]},{"type":"call","value":[2820,1912,1216,650]},{"type":"call","value":[2820,1912,1216,1434]},{"type":"call","value":[2820,1912,1216,1672]},{"type":"call","value":[2820,1912,1216,1562]},{"type":"call","value":[2820,1912,1216,360]},{"type":"call","value":[2820,1912,1216,1144]},{"type":"call","value":[2820,1912,1216,1690]},{"type":"call","value":[2820,1912,1216,488]},{"type":"call","value":[2820,1912,1216,1034]},{"type":"call","value":[2820,1912,1216,1580]},{"type":"call","value":[2820,1912,1216,1162]},{"type":"call","value":[2820,1912,1216,1708]},{"type":"call","value":[2820,1912,1216,1290]},{"type":"call","value":[2820,1912,1216,1180]},{"type":"call","value":[2820,1912,1216,1418]},{"type":"call","value":[2820,1912,1216,1308]},{"type":"call","value":[2820,1912,1216,1546]},{"type":"call","value":[2820,1912,1216,890]},{"type":"call","value":[2820,1912,1216,1436]},{"type":"call","value":[2820,1912,1216,1674]},{"type":"call","value":[2820,1912,1216,1018]},{"type":"call","value":[2820,1912,1216,1564]},{"type":"call","value":[2820,1912,1216,908]},{"type":"call","value":[2820,1912,1216,1146]},{"type":"call","value":[2820,1912,1216,1692]},{"type":"call","value":[2820,1912,1216,1274]},{"type":"call","value":[2820,1912,1216,380]},{"type":"call","value":[2820,1912,1216,618]},{"type":"call","value":[2820,1912,1216,1164]},{"type":"call","value":[2820,1912,1216,1402]},{"type":"call","value":[2820,1912,1216,508]},{"type":"call","value":[2820,1912,1216,746]},{"type":"call","value":[2820,1912,1216,1292]},{"type":"call","value":[2820,1912,1216,1530]},{"type":"call","value":[2820,1912,1216,636]},{"type":"call","value":[2820,1912,1216,1182]},{"type":"call","value":[2820,1912,1216,1420]},{"type":"call","value":[2820,1912,1216,1658]},{"type":"call","value":[2820,1912,1216,764]},{"type":"call","value":[2820,1912,1216,1310]},{"type":"call","value":[2820,1912,1216,1548]},{"type":"call","value":[2820,1912,1216,1438]},{"type":"call","value":[2820,1912,1216,1676]},{"type":"call","value":[2820,1912,1216,782]},{"type":"call","value":[2820,1912,1216,1566]},{"type":"call","value":[2820,1912,1216,1148]},{"type":"call","value":[2820,1912,1216,1694]},{"type":"call","value":[2820,1912,1216,1276]},{"type":"call","value":[2820,1912,1216,1166]},{"type":"call","value":[2820,1912,1216,1404]},{"type":"call","value":[2820,1912,1216,1294]},{"type":"call","value":[2820,1912,1216,1532]},{"type":"call","value":[2820,1912,1216,1422]},{"type":"call","value":[2820,1912,1216,1660]},{"type":"call","value":[2820,1912,1216,1550]},{"type":"call","value":[2820,1912,1216,1132]},{"type":"call","value":[2820,1912,1216,1678]},{"type":"call","value":[2820,1912,1216,1022]},{"type":"call","value":[2820,1912,1216,1260]},{"type":"call","value":[2820,1912,1216,366]},{"type":"call","value":[2820,1912,1216,912]},{"type":"call","value":[2820,1912,1216,1150]},{"type":"call","value":[2820,1912,1216,1696]},{"type":"call","value":[2820,1912,1216,1388]},{"type":"call","value":[2820,1912,1216,494]},{"type":"call","value":[2820,1912,1216,1278]},{"type":"call","value":[2820,1912,1216,503]},{"type":"call","value":[2820,1912,1216,1168]},{"type":"call","value":[2820,1912,1216,1406]},{"type":"call","value":[2820,1912,1216,512]},{"type":"call","value":[2820,1912,1216,1296]},{"type":"call","value":[2820,1912,1216,1534]},{"type":"call","value":[2820,1912,1216,878]},{"type":"call","value":[2820,1912,1216,1424]},{"type":"call","value":[2820,1912,1216,1662]},{"type":"call","value":[2820,1912,1216,1006]},{"type":"call","value":[2820,1912,1216,1552]},{"type":"call","value":[2820,1912,1216,1134]},{"type":"call","value":[2820,1912,1216,240]},{"type":"call","value":[2820,1912,1216,1680]},{"type":"call","value":[2820,1912,1216,478]},{"type":"call","value":[2820,1912,1216,1262]},{"type":"call","value":[2820,1912,1216,606]},{"type":"call","value":[2820,1912,1216,1152]},{"type":"call","value":[2820,1912,1216,1390]},{"type":"call","value":[2820,1912,1216,734]},{"type":"call","value":[2820,1912,1216,1280]},{"type":"call","value":[2820,1912,1216,1518]},{"type":"call","value":[2820,1912,1216,624]},{"type":"call","value":[2820,1912,1216,862]},{"type":"call","value":[2820,1912,1216,1408]},{"type":"call","value":[2820,1912,1216,1646]},{"type":"call","value":[2820,1912,1216,1536]},{"type":"call","value":[2820,1912,1216,1426]},{"type":"call","value":[2820,1912,1216,1118]},{"type":"call","value":[2820,1912,1216,1664]},{"type":"call","value":[2820,1912,1216,770]},{"type":"call","value":[2820,1912,1216,1554]},{"type":"call","value":[2820,1912,1216,1136]},{"type":"call","value":[2820,1912,1216,1682]},{"type":"call","value":[2820,1912,1216,1026]},{"type":"call","value":[2820,1912,1216,1264]},{"type":"call","value":[2820,1912,1216,370]},{"type":"call","value":[2820,1912,1216,1154]},{"type":"call","value":[2820,1912,1216,1392]},{"type":"call","value":[2820,1912,1216,498]},{"type":"call","value":[2820,1912,1216,1282]},{"type":"call","value":[2820,1912,1216,1520]},{"type":"call","value":[2820,1912,1216,1410]},{"type":"call","value":[2820,1912,1216,1648]},{"type":"call","value":[2820,1912,1216,754]},{"type":"call","value":[2820,1912,1216,1538]},{"type":"call","value":[2820,1912,1216,336]},{"type":"call","value":[2820,1912,1216,1666]},{"type":"call","value":[2820,1912,1216,464]},{"type":"call","value":[2820,1912,1216,1248]},{"type":"call","value":[2820,1912,1216,354]},{"type":"call","value":[2820,1912,1216,1138]},{"type":"call","value":[2820,1912,1216,1376]},{"type":"call","value":[2820,1912,1216,482]},{"type":"call","value":[2820,1912,1216,1266]},{"type":"call","value":[2820,1912,1216,1504]},{"type":"call","value":[2820,1912,1216,1156]},{"type":"call","value":[2820,1912,1216,1394]},{"type":"call","value":[2820,1912,1216,1632]},{"type":"call","value":[2820,1912,1216,1284]},{"type":"call","value":[2820,1912,1216,1522]},{"type":"call","value":[2820,1912,1216,866]},{"type":"call","value":[2820,1912,1216,1412]},{"type":"call","value":[2820,1912,1216,1650]},{"type":"call","value":[2820,1912,1216,1540]},{"type":"call","value":[2820,1912,1216,884]},{"type":"call","value":[2820,1912,1216,1668]},{"type":"call","value":[2820,1912,1216,1012]},{"type":"call","value":[2820,1912,1216,1250]},{"type":"call","value":[2820,1912,1216,594]},{"type":"call","value":[2820,1912,1216,1140]},{"type":"call","value":[2820,1912,1216,1378]},{"type":"call","value":[2820,1912,1216,1268]},{"type":"call","value":[2820,1912,1216,1506]},{"type":"call","value":[2820,1912,1216,612]},{"type":"call","value":[2820,1912,1216,1396]},{"type":"call","value":[2820,1912,1216,1634]},{"type":"call","value":[2820,1912,1216,740]},{"type":"call","value":[2820,1912,1216,1524]},{"type":"call","value":[2820,1912,1216,1652]},{"type":"call","value":[2820,1912,1216,1234]},{"type":"call","value":[2820,1912,1216,340]},{"type":"call","value":[2820,1912,1216,578]},{"type":"call","value":[2820,1912,1216,1124]},{"type":"call","value":[2820,1912,1216,1670]},{"type":"call","value":[2820,1912,1216,468]},{"type":"call","value":[2820,1912,1216,1252]},{"type":"call","value":[2820,1912,1216,1142]},{"type":"call","value":[2820,1912,1216,1380]},{"type":"call","value":[2820,1912,1216,1270]},{"type":"call","value":[2820,1912,1216,1508]},{"type":"call","value":[2820,1912,1216,852]},{"type":"call","value":[2820,1912,1216,1398]},{"type":"call","value":[2820,1912,1216,1636]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"link function at runtime on Windows"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAlloc"}},"children":[],"locations":[{"type":"call","value":[2820,1912,1216,39]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocEx"}},"children":[],"locations":[{"type":"call","value":[2820,1912,1216,129]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"VirtualAllocExNuma"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwAllocateVirtualMemory"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"NtMapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"string","string":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open process":{"meta":{"name":"open process","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Open Process"],"objective":"Process","behavior":"Open Process","method":"","id":"C0065"}],"references":[],"examples":["Practical Malware Analysis Lab 17-02.dll_:0x1000D10D"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: open process\n authors:\n - 0x534a@mailbox.org\n lib: 'true'\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Process::Open Process [C0065]\n examples:\n - Practical Malware Analysis Lab 17-02.dll_:0x1000D10D\n features:\n - or:\n - api: kernel32.OpenProcess\n - api: NtOpenProcess\n - api: ZwOpenProcess\n","matches":[[{"type":"thread","value":[2456,3052,3064]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,480]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2192,2204]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,475]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,1180,500]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,476]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2596]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2596,2414]},{"type":"call","value":[1180,1852,2596,2423]},{"type":"call","value":[1180,1852,2596,3436]},{"type":"call","value":[1180,1852,2596,3863]},{"type":"call","value":[1180,1852,2596,2780]},{"type":"call","value":[1180,1852,2596,3445]},{"type":"call","value":[1180,1852,2596,2789]},{"type":"call","value":[1180,1852,2596,3454]},{"type":"call","value":[1180,1852,2596,2133]},{"type":"call","value":[1180,1852,2596,3573]},{"type":"call","value":[1180,1852,2596,2798]},{"type":"call","value":[1180,1852,2596,3463]},{"type":"call","value":[1180,1852,2596,3582]},{"type":"call","value":[1180,1852,2596,2261]},{"type":"call","value":[1180,1852,2596,3591]},{"type":"call","value":[1180,1852,2596,2270]},{"type":"call","value":[1180,1852,2596,293]},{"type":"call","value":[1180,1852,2596,2279]},{"type":"call","value":[1180,1852,2596,3600]},{"type":"call","value":[1180,1852,2596,4613]},{"type":"call","value":[1180,1852,2596,4622]},{"type":"call","value":[1180,1852,2596,1632]},{"type":"call","value":[1180,1852,2596,4085]},{"type":"call","value":[1180,1852,2596,4631]},{"type":"call","value":[1180,1852,2596,4869]},{"type":"call","value":[1180,1852,2596,3975]},{"type":"call","value":[1180,1852,2596,4094]},{"type":"call","value":[1180,1852,2596,4640]},{"type":"call","value":[1180,1852,2596,2117]},{"type":"call","value":[1180,1852,2596,4103]},{"type":"call","value":[1180,1852,2596,2126]},{"type":"call","value":[1180,1852,2596,4112]},{"type":"call","value":[1180,1852,2596,4121]},{"type":"call","value":[1180,1852,2596,1726]},{"type":"call","value":[1180,1852,2596,3950]},{"type":"call","value":[1180,1852,2596,1735]},{"type":"call","value":[1180,1852,2596,1854]},{"type":"call","value":[1180,1852,2596,4734]},{"type":"call","value":[1180,1852,2596,3959]},{"type":"call","value":[1180,1852,2596,1744]},{"type":"call","value":[1180,1852,2596,4743]},{"type":"call","value":[1180,1852,2596,3968]},{"type":"call","value":[1180,1852,2596,1753]},{"type":"call","value":[1180,1852,2596,4752]},{"type":"call","value":[1180,1852,2596,1335]},{"type":"call","value":[1180,1852,2596,1762]},{"type":"call","value":[1180,1852,2596,4761]},{"type":"call","value":[1180,1852,2596,4770]},{"type":"call","value":[1180,1852,2596,2384]},{"type":"call","value":[1180,1852,2596,2393]},{"type":"call","value":[1180,1852,2596,2402]},{"type":"call","value":[1180,1852,2596,2411]},{"type":"call","value":[1180,1852,2596,3424]},{"type":"call","value":[1180,1852,2596,2768]},{"type":"call","value":[1180,1852,2596,3433]},{"type":"call","value":[1180,1852,2596,3552]},{"type":"call","value":[1180,1852,2596,2777]},{"type":"call","value":[1180,1852,2596,3561]},{"type":"call","value":[1180,1852,2596,2786]},{"type":"call","value":[1180,1852,2596,3451]},{"type":"call","value":[1180,1852,2596,3570]},{"type":"call","value":[1180,1852,2596,2795]},{"type":"call","value":[1180,1852,2596,3460]},{"type":"call","value":[1180,1852,2596,4592]},{"type":"call","value":[1180,1852,2596,2258]},{"type":"call","value":[1180,1852,2596,2804]},{"type":"call","value":[1180,1852,2596,281]},{"type":"call","value":[1180,1852,2596,2267]},{"type":"call","value":[1180,1852,2596,3588]},{"type":"call","value":[1180,1852,2596,4601]},{"type":"call","value":[1180,1852,2596,290]},{"type":"call","value":[1180,1852,2596,1849]},{"type":"call","value":[1180,1852,2596,2276]},{"type":"call","value":[1180,1852,2596,4610]},{"type":"call","value":[1180,1852,2596,4073]},{"type":"call","value":[1180,1852,2596,299]},{"type":"call","value":[1180,1852,2596,4619]},{"type":"call","value":[1180,1852,2596,4082]},{"type":"call","value":[1180,1852,2596,4628]},{"type":"call","value":[1180,1852,2596,2105]},{"type":"call","value":[1180,1852,2596,4091]},{"type":"call","value":[1180,1852,2596,2114]},{"type":"call","value":[1180,1852,2596,4100]},{"type":"call","value":[1180,1852,2596,2123]},{"type":"call","value":[1180,1852,2596,4109]},{"type":"call","value":[1180,1852,2596,1723]},{"type":"call","value":[1180,1852,2596,3947]},{"type":"call","value":[1180,1852,2596,1732]},{"type":"call","value":[1180,1852,2596,3956]},{"type":"call","value":[1180,1852,2596,1741]},{"type":"call","value":[1180,1852,2596,4740]},{"type":"call","value":[1180,1852,2596,3965]},{"type":"call","value":[1180,1852,2596,1750]},{"type":"call","value":[1180,1852,2596,4749]},{"type":"call","value":[1180,1852,2596,4758]},{"type":"call","value":[1180,1852,2596,2381]},{"type":"call","value":[1180,1852,2596,2390]},{"type":"call","value":[1180,1852,2596,3403]},{"type":"call","value":[1180,1852,2596,2399]},{"type":"call","value":[1180,1852,2596,3531]},{"type":"call","value":[1180,1852,2596,3412]},{"type":"call","value":[1180,1852,2596,1316]},{"type":"call","value":[1180,1852,2596,2756]},{"type":"call","value":[1180,1852,2596,3540]},{"type":"call","value":[1180,1852,2596,2765]},{"type":"call","value":[1180,1852,2596,3549]},{"type":"call","value":[1180,1852,2596,2228]},{"type":"call","value":[1180,1852,2596,2774]},{"type":"call","value":[1180,1852,2596,2783]},{"type":"call","value":[1180,1852,2596,260]},{"type":"call","value":[1180,1852,2596,2246]},{"type":"call","value":[1180,1852,2596,269]},{"type":"call","value":[1180,1852,2596,2255]},{"type":"call","value":[1180,1852,2596,2493]},{"type":"call","value":[1180,1852,2596,278]},{"type":"call","value":[1180,1852,2596,2264]},{"type":"call","value":[1180,1852,2596,4598]},{"type":"call","value":[1180,1852,2596,4836]},{"type":"call","value":[1180,1852,2596,287]},{"type":"call","value":[1180,1852,2596,4607]},{"type":"call","value":[1180,1852,2596,4070]},{"type":"call","value":[1180,1852,2596,4616]},{"type":"call","value":[1180,1852,2596,2093]},{"type":"call","value":[1180,1852,2596,4079]},{"type":"call","value":[1180,1852,2596,2102]},{"type":"call","value":[1180,1852,2596,4088]},{"type":"call","value":[1180,1852,2596,2111]},{"type":"call","value":[1180,1852,2596,2120]},{"type":"call","value":[1180,1852,2596,2477]},{"type":"call","value":[1180,1852,2596,3917]},{"type":"call","value":[1180,1852,2596,2486]},{"type":"call","value":[1180,1852,2596,3935]},{"type":"call","value":[1180,1852,2596,1720]},{"type":"call","value":[1180,1852,2596,3944]},{"type":"call","value":[1180,1852,2596,1729]},{"type":"call","value":[1180,1852,2596,3953]},{"type":"call","value":[1180,1852,2596,4737]},{"type":"call","value":[1180,1852,2596,1832]},{"type":"call","value":[1180,1852,2596,3391]},{"type":"call","value":[1180,1852,2596,1295]},{"type":"call","value":[1180,1852,2596,3400]},{"type":"call","value":[1180,1852,2596,3519]},{"type":"call","value":[1180,1852,2596,1304]},{"type":"call","value":[1180,1852,2596,3409]},{"type":"call","value":[1180,1852,2596,3528]},{"type":"call","value":[1180,1852,2596,2207]},{"type":"call","value":[1180,1852,2596,1313]},{"type":"call","value":[1180,1852,2596,2753]},{"type":"call","value":[1180,1852,2596,3418]},{"type":"call","value":[1180,1852,2596,3537]},{"type":"call","value":[1180,1852,2596,2216]},{"type":"call","value":[1180,1852,2596,2762]},{"type":"call","value":[1180,1852,2596,4849]},{"type":"call","value":[1180,1852,2596,3546]},{"type":"call","value":[1180,1852,2596,2225]},{"type":"call","value":[1180,1852,2596,2771]},{"type":"call","value":[1180,1852,2596,248]},{"type":"call","value":[1180,1852,2596,2234]},{"type":"call","value":[1180,1852,2596,3555]},{"type":"call","value":[1180,1852,2596,257]},{"type":"call","value":[1180,1852,2596,1816]},{"type":"call","value":[1180,1852,2596,2243]},{"type":"call","value":[1180,1852,2596,266]},{"type":"call","value":[1180,1852,2596,1825]},{"type":"call","value":[1180,1852,2596,4824]},{"type":"call","value":[1180,1852,2596,275]},{"type":"call","value":[1180,1852,2596,4595]},{"type":"call","value":[1180,1852,2596,4833]},{"type":"call","value":[1180,1852,2596,2072]},{"type":"call","value":[1180,1852,2596,284]},{"type":"call","value":[1180,1852,2596,4604]},{"type":"call","value":[1180,1852,2596,2081]},{"type":"call","value":[1180,1852,2596,4067]},{"type":"call","value":[1180,1852,2596,2865]},{"type":"call","value":[1180,1852,2596,2090]},{"type":"call","value":[1180,1852,2596,4076]},{"type":"call","value":[1180,1852,2596,2108]},{"type":"call","value":[1180,1852,2596,2465]},{"type":"call","value":[1180,1852,2596,3905]},{"type":"call","value":[1180,1852,2596,2474]},{"type":"call","value":[1180,1852,2596,3914]},{"type":"call","value":[1180,1852,2596,2483]},{"type":"call","value":[1180,1852,2596,3923]},{"type":"call","value":[1180,1852,2596,3932]},{"type":"call","value":[1180,1852,2596,1717]},{"type":"call","value":[1180,1852,2596,4179]},{"type":"call","value":[1180,1852,2596,643]},{"type":"call","value":[1180,1852,2596,4682]},{"type":"call","value":[1180,1852,2596,4691]},{"type":"call","value":[1180,1852,2596,3379]},{"type":"call","value":[1180,1852,2596,4163]},{"type":"call","value":[1180,1852,2596,3388]},{"type":"call","value":[1180,1852,2596,3507]},{"type":"call","value":[1180,1852,2596,1292]},{"type":"call","value":[1180,1852,2596,4172]},{"type":"call","value":[1180,1852,2596,3397]},{"type":"call","value":[1180,1852,2596,3516]},{"type":"call","value":[1180,1852,2596,2195]},{"type":"call","value":[1180,1852,2596,1301]},{"type":"call","value":[1180,1852,2596,3406]},{"type":"call","value":[1180,1852,2596,3525]},{"type":"call","value":[1180,1852,2596,2204]},{"type":"call","value":[1180,1852,2596,1310]},{"type":"call","value":[1180,1852,2596,2750]},{"type":"call","value":[1180,1852,2596,3415]},{"type":"call","value":[1180,1852,2596,3534]},{"type":"call","value":[1180,1852,2596,2213]},{"type":"call","value":[1180,1852,2596,2759]},{"type":"call","value":[1180,1852,2596,4846]},{"type":"call","value":[1180,1852,2596,1557]},{"type":"call","value":[1180,1852,2596,3543]},{"type":"call","value":[1180,1852,2596,3116]},{"type":"call","value":[1180,1852,2596,236]},{"type":"call","value":[1180,1852,2596,2222]},{"type":"call","value":[1180,1852,2596,245]},{"type":"call","value":[1180,1852,2596,1804]},{"type":"call","value":[1180,1852,2596,254]},{"type":"call","value":[1180,1852,2596,1813]},{"type":"call","value":[1180,1852,2596,263]},{"type":"call","value":[1180,1852,2596,1822]},{"type":"call","value":[1180,1852,2596,4821]},{"type":"call","value":[1180,1852,2596,2060]},{"type":"call","value":[1180,1852,2596,272]},{"type":"call","value":[1180,1852,2596,4830]},{"type":"call","value":[1180,1852,2596,2069]},{"type":"call","value":[1180,1852,2596,4839]},{"type":"call","value":[1180,1852,2596,2862]},{"type":"call","value":[1180,1852,2596,2453]},{"type":"call","value":[1180,1852,2596,3893]},{"type":"call","value":[1180,1852,2596,2462]},{"type":"call","value":[1180,1852,2596,3902]},{"type":"call","value":[1180,1852,2596,2471]},{"type":"call","value":[1180,1852,2596,3911]},{"type":"call","value":[1180,1852,2596,2480]},{"type":"call","value":[1180,1852,2596,2837]},{"type":"call","value":[1180,1852,2596,4704]},{"type":"call","value":[1180,1852,2596,2846]},{"type":"call","value":[1180,1852,2596,2855]},{"type":"call","value":[1180,1852,2596,640]},{"type":"call","value":[1180,1852,2596,4679]},{"type":"call","value":[1180,1852,2596,4688]},{"type":"call","value":[1180,1852,2596,3367]},{"type":"call","value":[1180,1852,2596,4151]},{"type":"call","value":[1180,1852,2596,4697]},{"type":"call","value":[1180,1852,2596,3376]},{"type":"call","value":[1180,1852,2596,4160]},{"type":"call","value":[1180,1852,2596,3385]},{"type":"call","value":[1180,1852,2596,3504]},{"type":"call","value":[1180,1852,2596,2183]},{"type":"call","value":[1180,1852,2596,1289]},{"type":"call","value":[1180,1852,2596,4169]},{"type":"call","value":[1180,1852,2596,3394]},{"type":"call","value":[1180,1852,2596,3513]},{"type":"call","value":[1180,1852,2596,2192]},{"type":"call","value":[1180,1852,2596,1298]},{"type":"call","value":[1180,1852,2596,3522]},{"type":"call","value":[1180,1852,2596,2201]},{"type":"call","value":[1180,1852,2596,1307]},{"type":"call","value":[1180,1852,2596,2210]},{"type":"call","value":[1180,1852,2596,1792]},{"type":"call","value":[1180,1852,2596,2219]},{"type":"call","value":[1180,1852,2596,242]},{"type":"call","value":[1180,1852,2596,1801]},{"type":"call","value":[1180,1852,2596,251]},{"type":"call","value":[1180,1852,2596,1810]},{"type":"call","value":[1180,1852,2596,2048]},{"type":"call","value":[1180,1852,2596,1819]},{"type":"call","value":[1180,1852,2596,4818]},{"type":"call","value":[1180,1852,2596,2057]},{"type":"call","value":[1180,1852,2596,4827]},{"type":"call","value":[1180,1852,2596,2066]},{"type":"call","value":[1180,1852,2596,2075]},{"type":"call","value":[1180,1852,2596,2432]},{"type":"call","value":[1180,1852,2596,3872]},{"type":"call","value":[1180,1852,2596,2441]},{"type":"call","value":[1180,1852,2596,3881]},{"type":"call","value":[1180,1852,2596,2450]},{"type":"call","value":[1180,1852,2596,3890]},{"type":"call","value":[1180,1852,2596,3899]},{"type":"call","value":[1180,1852,2596,2468]},{"type":"call","value":[1180,1852,2596,3908]},{"type":"call","value":[1180,1852,2596,2834]},{"type":"call","value":[1180,1852,2596,2843]},{"type":"call","value":[1180,1852,2596,2852]},{"type":"call","value":[1180,1852,2596,1250]},{"type":"call","value":[1180,1852,2596,4676]},{"type":"call","value":[1180,1852,2596,4139]},{"type":"call","value":[1180,1852,2596,4685]},{"type":"call","value":[1180,1852,2596,3364]},{"type":"call","value":[1180,1852,2596,4148]},{"type":"call","value":[1180,1852,2596,4694]},{"type":"call","value":[1180,1852,2596,3373]},{"type":"call","value":[1180,1852,2596,4157]},{"type":"call","value":[1180,1852,2596,3382]},{"type":"call","value":[1180,1852,2596,3501]},{"type":"call","value":[1180,1852,2596,2180]},{"type":"call","value":[1180,1852,2596,4166]},{"type":"call","value":[1180,1852,2596,3510]},{"type":"call","value":[1180,1852,2596,2189]},{"type":"call","value":[1180,1852,2596,1771]},{"type":"call","value":[1180,1852,2596,2198]},{"type":"call","value":[1180,1852,2596,1780]},{"type":"call","value":[1180,1852,2596,4779]},{"type":"call","value":[1180,1852,2596,1789]},{"type":"call","value":[1180,1852,2596,4788]},{"type":"call","value":[1180,1852,2596,2027]},{"type":"call","value":[1180,1852,2596,239]},{"type":"call","value":[1180,1852,2596,3119]},{"type":"call","value":[1180,1852,2596,2036]},{"type":"call","value":[1180,1852,2596,3476]},{"type":"call","value":[1180,1852,2596,1807]},{"type":"call","value":[1180,1852,2596,4806]},{"type":"call","value":[1180,1852,2596,2045]},{"type":"call","value":[1180,1852,2596,4925]},{"type":"call","value":[1180,1852,2596,4815]},{"type":"call","value":[1180,1852,2596,2054]},{"type":"call","value":[1180,1852,2596,3613]},{"type":"call","value":[1180,1852,2596,2063]},{"type":"call","value":[1180,1852,2596,2420]},{"type":"call","value":[1180,1852,2596,3204]},{"type":"call","value":[1180,1852,2596,2429]},{"type":"call","value":[1180,1852,2596,3869]},{"type":"call","value":[1180,1852,2596,3878]},{"type":"call","value":[1180,1852,2596,3887]},{"type":"call","value":[1180,1852,2596,3469]},{"type":"call","value":[1180,1852,2596,3896]},{"type":"call","value":[1180,1852,2596,3597]},{"type":"call","value":[1180,1852,2596,2822]},{"type":"call","value":[1180,1852,2596,3606]},{"type":"call","value":[1180,1852,2596,1272]},{"type":"call","value":[1180,1852,2596,2831]},{"type":"call","value":[1180,1852,2596,2840]},{"type":"call","value":[1180,1852,2596,4637]},{"type":"call","value":[1180,1852,2596,2849]},{"type":"call","value":[1180,1852,2596,4646]},{"type":"call","value":[1180,1852,2596,4118]},{"type":"call","value":[1180,1852,2596,4664]},{"type":"call","value":[1180,1852,2596,1247]},{"type":"call","value":[1180,1852,2596,4127]},{"type":"call","value":[1180,1852,2596,4673]},{"type":"call","value":[1180,1852,2596,4136]},{"type":"call","value":[1180,1852,2596,3370]},{"type":"call","value":[1180,1852,2596,4154]},{"type":"call","value":[1180,1852,2596,2177]},{"type":"call","value":[1180,1852,2596,1759]},{"type":"call","value":[1180,1852,2596,2186]},{"type":"call","value":[1180,1852,2596,1768]},{"type":"call","value":[1180,1852,2596,4767]},{"type":"call","value":[1180,1852,2596,4776]},{"type":"call","value":[1180,1852,2596,4785]},{"type":"call","value":[1180,1852,2596,2024]},{"type":"call","value":[1180,1852,2596,4794]},{"type":"call","value":[1180,1852,2596,2033]},{"type":"call","value":[1180,1852,2596,4803]},{"type":"call","value":[1180,1852,2596,2042]},{"type":"call","value":[1180,1852,2596,2051]},{"type":"call","value":[1180,1852,2596,2408]},{"type":"call","value":[1180,1852,2596,2417]},{"type":"call","value":[1180,1852,2596,1096]},{"type":"call","value":[1180,1852,2596,2426]},{"type":"call","value":[1180,1852,2596,3866]},{"type":"call","value":[1180,1852,2596,2435]},{"type":"call","value":[1180,1852,2596,3448]},{"type":"call","value":[1180,1852,2596,3875]},{"type":"call","value":[1180,1852,2596,2792]},{"type":"call","value":[1180,1852,2596,3884]},{"type":"call","value":[1180,1852,2596,3457]},{"type":"call","value":[1180,1852,2596,2801]},{"type":"call","value":[1180,1852,2596,3466]},{"type":"call","value":[1180,1852,2596,3585]},{"type":"call","value":[1180,1852,2596,2810]},{"type":"call","value":[1180,1852,2596,3594]},{"type":"call","value":[1180,1852,2596,2273]},{"type":"call","value":[1180,1852,2596,2819]},{"type":"call","value":[1180,1852,2596,3603]},{"type":"call","value":[1180,1852,2596,4625]},{"type":"call","value":[1180,1852,2596,4634]},{"type":"call","value":[1180,1852,2596,4097]},{"type":"call","value":[1180,1852,2596,4643]},{"type":"call","value":[1180,1852,2596,4106]},{"type":"call","value":[1180,1852,2596,4652]},{"type":"call","value":[1180,1852,2596,4115]},{"type":"call","value":[1180,1852,2596,4661]},{"type":"call","value":[1180,1852,2596,1253]},{"type":"call","value":[1180,1852,2596,1738]},{"type":"call","value":[1180,1852,2596,3962]},{"type":"call","value":[1180,1852,2596,1747]},{"type":"call","value":[1180,1852,2596,2174]},{"type":"call","value":[1180,1852,2596,4746]},{"type":"call","value":[1180,1852,2596,1756]},{"type":"call","value":[1180,1852,2596,4755]},{"type":"call","value":[1180,1852,2596,1765]},{"type":"call","value":[1180,1852,2596,4764]},{"type":"call","value":[1180,1852,2596,1774]},{"type":"call","value":[1180,1852,2596,4773]},{"type":"call","value":[1180,1852,2596,4782]},{"type":"call","value":[1180,1852,2596,2021]},{"type":"call","value":[1180,1852,2596,2030]},{"type":"call","value":[1180,1852,2596,2387]},{"type":"call","value":[1180,1852,2596,2039]},{"type":"call","value":[1180,1852,2596,2396]},{"type":"call","value":[1180,1852,2596,2286]},{"type":"call","value":[1180,1852,2596,2405]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,1656]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1656,5605]},{"type":"call","value":[1200,1248,1656,5615]},{"type":"call","value":[1200,1248,1656,6127]},{"type":"call","value":[1200,1248,1656,6136]},{"type":"call","value":[1200,1248,1656,5617]},{"type":"call","value":[1200,1248,1656,6125]},{"type":"call","value":[1200,1248,1656,6115]},{"type":"call","value":[1200,1248,1656,5626]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,1560]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6268]},{"type":"call","value":[1200,1248,1560,6243]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,2360,1788]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[2820,2360,1788,92]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2744,2916]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,478]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1572,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenProcess"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenProcess"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2804,937]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenProcess"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open file":{"meta":{"name":"create or open file","authors":["michael.hunhoff@mandiant.com","joakim@intezer.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Create File"],"objective":"File System","behavior":"Create File","method":"","id":"C0016"}],"references":[],"examples":["B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: create or open file\n authors:\n - michael.hunhoff@mandiant.com\n - joakim@intezer.com\n lib: 'true'\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - File System::Create File [C0016]\n examples:\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x401D7E\n features:\n - or:\n - api: CreateFile\n - api: CreateFileEx\n - api: IoCreateFile\n - api: IoCreateFileEx\n - api: ZwOpenFile\n - api: ZwCreateFile\n - api: NtOpenFile\n - api: NtCreateFile\n - api: LZCreateFile\n - api: LZOpenFile\n - api: fopen\n - api: fopen64\n - api: fdopen\n - api: freopen\n - api: open\n - api: openat\n","matches":[[{"type":"thread","value":[2456,3052,3064]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,782]},{"type":"call","value":[2456,3052,3064,716]},{"type":"call","value":[2456,3052,3064,739]},{"type":"call","value":[2456,3052,3064,751]},{"type":"call","value":[2456,3052,3064,730]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,370]},{"type":"call","value":[2456,3052,3064,804]},{"type":"call","value":[2456,3052,3064,813]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2456,3052,2792]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,916]},{"type":"call","value":[2456,3052,2792,911]},{"type":"call","value":[2456,3052,2792,903]},{"type":"call","value":[2456,3052,2792,898]},{"type":"call","value":[2456,3052,2792,893]},{"type":"call","value":[2456,3052,2792,888]},{"type":"call","value":[2456,3052,2792,883]},{"type":"call","value":[2456,3052,2792,907]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2192,2204]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,363]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,1180,500]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,362]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2852,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,118]},{"type":"call","value":[3052,2852,2804,115]},{"type":"call","value":[3052,2852,2804,84]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2852,2900,2904]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,90]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,920]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,28]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2596]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2596,217]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,764]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,764,595]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1156]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,2639]},{"type":"call","value":[1180,1852,1156,2729]},{"type":"call","value":[1180,1852,1156,2876]},{"type":"call","value":[1180,1852,1156,2673]},{"type":"call","value":[1180,1852,1156,2612]},{"type":"call","value":[1180,1852,1156,802]},{"type":"call","value":[1180,1852,1156,2895]},{"type":"call","value":[1180,1852,1156,2724]},{"type":"call","value":[1180,1852,1156,2884]},{"type":"call","value":[1180,1852,1156,2900]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,4953]},{"type":"call","value":[1180,1852,1156,3728]},{"type":"call","value":[1180,1852,1156,742]},{"type":"call","value":[1180,1852,1156,1873]},{"type":"call","value":[1180,1852,1156,5026]},{"type":"call","value":[1180,1852,1156,847]},{"type":"call","value":[1180,1852,1156,2345]},{"type":"call","value":[1180,1852,1156,2949]},{"type":"call","value":[1180,1852,1156,930]},{"type":"call","value":[1180,1852,1156,779]},{"type":"call","value":[1180,1852,1156,1877]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,236]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1412]},{"type":"call","value":[1180,1852,236,1419]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1476]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1476,1606]},{"type":"call","value":[1180,1852,1476,1641]},{"type":"call","value":[1180,1852,1476,1602]},{"type":"call","value":[1180,1852,1476,1670]},{"type":"call","value":[1180,1852,1476,1618]},{"type":"call","value":[1180,1852,1476,1663]},{"type":"call","value":[1180,1852,1476,1685]},{"type":"call","value":[1180,1852,1476,1637]},{"type":"call","value":[1180,1852,1476,1614]},{"type":"call","value":[1180,1852,1476,1659]},{"type":"call","value":[1180,1852,1476,1652]},{"type":"call","value":[1180,1852,1476,1681]},{"type":"call","value":[1180,1852,1476,1674]},{"type":"call","value":[1180,1852,1476,1648]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1020]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1020,3040]},{"type":"call","value":[1180,1852,1020,3063]},{"type":"call","value":[1180,1852,1020,3082]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1020,3096]},{"type":"call","value":[1180,1852,1020,2665]},{"type":"call","value":[1180,1852,1020,2716]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,732]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1200,1248,732,5904]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,2304]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2304,6019]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2724,1816]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,54]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,39]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2800,640]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,46]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,31]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2744,2916]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,362]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open registry key":{"meta":{"name":"create or open registry key","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Create Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Create Registry Key","id":"C0036.004"},{"parts":["Operating System","Registry","Open Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Open Registry Key","id":"C0036.003"}],"references":[],"examples":["Practical Malware Analysis Lab 03-02.dll_:0x10004706","Practical Malware Analysis Lab 11-01.exe_:0x401000","493167E85E45363D09495D0841C30648:0x404D60","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","692f7fd6d198e804d6af98eb9e390d61:0x6000003"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: create or open registry key\n authors:\n - michael.hunhoff@mandiant.com\n - anushka.virgaonkar@mandiant.com\n lib: 'true'\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Operating System::Registry::Create Registry Key [C0036.004]\n - Operating System::Registry::Open Registry Key [C0036.003]\n examples:\n - Practical Malware Analysis Lab 03-02.dll_:0x10004706\n - Practical Malware Analysis Lab 11-01.exe_:0x401000\n - 493167E85E45363D09495D0841C30648:0x404D60\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n - 692f7fd6d198e804d6af98eb9e390d61:0x6000003\n features:\n - or:\n - api: advapi32.RegOpenKey\n - api: advapi32.RegOpenKeyEx\n - api: advapi32.RegCreateKey\n - api: advapi32.RegCreateKeyEx\n - api: advapi32.RegOpenCurrentUser\n - api: advapi32.RegOpenKeyTransacted\n - api: advapi32.RegOpenUserClassesRoot\n - api: advapi32.RegCreateKeyTransacted\n - api: ZwOpenKey\n - api: ZwOpenKeyEx\n - api: ZwCreateKey\n - api: ZwOpenKeyTransacted\n - api: ZwOpenKeyTransactedEx\n - api: ZwCreateKeyTransacted\n - api: NtOpenKey\n - api: NtCreateKey\n - api: SHRegOpenUSKey\n - api: SHRegCreateUSKey\n - api: RtlCreateRegistryKey\n - api: Microsoft.Win32.RegistryKey::OpenSubKey\n - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n - api: Microsoft.Win32.RegistryKey::CreateSubKey\n","matches":[[{"type":"thread","value":[2456,3052,3064]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,46]},{"type":"call","value":[2456,3052,3064,1022]},{"type":"call","value":[2456,3052,3064,32]},{"type":"call","value":[2456,3052,3064,47]},{"type":"call","value":[2456,3052,3064,48]},{"type":"call","value":[2456,3052,3064,43]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2192,2204]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,35]},{"type":"call","value":[3052,2192,2204,1206]},{"type":"call","value":[3052,2192,2204,39]},{"type":"call","value":[3052,2192,2204,40]},{"type":"call","value":[3052,2192,2204,32]},{"type":"call","value":[3052,2192,2204,38]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,1180,500]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,742]},{"type":"call","value":[3052,1180,500,31]},{"type":"call","value":[3052,1180,500,39]},{"type":"call","value":[3052,1180,500,34]},{"type":"call","value":[3052,1180,500,37]},{"type":"call","value":[3052,1180,500,38]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2852,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,63]},{"type":"call","value":[3052,2852,2804,58]},{"type":"call","value":[3052,2852,2804,55]},{"type":"call","value":[3052,2852,2804,61]},{"type":"call","value":[3052,2852,2804,1957]},{"type":"call","value":[3052,2852,2804,62]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2852,2900,2904]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,85]},{"type":"call","value":[2852,2900,2904,200]},{"type":"call","value":[2852,2900,2904,43]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,920]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,45]},{"type":"call","value":[1180,1852,920,42]},{"type":"call","value":[1180,1852,920,32]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1156]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,2351]},{"type":"call","value":[1180,1852,1156,3679]},{"type":"call","value":[1180,1852,1156,2573]},{"type":"call","value":[1180,1852,1156,4964]},{"type":"call","value":[1180,1852,1156,4956]},{"type":"call","value":[1180,1852,1156,2567]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,236]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1181]},{"type":"call","value":[1180,1852,236,1160]},{"type":"call","value":[1180,1852,236,1133]},{"type":"call","value":[1180,1852,236,1173]},{"type":"call","value":[1180,1852,236,1113]},{"type":"call","value":[1180,1852,236,1121]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,1560]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1560,6276]},{"type":"call","value":[1200,1248,1560,6255]},{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,1560,6280]},{"type":"call","value":[1200,1248,1560,6254]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2420,2524]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2420,2524,32]},{"type":"call","value":[1852,2420,2524,24]},{"type":"call","value":[1852,2420,2524,30]},{"type":"call","value":[1852,2420,2524,27]},{"type":"call","value":[1852,2420,2524,31]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,2360,1788]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2820,2360,1788,165]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2724,1816]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,26]},{"type":"call","value":[1852,2724,1816,44]},{"type":"call","value":[1852,2724,1816,95]},{"type":"call","value":[1852,2724,1816,969]},{"type":"call","value":[1852,2724,1816,77]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2800,640]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,36]},{"type":"call","value":[1852,2800,640,87]},{"type":"call","value":[1852,2800,640,1236]},{"type":"call","value":[1852,2800,640,69]},{"type":"call","value":[1852,2800,640,17]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2744,2916]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,37]},{"type":"call","value":[1852,2744,2916,38]},{"type":"call","value":[1852,2744,2916,732]},{"type":"call","value":[1852,2744,2916,31]},{"type":"call","value":[1852,2744,2916,39]},{"type":"call","value":[1852,2744,2916,34]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,500,240]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,500,240,31]},{"type":"call","value":[1852,500,240,32]},{"type":"call","value":[1852,500,240,27]},{"type":"call","value":[1852,500,240,24]},{"type":"call","value":[1852,500,240,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1572,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2804,1016]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"enumerate processes via NtQuerySystemInformation":{"meta":{"name":"enumerate processes via NtQuerySystemInformation","namespace":"host-interaction/process/list","authors":["@_re_fox"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Discovery","Process Discovery"],"tactic":"Discovery","technique":"Process Discovery","subtechnique":"","id":"T1057"},{"parts":["Discovery","Software Discovery"],"tactic":"Discovery","technique":"Software Discovery","subtechnique":"","id":"T1518"}],"mbc":[],"references":[],"examples":["31bd8dd48ac0de3d4da340bf29f4d280:0x00401be3"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: enumerate processes via NtQuerySystemInformation\n namespace: host-interaction/process/list\n authors:\n - \"@_re_fox\"\n scopes:\n static: basic block\n dynamic: thread\n att&ck:\n - Discovery::Process Discovery [T1057]\n - Discovery::Software Discovery [T1518]\n examples:\n - 31bd8dd48ac0de3d4da340bf29f4d280:0x00401be3\n features:\n - and:\n - number: 0x5 = SYSTEM_PROCESS_INFORMATION\n - or:\n - api: NtQuerySystemInformation\n - api: NtQuerySystemInformationEx\n - api: ZwQuerySystemInformation\n - api: ZwQuerySystemInformationEx\n","matches":[[{"type":"thread","value":[2456,3052,3064]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5,"description":"SYSTEM_PROCESS_INFORMATION"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,804]},{"type":"call","value":[2456,3052,3064,814]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,484]},{"type":"call","value":[2456,3052,3064,481]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,1180,500]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":5,"description":"SYSTEM_PROCESS_INFORMATION"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,699]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,480]},{"type":"call","value":[3052,1180,500,477]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get file attributes":{"meta":{"name":"get file attributes","namespace":"host-interaction/file-system/meta","authors":["michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["File System","Get File Attributes"],"objective":"File System","behavior":"Get File Attributes","method":"","id":"C0049"}],"references":[],"examples":["03B236B23B1EC37C663527C1F53AF3FE:0x180019824","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: get file attributes\n namespace: host-interaction/file-system/meta\n authors:\n - michael.hunhoff@mandiant.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - File System::Get File Attributes [C0049]\n examples:\n - 03B236B23B1EC37C663527C1F53AF3FE:0x180019824\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4029E0\n features:\n - or:\n - api: kernel32.GetFileAttributes\n - api: ZwQueryDirectoryFile\n - api: ZwQueryInformationFile\n - api: NtQueryDirectoryFile\n - api: NtQueryInformationFile\n - api: System.IO.File::GetAttributes\n - api: System.IO.File::GetCreationTime\n - api: System.IO.File::GetCreationTimeUtc\n - api: System.IO.File::GetLastAccessTime\n - api: System.IO.File::GetLastAccessTimeUtc\n - api: System.IO.File::GetLastWriteTime\n - api: System.IO.File::GetLastWriteTimeUtc\n - property/read: System.IO.FileSystemInfo::Attributes\n - api: stat\n - api: fstat\n - api: lstat\n - api: fstatat\n","matches":[[{"type":"thread","value":[2456,3052,3064]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,731]},{"type":"call","value":[2456,3052,3064,740]},{"type":"call","value":[2456,3052,3064,814]},{"type":"call","value":[2456,3052,3064,717]},{"type":"call","value":[2456,3052,3064,752]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2456,3052,2792]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,897]},{"type":"call","value":[2456,3052,2792,892]},{"type":"call","value":[2456,3052,2792,887]},{"type":"call","value":[2456,3052,2792,882]},{"type":"call","value":[2456,3052,2792,910]},{"type":"call","value":[2456,3052,2792,906]},{"type":"call","value":[2456,3052,2792,915]},{"type":"call","value":[2456,3052,2792,902]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[3052,2852,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,781]},{"type":"call","value":[3052,2852,2804,1684]},{"type":"call","value":[3052,2852,2804,1028]},{"type":"call","value":[3052,2852,2804,372]},{"type":"call","value":[3052,2852,2804,799]},{"type":"call","value":[3052,2852,2804,1931]},{"type":"call","value":[3052,2852,2804,1275]},{"type":"call","value":[3052,2852,2804,1702]},{"type":"call","value":[3052,2852,2804,1046]},{"type":"call","value":[3052,2852,2804,390]},{"type":"call","value":[3052,2852,2804,1293]},{"type":"call","value":[3052,2852,2804,637]},{"type":"call","value":[3052,2852,2804,884]},{"type":"call","value":[3052,2852,2804,1311]},{"type":"call","value":[3052,2852,2804,228]},{"type":"call","value":[3052,2852,2804,655]},{"type":"call","value":[3052,2852,2804,1558]},{"type":"call","value":[3052,2852,2804,902]},{"type":"call","value":[3052,2852,2804,246]},{"type":"call","value":[3052,2852,2804,1805]},{"type":"call","value":[3052,2852,2804,1149]},{"type":"call","value":[3052,2852,2804,1576]},{"type":"call","value":[3052,2852,2804,493]},{"type":"call","value":[3052,2852,2804,920]},{"type":"call","value":[3052,2852,2804,264]},{"type":"call","value":[3052,2852,2804,1823]},{"type":"call","value":[3052,2852,2804,1167]},{"type":"call","value":[3052,2852,2804,511]},{"type":"call","value":[3052,2852,2804,758]},{"type":"call","value":[3052,2852,2804,529]},{"type":"call","value":[3052,2852,2804,1661]},{"type":"call","value":[3052,2852,2804,776]},{"type":"call","value":[3052,2852,2804,1679]},{"type":"call","value":[3052,2852,2804,1023]},{"type":"call","value":[3052,2852,2804,367]},{"type":"call","value":[3052,2852,2804,1926]},{"type":"call","value":[3052,2852,2804,1270]},{"type":"call","value":[3052,2852,2804,1697]},{"type":"call","value":[3052,2852,2804,614]},{"type":"call","value":[3052,2852,2804,1041]},{"type":"call","value":[3052,2852,2804,385]},{"type":"call","value":[3052,2852,2804,1288]},{"type":"call","value":[3052,2852,2804,632]},{"type":"call","value":[3052,2852,2804,879]},{"type":"call","value":[3052,2852,2804,1306]},{"type":"call","value":[3052,2852,2804,650]},{"type":"call","value":[3052,2852,2804,1553]},{"type":"call","value":[3052,2852,2804,897]},{"type":"call","value":[3052,2852,2804,1800]},{"type":"call","value":[3052,2852,2804,1144]},{"type":"call","value":[3052,2852,2804,488]},{"type":"call","value":[3052,2852,2804,915]},{"type":"call","value":[3052,2852,2804,1818]},{"type":"call","value":[3052,2852,2804,1162]},{"type":"call","value":[3052,2852,2804,506]},{"type":"call","value":[3052,2852,2804,753]},{"type":"call","value":[3052,2852,2804,1656]},{"type":"call","value":[3052,2852,2804,1000]},{"type":"call","value":[3052,2852,2804,344]},{"type":"call","value":[3052,2852,2804,771]},{"type":"call","value":[3052,2852,2804,1674]},{"type":"call","value":[3052,2852,2804,1018]},{"type":"call","value":[3052,2852,2804,362]},{"type":"call","value":[3052,2852,2804,1921]},{"type":"call","value":[3052,2852,2804,1265]},{"type":"call","value":[3052,2852,2804,1692]},{"type":"call","value":[3052,2852,2804,609]},{"type":"call","value":[3052,2852,2804,1036]},{"type":"call","value":[3052,2852,2804,380]},{"type":"call","value":[3052,2852,2804,1283]},{"type":"call","value":[3052,2852,2804,627]},{"type":"call","value":[3052,2852,2804,874]},{"type":"call","value":[3052,2852,2804,218]},{"type":"call","value":[3052,2852,2804,645]},{"type":"call","value":[3052,2852,2804,1777]},{"type":"call","value":[3052,2852,2804,1121]},{"type":"call","value":[3052,2852,2804,892]},{"type":"call","value":[3052,2852,2804,236]},{"type":"call","value":[3052,2852,2804,1795]},{"type":"call","value":[3052,2852,2804,1139]},{"type":"call","value":[3052,2852,2804,483]},{"type":"call","value":[3052,2852,2804,1813]},{"type":"call","value":[3052,2852,2804,730]},{"type":"call","value":[3052,2852,2804,1157]},{"type":"call","value":[3052,2852,2804,501]},{"type":"call","value":[3052,2852,2804,763]},{"type":"call","value":[3052,2852,2804,748]},{"type":"call","value":[3052,2852,2804,1651]},{"type":"call","value":[3052,2852,2804,995]},{"type":"call","value":[3052,2852,2804,339]},{"type":"call","value":[3052,2852,2804,766]},{"type":"call","value":[3052,2852,2804,1669]},{"type":"call","value":[3052,2852,2804,1013]},{"type":"call","value":[3052,2852,2804,357]},{"type":"call","value":[3052,2852,2804,1916]},{"type":"call","value":[3052,2852,2804,1260]},{"type":"call","value":[3052,2852,2804,604]},{"type":"call","value":[3052,2852,2804,375]},{"type":"call","value":[3052,2852,2804,851]},{"type":"call","value":[3052,2852,2804,1278]},{"type":"call","value":[3052,2852,2804,622]},{"type":"call","value":[3052,2852,2804,869]},{"type":"call","value":[3052,2852,2804,1772]},{"type":"call","value":[3052,2852,2804,1116]},{"type":"call","value":[3052,2852,2804,460]},{"type":"call","value":[3052,2852,2804,887]},{"type":"call","value":[3052,2852,2804,1790]},{"type":"call","value":[3052,2852,2804,1134]},{"type":"call","value":[3052,2852,2804,478]},{"type":"call","value":[3052,2852,2804,1808]},{"type":"call","value":[3052,2852,2804,725]},{"type":"call","value":[3052,2852,2804,1152]},{"type":"call","value":[3052,2852,2804,496]},{"type":"call","value":[3052,2852,2804,743]},{"type":"call","value":[3052,2852,2804,1646]},{"type":"call","value":[3052,2852,2804,990]},{"type":"call","value":[3052,2852,2804,334]},{"type":"call","value":[3052,2852,2804,1893]},{"type":"call","value":[3052,2852,2804,1237]},{"type":"call","value":[3052,2852,2804,1664]},{"type":"call","value":[3052,2852,2804,581]},{"type":"call","value":[3052,2852,2804,1008]},{"type":"call","value":[3052,2852,2804,352]},{"type":"call","value":[3052,2852,2804,1911]},{"type":"call","value":[3052,2852,2804,1255]},{"type":"call","value":[3052,2852,2804,599]},{"type":"call","value":[3052,2852,2804,1929]},{"type":"call","value":[3052,2852,2804,846]},{"type":"call","value":[3052,2852,2804,1273]},{"type":"call","value":[3052,2852,2804,190]},{"type":"call","value":[3052,2852,2804,617]},{"type":"call","value":[3052,2852,2804,864]},{"type":"call","value":[3052,2852,2804,208]},{"type":"call","value":[3052,2852,2804,1767]},{"type":"call","value":[3052,2852,2804,1111]},{"type":"call","value":[3052,2852,2804,455]},{"type":"call","value":[3052,2852,2804,882]},{"type":"call","value":[3052,2852,2804,226]},{"type":"call","value":[3052,2852,2804,1785]},{"type":"call","value":[3052,2852,2804,1129]},{"type":"call","value":[3052,2852,2804,473]},{"type":"call","value":[3052,2852,2804,720]},{"type":"call","value":[3052,2852,2804,1623]},{"type":"call","value":[3052,2852,2804,967]},{"type":"call","value":[3052,2852,2804,311]},{"type":"call","value":[3052,2852,2804,738]},{"type":"call","value":[3052,2852,2804,1641]},{"type":"call","value":[3052,2852,2804,985]},{"type":"call","value":[3052,2852,2804,329]},{"type":"call","value":[3052,2852,2804,1888]},{"type":"call","value":[3052,2852,2804,1232]},{"type":"call","value":[3052,2852,2804,1659]},{"type":"call","value":[3052,2852,2804,1003]},{"type":"call","value":[3052,2852,2804,347]},{"type":"call","value":[3052,2852,2804,1906]},{"type":"call","value":[3052,2852,2804,1250]},{"type":"call","value":[3052,2852,2804,594]},{"type":"call","value":[3052,2852,2804,1924]},{"type":"call","value":[3052,2852,2804,841]},{"type":"call","value":[3052,2852,2804,1268]},{"type":"call","value":[3052,2852,2804,612]},{"type":"call","value":[3052,2852,2804,859]},{"type":"call","value":[3052,2852,2804,1762]},{"type":"call","value":[3052,2852,2804,1106]},{"type":"call","value":[3052,2852,2804,450]},{"type":"call","value":[3052,2852,2804,1780]},{"type":"call","value":[3052,2852,2804,697]},{"type":"call","value":[3052,2852,2804,1124]},{"type":"call","value":[3052,2852,2804,468]},{"type":"call","value":[3052,2852,2804,715]},{"type":"call","value":[3052,2852,2804,1618]},{"type":"call","value":[3052,2852,2804,962]},{"type":"call","value":[3052,2852,2804,306]},{"type":"call","value":[3052,2852,2804,733]},{"type":"call","value":[3052,2852,2804,1636]},{"type":"call","value":[3052,2852,2804,980]},{"type":"call","value":[3052,2852,2804,324]},{"type":"call","value":[3052,2852,2804,1883]},{"type":"call","value":[3052,2852,2804,1227]},{"type":"call","value":[3052,2852,2804,1654]},{"type":"call","value":[3052,2852,2804,998]},{"type":"call","value":[3052,2852,2804,342]},{"type":"call","value":[3052,2852,2804,1901]},{"type":"call","value":[3052,2852,2804,1245]},{"type":"call","value":[3052,2852,2804,589]},{"type":"call","value":[3052,2852,2804,836]},{"type":"call","value":[3052,2852,2804,1739]},{"type":"call","value":[3052,2852,2804,1083]},{"type":"call","value":[3052,2852,2804,427]},{"type":"call","value":[3052,2852,2804,854]},{"type":"call","value":[3052,2852,2804,198]},{"type":"call","value":[3052,2852,2804,1757]},{"type":"call","value":[3052,2852,2804,1101]},{"type":"call","value":[3052,2852,2804,445]},{"type":"call","value":[3052,2852,2804,1348]},{"type":"call","value":[3052,2852,2804,1775]},{"type":"call","value":[3052,2852,2804,692]},{"type":"call","value":[3052,2852,2804,1119]},{"type":"call","value":[3052,2852,2804,463]},{"type":"call","value":[3052,2852,2804,710]},{"type":"call","value":[3052,2852,2804,1613]},{"type":"call","value":[3052,2852,2804,957]},{"type":"call","value":[3052,2852,2804,301]},{"type":"call","value":[3052,2852,2804,728]},{"type":"call","value":[3052,2852,2804,1860]},{"type":"call","value":[3052,2852,2804,1631]},{"type":"call","value":[3052,2852,2804,975]},{"type":"call","value":[3052,2852,2804,319]},{"type":"call","value":[3052,2852,2804,1878]},{"type":"call","value":[3052,2852,2804,1222]},{"type":"call","value":[3052,2852,2804,566]},{"type":"call","value":[3052,2852,2804,1896]},{"type":"call","value":[3052,2852,2804,813]},{"type":"call","value":[3052,2852,2804,1240]},{"type":"call","value":[3052,2852,2804,584]},{"type":"call","value":[3052,2852,2804,831]},{"type":"call","value":[3052,2852,2804,1734]},{"type":"call","value":[3052,2852,2804,1078]},{"type":"call","value":[3052,2852,2804,422]},{"type":"call","value":[3052,2852,2804,849]},{"type":"call","value":[3052,2852,2804,1752]},{"type":"call","value":[3052,2852,2804,1096]},{"type":"call","value":[3052,2852,2804,440]},{"type":"call","value":[3052,2852,2804,1343]},{"type":"call","value":[3052,2852,2804,687]},{"type":"call","value":[3052,2852,2804,1114]},{"type":"call","value":[3052,2852,2804,458]},{"type":"call","value":[3052,2852,2804,1590]},{"type":"call","value":[3052,2852,2804,705]},{"type":"call","value":[3052,2852,2804,1608]},{"type":"call","value":[3052,2852,2804,952]},{"type":"call","value":[3052,2852,2804,296]},{"type":"call","value":[3052,2852,2804,1855]},{"type":"call","value":[3052,2852,2804,1199]},{"type":"call","value":[3052,2852,2804,1626]},{"type":"call","value":[3052,2852,2804,543]},{"type":"call","value":[3052,2852,2804,970]},{"type":"call","value":[3052,2852,2804,314]},{"type":"call","value":[3052,2852,2804,1873]},{"type":"call","value":[3052,2852,2804,1217]},{"type":"call","value":[3052,2852,2804,561]},{"type":"call","value":[3052,2852,2804,1891]},{"type":"call","value":[3052,2852,2804,808]},{"type":"call","value":[3052,2852,2804,1235]},{"type":"call","value":[3052,2852,2804,579]},{"type":"call","value":[3052,2852,2804,1482]},{"type":"call","value":[3052,2852,2804,826]},{"type":"call","value":[3052,2852,2804,1729]},{"type":"call","value":[3052,2852,2804,1073]},{"type":"call","value":[3052,2852,2804,417]},{"type":"call","value":[3052,2852,2804,844]},{"type":"call","value":[3052,2852,2804,188]},{"type":"call","value":[3052,2852,2804,1320]},{"type":"call","value":[3052,2852,2804,1747]},{"type":"call","value":[3052,2852,2804,1091]},{"type":"call","value":[3052,2852,2804,435]},{"type":"call","value":[3052,2852,2804,1338]},{"type":"call","value":[3052,2852,2804,682]},{"type":"call","value":[3052,2852,2804,1585]},{"type":"call","value":[3052,2852,2804,929]},{"type":"call","value":[3052,2852,2804,273]},{"type":"call","value":[3052,2852,2804,700]},{"type":"call","value":[3052,2852,2804,1603]},{"type":"call","value":[3052,2852,2804,947]},{"type":"call","value":[3052,2852,2804,1850]},{"type":"call","value":[3052,2852,2804,1194]},{"type":"call","value":[3052,2852,2804,1621]},{"type":"call","value":[3052,2852,2804,538]},{"type":"call","value":[3052,2852,2804,965]},{"type":"call","value":[3052,2852,2804,309]},{"type":"call","value":[3052,2852,2804,1868]},{"type":"call","value":[3052,2852,2804,1212]},{"type":"call","value":[3052,2852,2804,556]},{"type":"call","value":[3052,2852,2804,1459]},{"type":"call","value":[3052,2852,2804,803]},{"type":"call","value":[3052,2852,2804,147]},{"type":"call","value":[3052,2852,2804,1706]},{"type":"call","value":[3052,2852,2804,1477]},{"type":"call","value":[3052,2852,2804,821]},{"type":"call","value":[3052,2852,2804,165]},{"type":"call","value":[3052,2852,2804,1724]},{"type":"call","value":[3052,2852,2804,1068]},{"type":"call","value":[3052,2852,2804,412]},{"type":"call","value":[3052,2852,2804,1315]},{"type":"call","value":[3052,2852,2804,1742]},{"type":"call","value":[3052,2852,2804,659]},{"type":"call","value":[3052,2852,2804,1086]},{"type":"call","value":[3052,2852,2804,430]},{"type":"call","value":[3052,2852,2804,1333]},{"type":"call","value":[3052,2852,2804,677]},{"type":"call","value":[3052,2852,2804,1580]},{"type":"call","value":[3052,2852,2804,924]},{"type":"call","value":[3052,2852,2804,268]},{"type":"call","value":[3052,2852,2804,695]},{"type":"call","value":[3052,2852,2804,1598]},{"type":"call","value":[3052,2852,2804,942]},{"type":"call","value":[3052,2852,2804,286]},{"type":"call","value":[3052,2852,2804,1845]},{"type":"call","value":[3052,2852,2804,1189]},{"type":"call","value":[3052,2852,2804,533]},{"type":"call","value":[3052,2852,2804,960]},{"type":"call","value":[3052,2852,2804,304]},{"type":"call","value":[3052,2852,2804,1863]},{"type":"call","value":[3052,2852,2804,1207]},{"type":"call","value":[3052,2852,2804,551]},{"type":"call","value":[3052,2852,2804,798]},{"type":"call","value":[3052,2852,2804,1701]},{"type":"call","value":[3052,2852,2804,1045]},{"type":"call","value":[3052,2852,2804,1472]},{"type":"call","value":[3052,2852,2804,389]},{"type":"call","value":[3052,2852,2804,816]},{"type":"call","value":[3052,2852,2804,1719]},{"type":"call","value":[3052,2852,2804,1063]},{"type":"call","value":[3052,2852,2804,407]},{"type":"call","value":[3052,2852,2804,1310]},{"type":"call","value":[3052,2852,2804,1737]},{"type":"call","value":[3052,2852,2804,654]},{"type":"call","value":[3052,2852,2804,1081]},{"type":"call","value":[3052,2852,2804,425]},{"type":"call","value":[3052,2852,2804,1328]},{"type":"call","value":[3052,2852,2804,672]},{"type":"call","value":[3052,2852,2804,1575]},{"type":"call","value":[3052,2852,2804,919]},{"type":"call","value":[3052,2852,2804,690]},{"type":"call","value":[3052,2852,2804,1822]},{"type":"call","value":[3052,2852,2804,1166]},{"type":"call","value":[3052,2852,2804,1593]},{"type":"call","value":[3052,2852,2804,937]},{"type":"call","value":[3052,2852,2804,281]},{"type":"call","value":[3052,2852,2804,1840]},{"type":"call","value":[3052,2852,2804,1184]},{"type":"call","value":[3052,2852,2804,528]},{"type":"call","value":[3052,2852,2804,1858]},{"type":"call","value":[3052,2852,2804,775]},{"type":"call","value":[3052,2852,2804,1202]},{"type":"call","value":[3052,2852,2804,119]},{"type":"call","value":[3052,2852,2804,546]},{"type":"call","value":[3052,2852,2804,793]},{"type":"call","value":[3052,2852,2804,1696]},{"type":"call","value":[3052,2852,2804,1040]},{"type":"call","value":[3052,2852,2804,384]},{"type":"call","value":[3052,2852,2804,811]},{"type":"call","value":[3052,2852,2804,1714]},{"type":"call","value":[3052,2852,2804,1058]},{"type":"call","value":[3052,2852,2804,402]},{"type":"call","value":[3052,2852,2804,1305]},{"type":"call","value":[3052,2852,2804,649]},{"type":"call","value":[3052,2852,2804,420]},{"type":"call","value":[3052,2852,2804,896]},{"type":"call","value":[3052,2852,2804,1323]},{"type":"call","value":[3052,2852,2804,667]},{"type":"call","value":[3052,2852,2804,1570]},{"type":"call","value":[3052,2852,2804,914]},{"type":"call","value":[3052,2852,2804,258]},{"type":"call","value":[3052,2852,2804,1817]},{"type":"call","value":[3052,2852,2804,1161]},{"type":"call","value":[3052,2852,2804,1588]},{"type":"call","value":[3052,2852,2804,505]},{"type":"call","value":[3052,2852,2804,932]},{"type":"call","value":[3052,2852,2804,276]},{"type":"call","value":[3052,2852,2804,1835]},{"type":"call","value":[3052,2852,2804,1179]},{"type":"call","value":[3052,2852,2804,523]},{"type":"call","value":[3052,2852,2804,1853]},{"type":"call","value":[3052,2852,2804,770]},{"type":"call","value":[3052,2852,2804,1197]},{"type":"call","value":[3052,2852,2804,541]},{"type":"call","value":[3052,2852,2804,788]},{"type":"call","value":[3052,2852,2804,1691]},{"type":"call","value":[3052,2852,2804,1035]},{"type":"call","value":[3052,2852,2804,379]},{"type":"call","value":[3052,2852,2804,1282]},{"type":"call","value":[3052,2852,2804,1709]},{"type":"call","value":[3052,2852,2804,626]},{"type":"call","value":[3052,2852,2804,1053]},{"type":"call","value":[3052,2852,2804,397]},{"type":"call","value":[3052,2852,2804,1300]},{"type":"call","value":[3052,2852,2804,644]},{"type":"call","value":[3052,2852,2804,891]},{"type":"call","value":[3052,2852,2804,1318]},{"type":"call","value":[3052,2852,2804,662]},{"type":"call","value":[3052,2852,2804,1565]},{"type":"call","value":[3052,2852,2804,909]},{"type":"call","value":[3052,2852,2804,1812]},{"type":"call","value":[3052,2852,2804,1156]},{"type":"call","value":[3052,2852,2804,1583]},{"type":"call","value":[3052,2852,2804,500]},{"type":"call","value":[3052,2852,2804,927]},{"type":"call","value":[3052,2852,2804,271]},{"type":"call","value":[3052,2852,2804,1830]},{"type":"call","value":[3052,2852,2804,1174]},{"type":"call","value":[3052,2852,2804,518]},{"type":"call","value":[3052,2852,2804,765]},{"type":"call","value":[3052,2852,2804,1668]},{"type":"call","value":[3052,2852,2804,1012]},{"type":"call","value":[3052,2852,2804,356]},{"type":"call","value":[3052,2852,2804,783]},{"type":"call","value":[3052,2852,2804,1686]},{"type":"call","value":[3052,2852,2804,1030]},{"type":"call","value":[3052,2852,2804,374]},{"type":"call","value":[3052,2852,2804,1933]},{"type":"call","value":[3052,2852,2804,1277]},{"type":"call","value":[3052,2852,2804,1704]},{"type":"call","value":[3052,2852,2804,621]},{"type":"call","value":[3052,2852,2804,1048]},{"type":"call","value":[3052,2852,2804,392]},{"type":"call","value":[3052,2852,2804,1295]},{"type":"call","value":[3052,2852,2804,639]},{"type":"call","value":[3052,2852,2804,886]},{"type":"call","value":[3052,2852,2804,1313]},{"type":"call","value":[3052,2852,2804,230]},{"type":"call","value":[3052,2852,2804,657]},{"type":"call","value":[3052,2852,2804,1560]},{"type":"call","value":[3052,2852,2804,904]},{"type":"call","value":[3052,2852,2804,248]},{"type":"call","value":[3052,2852,2804,1807]},{"type":"call","value":[3052,2852,2804,1151]},{"type":"call","value":[3052,2852,2804,495]},{"type":"call","value":[3052,2852,2804,1825]},{"type":"call","value":[3052,2852,2804,742]},{"type":"call","value":[3052,2852,2804,1169]},{"type":"call","value":[3052,2852,2804,513]},{"type":"call","value":[3052,2852,2804,760]},{"type":"call","value":[3052,2852,2804,1663]},{"type":"call","value":[3052,2852,2804,1007]},{"type":"call","value":[3052,2852,2804,351]},{"type":"call","value":[3052,2852,2804,778]},{"type":"call","value":[3052,2852,2804,1681]},{"type":"call","value":[3052,2852,2804,1025]},{"type":"call","value":[3052,2852,2804,369]},{"type":"call","value":[3052,2852,2804,1928]},{"type":"call","value":[3052,2852,2804,1272]},{"type":"call","value":[3052,2852,2804,1699]},{"type":"call","value":[3052,2852,2804,616]},{"type":"call","value":[3052,2852,2804,1043]},{"type":"call","value":[3052,2852,2804,387]},{"type":"call","value":[3052,2852,2804,1290]},{"type":"call","value":[3052,2852,2804,634]},{"type":"call","value":[3052,2852,2804,881]},{"type":"call","value":[3052,2852,2804,1784]},{"type":"call","value":[3052,2852,2804,1128]},{"type":"call","value":[3052,2852,2804,1555]},{"type":"call","value":[3052,2852,2804,472]},{"type":"call","value":[3052,2852,2804,899]},{"type":"call","value":[3052,2852,2804,1802]},{"type":"call","value":[3052,2852,2804,1146]},{"type":"call","value":[3052,2852,2804,490]},{"type":"call","value":[3052,2852,2804,1820]},{"type":"call","value":[3052,2852,2804,737]},{"type":"call","value":[3052,2852,2804,1164]},{"type":"call","value":[3052,2852,2804,508]},{"type":"call","value":[3052,2852,2804,755]},{"type":"call","value":[3052,2852,2804,1658]},{"type":"call","value":[3052,2852,2804,1002]},{"type":"call","value":[3052,2852,2804,346]},{"type":"call","value":[3052,2852,2804,773]},{"type":"call","value":[3052,2852,2804,1905]},{"type":"call","value":[3052,2852,2804,1676]},{"type":"call","value":[3052,2852,2804,1020]},{"type":"call","value":[3052,2852,2804,364]},{"type":"call","value":[3052,2852,2804,1923]},{"type":"call","value":[3052,2852,2804,1267]},{"type":"call","value":[3052,2852,2804,611]},{"type":"call","value":[3052,2852,2804,858]},{"type":"call","value":[3052,2852,2804,1285]},{"type":"call","value":[3052,2852,2804,202]},{"type":"call","value":[3052,2852,2804,629]},{"type":"call","value":[3052,2852,2804,876]},{"type":"call","value":[3052,2852,2804,220]},{"type":"call","value":[3052,2852,2804,1779]},{"type":"call","value":[3052,2852,2804,1123]},{"type":"call","value":[3052,2852,2804,467]},{"type":"call","value":[3052,2852,2804,894]},{"type":"call","value":[3052,2852,2804,238]},{"type":"call","value":[3052,2852,2804,1797]},{"type":"call","value":[3052,2852,2804,1141]},{"type":"call","value":[3052,2852,2804,485]},{"type":"call","value":[3052,2852,2804,732]},{"type":"call","value":[3052,2852,2804,1159]},{"type":"call","value":[3052,2852,2804,503]},{"type":"call","value":[3052,2852,2804,1635]},{"type":"call","value":[3052,2852,2804,750]},{"type":"call","value":[3052,2852,2804,1653]},{"type":"call","value":[3052,2852,2804,997]},{"type":"call","value":[3052,2852,2804,341]},{"type":"call","value":[3052,2852,2804,1900]},{"type":"call","value":[3052,2852,2804,1244]},{"type":"call","value":[3052,2852,2804,1671]},{"type":"call","value":[3052,2852,2804,588]},{"type":"call","value":[3052,2852,2804,1015]},{"type":"call","value":[3052,2852,2804,359]},{"type":"call","value":[3052,2852,2804,1918]},{"type":"call","value":[3052,2852,2804,1262]},{"type":"call","value":[3052,2852,2804,606]},{"type":"call","value":[3052,2852,2804,853]},{"type":"call","value":[3052,2852,2804,1280]},{"type":"call","value":[3052,2852,2804,624]},{"type":"call","value":[3052,2852,2804,871]},{"type":"call","value":[3052,2852,2804,1774]},{"type":"call","value":[3052,2852,2804,1118]},{"type":"call","value":[3052,2852,2804,462]},{"type":"call","value":[3052,2852,2804,889]},{"type":"call","value":[3052,2852,2804,1792]},{"type":"call","value":[3052,2852,2804,1136]},{"type":"call","value":[3052,2852,2804,480]},{"type":"call","value":[3052,2852,2804,727]},{"type":"call","value":[3052,2852,2804,1630]},{"type":"call","value":[3052,2852,2804,974]},{"type":"call","value":[3052,2852,2804,318]},{"type":"call","value":[3052,2852,2804,745]},{"type":"call","value":[3052,2852,2804,1648]},{"type":"call","value":[3052,2852,2804,992]},{"type":"call","value":[3052,2852,2804,336]},{"type":"call","value":[3052,2852,2804,1895]},{"type":"call","value":[3052,2852,2804,1239]},{"type":"call","value":[3052,2852,2804,1666]},{"type":"call","value":[3052,2852,2804,583]},{"type":"call","value":[3052,2852,2804,1010]},{"type":"call","value":[3052,2852,2804,354]},{"type":"call","value":[3052,2852,2804,1913]},{"type":"call","value":[3052,2852,2804,1257]},{"type":"call","value":[3052,2852,2804,601]},{"type":"call","value":[3052,2852,2804,848]},{"type":"call","value":[3052,2852,2804,192]},{"type":"call","value":[3052,2852,2804,619]},{"type":"call","value":[3052,2852,2804,1751]},{"type":"call","value":[3052,2852,2804,1095]},{"type":"call","value":[3052,2852,2804,866]},{"type":"call","value":[3052,2852,2804,210]},{"type":"call","value":[3052,2852,2804,1769]},{"type":"call","value":[3052,2852,2804,1113]},{"type":"call","value":[3052,2852,2804,457]},{"type":"call","value":[3052,2852,2804,1787]},{"type":"call","value":[3052,2852,2804,704]},{"type":"call","value":[3052,2852,2804,1131]},{"type":"call","value":[3052,2852,2804,475]},{"type":"call","value":[3052,2852,2804,722]},{"type":"call","value":[3052,2852,2804,1625]},{"type":"call","value":[3052,2852,2804,969]},{"type":"call","value":[3052,2852,2804,313]},{"type":"call","value":[3052,2852,2804,740]},{"type":"call","value":[3052,2852,2804,1643]},{"type":"call","value":[3052,2852,2804,987]},{"type":"call","value":[3052,2852,2804,331]},{"type":"call","value":[3052,2852,2804,1890]},{"type":"call","value":[3052,2852,2804,1234]},{"type":"call","value":[3052,2852,2804,578]},{"type":"call","value":[3052,2852,2804,1005]},{"type":"call","value":[3052,2852,2804,349]},{"type":"call","value":[3052,2852,2804,1481]},{"type":"call","value":[3052,2852,2804,1908]},{"type":"call","value":[3052,2852,2804,1252]},{"type":"call","value":[3052,2852,2804,596]},{"type":"call","value":[3052,2852,2804,843]},{"type":"call","value":[3052,2852,2804,1746]},{"type":"call","value":[3052,2852,2804,1090]},{"type":"call","value":[3052,2852,2804,434]},{"type":"call","value":[3052,2852,2804,861]},{"type":"call","value":[3052,2852,2804,1764]},{"type":"call","value":[3052,2852,2804,1108]},{"type":"call","value":[3052,2852,2804,452]},{"type":"call","value":[3052,2852,2804,1782]},{"type":"call","value":[3052,2852,2804,699]},{"type":"call","value":[3052,2852,2804,1126]},{"type":"call","value":[3052,2852,2804,470]},{"type":"call","value":[3052,2852,2804,717]},{"type":"call","value":[3052,2852,2804,1620]},{"type":"call","value":[3052,2852,2804,964]},{"type":"call","value":[3052,2852,2804,308]},{"type":"call","value":[3052,2852,2804,735]},{"type":"call","value":[3052,2852,2804,1867]},{"type":"call","value":[3052,2852,2804,1211]},{"type":"call","value":[3052,2852,2804,1638]},{"type":"call","value":[3052,2852,2804,982]},{"type":"call","value":[3052,2852,2804,326]},{"type":"call","value":[3052,2852,2804,1885]},{"type":"call","value":[3052,2852,2804,1229]},{"type":"call","value":[3052,2852,2804,1476]},{"type":"call","value":[3052,2852,2804,1903]},{"type":"call","value":[3052,2852,2804,820]},{"type":"call","value":[3052,2852,2804,1247]},{"type":"call","value":[3052,2852,2804,591]},{"type":"call","value":[3052,2852,2804,838]},{"type":"call","value":[3052,2852,2804,1741]},{"type":"call","value":[3052,2852,2804,1085]},{"type":"call","value":[3052,2852,2804,429]},{"type":"call","value":[3052,2852,2804,856]},{"type":"call","value":[3052,2852,2804,200]},{"type":"call","value":[3052,2852,2804,1759]},{"type":"call","value":[3052,2852,2804,1103]},{"type":"call","value":[3052,2852,2804,447]},{"type":"call","value":[3052,2852,2804,694]},{"type":"call","value":[3052,2852,2804,465]},{"type":"call","value":[3052,2852,2804,1597]},{"type":"call","value":[3052,2852,2804,941]},{"type":"call","value":[3052,2852,2804,712]},{"type":"call","value":[3052,2852,2804,1615]},{"type":"call","value":[3052,2852,2804,959]},{"type":"call","value":[3052,2852,2804,303]},{"type":"call","value":[3052,2852,2804,1862]},{"type":"call","value":[3052,2852,2804,1206]},{"type":"call","value":[3052,2852,2804,1633]},{"type":"call","value":[3052,2852,2804,550]},{"type":"call","value":[3052,2852,2804,977]},{"type":"call","value":[3052,2852,2804,321]},{"type":"call","value":[3052,2852,2804,1880]},{"type":"call","value":[3052,2852,2804,1224]},{"type":"call","value":[3052,2852,2804,568]},{"type":"call","value":[3052,2852,2804,1898]},{"type":"call","value":[3052,2852,2804,815]},{"type":"call","value":[3052,2852,2804,1242]},{"type":"call","value":[3052,2852,2804,586]},{"type":"call","value":[3052,2852,2804,833]},{"type":"call","value":[3052,2852,2804,1736]},{"type":"call","value":[3052,2852,2804,1080]},{"type":"call","value":[3052,2852,2804,424]},{"type":"call","value":[3052,2852,2804,1327]},{"type":"call","value":[3052,2852,2804,1754]},{"type":"call","value":[3052,2852,2804,671]},{"type":"call","value":[3052,2852,2804,1098]},{"type":"call","value":[3052,2852,2804,442]},{"type":"call","value":[3052,2852,2804,1345]},{"type":"call","value":[3052,2852,2804,689]},{"type":"call","value":[3052,2852,2804,1592]},{"type":"call","value":[3052,2852,2804,936]},{"type":"call","value":[3052,2852,2804,280]},{"type":"call","value":[3052,2852,2804,707]},{"type":"call","value":[3052,2852,2804,1610]},{"type":"call","value":[3052,2852,2804,954]},{"type":"call","value":[3052,2852,2804,298]},{"type":"call","value":[3052,2852,2804,1857]},{"type":"call","value":[3052,2852,2804,1201]},{"type":"call","value":[3052,2852,2804,1628]},{"type":"call","value":[3052,2852,2804,545]},{"type":"call","value":[3052,2852,2804,972]},{"type":"call","value":[3052,2852,2804,316]},{"type":"call","value":[3052,2852,2804,1875]},{"type":"call","value":[3052,2852,2804,1219]},{"type":"call","value":[3052,2852,2804,563]},{"type":"call","value":[3052,2852,2804,1466]},{"type":"call","value":[3052,2852,2804,810]},{"type":"call","value":[3052,2852,2804,1713]},{"type":"call","value":[3052,2852,2804,1057]},{"type":"call","value":[3052,2852,2804,401]},{"type":"call","value":[3052,2852,2804,828]},{"type":"call","value":[3052,2852,2804,1731]},{"type":"call","value":[3052,2852,2804,1075]},{"type":"call","value":[3052,2852,2804,419]},{"type":"call","value":[3052,2852,2804,1322]},{"type":"call","value":[3052,2852,2804,1749]},{"type":"call","value":[3052,2852,2804,666]},{"type":"call","value":[3052,2852,2804,1093]},{"type":"call","value":[3052,2852,2804,437]},{"type":"call","value":[3052,2852,2804,1340]},{"type":"call","value":[3052,2852,2804,684]},{"type":"call","value":[3052,2852,2804,1587]},{"type":"call","value":[3052,2852,2804,931]},{"type":"call","value":[3052,2852,2804,275]},{"type":"call","value":[3052,2852,2804,702]},{"type":"call","value":[3052,2852,2804,1605]},{"type":"call","value":[3052,2852,2804,949]},{"type":"call","value":[3052,2852,2804,293]},{"type":"call","value":[3052,2852,2804,1852]},{"type":"call","value":[3052,2852,2804,1196]},{"type":"call","value":[3052,2852,2804,540]},{"type":"call","value":[3052,2852,2804,1870]},{"type":"call","value":[3052,2852,2804,787]},{"type":"call","value":[3052,2852,2804,1214]},{"type":"call","value":[3052,2852,2804,558]},{"type":"call","value":[3052,2852,2804,1461]},{"type":"call","value":[3052,2852,2804,805]},{"type":"call","value":[3052,2852,2804,1708]},{"type":"call","value":[3052,2852,2804,1052]},{"type":"call","value":[3052,2852,2804,1479]},{"type":"call","value":[3052,2852,2804,396]},{"type":"call","value":[3052,2852,2804,823]},{"type":"call","value":[3052,2852,2804,1726]},{"type":"call","value":[3052,2852,2804,1070]},{"type":"call","value":[3052,2852,2804,414]},{"type":"call","value":[3052,2852,2804,1317]},{"type":"call","value":[3052,2852,2804,1744]},{"type":"call","value":[3052,2852,2804,661]},{"type":"call","value":[3052,2852,2804,1088]},{"type":"call","value":[3052,2852,2804,432]},{"type":"call","value":[3052,2852,2804,1335]},{"type":"call","value":[3052,2852,2804,679]},{"type":"call","value":[3052,2852,2804,1582]},{"type":"call","value":[3052,2852,2804,926]},{"type":"call","value":[3052,2852,2804,270]},{"type":"call","value":[3052,2852,2804,1829]},{"type":"call","value":[3052,2852,2804,1173]},{"type":"call","value":[3052,2852,2804,1600]},{"type":"call","value":[3052,2852,2804,517]},{"type":"call","value":[3052,2852,2804,944]},{"type":"call","value":[3052,2852,2804,288]},{"type":"call","value":[3052,2852,2804,1847]},{"type":"call","value":[3052,2852,2804,1191]},{"type":"call","value":[3052,2852,2804,535]},{"type":"call","value":[3052,2852,2804,1865]},{"type":"call","value":[3052,2852,2804,782]},{"type":"call","value":[3052,2852,2804,1209]},{"type":"call","value":[3052,2852,2804,553]},{"type":"call","value":[3052,2852,2804,800]},{"type":"call","value":[3052,2852,2804,1703]},{"type":"call","value":[3052,2852,2804,1047]},{"type":"call","value":[3052,2852,2804,1474]},{"type":"call","value":[3052,2852,2804,391]},{"type":"call","value":[3052,2852,2804,818]},{"type":"call","value":[3052,2852,2804,1721]},{"type":"call","value":[3052,2852,2804,1065]},{"type":"call","value":[3052,2852,2804,409]},{"type":"call","value":[3052,2852,2804,1312]},{"type":"call","value":[3052,2852,2804,656]},{"type":"call","value":[3052,2852,2804,1559]},{"type":"call","value":[3052,2852,2804,903]},{"type":"call","value":[3052,2852,2804,1330]},{"type":"call","value":[3052,2852,2804,674]},{"type":"call","value":[3052,2852,2804,1577]},{"type":"call","value":[3052,2852,2804,921]},{"type":"call","value":[3052,2852,2804,1824]},{"type":"call","value":[3052,2852,2804,1168]},{"type":"call","value":[3052,2852,2804,1595]},{"type":"call","value":[3052,2852,2804,512]},{"type":"call","value":[3052,2852,2804,939]},{"type":"call","value":[3052,2852,2804,283]},{"type":"call","value":[3052,2852,2804,1842]},{"type":"call","value":[3052,2852,2804,1186]},{"type":"call","value":[3052,2852,2804,530]},{"type":"call","value":[3052,2852,2804,777]},{"type":"call","value":[3052,2852,2804,1204]},{"type":"call","value":[3052,2852,2804,548]},{"type":"call","value":[3052,2852,2804,1680]},{"type":"call","value":[3052,2852,2804,795]},{"type":"call","value":[3052,2852,2804,1698]},{"type":"call","value":[3052,2852,2804,1042]},{"type":"call","value":[3052,2852,2804,386]},{"type":"call","value":[3052,2852,2804,1289]},{"type":"call","value":[3052,2852,2804,1716]},{"type":"call","value":[3052,2852,2804,633]},{"type":"call","value":[3052,2852,2804,1060]},{"type":"call","value":[3052,2852,2804,404]},{"type":"call","value":[3052,2852,2804,1307]},{"type":"call","value":[3052,2852,2804,651]},{"type":"call","value":[3052,2852,2804,1554]},{"type":"call","value":[3052,2852,2804,898]},{"type":"call","value":[3052,2852,2804,1325]},{"type":"call","value":[3052,2852,2804,242]},{"type":"call","value":[3052,2852,2804,669]},{"type":"call","value":[3052,2852,2804,1572]},{"type":"call","value":[3052,2852,2804,916]},{"type":"call","value":[3052,2852,2804,260]},{"type":"call","value":[3052,2852,2804,1819]},{"type":"call","value":[3052,2852,2804,1163]},{"type":"call","value":[3052,2852,2804,507]},{"type":"call","value":[3052,2852,2804,934]},{"type":"call","value":[3052,2852,2804,278]},{"type":"call","value":[3052,2852,2804,1837]},{"type":"call","value":[3052,2852,2804,1181]},{"type":"call","value":[3052,2852,2804,525]},{"type":"call","value":[3052,2852,2804,772]},{"type":"call","value":[3052,2852,2804,1675]},{"type":"call","value":[3052,2852,2804,1019]},{"type":"call","value":[3052,2852,2804,363]},{"type":"call","value":[3052,2852,2804,790]},{"type":"call","value":[3052,2852,2804,1693]},{"type":"call","value":[3052,2852,2804,1037]},{"type":"call","value":[3052,2852,2804,381]},{"type":"call","value":[3052,2852,2804,1284]},{"type":"call","value":[3052,2852,2804,1711]},{"type":"call","value":[3052,2852,2804,628]},{"type":"call","value":[3052,2852,2804,1055]},{"type":"call","value":[3052,2852,2804,399]},{"type":"call","value":[3052,2852,2804,1302]},{"type":"call","value":[3052,2852,2804,646]},{"type":"call","value":[3052,2852,2804,893]},{"type":"call","value":[3052,2852,2804,664]},{"type":"call","value":[3052,2852,2804,1796]},{"type":"call","value":[3052,2852,2804,1140]},{"type":"call","value":[3052,2852,2804,911]},{"type":"call","value":[3052,2852,2804,1814]},{"type":"call","value":[3052,2852,2804,1158]},{"type":"call","value":[3052,2852,2804,502]},{"type":"call","value":[3052,2852,2804,1832]},{"type":"call","value":[3052,2852,2804,749]},{"type":"call","value":[3052,2852,2804,1176]},{"type":"call","value":[3052,2852,2804,520]},{"type":"call","value":[3052,2852,2804,767]},{"type":"call","value":[3052,2852,2804,1670]},{"type":"call","value":[3052,2852,2804,1014]},{"type":"call","value":[3052,2852,2804,358]},{"type":"call","value":[3052,2852,2804,785]},{"type":"call","value":[3052,2852,2804,129]},{"type":"call","value":[3052,2852,2804,1688]},{"type":"call","value":[3052,2852,2804,1032]},{"type":"call","value":[3052,2852,2804,376]},{"type":"call","value":[3052,2852,2804,1279]},{"type":"call","value":[3052,2852,2804,623]},{"type":"call","value":[3052,2852,2804,1050]},{"type":"call","value":[3052,2852,2804,394]},{"type":"call","value":[3052,2852,2804,1297]},{"type":"call","value":[3052,2852,2804,641]},{"type":"call","value":[3052,2852,2804,888]},{"type":"call","value":[3052,2852,2804,232]},{"type":"call","value":[3052,2852,2804,1791]},{"type":"call","value":[3052,2852,2804,1135]},{"type":"call","value":[3052,2852,2804,1562]},{"type":"call","value":[3052,2852,2804,479]},{"type":"call","value":[3052,2852,2804,906]},{"type":"call","value":[3052,2852,2804,250]},{"type":"call","value":[3052,2852,2804,1809]},{"type":"call","value":[3052,2852,2804,1153]},{"type":"call","value":[3052,2852,2804,497]},{"type":"call","value":[3052,2852,2804,1827]},{"type":"call","value":[3052,2852,2804,744]},{"type":"call","value":[3052,2852,2804,1171]},{"type":"call","value":[3052,2852,2804,515]},{"type":"call","value":[3052,2852,2804,762]},{"type":"call","value":[3052,2852,2804,1665]},{"type":"call","value":[3052,2852,2804,1009]},{"type":"call","value":[3052,2852,2804,353]},{"type":"call","value":[3052,2852,2804,780]},{"type":"call","value":[3052,2852,2804,1912]},{"type":"call","value":[3052,2852,2804,1256]},{"type":"call","value":[3052,2852,2804,1683]},{"type":"call","value":[3052,2852,2804,1027]},{"type":"call","value":[3052,2852,2804,371]},{"type":"call","value":[3052,2852,2804,1930]},{"type":"call","value":[3052,2852,2804,1274]},{"type":"call","value":[3052,2852,2804,618]},{"type":"call","value":[3052,2852,2804,865]},{"type":"call","value":[3052,2852,2804,1292]},{"type":"call","value":[3052,2852,2804,636]},{"type":"call","value":[3052,2852,2804,883]},{"type":"call","value":[3052,2852,2804,1786]},{"type":"call","value":[3052,2852,2804,1130]},{"type":"call","value":[3052,2852,2804,1557]},{"type":"call","value":[3052,2852,2804,474]},{"type":"call","value":[3052,2852,2804,901]},{"type":"call","value":[3052,2852,2804,1804]},{"type":"call","value":[3052,2852,2804,1148]},{"type":"call","value":[3052,2852,2804,492]},{"type":"call","value":[3052,2852,2804,739]},{"type":"call","value":[3052,2852,2804,510]},{"type":"call","value":[3052,2852,2804,1642]},{"type":"call","value":[3052,2852,2804,986]},{"type":"call","value":[3052,2852,2804,757]},{"type":"call","value":[3052,2852,2804,1660]},{"type":"call","value":[3052,2852,2804,1004]},{"type":"call","value":[3052,2852,2804,348]},{"type":"call","value":[3052,2852,2804,1907]},{"type":"call","value":[3052,2852,2804,1251]},{"type":"call","value":[3052,2852,2804,1678]},{"type":"call","value":[3052,2852,2804,595]},{"type":"call","value":[3052,2852,2804,1022]},{"type":"call","value":[3052,2852,2804,366]},{"type":"call","value":[3052,2852,2804,1925]},{"type":"call","value":[3052,2852,2804,1269]},{"type":"call","value":[3052,2852,2804,613]},{"type":"call","value":[3052,2852,2804,860]},{"type":"call","value":[3052,2852,2804,1287]},{"type":"call","value":[3052,2852,2804,204]},{"type":"call","value":[3052,2852,2804,631]},{"type":"call","value":[3052,2852,2804,878]},{"type":"call","value":[3052,2852,2804,222]},{"type":"call","value":[3052,2852,2804,1781]},{"type":"call","value":[3052,2852,2804,1125]},{"type":"call","value":[3052,2852,2804,469]},{"type":"call","value":[3052,2852,2804,240]},{"type":"call","value":[3052,2852,2804,1799]},{"type":"call","value":[3052,2852,2804,716]},{"type":"call","value":[3052,2852,2804,1143]},{"type":"call","value":[3052,2852,2804,487]},{"type":"call","value":[3052,2852,2804,734]},{"type":"call","value":[3052,2852,2804,1637]},{"type":"call","value":[3052,2852,2804,981]},{"type":"call","value":[3052,2852,2804,325]},{"type":"call","value":[3052,2852,2804,752]},{"type":"call","value":[3052,2852,2804,1655]},{"type":"call","value":[3052,2852,2804,999]},{"type":"call","value":[3052,2852,2804,343]},{"type":"call","value":[3052,2852,2804,1902]},{"type":"call","value":[3052,2852,2804,1246]},{"type":"call","value":[3052,2852,2804,1673]},{"type":"call","value":[3052,2852,2804,590]},{"type":"call","value":[3052,2852,2804,1017]},{"type":"call","value":[3052,2852,2804,361]},{"type":"call","value":[3052,2852,2804,1920]},{"type":"call","value":[3052,2852,2804,1264]},{"type":"call","value":[3052,2852,2804,608]},{"type":"call","value":[3052,2852,2804,855]},{"type":"call","value":[3052,2852,2804,1758]},{"type":"call","value":[3052,2852,2804,1102]},{"type":"call","value":[3052,2852,2804,446]},{"type":"call","value":[3052,2852,2804,873]},{"type":"call","value":[3052,2852,2804,1776]},{"type":"call","value":[3052,2852,2804,1120]},{"type":"call","value":[3052,2852,2804,464]},{"type":"call","value":[3052,2852,2804,1794]},{"type":"call","value":[3052,2852,2804,711]},{"type":"call","value":[3052,2852,2804,1138]},{"type":"call","value":[3052,2852,2804,482]},{"type":"call","value":[3052,2852,2804,729]},{"type":"call","value":[3052,2852,2804,1632]},{"type":"call","value":[3052,2852,2804,976]},{"type":"call","value":[3052,2852,2804,320]},{"type":"call","value":[3052,2852,2804,747]},{"type":"call","value":[3052,2852,2804,1650]},{"type":"call","value":[3052,2852,2804,994]},{"type":"call","value":[3052,2852,2804,338]},{"type":"call","value":[3052,2852,2804,1897]},{"type":"call","value":[3052,2852,2804,1241]},{"type":"call","value":[3052,2852,2804,585]},{"type":"call","value":[3052,2852,2804,1915]},{"type":"call","value":[3052,2852,2804,832]},{"type":"call","value":[3052,2852,2804,1259]},{"type":"call","value":[3052,2852,2804,603]},{"type":"call","value":[3052,2852,2804,850]},{"type":"call","value":[3052,2852,2804,194]},{"type":"call","value":[3052,2852,2804,1753]},{"type":"call","value":[3052,2852,2804,1097]},{"type":"call","value":[3052,2852,2804,441]},{"type":"call","value":[3052,2852,2804,868]},{"type":"call","value":[3052,2852,2804,212]},{"type":"call","value":[3052,2852,2804,1771]},{"type":"call","value":[3052,2852,2804,1115]},{"type":"call","value":[3052,2852,2804,459]},{"type":"call","value":[3052,2852,2804,1789]},{"type":"call","value":[3052,2852,2804,706]},{"type":"call","value":[3052,2852,2804,1133]},{"type":"call","value":[3052,2852,2804,477]},{"type":"call","value":[3052,2852,2804,724]},{"type":"call","value":[3052,2852,2804,1627]},{"type":"call","value":[3052,2852,2804,971]},{"type":"call","value":[3052,2852,2804,315]},{"type":"call","value":[3052,2852,2804,1874]},{"type":"call","value":[3052,2852,2804,1218]},{"type":"call","value":[3052,2852,2804,1645]},{"type":"call","value":[3052,2852,2804,562]},{"type":"call","value":[3052,2852,2804,989]},{"type":"call","value":[3052,2852,2804,333]},{"type":"call","value":[3052,2852,2804,1892]},{"type":"call","value":[3052,2852,2804,1236]},{"type":"call","value":[3052,2852,2804,580]},{"type":"call","value":[3052,2852,2804,1483]},{"type":"call","value":[3052,2852,2804,1910]},{"type":"call","value":[3052,2852,2804,827]},{"type":"call","value":[3052,2852,2804,1254]},{"type":"call","value":[3052,2852,2804,598]},{"type":"call","value":[3052,2852,2804,845]},{"type":"call","value":[3052,2852,2804,1748]},{"type":"call","value":[3052,2852,2804,1092]},{"type":"call","value":[3052,2852,2804,436]},{"type":"call","value":[3052,2852,2804,863]},{"type":"call","value":[3052,2852,2804,1766]},{"type":"call","value":[3052,2852,2804,1110]},{"type":"call","value":[3052,2852,2804,454]},{"type":"call","value":[3052,2852,2804,1357]},{"type":"call","value":[3052,2852,2804,701]},{"type":"call","value":[3052,2852,2804,1604]},{"type":"call","value":[3052,2852,2804,948]},{"type":"call","value":[3052,2852,2804,292]},{"type":"call","value":[3052,2852,2804,719]},{"type":"call","value":[3052,2852,2804,1622]},{"type":"call","value":[3052,2852,2804,966]},{"type":"call","value":[3052,2852,2804,310]},{"type":"call","value":[3052,2852,2804,1869]},{"type":"call","value":[3052,2852,2804,1213]},{"type":"call","value":[3052,2852,2804,1640]},{"type":"call","value":[3052,2852,2804,984]},{"type":"call","value":[3052,2852,2804,328]},{"type":"call","value":[3052,2852,2804,1887]},{"type":"call","value":[3052,2852,2804,1231]},{"type":"call","value":[3052,2852,2804,1478]},{"type":"call","value":[3052,2852,2804,822]},{"type":"call","value":[3052,2852,2804,1249]},{"type":"call","value":[3052,2852,2804,593]},{"type":"call","value":[3052,2852,2804,1725]},{"type":"call","value":[3052,2852,2804,840]},{"type":"call","value":[3052,2852,2804,1743]},{"type":"call","value":[3052,2852,2804,1087]},{"type":"call","value":[3052,2852,2804,431]},{"type":"call","value":[3052,2852,2804,1334]},{"type":"call","value":[3052,2852,2804,1761]},{"type":"call","value":[3052,2852,2804,678]},{"type":"call","value":[3052,2852,2804,1105]},{"type":"call","value":[3052,2852,2804,449]},{"type":"call","value":[3052,2852,2804,696]},{"type":"call","value":[3052,2852,2804,1599]},{"type":"call","value":[3052,2852,2804,943]},{"type":"call","value":[3052,2852,2804,287]},{"type":"call","value":[3052,2852,2804,714]},{"type":"call","value":[3052,2852,2804,1617]},{"type":"call","value":[3052,2852,2804,961]},{"type":"call","value":[3052,2852,2804,305]},{"type":"call","value":[3052,2852,2804,1864]},{"type":"call","value":[3052,2852,2804,1208]},{"type":"call","value":[3052,2852,2804,552]},{"type":"call","value":[3052,2852,2804,979]},{"type":"call","value":[3052,2852,2804,323]},{"type":"call","value":[3052,2852,2804,1882]},{"type":"call","value":[3052,2852,2804,1226]},{"type":"call","value":[3052,2852,2804,570]},{"type":"call","value":[3052,2852,2804,1473]},{"type":"call","value":[3052,2852,2804,817]},{"type":"call","value":[3052,2852,2804,1720]},{"type":"call","value":[3052,2852,2804,1064]},{"type":"call","value":[3052,2852,2804,408]},{"type":"call","value":[3052,2852,2804,835]},{"type":"call","value":[3052,2852,2804,1738]},{"type":"call","value":[3052,2852,2804,1082]},{"type":"call","value":[3052,2852,2804,426]},{"type":"call","value":[3052,2852,2804,1329]},{"type":"call","value":[3052,2852,2804,1756]},{"type":"call","value":[3052,2852,2804,673]},{"type":"call","value":[3052,2852,2804,1100]},{"type":"call","value":[3052,2852,2804,444]},{"type":"call","value":[3052,2852,2804,1347]},{"type":"call","value":[3052,2852,2804,691]},{"type":"call","value":[3052,2852,2804,1594]},{"type":"call","value":[3052,2852,2804,938]},{"type":"call","value":[3052,2852,2804,282]},{"type":"call","value":[3052,2852,2804,709]},{"type":"call","value":[3052,2852,2804,1841]},{"type":"call","value":[3052,2852,2804,1185]},{"type":"call","value":[3052,2852,2804,1612]},{"type":"call","value":[3052,2852,2804,956]},{"type":"call","value":[3052,2852,2804,300]},{"type":"call","value":[3052,2852,2804,1859]},{"type":"call","value":[3052,2852,2804,1203]},{"type":"call","value":[3052,2852,2804,547]},{"type":"call","value":[3052,2852,2804,1877]},{"type":"call","value":[3052,2852,2804,794]},{"type":"call","value":[3052,2852,2804,1221]},{"type":"call","value":[3052,2852,2804,138]},{"type":"call","value":[3052,2852,2804,565]},{"type":"call","value":[3052,2852,2804,812]},{"type":"call","value":[3052,2852,2804,156]},{"type":"call","value":[3052,2852,2804,1715]},{"type":"call","value":[3052,2852,2804,1059]},{"type":"call","value":[3052,2852,2804,403]},{"type":"call","value":[3052,2852,2804,830]},{"type":"call","value":[3052,2852,2804,174]},{"type":"call","value":[3052,2852,2804,1733]},{"type":"call","value":[3052,2852,2804,1077]},{"type":"call","value":[3052,2852,2804,421]},{"type":"call","value":[3052,2852,2804,1324]},{"type":"call","value":[3052,2852,2804,668]},{"type":"call","value":[3052,2852,2804,439]},{"type":"call","value":[3052,2852,2804,1571]},{"type":"call","value":[3052,2852,2804,1342]},{"type":"call","value":[3052,2852,2804,686]},{"type":"call","value":[3052,2852,2804,1589]},{"type":"call","value":[3052,2852,2804,933]},{"type":"call","value":[3052,2852,2804,277]},{"type":"call","value":[3052,2852,2804,1836]},{"type":"call","value":[3052,2852,2804,1180]},{"type":"call","value":[3052,2852,2804,1607]},{"type":"call","value":[3052,2852,2804,524]},{"type":"call","value":[3052,2852,2804,951]},{"type":"call","value":[3052,2852,2804,295]},{"type":"call","value":[3052,2852,2804,1854]},{"type":"call","value":[3052,2852,2804,1198]},{"type":"call","value":[3052,2852,2804,542]},{"type":"call","value":[3052,2852,2804,1872]},{"type":"call","value":[3052,2852,2804,789]},{"type":"call","value":[3052,2852,2804,1216]},{"type":"call","value":[3052,2852,2804,560]},{"type":"call","value":[3052,2852,2804,1463]},{"type":"call","value":[3052,2852,2804,807]},{"type":"call","value":[3052,2852,2804,1710]},{"type":"call","value":[3052,2852,2804,1054]},{"type":"call","value":[3052,2852,2804,398]},{"type":"call","value":[3052,2852,2804,825]},{"type":"call","value":[3052,2852,2804,1301]},{"type":"call","value":[3052,2852,2804,1728]},{"type":"call","value":[3052,2852,2804,1072]},{"type":"call","value":[3052,2852,2804,416]},{"type":"call","value":[3052,2852,2804,1319]},{"type":"call","value":[3052,2852,2804,663]},{"type":"call","value":[3052,2852,2804,910]},{"type":"call","value":[3052,2852,2804,1337]},{"type":"call","value":[3052,2852,2804,254]},{"type":"call","value":[3052,2852,2804,681]},{"type":"call","value":[3052,2852,2804,1584]},{"type":"call","value":[3052,2852,2804,928]},{"type":"call","value":[3052,2852,2804,272]},{"type":"call","value":[3052,2852,2804,1831]},{"type":"call","value":[3052,2852,2804,1175]},{"type":"call","value":[3052,2852,2804,1602]},{"type":"call","value":[3052,2852,2804,519]},{"type":"call","value":[3052,2852,2804,946]},{"type":"call","value":[3052,2852,2804,290]},{"type":"call","value":[3052,2852,2804,1849]},{"type":"call","value":[3052,2852,2804,1193]},{"type":"call","value":[3052,2852,2804,537]},{"type":"call","value":[3052,2852,2804,784]},{"type":"call","value":[3052,2852,2804,555]},{"type":"call","value":[3052,2852,2804,1687]},{"type":"call","value":[3052,2852,2804,1031]},{"type":"call","value":[3052,2852,2804,802]},{"type":"call","value":[3052,2852,2804,1705]},{"type":"call","value":[3052,2852,2804,1049]},{"type":"call","value":[3052,2852,2804,393]},{"type":"call","value":[3052,2852,2804,1296]},{"type":"call","value":[3052,2852,2804,1723]},{"type":"call","value":[3052,2852,2804,640]},{"type":"call","value":[3052,2852,2804,1067]},{"type":"call","value":[3052,2852,2804,411]},{"type":"call","value":[3052,2852,2804,1314]},{"type":"call","value":[3052,2852,2804,658]},{"type":"call","value":[3052,2852,2804,1561]},{"type":"call","value":[3052,2852,2804,905]},{"type":"call","value":[3052,2852,2804,1332]},{"type":"call","value":[3052,2852,2804,676]},{"type":"call","value":[3052,2852,2804,1579]},{"type":"call","value":[3052,2852,2804,923]},{"type":"call","value":[3052,2852,2804,1826]},{"type":"call","value":[3052,2852,2804,1170]},{"type":"call","value":[3052,2852,2804,514]},{"type":"call","value":[3052,2852,2804,285]},{"type":"call","value":[3052,2852,2804,1844]},{"type":"call","value":[3052,2852,2804,761]},{"type":"call","value":[3052,2852,2804,1188]},{"type":"call","value":[3052,2852,2804,532]},{"type":"call","value":[3052,2852,2804,779]},{"type":"call","value":[3052,2852,2804,1682]},{"type":"call","value":[3052,2852,2804,1026]},{"type":"call","value":[3052,2852,2804,370]},{"type":"call","value":[3052,2852,2804,797]},{"type":"call","value":[3052,2852,2804,1700]},{"type":"call","value":[3052,2852,2804,1044]},{"type":"call","value":[3052,2852,2804,388]},{"type":"call","value":[3052,2852,2804,1291]},{"type":"call","value":[3052,2852,2804,1718]},{"type":"call","value":[3052,2852,2804,635]},{"type":"call","value":[3052,2852,2804,1062]},{"type":"call","value":[3052,2852,2804,406]},{"type":"call","value":[3052,2852,2804,1309]},{"type":"call","value":[3052,2852,2804,653]},{"type":"call","value":[3052,2852,2804,1556]},{"type":"call","value":[3052,2852,2804,900]},{"type":"call","value":[3052,2852,2804,244]},{"type":"call","value":[3052,2852,2804,1803]},{"type":"call","value":[3052,2852,2804,1147]},{"type":"call","value":[3052,2852,2804,1574]},{"type":"call","value":[3052,2852,2804,491]},{"type":"call","value":[3052,2852,2804,918]},{"type":"call","value":[3052,2852,2804,262]},{"type":"call","value":[3052,2852,2804,1821]},{"type":"call","value":[3052,2852,2804,1165]},{"type":"call","value":[3052,2852,2804,509]},{"type":"call","value":[3052,2852,2804,1839]},{"type":"call","value":[3052,2852,2804,756]},{"type":"call","value":[3052,2852,2804,1183]},{"type":"call","value":[3052,2852,2804,527]},{"type":"call","value":[3052,2852,2804,774]},{"type":"call","value":[3052,2852,2804,1677]},{"type":"call","value":[3052,2852,2804,1021]},{"type":"call","value":[3052,2852,2804,365]},{"type":"call","value":[3052,2852,2804,792]},{"type":"call","value":[3052,2852,2804,1695]},{"type":"call","value":[3052,2852,2804,1039]},{"type":"call","value":[3052,2852,2804,383]},{"type":"call","value":[3052,2852,2804,1286]},{"type":"call","value":[3052,2852,2804,630]},{"type":"call","value":[3052,2852,2804,877]},{"type":"call","value":[3052,2852,2804,648]},{"type":"call","value":[3052,2852,2804,895]},{"type":"call","value":[3052,2852,2804,1798]},{"type":"call","value":[3052,2852,2804,1142]},{"type":"call","value":[3052,2852,2804,1569]},{"type":"call","value":[3052,2852,2804,486]},{"type":"call","value":[3052,2852,2804,913]},{"type":"call","value":[3052,2852,2804,1816]},{"type":"call","value":[3052,2852,2804,1160]},{"type":"call","value":[3052,2852,2804,504]},{"type":"call","value":[3052,2852,2804,1834]},{"type":"call","value":[3052,2852,2804,751]},{"type":"call","value":[3052,2852,2804,1178]},{"type":"call","value":[3052,2852,2804,522]},{"type":"call","value":[3052,2852,2804,769]},{"type":"call","value":[3052,2852,2804,1672]},{"type":"call","value":[3052,2852,2804,1016]},{"type":"call","value":[3052,2852,2804,360]},{"type":"call","value":[3052,2852,2804,1919]},{"type":"call","value":[3052,2852,2804,1263]},{"type":"call","value":[3052,2852,2804,1690]},{"type":"call","value":[3052,2852,2804,607]},{"type":"call","value":[3052,2852,2804,1034]},{"type":"call","value":[3052,2852,2804,378]},{"type":"call","value":[3052,2852,2804,1281]},{"type":"call","value":[3052,2852,2804,625]},{"type":"call","value":[3052,2852,2804,872]},{"type":"call","value":[3052,2852,2804,1299]},{"type":"call","value":[3052,2852,2804,216]},{"type":"call","value":[3052,2852,2804,643]},{"type":"call","value":[3052,2852,2804,890]},{"type":"call","value":[3052,2852,2804,234]},{"type":"call","value":[3052,2852,2804,1793]},{"type":"call","value":[3052,2852,2804,1137]},{"type":"call","value":[3052,2852,2804,1564]},{"type":"call","value":[3052,2852,2804,481]},{"type":"call","value":[3052,2852,2804,908]},{"type":"call","value":[3052,2852,2804,252]},{"type":"call","value":[3052,2852,2804,1811]},{"type":"call","value":[3052,2852,2804,1155]},{"type":"call","value":[3052,2852,2804,499]},{"type":"call","value":[3052,2852,2804,746]},{"type":"call","value":[3052,2852,2804,1649]},{"type":"call","value":[3052,2852,2804,993]},{"type":"call","value":[3052,2852,2804,337]},{"type":"call","value":[3052,2852,2804,764]},{"type":"call","value":[3052,2852,2804,1667]},{"type":"call","value":[3052,2852,2804,1011]},{"type":"call","value":[3052,2852,2804,355]},{"type":"call","value":[3052,2852,2804,1914]},{"type":"call","value":[3052,2852,2804,1258]},{"type":"call","value":[3052,2852,2804,1685]},{"type":"call","value":[3052,2852,2804,602]},{"type":"call","value":[3052,2852,2804,1029]},{"type":"call","value":[3052,2852,2804,373]},{"type":"call","value":[3052,2852,2804,1932]},{"type":"call","value":[3052,2852,2804,1276]},{"type":"call","value":[3052,2852,2804,620]},{"type":"call","value":[3052,2852,2804,867]},{"type":"call","value":[3052,2852,2804,1294]},{"type":"call","value":[3052,2852,2804,638]},{"type":"call","value":[3052,2852,2804,1770]},{"type":"call","value":[3052,2852,2804,885]},{"type":"call","value":[3052,2852,2804,1788]},{"type":"call","value":[3052,2852,2804,1132]},{"type":"call","value":[3052,2852,2804,476]},{"type":"call","value":[3052,2852,2804,1806]},{"type":"call","value":[3052,2852,2804,723]},{"type":"call","value":[3052,2852,2804,1150]},{"type":"call","value":[3052,2852,2804,494]},{"type":"call","value":[3052,2852,2804,741]},{"type":"call","value":[3052,2852,2804,1644]},{"type":"call","value":[3052,2852,2804,988]},{"type":"call","value":[3052,2852,2804,332]},{"type":"call","value":[3052,2852,2804,759]},{"type":"call","value":[3052,2852,2804,1662]},{"type":"call","value":[3052,2852,2804,1006]},{"type":"call","value":[3052,2852,2804,350]},{"type":"call","value":[3052,2852,2804,1909]},{"type":"call","value":[3052,2852,2804,1253]},{"type":"call","value":[3052,2852,2804,597]},{"type":"call","value":[3052,2852,2804,1024]},{"type":"call","value":[3052,2852,2804,368]},{"type":"call","value":[3052,2852,2804,1927]},{"type":"call","value":[3052,2852,2804,1271]},{"type":"call","value":[3052,2852,2804,615]},{"type":"call","value":[3052,2852,2804,862]},{"type":"call","value":[3052,2852,2804,206]},{"type":"call","value":[3052,2852,2804,1765]},{"type":"call","value":[3052,2852,2804,1109]},{"type":"call","value":[3052,2852,2804,453]},{"type":"call","value":[3052,2852,2804,880]},{"type":"call","value":[3052,2852,2804,224]},{"type":"call","value":[3052,2852,2804,1783]},{"type":"call","value":[3052,2852,2804,1127]},{"type":"call","value":[3052,2852,2804,471]},{"type":"call","value":[3052,2852,2804,1801]},{"type":"call","value":[3052,2852,2804,718]},{"type":"call","value":[3052,2852,2804,1145]},{"type":"call","value":[3052,2852,2804,489]},{"type":"call","value":[3052,2852,2804,736]},{"type":"call","value":[3052,2852,2804,1639]},{"type":"call","value":[3052,2852,2804,983]},{"type":"call","value":[3052,2852,2804,327]},{"type":"call","value":[3052,2852,2804,754]},{"type":"call","value":[3052,2852,2804,1886]},{"type":"call","value":[3052,2852,2804,1657]},{"type":"call","value":[3052,2852,2804,1001]},{"type":"call","value":[3052,2852,2804,345]},{"type":"call","value":[3052,2852,2804,1904]},{"type":"call","value":[3052,2852,2804,1248]},{"type":"call","value":[3052,2852,2804,592]},{"type":"call","value":[3052,2852,2804,1922]},{"type":"call","value":[3052,2852,2804,839]},{"type":"call","value":[3052,2852,2804,1266]},{"type":"call","value":[3052,2852,2804,183]},{"type":"call","value":[3052,2852,2804,610]},{"type":"call","value":[3052,2852,2804,857]},{"type":"call","value":[3052,2852,2804,1760]},{"type":"call","value":[3052,2852,2804,1104]},{"type":"call","value":[3052,2852,2804,448]},{"type":"call","value":[3052,2852,2804,875]},{"type":"call","value":[3052,2852,2804,1778]},{"type":"call","value":[3052,2852,2804,1122]},{"type":"call","value":[3052,2852,2804,466]},{"type":"call","value":[3052,2852,2804,713]},{"type":"call","value":[3052,2852,2804,484]},{"type":"call","value":[3052,2852,2804,1616]},{"type":"call","value":[3052,2852,2804,731]},{"type":"call","value":[3052,2852,2804,1634]},{"type":"call","value":[3052,2852,2804,978]},{"type":"call","value":[3052,2852,2804,322]},{"type":"call","value":[3052,2852,2804,1881]},{"type":"call","value":[3052,2852,2804,1225]},{"type":"call","value":[3052,2852,2804,1652]},{"type":"call","value":[3052,2852,2804,569]},{"type":"call","value":[3052,2852,2804,996]},{"type":"call","value":[3052,2852,2804,340]},{"type":"call","value":[3052,2852,2804,1899]},{"type":"call","value":[3052,2852,2804,1243]},{"type":"call","value":[3052,2852,2804,587]},{"type":"call","value":[3052,2852,2804,1917]},{"type":"call","value":[3052,2852,2804,834]},{"type":"call","value":[3052,2852,2804,1261]},{"type":"call","value":[3052,2852,2804,605]},{"type":"call","value":[3052,2852,2804,852]},{"type":"call","value":[3052,2852,2804,196]},{"type":"call","value":[3052,2852,2804,1755]},{"type":"call","value":[3052,2852,2804,1099]},{"type":"call","value":[3052,2852,2804,443]},{"type":"call","value":[3052,2852,2804,870]},{"type":"call","value":[3052,2852,2804,214]},{"type":"call","value":[3052,2852,2804,1346]},{"type":"call","value":[3052,2852,2804,1773]},{"type":"call","value":[3052,2852,2804,1117]},{"type":"call","value":[3052,2852,2804,461]},{"type":"call","value":[3052,2852,2804,708]},{"type":"call","value":[3052,2852,2804,1611]},{"type":"call","value":[3052,2852,2804,955]},{"type":"call","value":[3052,2852,2804,299]},{"type":"call","value":[3052,2852,2804,726]},{"type":"call","value":[3052,2852,2804,1629]},{"type":"call","value":[3052,2852,2804,973]},{"type":"call","value":[3052,2852,2804,317]},{"type":"call","value":[3052,2852,2804,1876]},{"type":"call","value":[3052,2852,2804,1220]},{"type":"call","value":[3052,2852,2804,1647]},{"type":"call","value":[3052,2852,2804,564]},{"type":"call","value":[3052,2852,2804,991]},{"type":"call","value":[3052,2852,2804,335]},{"type":"call","value":[3052,2852,2804,1894]},{"type":"call","value":[3052,2852,2804,1238]},{"type":"call","value":[3052,2852,2804,582]},{"type":"call","value":[3052,2852,2804,829]},{"type":"call","value":[3052,2852,2804,600]},{"type":"call","value":[3052,2852,2804,1732]},{"type":"call","value":[3052,2852,2804,1076]},{"type":"call","value":[3052,2852,2804,847]},{"type":"call","value":[3052,2852,2804,1750]},{"type":"call","value":[3052,2852,2804,1094]},{"type":"call","value":[3052,2852,2804,438]},{"type":"call","value":[3052,2852,2804,1341]},{"type":"call","value":[3052,2852,2804,1768]},{"type":"call","value":[3052,2852,2804,685]},{"type":"call","value":[3052,2852,2804,1112]},{"type":"call","value":[3052,2852,2804,456]},{"type":"call","value":[3052,2852,2804,703]},{"type":"call","value":[3052,2852,2804,1606]},{"type":"call","value":[3052,2852,2804,950]},{"type":"call","value":[3052,2852,2804,294]},{"type":"call","value":[3052,2852,2804,721]},{"type":"call","value":[3052,2852,2804,1624]},{"type":"call","value":[3052,2852,2804,968]},{"type":"call","value":[3052,2852,2804,312]},{"type":"call","value":[3052,2852,2804,1871]},{"type":"call","value":[3052,2852,2804,1215]},{"type":"call","value":[3052,2852,2804,559]},{"type":"call","value":[3052,2852,2804,330]},{"type":"call","value":[3052,2852,2804,1889]},{"type":"call","value":[3052,2852,2804,806]},{"type":"call","value":[3052,2852,2804,1233]},{"type":"call","value":[3052,2852,2804,577]},{"type":"call","value":[3052,2852,2804,1480]},{"type":"call","value":[3052,2852,2804,824]},{"type":"call","value":[3052,2852,2804,1727]},{"type":"call","value":[3052,2852,2804,1071]},{"type":"call","value":[3052,2852,2804,415]},{"type":"call","value":[3052,2852,2804,842]},{"type":"call","value":[3052,2852,2804,186]},{"type":"call","value":[3052,2852,2804,1745]},{"type":"call","value":[3052,2852,2804,1089]},{"type":"call","value":[3052,2852,2804,433]},{"type":"call","value":[3052,2852,2804,1336]},{"type":"call","value":[3052,2852,2804,1763]},{"type":"call","value":[3052,2852,2804,680]},{"type":"call","value":[3052,2852,2804,1107]},{"type":"call","value":[3052,2852,2804,451]},{"type":"call","value":[3052,2852,2804,698]},{"type":"call","value":[3052,2852,2804,1601]},{"type":"call","value":[3052,2852,2804,945]},{"type":"call","value":[3052,2852,2804,289]},{"type":"call","value":[3052,2852,2804,1848]},{"type":"call","value":[3052,2852,2804,1192]},{"type":"call","value":[3052,2852,2804,1619]},{"type":"call","value":[3052,2852,2804,536]},{"type":"call","value":[3052,2852,2804,963]},{"type":"call","value":[3052,2852,2804,307]},{"type":"call","value":[3052,2852,2804,1866]},{"type":"call","value":[3052,2852,2804,1210]},{"type":"call","value":[3052,2852,2804,554]},{"type":"call","value":[3052,2852,2804,1457]},{"type":"call","value":[3052,2852,2804,1884]},{"type":"call","value":[3052,2852,2804,801]},{"type":"call","value":[3052,2852,2804,1228]},{"type":"call","value":[3052,2852,2804,1475]},{"type":"call","value":[3052,2852,2804,819]},{"type":"call","value":[3052,2852,2804,1722]},{"type":"call","value":[3052,2852,2804,1066]},{"type":"call","value":[3052,2852,2804,410]},{"type":"call","value":[3052,2852,2804,837]},{"type":"call","value":[3052,2852,2804,1740]},{"type":"call","value":[3052,2852,2804,1084]},{"type":"call","value":[3052,2852,2804,428]},{"type":"call","value":[3052,2852,2804,1331]},{"type":"call","value":[3052,2852,2804,675]},{"type":"call","value":[3052,2852,2804,1578]},{"type":"call","value":[3052,2852,2804,922]},{"type":"call","value":[3052,2852,2804,1349]},{"type":"call","value":[3052,2852,2804,266]},{"type":"call","value":[3052,2852,2804,693]},{"type":"call","value":[3052,2852,2804,1596]},{"type":"call","value":[3052,2852,2804,940]},{"type":"call","value":[3052,2852,2804,284]},{"type":"call","value":[3052,2852,2804,1843]},{"type":"call","value":[3052,2852,2804,1187]},{"type":"call","value":[3052,2852,2804,1614]},{"type":"call","value":[3052,2852,2804,531]},{"type":"call","value":[3052,2852,2804,958]},{"type":"call","value":[3052,2852,2804,302]},{"type":"call","value":[3052,2852,2804,1861]},{"type":"call","value":[3052,2852,2804,1205]},{"type":"call","value":[3052,2852,2804,549]},{"type":"call","value":[3052,2852,2804,1879]},{"type":"call","value":[3052,2852,2804,796]},{"type":"call","value":[3052,2852,2804,1223]},{"type":"call","value":[3052,2852,2804,567]},{"type":"call","value":[3052,2852,2804,814]},{"type":"call","value":[3052,2852,2804,1717]},{"type":"call","value":[3052,2852,2804,1061]},{"type":"call","value":[3052,2852,2804,405]},{"type":"call","value":[3052,2852,2804,1308]},{"type":"call","value":[3052,2852,2804,1735]},{"type":"call","value":[3052,2852,2804,652]},{"type":"call","value":[3052,2852,2804,1079]},{"type":"call","value":[3052,2852,2804,423]},{"type":"call","value":[3052,2852,2804,1326]},{"type":"call","value":[3052,2852,2804,670]},{"type":"call","value":[3052,2852,2804,1573]},{"type":"call","value":[3052,2852,2804,917]},{"type":"call","value":[3052,2852,2804,1344]},{"type":"call","value":[3052,2852,2804,688]},{"type":"call","value":[3052,2852,2804,1591]},{"type":"call","value":[3052,2852,2804,935]},{"type":"call","value":[3052,2852,2804,279]},{"type":"call","value":[3052,2852,2804,1838]},{"type":"call","value":[3052,2852,2804,1182]},{"type":"call","value":[3052,2852,2804,1609]},{"type":"call","value":[3052,2852,2804,526]},{"type":"call","value":[3052,2852,2804,953]},{"type":"call","value":[3052,2852,2804,297]},{"type":"call","value":[3052,2852,2804,1856]},{"type":"call","value":[3052,2852,2804,1200]},{"type":"call","value":[3052,2852,2804,544]},{"type":"call","value":[3052,2852,2804,791]},{"type":"call","value":[3052,2852,2804,1694]},{"type":"call","value":[3052,2852,2804,1038]},{"type":"call","value":[3052,2852,2804,1465]},{"type":"call","value":[3052,2852,2804,382]},{"type":"call","value":[3052,2852,2804,809]},{"type":"call","value":[3052,2852,2804,1712]},{"type":"call","value":[3052,2852,2804,1056]},{"type":"call","value":[3052,2852,2804,400]},{"type":"call","value":[3052,2852,2804,1303]},{"type":"call","value":[3052,2852,2804,1730]},{"type":"call","value":[3052,2852,2804,647]},{"type":"call","value":[3052,2852,2804,1074]},{"type":"call","value":[3052,2852,2804,418]},{"type":"call","value":[3052,2852,2804,1321]},{"type":"call","value":[3052,2852,2804,665]},{"type":"call","value":[3052,2852,2804,1568]},{"type":"call","value":[3052,2852,2804,912]},{"type":"call","value":[3052,2852,2804,1339]},{"type":"call","value":[3052,2852,2804,256]},{"type":"call","value":[3052,2852,2804,683]},{"type":"call","value":[3052,2852,2804,1815]},{"type":"call","value":[3052,2852,2804,1586]},{"type":"call","value":[3052,2852,2804,930]},{"type":"call","value":[3052,2852,2804,274]},{"type":"call","value":[3052,2852,2804,1833]},{"type":"call","value":[3052,2852,2804,1177]},{"type":"call","value":[3052,2852,2804,521]},{"type":"call","value":[3052,2852,2804,1851]},{"type":"call","value":[3052,2852,2804,768]},{"type":"call","value":[3052,2852,2804,1195]},{"type":"call","value":[3052,2852,2804,539]},{"type":"call","value":[3052,2852,2804,786]},{"type":"call","value":[3052,2852,2804,1689]},{"type":"call","value":[3052,2852,2804,1033]},{"type":"call","value":[3052,2852,2804,377]},{"type":"call","value":[3052,2852,2804,804]},{"type":"call","value":[3052,2852,2804,1707]},{"type":"call","value":[3052,2852,2804,1051]},{"type":"call","value":[3052,2852,2804,1298]},{"type":"call","value":[3052,2852,2804,642]},{"type":"call","value":[3052,2852,2804,1069]},{"type":"call","value":[3052,2852,2804,413]},{"type":"call","value":[3052,2852,2804,1316]},{"type":"call","value":[3052,2852,2804,660]},{"type":"call","value":[3052,2852,2804,1563]},{"type":"call","value":[3052,2852,2804,907]},{"type":"call","value":[3052,2852,2804,1810]},{"type":"call","value":[3052,2852,2804,1154]},{"type":"call","value":[3052,2852,2804,1581]},{"type":"call","value":[3052,2852,2804,498]},{"type":"call","value":[3052,2852,2804,925]},{"type":"call","value":[3052,2852,2804,1828]},{"type":"call","value":[3052,2852,2804,1172]},{"type":"call","value":[3052,2852,2804,516]},{"type":"call","value":[3052,2852,2804,1846]},{"type":"call","value":[3052,2852,2804,1190]},{"type":"call","value":[3052,2852,2804,534]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2596]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2596,218]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1156]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,780]},{"type":"call","value":[1180,1852,1156,803]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1476]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryDirectoryFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryInformationFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1476,1664]},{"type":"call","value":[1180,1852,1476,1675]},{"type":"call","value":[1180,1852,1476,1607]},{"type":"call","value":[1180,1852,1476,1686]},{"type":"call","value":[1180,1852,1476,1642]},{"type":"call","value":[1180,1852,1476,1619]},{"type":"call","value":[1180,1852,1476,1653]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::GetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"stat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"lstat"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fstatat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"open thread":{"meta":{"name":"open thread","authors":["0x534a@mailbox.org"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Process","Open Thread"],"objective":"Process","behavior":"Open Thread","method":"","id":"C0066"}],"references":[],"examples":["787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: open thread\n authors:\n - 0x534a@mailbox.org\n lib: 'true'\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Process::Open Thread [C0066]\n examples:\n - 787cbc8a6d1bc58ea169e51e1ad029a637f22560660cc129ab8a099a745bd50e:00502F4C\n features:\n - or:\n - api: kernel32.OpenThread\n - api: NtOpenThread\n - api: ZwOpenThread\n","matches":[[{"type":"thread","value":[3052,2852,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,4]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,2836]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2836,1071]},{"type":"call","value":[1180,1852,2836,1077]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[792,1224,2540]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[792,1224,2540,1540]},{"type":"call","value":[792,1224,2540,1585]},{"type":"call","value":[792,1224,2540,1559]},{"type":"call","value":[792,1224,2540,1565]},{"type":"call","value":[792,1224,2540,1562]},{"type":"call","value":[792,1224,2540,1613]},{"type":"call","value":[792,1224,2540,1552]},{"type":"call","value":[792,1224,2540,1597]},{"type":"call","value":[792,1224,2540,1601]},{"type":"call","value":[792,1224,2540,1609]},{"type":"call","value":[792,1224,2540,1548]},{"type":"call","value":[792,1224,2540,1593]},{"type":"call","value":[792,1224,2540,1544]},{"type":"call","value":[792,1224,2540,1589]},{"type":"call","value":[792,1224,2540,1605]},{"type":"call","value":[792,1224,2540,1556]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1200,1248,2544]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2544,1611]},{"type":"call","value":[1200,1248,2544,1736]},{"type":"call","value":[1200,1248,2544,1559]},{"type":"call","value":[1200,1248,2544,1571]},{"type":"call","value":[1200,1248,2544,1623]},{"type":"call","value":[1200,1248,2544,1684]},{"type":"call","value":[1200,1248,2544,1748]},{"type":"call","value":[1200,1248,2544,1583]},{"type":"call","value":[1200,1248,2544,1696]},{"type":"call","value":[1200,1248,2544,1760]},{"type":"call","value":[1200,1248,2544,1595]},{"type":"call","value":[1200,1248,2544,1708]},{"type":"call","value":[1200,1248,2544,1772]},{"type":"call","value":[1200,1248,2544,1543]},{"type":"call","value":[1200,1248,2544,1607]},{"type":"call","value":[1200,1248,2544,1720]},{"type":"call","value":[1200,1248,2544,1732]},{"type":"call","value":[1200,1248,2544,1555]},{"type":"call","value":[1200,1248,2544,1680]},{"type":"call","value":[1200,1248,2544,1619]},{"type":"call","value":[1200,1248,2544,1744]},{"type":"call","value":[1200,1248,2544,1567]},{"type":"call","value":[1200,1248,2544,1692]},{"type":"call","value":[1200,1248,2544,1756]},{"type":"call","value":[1200,1248,2544,1579]},{"type":"call","value":[1200,1248,2544,1704]},{"type":"call","value":[1200,1248,2544,1768]},{"type":"call","value":[1200,1248,2544,1591]},{"type":"call","value":[1200,1248,2544,1716]},{"type":"call","value":[1200,1248,2544,1603]},{"type":"call","value":[1200,1248,2544,1728]},{"type":"call","value":[1200,1248,2544,1551]},{"type":"call","value":[1200,1248,2544,1676]},{"type":"call","value":[1200,1248,2544,1615]},{"type":"call","value":[1200,1248,2544,1740]},{"type":"call","value":[1200,1248,2544,1563]},{"type":"call","value":[1200,1248,2544,1688]},{"type":"call","value":[1200,1248,2544,1627]},{"type":"call","value":[1200,1248,2544,1633]},{"type":"call","value":[1200,1248,2544,1752]},{"type":"call","value":[1200,1248,2544,1630]},{"type":"call","value":[1200,1248,2544,1636]},{"type":"call","value":[1200,1248,2544,1575]},{"type":"call","value":[1200,1248,2544,1700]},{"type":"call","value":[1200,1248,2544,1764]},{"type":"call","value":[1200,1248,2544,1587]},{"type":"call","value":[1200,1248,2544,1712]},{"type":"call","value":[1200,1248,2544,1599]},{"type":"call","value":[1200,1248,2544,1724]},{"type":"call","value":[1200,1248,2544,1547]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1248,1680,3044]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[1248,1680,3044,1058]},{"type":"call","value":[1248,1680,3044,1042]},{"type":"call","value":[1248,1680,3044,1106]},{"type":"call","value":[1248,1680,3044,1102]},{"type":"call","value":[1248,1680,3044,1086]},{"type":"call","value":[1248,1680,3044,1054]},{"type":"call","value":[1248,1680,3044,1050]},{"type":"call","value":[1248,1680,3044,1098]},{"type":"call","value":[1248,1680,3044,1066]},{"type":"call","value":[1248,1680,3044,1062]},{"type":"call","value":[1248,1680,3044,1046]},{"type":"call","value":[1248,1680,3044,1110]},{"type":"call","value":[1248,1680,3044,1094]},{"type":"call","value":[1248,1680,3044,1090]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2724,2016]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[1852,2724,2016,905]},{"type":"call","value":[1852,2724,2016,873]},{"type":"call","value":[1852,2724,2016,857]},{"type":"call","value":[1852,2724,2016,853]},{"type":"call","value":[1852,2724,2016,921]},{"type":"call","value":[1852,2724,2016,917]},{"type":"call","value":[1852,2724,2016,901]},{"type":"call","value":[1852,2724,2016,869]},{"type":"call","value":[1852,2724,2016,865]},{"type":"call","value":[1852,2724,2016,913]},{"type":"call","value":[1852,2724,2016,897]},{"type":"call","value":[1852,2724,2016,877]},{"type":"call","value":[1852,2724,2016,861]},{"type":"call","value":[1852,2724,2016,909]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1852,2800,3044]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[1852,2800,3044,1138]},{"type":"call","value":[1852,2800,3044,1186]},{"type":"call","value":[1852,2800,3044,1170]},{"type":"call","value":[1852,2800,3044,1150]},{"type":"call","value":[1852,2800,3044,1134]},{"type":"call","value":[1852,2800,3044,1182]},{"type":"call","value":[1852,2800,3044,1194]},{"type":"call","value":[1852,2800,3044,1178]},{"type":"call","value":[1852,2800,3044,1146]},{"type":"call","value":[1852,2800,3044,1130]},{"type":"call","value":[1852,2800,3044,1126]},{"type":"call","value":[1852,2800,3044,1190]},{"type":"call","value":[1852,2800,3044,1174]},{"type":"call","value":[1852,2800,3044,1142]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1572,2932]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2932,836]},{"type":"call","value":[2820,1572,2932,820]},{"type":"call","value":[2820,1572,2932,804]},{"type":"call","value":[2820,1572,2932,772]},{"type":"call","value":[2820,1572,2932,784]},{"type":"call","value":[2820,1572,2932,768]},{"type":"call","value":[2820,1572,2932,752]},{"type":"call","value":[2820,1572,2932,832]},{"type":"call","value":[2820,1572,2932,816]},{"type":"call","value":[2820,1572,2932,780]},{"type":"call","value":[2820,1572,2932,764]},{"type":"call","value":[2820,1572,2932,828]},{"type":"call","value":[2820,1572,2932,812]},{"type":"call","value":[2820,1572,2932,824]},{"type":"call","value":[2820,1572,2932,808]},{"type":"call","value":[2820,1572,2932,776]},{"type":"call","value":[2820,1572,2932,760]},{"type":"call","value":[2820,1572,2932,756]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[2820,1912,1216]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.OpenThread"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenThread"}},"children":[],"locations":[{"type":"call","value":[2820,1912,1216,1751]},{"type":"call","value":[2820,1912,1216,1781]},{"type":"call","value":[2820,1912,1216,1809]},{"type":"call","value":[2820,1912,1216,1748]},{"type":"call","value":[2820,1912,1216,1754]},{"type":"call","value":[2820,1912,1216,1793]},{"type":"call","value":[2820,1912,1216,1744]},{"type":"call","value":[2820,1912,1216,1728]},{"type":"call","value":[2820,1912,1216,1757]},{"type":"call","value":[2820,1912,1216,1789]},{"type":"call","value":[2820,1912,1216,1805]},{"type":"call","value":[2820,1912,1216,1801]},{"type":"call","value":[2820,1912,1216,1740]},{"type":"call","value":[2820,1912,1216,1785]},{"type":"call","value":[2820,1912,1216,1777]},{"type":"call","value":[2820,1912,1216,1797]},{"type":"call","value":[2820,1912,1216,1736]},{"type":"call","value":[2820,1912,1216,1732]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenThread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set file attributes":{"meta":{"name":"set file attributes","namespace":"host-interaction/file-system/meta","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[{"parts":["Defense Evasion","File and Directory Permissions Modification"],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","subtechnique":"","id":"T1222"}],"mbc":[{"parts":["File System","Set File Attributes"],"objective":"File System","behavior":"Set File Attributes","method":"","id":"C0050"}],"references":[],"examples":["946A99F36A46D335DEC080D9A4371940:0x100015f0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: set file attributes\n namespace: host-interaction/file-system/meta\n authors:\n - moritz.raabe@mandiant.com\n - michael.hunhoff@mandiant.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: basic block\n dynamic: thread\n att&ck:\n - Defense Evasion::File and Directory Permissions Modification [T1222]\n mbc:\n - File System::Set File Attributes [C0050]\n examples:\n - 946A99F36A46D335DEC080D9A4371940:0x100015f0\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4028B6\n features:\n - or:\n - api: kernel32.SetFileAttributes\n - api: ZwSetInformationFile\n - api: NtSetInformationFile\n - api: System.IO.File::SetAttributes\n - api: System.IO.File::SetCreationTime\n - api: System.IO.File::SetCreationTimeUtc\n - api: System.IO.File::SetLastAccessTime\n - api: System.IO.File::SetLastAccessTimeUtc\n - api: System.IO.File::SetLastWriteTime\n - api: System.IO.File::SetLastWriteTimeUtc\n - property/write: System.IO.FileSystemInfo::Attributes\n - api: utime\n - api: utimes\n","matches":[[{"type":"thread","value":[3052,2852,2804]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.SetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtSetInformationFile"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,576]},{"type":"call","value":[3052,2852,2804,395]},{"type":"call","value":[3052,2852,2804,1304]},{"type":"call","value":[3052,2852,2804,1462]},{"type":"call","value":[3052,2852,2804,1458]},{"type":"call","value":[3052,2852,2804,1471]},{"type":"call","value":[3052,2852,2804,1230]},{"type":"call","value":[3052,2852,2804,291]},{"type":"call","value":[3052,2852,2804,1455]},{"type":"call","value":[3052,2852,2804,1351]},{"type":"call","value":[3052,2852,2804,120]},{"type":"call","value":[3052,2852,2804,1460]},{"type":"call","value":[3052,2852,2804,557]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utimes"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1156]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.SetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtSetInformationFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,2896]},{"type":"call","value":[1180,1852,1156,2674]},{"type":"call","value":[1180,1852,1156,2725]},{"type":"call","value":[1180,1852,1156,2613]},{"type":"call","value":[1180,1852,1156,2901]},{"type":"call","value":[1180,1852,1156,2885]},{"type":"call","value":[1180,1852,1156,2640]},{"type":"call","value":[1180,1852,1156,2730]},{"type":"call","value":[1180,1852,1156,2877]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utimes"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1476]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.SetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtSetInformationFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1476,1643]},{"type":"call","value":[1180,1852,1476,1654]},{"type":"call","value":[1180,1852,1476,1620]},{"type":"call","value":[1180,1852,1476,1665]},{"type":"call","value":[1180,1852,1476,1676]},{"type":"call","value":[1180,1852,1476,1687]},{"type":"call","value":[1180,1852,1476,1608]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utimes"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"thread","value":[1180,1852,1020]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.SetFileAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetInformationFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtSetInformationFile"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1020,2666]},{"type":"call","value":[1180,1852,1020,2667]},{"type":"call","value":[1180,1852,1020,2668]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetAttributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetCreationTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastAccessTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::SetLastWriteTimeUtc"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"write","property":"System.IO.FileSystemInfo::Attributes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utime"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"utimes"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create raw socket":{"meta":{"name":"create raw socket","namespace":"communication/socket","authors":["blas.kojusner@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Create Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Create Socket","id":"C0001.003"}],"references":["https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2","https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket","https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketa"],"examples":["10EBCF8C20403457A08762200015B151:0x140001000"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"# generated using capa explorer for IDA Pro\nrule:\n meta:\n name: create raw socket\n namespace: communication/socket\n authors:\n - blas.kojusner@mandiant.com\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Communication::Socket Communication::Create Socket [C0001.003]\n references:\n - https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2\n - https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-socket\n - https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketa\n examples:\n - 10EBCF8C20403457A08762200015B151:0x140001000\n features:\n - and:\n - or:\n - api: socket\n - api: ws2_32.WSASocketA\n - or:\n - number: 2 = AF_INET\n - number: 23 = AF_INET6\n - number: 3 = SOCK_RAW\n","matches":[[{"type":"thread","value":[1180,1852,2828]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":3,"description":"SOCK_RAW"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,1049]},{"type":"call","value":[1180,1852,2828,2365]},{"type":"call","value":[1180,1852,2828,1053]},{"type":"call","value":[1180,1852,2828,2369]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.WSASocketA"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,1050]},{"type":"call","value":[1180,1852,2828,2366]},{"type":"call","value":[1180,1852,2828,4241]},{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"number","number":23,"description":"AF_INET6"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create UDP socket":{"meta":{"name":"create UDP socket","namespace":"communication/socket/udp/send","authors":["moritz.raabe@mandiant.com","joakim@intezer.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Create UDP Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Create UDP Socket","id":"C0001.010"}],"references":[],"examples":["203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: create UDP socket\n namespace: communication/socket/udp/send\n authors:\n - moritz.raabe@mandiant.com\n - joakim@intezer.com\n - michael.hunhoff@mandiant.com\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Communication::Socket Communication::Create UDP Socket [C0001.010]\n examples:\n - 203BD48BCC18434314AD60F4C8BC21E3D3422EB0624B22B827410F9BC63B4082:0x401240\n features:\n - or:\n - and:\n - count(number(2 = AF_INET/SOCK_DGRAM)): 2 or more\n - or:\n - api: ws2_32.socket\n - api: ws2_32.WSASocket\n - api: socket\n - api: System.Net.Sockets.Socket::ctor\n - api: System.Net.Sockets.UdpClient::ctor\n","matches":[[{"type":"thread","value":[1180,1852,2828]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.UdpClient::ctor"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"range","description":"AF_INET/SOCK_DGRAM","min":2,"max":9223372036854775808,"child":{"type":"number","number":2,"description":"AF_INET/SOCK_DGRAM"}}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,1050]},{"type":"call","value":[1180,1852,2828,2366]},{"type":"call","value":[1180,1852,2828,4241]},{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Sockets.Socket::ctor"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create TCP socket":{"meta":{"name":"create TCP socket","namespace":"communication/socket/tcp","authors":["william.ballenthin@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"basic block","dynamic":"thread"},"attack":[],"mbc":[{"parts":["Communication","Socket Communication","Create TCP Socket"],"objective":"Communication","behavior":"Socket Communication","method":"Create TCP Socket","id":"C0001.011"}],"references":[],"examples":["Practical Malware Analysis Lab 01-01.dll_:0x10001010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: create TCP socket\n namespace: communication/socket/tcp\n authors:\n - william.ballenthin@mandiant.com\n - joakim@intezer.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: basic block\n dynamic: thread\n mbc:\n - Communication::Socket Communication::Create TCP Socket [C0001.011]\n examples:\n - Practical Malware Analysis Lab 01-01.dll_:0x10001010\n features:\n - or:\n - and:\n - number: 6 = IPPROTO_TCP\n - number: 1 = SOCK_STREAM\n - number: 2 = AF_INET\n - or:\n - api: ws2_32.socket\n - api: ws2_32.WSASocket\n - api: socket\n - property/read: System.Net.Sockets.TcpClient::Client\n","matches":[[{"type":"thread","value":[1180,1852,2828]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Net.Sockets.TcpClient::Client"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":6,"description":"IPPROTO_TCP"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,2367]},{"type":"call","value":[1180,1852,2828,1051]},{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":1,"description":"SOCK_STREAM"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,4508]},{"type":"call","value":[1180,1852,2828,4334]},{"type":"call","value":[1180,1852,2828,4453]},{"type":"call","value":[1180,1852,2828,4572]},{"type":"call","value":[1180,1852,2828,4517]},{"type":"call","value":[1180,1852,2828,4343]},{"type":"call","value":[1180,1852,2828,4462]},{"type":"call","value":[1180,1852,2828,4526]},{"type":"call","value":[1180,1852,2828,4352]},{"type":"call","value":[1180,1852,2828,4471]},{"type":"call","value":[1180,1852,2828,4416]},{"type":"call","value":[1180,1852,2828,4535]},{"type":"call","value":[1180,1852,2828,4480]},{"type":"call","value":[1180,1852,2828,4544]},{"type":"call","value":[1180,1852,2828,4309]},{"type":"call","value":[1180,1852,2828,4373]},{"type":"call","value":[1180,1852,2828,4318]},{"type":"call","value":[1180,1852,2828,4437]},{"type":"call","value":[1180,1852,2828,4382]},{"type":"call","value":[1180,1852,2828,4501]},{"type":"call","value":[1180,1852,2828,4327]},{"type":"call","value":[1180,1852,2828,4446]},{"type":"call","value":[1180,1852,2828,4565]},{"type":"call","value":[1180,1852,2828,4510]},{"type":"call","value":[1180,1852,2828,4336]},{"type":"call","value":[1180,1852,2828,4455]},{"type":"call","value":[1180,1852,2828,4574]},{"type":"call","value":[1180,1852,2828,4519]},{"type":"call","value":[1180,1852,2828,4345]},{"type":"call","value":[1180,1852,2828,4464]},{"type":"call","value":[1180,1852,2828,4528]},{"type":"call","value":[1180,1852,2828,4473]},{"type":"call","value":[1180,1852,2828,4537]},{"type":"call","value":[1180,1852,2828,4302]},{"type":"call","value":[1180,1852,2828,4366]},{"type":"call","value":[1180,1852,2828,4311]},{"type":"call","value":[1180,1852,2828,4430]},{"type":"call","value":[1180,1852,2828,4375]},{"type":"call","value":[1180,1852,2828,4320]},{"type":"call","value":[1180,1852,2828,4439]},{"type":"call","value":[1180,1852,2828,4384]},{"type":"call","value":[1180,1852,2828,4503]},{"type":"call","value":[1180,1852,2828,4329]},{"type":"call","value":[1180,1852,2828,4448]},{"type":"call","value":[1180,1852,2828,4567]},{"type":"call","value":[1180,1852,2828,4512]},{"type":"call","value":[1180,1852,2828,4338]},{"type":"call","value":[1180,1852,2828,4457]},{"type":"call","value":[1180,1852,2828,4576]},{"type":"call","value":[1180,1852,2828,4521]},{"type":"call","value":[1180,1852,2828,4466]},{"type":"call","value":[1180,1852,2828,4585]},{"type":"call","value":[1180,1852,2828,4530]},{"type":"call","value":[1180,1852,2828,4539]},{"type":"call","value":[1180,1852,2828,4295]},{"type":"call","value":[1180,1852,2828,4304]},{"type":"call","value":[1180,1852,2828,4368]},{"type":"call","value":[1180,1852,2828,4313]},{"type":"call","value":[1180,1852,2828,4432]},{"type":"call","value":[1180,1852,2828,4377]},{"type":"call","value":[1180,1852,2828,4496]},{"type":"call","value":[1180,1852,2828,4322]},{"type":"call","value":[1180,1852,2828,4441]},{"type":"call","value":[1180,1852,2828,4560]},{"type":"call","value":[1180,1852,2828,4386]},{"type":"call","value":[1180,1852,2828,4505]},{"type":"call","value":[1180,1852,2828,4331]},{"type":"call","value":[1180,1852,2828,4450]},{"type":"call","value":[1180,1852,2828,4569]},{"type":"call","value":[1180,1852,2828,4514]},{"type":"call","value":[1180,1852,2828,4459]},{"type":"call","value":[1180,1852,2828,4578]},{"type":"call","value":[1180,1852,2828,4523]},{"type":"call","value":[1180,1852,2828,4468]},{"type":"call","value":[1180,1852,2828,4532]},{"type":"call","value":[1180,1852,2828,4297]},{"type":"call","value":[1180,1852,2828,4361]},{"type":"call","value":[1180,1852,2828,4306]},{"type":"call","value":[1180,1852,2828,4425]},{"type":"call","value":[1180,1852,2828,4370]},{"type":"call","value":[1180,1852,2828,4489]},{"type":"call","value":[1180,1852,2828,4315]},{"type":"call","value":[1180,1852,2828,4434]},{"type":"call","value":[1180,1852,2828,4553]},{"type":"call","value":[1180,1852,2828,4379]},{"type":"call","value":[1180,1852,2828,4498]},{"type":"call","value":[1180,1852,2828,4443]},{"type":"call","value":[1180,1852,2828,4562]},{"type":"call","value":[1180,1852,2828,4388]},{"type":"call","value":[1180,1852,2828,4507]},{"type":"call","value":[1180,1852,2828,4333]},{"type":"call","value":[1180,1852,2828,4452]},{"type":"call","value":[1180,1852,2828,4571]},{"type":"call","value":[1180,1852,2828,4516]},{"type":"call","value":[1180,1852,2828,4461]},{"type":"call","value":[1180,1852,2828,4525]},{"type":"call","value":[1180,1852,2828,4354]},{"type":"call","value":[1180,1852,2828,4299]},{"type":"call","value":[1180,1852,2828,4418]},{"type":"call","value":[1180,1852,2828,4363]},{"type":"call","value":[1180,1852,2828,4482]},{"type":"call","value":[1180,1852,2828,4308]},{"type":"call","value":[1180,1852,2828,4427]},{"type":"call","value":[1180,1852,2828,4546]},{"type":"call","value":[1180,1852,2828,4372]},{"type":"call","value":[1180,1852,2828,4491]},{"type":"call","value":[1180,1852,2828,4317]},{"type":"call","value":[1180,1852,2828,4436]},{"type":"call","value":[1180,1852,2828,4555]},{"type":"call","value":[1180,1852,2828,4381]},{"type":"call","value":[1180,1852,2828,4500]},{"type":"call","value":[1180,1852,2828,4445]},{"type":"call","value":[1180,1852,2828,4564]},{"type":"call","value":[1180,1852,2828,4509]},{"type":"call","value":[1180,1852,2828,4454]},{"type":"call","value":[1180,1852,2828,4573]},{"type":"call","value":[1180,1852,2828,4518]},{"type":"call","value":[1180,1852,2828,4347]},{"type":"call","value":[1180,1852,2828,4356]},{"type":"call","value":[1180,1852,2828,4475]},{"type":"call","value":[1180,1852,2828,4301]},{"type":"call","value":[1180,1852,2828,4420]},{"type":"call","value":[1180,1852,2828,4365]},{"type":"call","value":[1180,1852,2828,4484]},{"type":"call","value":[1180,1852,2828,4310]},{"type":"call","value":[1180,1852,2828,4429]},{"type":"call","value":[1180,1852,2828,4548]},{"type":"call","value":[1180,1852,2828,4374]},{"type":"call","value":[1180,1852,2828,4493]},{"type":"call","value":[1180,1852,2828,4319]},{"type":"call","value":[1180,1852,2828,4438]},{"type":"call","value":[1180,1852,2828,4557]},{"type":"call","value":[1180,1852,2828,4383]},{"type":"call","value":[1180,1852,2828,4502]},{"type":"call","value":[1180,1852,2828,4447]},{"type":"call","value":[1180,1852,2828,4566]},{"type":"call","value":[1180,1852,2828,4511]},{"type":"call","value":[1180,1852,2828,4575]},{"type":"call","value":[1180,1852,2828,4340]},{"type":"call","value":[1180,1852,2828,4349]},{"type":"call","value":[1180,1852,2828,4294]},{"type":"call","value":[1180,1852,2828,4413]},{"type":"call","value":[1180,1852,2828,4358]},{"type":"call","value":[1180,1852,2828,4477]},{"type":"call","value":[1180,1852,2828,4303]},{"type":"call","value":[1180,1852,2828,4422]},{"type":"call","value":[1180,1852,2828,4541]},{"type":"call","value":[1180,1852,2828,4367]},{"type":"call","value":[1180,1852,2828,4312]},{"type":"call","value":[1180,1852,2828,4431]},{"type":"call","value":[1180,1852,2828,4550]},{"type":"call","value":[1180,1852,2828,4376]},{"type":"call","value":[1180,1852,2828,4495]},{"type":"call","value":[1180,1852,2828,4440]},{"type":"call","value":[1180,1852,2828,4559]},{"type":"call","value":[1180,1852,2828,4504]},{"type":"call","value":[1180,1852,2828,4449]},{"type":"call","value":[1180,1852,2828,4568]},{"type":"call","value":[1180,1852,2828,4513]},{"type":"call","value":[1180,1852,2828,4577]},{"type":"call","value":[1180,1852,2828,4342]},{"type":"call","value":[1180,1852,2828,4351]},{"type":"call","value":[1180,1852,2828,4470]},{"type":"call","value":[1180,1852,2828,4296]},{"type":"call","value":[1180,1852,2828,4415]},{"type":"call","value":[1180,1852,2828,4534]},{"type":"call","value":[1180,1852,2828,4360]},{"type":"call","value":[1180,1852,2828,4479]},{"type":"call","value":[1180,1852,2828,4305]},{"type":"call","value":[1180,1852,2828,4424]},{"type":"call","value":[1180,1852,2828,4543]},{"type":"call","value":[1180,1852,2828,4369]},{"type":"call","value":[1180,1852,2828,4314]},{"type":"call","value":[1180,1852,2828,4433]},{"type":"call","value":[1180,1852,2828,4552]},{"type":"call","value":[1180,1852,2828,4378]},{"type":"call","value":[1180,1852,2828,4497]},{"type":"call","value":[1180,1852,2828,4442]},{"type":"call","value":[1180,1852,2828,4561]},{"type":"call","value":[1180,1852,2828,4506]},{"type":"call","value":[1180,1852,2828,4570]},{"type":"call","value":[1180,1852,2828,4335]},{"type":"call","value":[1180,1852,2828,4344]},{"type":"call","value":[1180,1852,2828,4463]},{"type":"call","value":[1180,1852,2828,4527]},{"type":"call","value":[1180,1852,2828,4353]},{"type":"call","value":[1180,1852,2828,4472]},{"type":"call","value":[1180,1852,2828,4298]},{"type":"call","value":[1180,1852,2828,4417]},{"type":"call","value":[1180,1852,2828,4536]},{"type":"call","value":[1180,1852,2828,4362]},{"type":"call","value":[1180,1852,2828,4481]},{"type":"call","value":[1180,1852,2828,4307]},{"type":"call","value":[1180,1852,2828,4426]},{"type":"call","value":[1180,1852,2828,4545]},{"type":"call","value":[1180,1852,2828,4371]},{"type":"call","value":[1180,1852,2828,4490]},{"type":"call","value":[1180,1852,2828,4435]},{"type":"call","value":[1180,1852,2828,4554]},{"type":"call","value":[1180,1852,2828,4499]},{"type":"call","value":[1180,1852,2828,4563]},{"type":"call","value":[1180,1852,2828,4328]},{"type":"call","value":[1180,1852,2828,4337]},{"type":"call","value":[1180,1852,2828,4456]},{"type":"call","value":[1180,1852,2828,4520]},{"type":"call","value":[1180,1852,2828,4346]},{"type":"call","value":[1180,1852,2828,4465]},{"type":"call","value":[1180,1852,2828,4529]},{"type":"call","value":[1180,1852,2828,4355]},{"type":"call","value":[1180,1852,2828,4474]},{"type":"call","value":[1180,1852,2828,4300]},{"type":"call","value":[1180,1852,2828,4419]},{"type":"call","value":[1180,1852,2828,4538]},{"type":"call","value":[1180,1852,2828,4364]},{"type":"call","value":[1180,1852,2828,4483]},{"type":"call","value":[1180,1852,2828,4428]},{"type":"call","value":[1180,1852,2828,4547]},{"type":"call","value":[1180,1852,2828,4492]},{"type":"call","value":[1180,1852,2828,4556]},{"type":"call","value":[1180,1852,2828,4321]},{"type":"call","value":[1180,1852,2828,4385]},{"type":"call","value":[1180,1852,2828,4330]},{"type":"call","value":[1180,1852,2828,4339]},{"type":"call","value":[1180,1852,2828,4458]},{"type":"call","value":[1180,1852,2828,4522]},{"type":"call","value":[1180,1852,2828,4348]},{"type":"call","value":[1180,1852,2828,4467]},{"type":"call","value":[1180,1852,2828,4293]},{"type":"call","value":[1180,1852,2828,4412]},{"type":"call","value":[1180,1852,2828,4531]},{"type":"call","value":[1180,1852,2828,4357]},{"type":"call","value":[1180,1852,2828,4476]},{"type":"call","value":[1180,1852,2828,4421]},{"type":"call","value":[1180,1852,2828,4540]},{"type":"call","value":[1180,1852,2828,4549]},{"type":"call","value":[1180,1852,2828,4494]},{"type":"call","value":[1180,1852,2828,4558]},{"type":"call","value":[1180,1852,2828,4387]},{"type":"call","value":[1180,1852,2828,4332]},{"type":"call","value":[1180,1852,2828,4451]},{"type":"call","value":[1180,1852,2828,4515]},{"type":"call","value":[1180,1852,2828,4341]},{"type":"call","value":[1180,1852,2828,4460]},{"type":"call","value":[1180,1852,2828,2364]},{"type":"call","value":[1180,1852,2828,4350]},{"type":"call","value":[1180,1852,2828,4469]},{"type":"call","value":[1180,1852,2828,4524]},{"type":"call","value":[1180,1852,2828,4414]},{"type":"call","value":[1180,1852,2828,4533]},{"type":"call","value":[1180,1852,2828,4359]},{"type":"call","value":[1180,1852,2828,4478]},{"type":"call","value":[1180,1852,2828,4423]},{"type":"call","value":[1180,1852,2828,4542]},{"type":"call","value":[1180,1852,2828,4551]},{"type":"call","value":[1180,1852,2828,4316]},{"type":"call","value":[1180,1852,2828,4380]},{"type":"call","value":[1180,1852,2828,4444]},{"type":"call","value":[1180,1852,2828,4389]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,1050]},{"type":"call","value":[1180,1852,2828,2366]},{"type":"call","value":[1180,1852,2828,4241]},{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.socket"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.WSASocket"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"socket"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2828,4585]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get system information on Windows":{"meta":{"name":"get system information on Windows","namespace":"host-interaction/os/info","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[],"references":[],"examples":["563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: get system information on Windows\n namespace: host-interaction/os/info\n authors:\n - moritz.raabe@mandiant.com\n - joakim@intezer.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Discovery::System Information Discovery [T1082]\n examples:\n - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140002280\n features:\n - and:\n - os: windows\n - or:\n - api: kernel32.GetSystemInfo\n - api: kernel32.GetNativeSystemInfo\n - api: NtQuerySystemInformation\n - api: NtQuerySystemInformationEx\n - api: ntdll.RtlGetNativeSystemInformation\n - api: ZwQuerySystemInformation\n - api: ZwQuerySystemInformationEx\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetNativeSystemInfo"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformation"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,484]},{"type":"call","value":[2456,3052,3064,481]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ntdll.RtlGetNativeSystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformation"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQuerySystemInformationEx"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"create or open section object":{"meta":{"name":"create or open section object","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[],"mbc":[],"references":[],"examples":["daa13ae302fe8b618ddbf590537443ef:0x401116"],"description":"","lib":true,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: create or open section object\n authors:\n - william.ballenthin@mandiant.com\n lib: 'true'\n scopes:\n static: function\n dynamic: process\n examples:\n - daa13ae302fe8b618ddbf590537443ef:0x401116\n features:\n - and:\n - os: windows\n - or:\n - api: NtCreateSection\n - api: ZwCreateSection\n - api: NtOpenSection\n - api: ZwOpenSection\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateSection"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,371]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"read file on Windows":{"meta":{"name":"read file on Windows","namespace":"host-interaction/file-system/read","authors":["moritz.raabe@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[],"mbc":[{"parts":["File System","Read File"],"objective":"File System","behavior":"Read File","method":"","id":"C0051"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: read file on Windows\n namespace: host-interaction/file-system/read\n authors:\n - moritz.raabe@mandiant.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: function\n dynamic: process\n mbc:\n - File System::Read File [C0051]\n examples:\n - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314567B\n features:\n - or:\n - and:\n - os: windows\n - optional:\n - and:\n - number: 0x80000000 = GENERIC_READ\n - match: create or open file\n - or:\n - api: kernel32.ReadFile\n - api: ReadFileEx\n - api: NtReadFile\n - api: ZwReadFile\n - api: LZRead\n - api: _read\n - api: fread\n - api: System.IO.File::ReadAllBytes\n - api: System.IO.File::ReadAllBytesAsync\n - api: System.IO.File::ReadAllLines\n - api: System.IO.File::ReadAllLinesAsync\n - api: System.IO.File::ReadAllText\n - api: System.IO.File::ReadAllTextAsync\n - api: System.IO.File::ReadLines\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::ReadLines"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":2147483648,"description":"GENERIC_READ"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,916]},{"type":"call","value":[2456,3052,2792,911]},{"type":"call","value":[2456,3052,2792,903]},{"type":"call","value":[2456,3052,2792,898]},{"type":"call","value":[2456,3052,2792,893]},{"type":"call","value":[2456,3052,2792,888]},{"type":"call","value":[2456,3052,2792,883]},{"type":"call","value":[2456,3052,2792,907]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,782]},{"type":"call","value":[2456,3052,3064,716]},{"type":"call","value":[2456,3052,3064,739]},{"type":"call","value":[2456,3052,3064,751]},{"type":"call","value":[2456,3052,3064,730]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,370]},{"type":"call","value":[2456,3052,3064,804]},{"type":"call","value":[2456,3052,3064,813]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2456,3052,2792]},{"type":"thread","value":[2456,3052,3064]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.ReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ReadFileEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtReadFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,816]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwReadFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZRead"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_read"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fread"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"write file on Windows":{"meta":{"name":"write file on Windows","namespace":"host-interaction/file-system/write","authors":["william.ballenthin@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[],"mbc":[{"parts":["File System","Writes File"],"objective":"File System","behavior":"Writes File","method":"","id":"C0052"}],"references":[],"examples":["Practical Malware Analysis Lab 01-04.exe_:0x4011FC","563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: write file on Windows\n namespace: host-interaction/file-system/write\n authors:\n - william.ballenthin@mandiant.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: function\n dynamic: process\n mbc:\n - File System::Writes File [C0052]\n examples:\n - Practical Malware Analysis Lab 01-04.exe_:0x4011FC\n # ntdll\n - 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x1400025C4\n features:\n - or:\n - and:\n - os: windows\n - optional:\n - or:\n - basic block:\n - or:\n - number: 0x40000000 = GENERIC_WRITE\n - number: 0x2 = FILE_WRITE_DATA\n - match: create or open file\n - thread:\n - or:\n - number: 0x40000000 = GENERIC_WRITE\n - number: 0x2 = FILE_WRITE_DATA\n - match: create or open file\n - or:\n - api: kernel32.WriteFile\n - api: kernel32.WriteFileEx\n - api: NtWriteFile\n - api: ZwWriteFile\n - api: _fwrite\n - api: fwrite\n - api: System.IO.File::WriteAllBytes\n - api: System.IO.File::WriteAllBytesAsync\n - api: System.IO.File::WriteAllLines\n - api: System.IO.File::WriteAllLinesAsync\n - api: System.IO.File::WriteAllText\n - api: System.IO.File::WriteAllTextAsync\n - api: System.IO.File::AppendAllLines\n - api: System.IO.File::AppendAllLinesAsync\n - api: System.IO.File::AppendAllText\n - api: System.IO.File::AppendAllTextAsync\n - api: System.IO.File::AppendText\n - api: System.IO.FileInfo::AppendText\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytes"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllBytesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::WriteAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLines"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllLinesAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendAllTextAsync"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.File::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.IO.FileInfo::AppendText"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"write file on Windows/d45b98346a26410b86a0189a2e52b6df"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"subscope","scope":"thread"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,866]},{"type":"call","value":[2456,3052,2792,834]},{"type":"call","value":[2456,3052,2792,850]},{"type":"call","value":[2456,3052,2792,828]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,916]},{"type":"call","value":[2456,3052,2792,911]},{"type":"call","value":[2456,3052,2792,903]},{"type":"call","value":[2456,3052,2792,898]},{"type":"call","value":[2456,3052,2792,893]},{"type":"call","value":[2456,3052,2792,888]},{"type":"call","value":[2456,3052,2792,883]},{"type":"call","value":[2456,3052,2792,907]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2456,3052,2792]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":1073741824,"description":"GENERIC_WRITE"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"FILE_WRITE_DATA"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,372]},{"type":"call","value":[2456,3052,3064,279]},{"type":"call","value":[2456,3052,3064,274]},{"type":"call","value":[2456,3052,3064,280]},{"type":"call","value":[2456,3052,3064,275]},{"type":"call","value":[2456,3052,3064,277]},{"type":"call","value":[2456,3052,3064,363]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open file"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"CreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"IoCreateFileEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,782]},{"type":"call","value":[2456,3052,3064,716]},{"type":"call","value":[2456,3052,3064,739]},{"type":"call","value":[2456,3052,3064,751]},{"type":"call","value":[2456,3052,3064,730]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,370]},{"type":"call","value":[2456,3052,3064,804]},{"type":"call","value":[2456,3052,3064,813]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZCreateFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"LZOpenFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fopen64"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fdopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"freopen"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"open"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"openat"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2456,3052,3064]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2456,3052,2792]},{"type":"thread","value":[2456,3052,3064]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.WriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.WriteFileEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtWriteFile"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,805]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwWriteFile"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"_fwrite"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"fwrite"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry value":{"meta":{"name":"query or enumerate registry value","namespace":"host-interaction/registry","authors":["william.ballenthin@mandiant.com","michael.hunhoff@mandiant.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Value"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Value","id":"C0036.006"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A","Practical Malware Analysis Lab 03-02.dll_:0x100047AD"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: query or enumerate registry value\n namespace: host-interaction/registry\n authors:\n - william.ballenthin@mandiant.com\n - michael.hunhoff@mandiant.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Discovery::Query Registry [T1012]\n mbc:\n - Operating System::Registry::Query Registry Value [C0036.006]\n examples:\n - BFB9B5391A13D0AFD787E87AB90F14F5:0x13145B5A\n - Practical Malware Analysis Lab 03-02.dll_:0x100047AD\n features:\n - and:\n - optional:\n - match: create or open registry key\n - or:\n - api: advapi32.RegGetValue\n - api: advapi32.RegEnumValue\n - api: advapi32.RegQueryValue\n - api: advapi32.RegQueryValueEx\n - api: advapi32.RegQueryMultipleValues\n - api: ZwQueryValueKey\n - api: ZwEnumerateValueKey\n - api: NtQueryValueKey\n - api: NtEnumerateValueKey\n - api: RtlQueryRegistryValues\n - api: SHGetValue\n - api: SHEnumValue\n - api: SHRegGetInt\n - api: SHRegGetPath\n - api: SHRegGetValue\n - api: SHQueryValueEx\n - api: SHRegGetUSValue\n - api: SHOpenRegStream\n - api: SHRegEnumUSValue\n - api: SHOpenRegStream2\n - api: SHRegQueryUSValue\n - api: SHRegGetBoolUSValue\n - api: SHRegGetValueFromHKCUHKLM\n - api: SHRegGetBoolValueFromHKCUHKLM\n - api: Microsoft.Win32.RegistryKey::GetValue\n - api: Microsoft.Win32.RegistryKey::GetValueKind\n - api: Microsoft.Win32.RegistryKey::GetValueNames\n - api: Microsoft.Win32.Registry::GetValue\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,46]},{"type":"call","value":[2456,3052,3064,1022]},{"type":"call","value":[2456,3052,3064,32]},{"type":"call","value":[2456,3052,3064,47]},{"type":"call","value":[2456,3052,3064,48]},{"type":"call","value":[2456,3052,3064,43]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2456,3052,3064]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,366]},{"type":"call","value":[2456,3052,3064,49]},{"type":"call","value":[2456,3052,3064,44]},{"type":"call","value":[2456,3052,3064,50]},{"type":"call","value":[2456,3052,3064,145]},{"type":"call","value":[2456,3052,3064,1023]},{"type":"call","value":[2456,3052,3064,37]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[3052,2192]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,35]},{"type":"call","value":[3052,2192,2204,1206]},{"type":"call","value":[3052,2192,2204,39]},{"type":"call","value":[3052,2192,2204,40]},{"type":"call","value":[3052,2192,2204,32]},{"type":"call","value":[3052,2192,2204,38]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[3052,2192,2204]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[3052,2192,2204,41]},{"type":"call","value":[3052,2192,2204,36]},{"type":"call","value":[3052,2192,2204,359]},{"type":"call","value":[3052,2192,2204,137]},{"type":"call","value":[3052,2192,2204,42]},{"type":"call","value":[3052,2192,2204,1207]},{"type":"call","value":[3052,2192,2204,33]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[3052,1180]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,742]},{"type":"call","value":[3052,1180,500,31]},{"type":"call","value":[3052,1180,500,39]},{"type":"call","value":[3052,1180,500,34]},{"type":"call","value":[3052,1180,500,37]},{"type":"call","value":[3052,1180,500,38]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[3052,1180,500]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[3052,1180,500,40]},{"type":"call","value":[3052,1180,500,35]},{"type":"call","value":[3052,1180,500,41]},{"type":"call","value":[3052,1180,500,136]},{"type":"call","value":[3052,1180,500,358]},{"type":"call","value":[3052,1180,500,743]},{"type":"call","value":[3052,1180,500,32]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[3052,2852]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,63]},{"type":"call","value":[3052,2852,2804,58]},{"type":"call","value":[3052,2852,2804,55]},{"type":"call","value":[3052,2852,2804,61]},{"type":"call","value":[3052,2852,2804,1957]},{"type":"call","value":[3052,2852,2804,62]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[3052,2852,2804]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[3052,2852,2804,80]},{"type":"call","value":[3052,2852,2804,56]},{"type":"call","value":[3052,2852,2804,1]},{"type":"call","value":[3052,2852,2804,64]},{"type":"call","value":[3052,2852,2804,59]},{"type":"call","value":[3052,2852,2804,65]},{"type":"call","value":[3052,2852,2804,1958]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[2852,2900]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,85]},{"type":"call","value":[2852,2900,2904,200]},{"type":"call","value":[2852,2900,2904,43]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2852,2900,2904]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,201]},{"type":"call","value":[2852,2900,2904,16]},{"type":"call","value":[2852,2900,2904,44]},{"type":"call","value":[2852,2900,2904,86]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1180,1852]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,2351]},{"type":"call","value":[1180,1852,1156,3679]},{"type":"call","value":[1180,1852,1156,2573]},{"type":"call","value":[1180,1852,1156,4964]},{"type":"call","value":[1180,1852,1156,4956]},{"type":"call","value":[1180,1852,1156,2567]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1181]},{"type":"call","value":[1180,1852,236,1160]},{"type":"call","value":[1180,1852,236,1133]},{"type":"call","value":[1180,1852,236,1173]},{"type":"call","value":[1180,1852,236,1113]},{"type":"call","value":[1180,1852,236,1121]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,45]},{"type":"call","value":[1180,1852,920,42]},{"type":"call","value":[1180,1852,920,32]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1180,1852,1156]},{"type":"thread","value":[1180,1852,236]},{"type":"thread","value":[1180,1852,920]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,43]},{"type":"call","value":[1180,1852,920,72]},{"type":"call","value":[1180,1852,920,33]},{"type":"call","value":[1180,1852,1156,2568]},{"type":"call","value":[1180,1852,920,46]},{"type":"call","value":[1180,1852,764,591]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1200,1248]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1560,6276]},{"type":"call","value":[1200,1248,1560,6255]},{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,1560,6280]},{"type":"call","value":[1200,1248,1560,6254]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1200,1248,1560]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6252]},{"type":"call","value":[1200,1248,1560,6258]},{"type":"call","value":[1200,1248,1560,6283]},{"type":"call","value":[1200,1248,1560,6277]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1852,2420]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2420,2524,32]},{"type":"call","value":[1852,2420,2524,24]},{"type":"call","value":[1852,2420,2524,30]},{"type":"call","value":[1852,2420,2524,27]},{"type":"call","value":[1852,2420,2524,31]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1852,2420,2524]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1852,2420,2524,129]},{"type":"call","value":[1852,2420,2524,34]},{"type":"call","value":[1852,2420,2524,25]},{"type":"call","value":[1852,2420,2524,33]},{"type":"call","value":[1852,2420,2524,28]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[2820,2360]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2820,2360,1788,165]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2820,2360,1788]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[2820,2360,1788,166]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1852,2724]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,26]},{"type":"call","value":[1852,2724,1816,44]},{"type":"call","value":[1852,2724,1816,95]},{"type":"call","value":[1852,2724,1816,969]},{"type":"call","value":[1852,2724,1816,77]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1852,2724,1816]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,96]},{"type":"call","value":[1852,2724,1816,970]},{"type":"call","value":[1852,2724,1816,45]},{"type":"call","value":[1852,2724,1816,18]},{"type":"call","value":[1852,2724,1816,35]},{"type":"call","value":[1852,2724,1816,27]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1852,2800]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,36]},{"type":"call","value":[1852,2800,640,87]},{"type":"call","value":[1852,2800,640,1236]},{"type":"call","value":[1852,2800,640,69]},{"type":"call","value":[1852,2800,640,17]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1852,2800,640]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,37]},{"type":"call","value":[1852,2800,640,27]},{"type":"call","value":[1852,2800,640,11]},{"type":"call","value":[1852,2800,640,88]},{"type":"call","value":[1852,2800,640,1237]},{"type":"call","value":[1852,2800,640,18]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1852,2744]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,37]},{"type":"call","value":[1852,2744,2916,38]},{"type":"call","value":[1852,2744,2916,732]},{"type":"call","value":[1852,2744,2916,31]},{"type":"call","value":[1852,2744,2916,39]},{"type":"call","value":[1852,2744,2916,34]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1852,2744,2916]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1852,2744,2916,32]},{"type":"call","value":[1852,2744,2916,358]},{"type":"call","value":[1852,2744,2916,40]},{"type":"call","value":[1852,2744,2916,35]},{"type":"call","value":[1852,2744,2916,41]},{"type":"call","value":[1852,2744,2916,136]},{"type":"call","value":[1852,2744,2916,733]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1852,500]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1852,500,240,31]},{"type":"call","value":[1852,500,240,32]},{"type":"call","value":[1852,500,240,27]},{"type":"call","value":[1852,500,240,24]},{"type":"call","value":[1852,500,240,30]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1852,500,240]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[1852,500,240,28]},{"type":"call","value":[1852,500,240,34]},{"type":"call","value":[1852,500,240,129]},{"type":"call","value":[1852,500,240,25]},{"type":"call","value":[1852,500,240,33]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[2820,1572]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2804,1016]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[2820,1572,2804]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryMultipleValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryValueKey"}},"children":[],"locations":[{"type":"call","value":[2820,1572,2804,1017]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateValueKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlQueryRegistryValues"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetInt"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHOpenRegStream2"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegGetBoolValueFromHKCUHKLM"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueKind"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetValueNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::GetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"map section object":{"meta":{"name":"map section object","namespace":"host-interaction/process","authors":["william.ballenthin@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[],"mbc":[],"references":[],"examples":["61908f4d70ce6f16173e76aa42a8c25a:0x4018F0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: map section object\n namespace: host-interaction/process\n authors:\n - william.ballenthin@mandiant.com\n scopes:\n static: function\n dynamic: process\n examples:\n - 61908f4d70ce6f16173e76aa42a8c25a:0x4018F0\n features:\n - and:\n - os: windows\n - or:\n - api: NtMapViewOfSection\n - api: ZwMapViewOfSection\n - optional:\n - api: NtUnmapViewOfSection\n - api: ZwUnmapViewOfSection\n - match: create or open section object\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtMapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,372]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwMapViewOfSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtUnmapViewOfSection"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,961]},{"type":"call","value":[2456,3052,3064,940]},{"type":"call","value":[2456,3052,3064,959]},{"type":"call","value":[2456,3052,3064,1015]},{"type":"call","value":[2456,3052,3064,1013]},{"type":"call","value":[2456,3052,3064,993]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwUnmapViewOfSection"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open section object"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"os","os":"windows"}},"children":[],"locations":[{"type":"no address"}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateSection"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,371]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenSection"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenSection"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"process","value":[2456,3052]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"persist via Run registry key":{"meta":{"name":"persist via Run registry key","namespace":"persistence/registry/run","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Persistence","Boot or Logon Autostart Execution","Registry Run Keys / Startup Folder"],"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","subtechnique":"Registry Run Keys / Startup Folder","id":"T1547.001"}],"mbc":[{"parts":["Persistence","Registry Run Keys / Startup Folder"],"objective":"Persistence","behavior":"Registry Run Keys / Startup Folder","method":"","id":"F0012"}],"references":[],"examples":["Practical Malware Analysis Lab 06-03.exe_:0x401130","b87e9dd18a5533a09d3e48a7a1efbcf6:0x1400070E0","9ff8e68343cc29c1036650fc153e69f7:0x470624"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: persist via Run registry key\n namespace: persistence/registry/run\n authors:\n - moritz.raabe@mandiant.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Persistence::Boot or Logon Autostart Execution::Registry Run Keys / Startup Folder [T1547.001]\n mbc:\n - Persistence::Registry Run Keys / Startup Folder [F0012]\n examples:\n - Practical Malware Analysis Lab 06-03.exe_:0x401130\n - b87e9dd18a5533a09d3e48a7a1efbcf6:0x1400070E0\n - 9ff8e68343cc29c1036650fc153e69f7:0x470624\n features:\n - and:\n - or:\n - match: set registry value\n - number: 0x80000001 = HKEY_CURRENT_USER\n - number: 0x80000002 = HKEY_LOCAL_MACHINE\n - or:\n - and:\n - string: /Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i\n - or:\n - string: /Run/i\n - string: /Explorer\\\\Shell Folders/i\n - string: /User Shell Folders/i\n - string: /RunServices/i\n - string: /Policies\\\\Explorer\\\\Run/i\n - string: /Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i\n - string: /System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i\n","matches":[[{"type":"process","value":[2456,3052]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"set registry value"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147483649,"description":"HKEY_CURRENT_USER"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,861]},{"type":"call","value":[2456,3052,2792,856]},{"type":"call","value":[2456,3052,2792,845]},{"type":"call","value":[2456,3052,2792,877]},{"type":"call","value":[2456,3052,2792,872]},{"type":"call","value":[2456,3052,2792,840]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147483650,"description":"HKEY_LOCAL_MACHINE"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,721]},{"type":"call","value":[2456,3052,3064,711]},{"type":"call","value":[2456,3052,3064,734]},{"type":"call","value":[2456,3052,3064,775]},{"type":"call","value":[2456,3052,3064,823]},{"type":"call","value":[2456,3052,3064,746]},{"type":"call","value":[2456,3052,3064,758]},{"type":"call","value":[2456,3052,3064,765]},{"type":"call","value":[2456,3052,3064,725]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i"}},"children":[],"locations":[{"type":"call","value":[2456,3052,2792,861]},{"type":"call","value":[2456,3052,2792,864]},{"type":"call","value":[2456,3052,3064,823]},{"type":"call","value":[2456,3052,2792,873]},{"type":"call","value":[2456,3052,2792,841]},{"type":"call","value":[2456,3052,2792,856]},{"type":"call","value":[2456,3052,2792,859]},{"type":"call","value":[2456,3052,2792,862]},{"type":"call","value":[2456,3052,2792,845]},{"type":"call","value":[2456,3052,2792,880]},{"type":"call","value":[2456,3052,2792,848]},{"type":"call","value":[2456,3052,2792,877]},{"type":"call","value":[2456,3052,2792,857]},{"type":"call","value":[2456,3052,2792,840]},{"type":"call","value":[2456,3052,2792,875]},{"type":"call","value":[2456,3052,2792,843]},{"type":"call","value":[2456,3052,2792,872]},{"type":"call","value":[2456,3052,2792,878]},{"type":"call","value":[2456,3052,2792,846]}],"captures":{"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\0000A65749F5902C4D82.exe":[{"type":"call","value":[2456,3052,3064,823]}],"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\0000A65749F5902C4D82.exe":[{"type":"call","value":[2456,3052,3064,823]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume":[{"type":"call","value":[2456,3052,2792,861]},{"type":"call","value":[2456,3052,2792,856]},{"type":"call","value":[2456,3052,2792,845]},{"type":"call","value":[2456,3052,2792,877]},{"type":"call","value":[2456,3052,2792,872]},{"type":"call","value":[2456,3052,2792,840]}],"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume":[{"type":"call","value":[2456,3052,2792,861]},{"type":"call","value":[2456,3052,2792,856]},{"type":"call","value":[2456,3052,2792,845]},{"type":"call","value":[2456,3052,2792,877]},{"type":"call","value":[2456,3052,2792,872]},{"type":"call","value":[2456,3052,2792,840]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\":[{"type":"call","value":[2456,3052,2792,841]},{"type":"call","value":[2456,3052,2792,846]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\Data":[{"type":"call","value":[2456,3052,2792,843]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3479-f160-11ea-9f0e-806e6f6e6963}\\Generation":[{"type":"call","value":[2456,3052,2792,848]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\":[{"type":"call","value":[2456,3052,2792,862]},{"type":"call","value":[2456,3052,2792,857]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\Data":[{"type":"call","value":[2456,3052,2792,859]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3475-f160-11ea-9f0e-806e6f6e6963}\\Generation":[{"type":"call","value":[2456,3052,2792,864]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\":[{"type":"call","value":[2456,3052,2792,878]},{"type":"call","value":[2456,3052,2792,873]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\Data":[{"type":"call","value":[2456,3052,2792,875]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{5f0c3476-f160-11ea-9f0e-806e6f6e6963}\\Generation":[{"type":"call","value":[2456,3052,2792,880]}]}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Run/i"}},"children":[],"locations":[{"type":"call","value":[2456,3052,3064,816]},{"type":"call","value":[2456,3052,3064,115]}],"captures":{"SplDriverUnloadComplete":[{"type":"call","value":[2456,3052,3064,115]}],"MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x0e\\x1f\\xba\\x0e\\x00\\xb4\t\\xcd!\\xb8\\x01L\\xcd!This program cannot be run in DOS mode.\r\r\n$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PE\\x00\\x00L\\x01\\x04\\x00 \\xe61[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x00\\x02\\x01\\x0b\\x01\\x0c\\x00\\x00@\\x00\\x00\\x00P\\x08\\x00\\x00\\x00\\x00\\x00\\xe0'\\x00\\x00\\x00\\x10\\x00\\x00\\x00P\\x00\\x00\\x00\\x00@\\x00\\x00\\x10\\x00\\x00\\x00\\x10\\x00\\x00":[{"type":"call","value":[2456,3052,3064,816]}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Explorer\\\\Shell Folders/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/User Shell Folders/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/RunServices/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Policies\\\\Explorer\\\\Run/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1180,1852]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"set registry value"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147483649,"description":"HKEY_CURRENT_USER"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,236,1217]},{"type":"call","value":[1180,1852,1028,946]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2147483650,"description":"HKEY_LOCAL_MACHINE"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1406]},{"type":"call","value":[1180,1852,236,1390]},{"type":"call","value":[1180,1852,920,35]},{"type":"call","value":[1180,1852,1020,2687]},{"type":"call","value":[1180,1852,920,9]},{"type":"call","value":[1180,1852,236,1441]},{"type":"call","value":[1180,1852,236,1171]},{"type":"call","value":[1180,1852,236,1450]},{"type":"call","value":[1180,1852,236,1395]},{"type":"call","value":[1180,1852,920,40]},{"type":"call","value":[1180,1852,236,1432]},{"type":"call","value":[1180,1852,1020,2669]},{"type":"call","value":[1180,1852,1020,3073]},{"type":"call","value":[1180,1852,1156,807]},{"type":"call","value":[1180,1852,1156,797]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Software\\\\Microsoft\\\\Windows\\\\CurrentVersion/i"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1028,4875]},{"type":"call","value":[1180,1852,236,1403]},{"type":"call","value":[1180,1852,236,1464]},{"type":"call","value":[1180,1852,236,1470]},{"type":"call","value":[1180,1852,236,1354]},{"type":"call","value":[1180,1852,236,1467]},{"type":"call","value":[1180,1852,236,1357]},{"type":"call","value":[1180,1852,1028,2007]},{"type":"call","value":[1180,1852,236,1360]},{"type":"call","value":[1180,1852,920,40]},{"type":"call","value":[1180,1852,236,1363]},{"type":"call","value":[1180,1852,236,1430]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,236,1439]},{"type":"call","value":[1180,1852,236,1448]},{"type":"call","value":[1180,1852,1028,3483]},{"type":"call","value":[1180,1852,236,1219]},{"type":"call","value":[1180,1852,236,1466]},{"type":"call","value":[1180,1852,236,1472]},{"type":"call","value":[1180,1852,236,1405]},{"type":"call","value":[1180,1852,236,1356]},{"type":"call","value":[1180,1852,236,1359]},{"type":"call","value":[1180,1852,236,1362]},{"type":"call","value":[1180,1852,236,1365]},{"type":"call","value":[1180,1852,1028,947]},{"type":"call","value":[1180,1852,236,1429]},{"type":"call","value":[1180,1852,236,1438]},{"type":"call","value":[1180,1852,236,1447]},{"type":"call","value":[1180,1852,236,1221]},{"type":"call","value":[1180,1852,236,1218]},{"type":"call","value":[1180,1852,236,1404]},{"type":"call","value":[1180,1852,236,1465]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,236,1352]},{"type":"call","value":[1180,1852,236,1355]},{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,920,35]},{"type":"call","value":[1180,1852,236,1364]},{"type":"call","value":[1180,1852,920,38]},{"type":"call","value":[1180,1852,236,1431]},{"type":"call","value":[1180,1852,1028,946]},{"type":"call","value":[1180,1852,236,1440]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,236,1449]},{"type":"call","value":[1180,1852,236,1217]},{"type":"call","value":[1180,1852,236,1220]}],"captures":{"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup":[{"type":"call","value":[1180,1852,920,35]}],"Software\\Microsoft\\Windows\\CurrentVersion\\Setup":[{"type":"call","value":[1180,1852,920,35]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath":[{"type":"call","value":[1180,1852,920,38]}],"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion":[{"type":"call","value":[1180,1852,920,40]}],"Software\\Microsoft\\Windows\\CurrentVersion":[{"type":"call","value":[1180,1852,920,40]}],"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run":[{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,1028,946]}],"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run":[{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,1028,946]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\yfeaxxbea":[{"type":"call","value":[1180,1852,1028,947]},{"type":"call","value":[1180,1852,1028,4875]},{"type":"call","value":[1180,1852,1028,2007]},{"type":"call","value":[1180,1852,1028,3483]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad":[{"type":"call","value":[1180,1852,236,1217]}],"Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Wpad":[{"type":"call","value":[1180,1852,236,1217]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}":[{"type":"call","value":[1180,1852,236,1352]},{"type":"call","value":[1180,1852,236,1218]},{"type":"call","value":[1180,1852,236,1359]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\WpadLastNetwork":[{"type":"call","value":[1180,1852,236,1472]},{"type":"call","value":[1180,1852,236,1219]},{"type":"call","value":[1180,1852,236,1220]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoProxyDetectType":[{"type":"call","value":[1180,1852,236,1221]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadDecisionReason":[{"type":"call","value":[1180,1852,236,1354]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadDecisionTime":[{"type":"call","value":[1180,1852,236,1355]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadDecision":[{"type":"call","value":[1180,1852,236,1356]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\WpadNetworkName":[{"type":"call","value":[1180,1852,236,1357]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\{E529480E-F7A1-4923-843A-F7D2F243A5B1}\\be-56-7b-0a-70-d1":[{"type":"call","value":[1180,1852,236,1360]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1":[{"type":"call","value":[1180,1852,236,1362]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\\WpadDecisionReason":[{"type":"call","value":[1180,1852,236,1363]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\\WpadDecisionTime":[{"type":"call","value":[1180,1852,236,1364]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Wpad\\be-56-7b-0a-70-d1\\WpadDecision":[{"type":"call","value":[1180,1852,236,1365]}],"HKEY_USERS\\S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders":[{"type":"call","value":[1180,1852,236,1429]},{"type":"call","value":[1180,1852,236,1447]},{"type":"call","value":[1180,1852,236,1403]},{"type":"call","value":[1180,1852,236,1438]}],"S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders":[{"type":"call","value":[1180,1852,236,1429]},{"type":"call","value":[1180,1852,236,1447]},{"type":"call","value":[1180,1852,236,1403]},{"type":"call","value":[1180,1852,236,1438]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData":[{"type":"call","value":[1180,1852,236,1448]},{"type":"call","value":[1180,1852,236,1431]},{"type":"call","value":[1180,1852,236,1405]},{"type":"call","value":[1180,1852,236,1440]},{"type":"call","value":[1180,1852,236,1430]},{"type":"call","value":[1180,1852,236,1404]},{"type":"call","value":[1180,1852,236,1449]},{"type":"call","value":[1180,1852,236,1439]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections":[{"type":"call","value":[1180,1852,236,1464]},{"type":"call","value":[1180,1852,236,1467]}],"Software\\Microsoft\\windows\\CurrentVersion\\Internet Settings\\Connections":[{"type":"call","value":[1180,1852,236,1464]},{"type":"call","value":[1180,1852,236,1467]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\DefaultConnectionSettings":[{"type":"call","value":[1180,1852,236,1470]},{"type":"call","value":[1180,1852,236,1465]},{"type":"call","value":[1180,1852,236,1466]}]}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/Run/i"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,1028,947]},{"type":"call","value":[1180,1852,1028,4875]},{"type":"call","value":[1180,1852,2828,4347]},{"type":"call","value":[1180,1852,1028,3483]},{"type":"call","value":[1180,1852,2828,4346]},{"type":"call","value":[1180,1852,1028,2007]},{"type":"call","value":[1180,1852,1028,946]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,2828,4432]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,2828,4431]}],"captures":{"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run":[{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,1028,946]}],"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run":[{"type":"call","value":[1180,1852,1028,2005]},{"type":"call","value":[1180,1852,1028,3481]},{"type":"call","value":[1180,1852,1028,939]},{"type":"call","value":[1180,1852,1028,4873]},{"type":"call","value":[1180,1852,1028,946]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\yfeaxxbea":[{"type":"call","value":[1180,1852,1028,947]},{"type":"call","value":[1180,1852,1028,4875]},{"type":"call","value":[1180,1852,1028,2007]},{"type":"call","value":[1180,1852,1028,3483]}],"VCRUNTIME140.dll":[{"type":"call","value":[1180,1852,2828,4346]},{"type":"call","value":[1180,1852,2828,4431]}],"api-ms-win-crt-runtime-l1-1-0.dll":[{"type":"call","value":[1180,1852,2828,4347]},{"type":"call","value":[1180,1852,2828,4432]}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Explorer\\\\Shell Folders/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/User Shell Folders/i"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1429]},{"type":"call","value":[1180,1852,236,1403]},{"type":"call","value":[1180,1852,236,1448]},{"type":"call","value":[1180,1852,236,1438]},{"type":"call","value":[1180,1852,236,1447]},{"type":"call","value":[1180,1852,236,1431]},{"type":"call","value":[1180,1852,236,1405]},{"type":"call","value":[1180,1852,236,1440]},{"type":"call","value":[1180,1852,236,1430]},{"type":"call","value":[1180,1852,236,1404]},{"type":"call","value":[1180,1852,236,1449]},{"type":"call","value":[1180,1852,236,1439]}],"captures":{"HKEY_USERS\\S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders":[{"type":"call","value":[1180,1852,236,1429]},{"type":"call","value":[1180,1852,236,1447]},{"type":"call","value":[1180,1852,236,1403]},{"type":"call","value":[1180,1852,236,1438]}],"S-1-5-21-2237850072-885592287-911325625-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders":[{"type":"call","value":[1180,1852,236,1429]},{"type":"call","value":[1180,1852,236,1447]},{"type":"call","value":[1180,1852,236,1403]},{"type":"call","value":[1180,1852,236,1438]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData":[{"type":"call","value":[1180,1852,236,1448]},{"type":"call","value":[1180,1852,236,1431]},{"type":"call","value":[1180,1852,236,1405]},{"type":"call","value":[1180,1852,236,1440]},{"type":"call","value":[1180,1852,236,1430]},{"type":"call","value":[1180,1852,236,1404]},{"type":"call","value":[1180,1852,236,1449]},{"type":"call","value":[1180,1852,236,1439]}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/RunServices/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Policies\\\\Explorer\\\\Run/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\load/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/System\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BootExecute/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"resolve DNS":{"meta":{"name":"resolve DNS","namespace":"communication/dns","authors":["william.ballenthin@mandiant.com","johnk3r","joakim@intezer.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[],"mbc":[{"parts":["Communication","DNS Communication","Resolve"],"objective":"Communication","behavior":"DNS Communication","method":"Resolve","id":"C0011.001"}],"references":[],"examples":["17264e3126a97c319a6a0c61e6da951e:0x5FDC25D0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: resolve DNS\n namespace: communication/dns\n authors:\n - william.ballenthin@mandiant.com\n - johnk3r\n - joakim@intezer.com\n - michael.hunhoff@mandiant.com\n scopes:\n static: function\n dynamic: process\n mbc:\n - Communication::DNS Communication::Resolve [C0011.001]\n examples:\n - 17264e3126a97c319a6a0c61e6da951e:0x5FDC25D0\n features:\n - or:\n - api: ws2_32.gethostbyname\n - api: DnsQuery_A\n - api: DnsQuery_W\n - api: DnsQuery_UTF8\n - api: DnsQueryEx\n - api: getaddrinfo\n - api: GetAddrInfo\n - api: GetAddrInfoEx\n - api: gethostbyname\n - api: getaddrinfo\n - api: getnameinfo\n - api: gethostent\n - api: System.Net.Dns::GetHostAddresses\n","matches":[[{"type":"process","value":[2852,2900]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.gethostbyname"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQuery_A"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQuery_W"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQuery_UTF8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQueryEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getaddrinfo"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,23]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAddrInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAddrInfoEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"gethostbyname"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getaddrinfo"}},"children":[],"locations":[{"type":"call","value":[2852,2900,2904,23]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getnameinfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"gethostent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Dns::GetHostAddresses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1180,1852]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.gethostbyname"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQuery_A"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQuery_W"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQuery_UTF8"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"DnsQueryEx"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getaddrinfo"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1103]},{"type":"call","value":[1180,1852,236,1101]},{"type":"call","value":[1180,1852,2784,1342]},{"type":"call","value":[1180,1852,236,1462]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAddrInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAddrInfoEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"gethostbyname"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"getaddrinfo"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1103]},{"type":"call","value":[1180,1852,236,1101]},{"type":"call","value":[1180,1852,2784,1342]},{"type":"call","value":[1180,1852,236,1462]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getnameinfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"gethostent"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"System.Net.Dns::GetHostAddresses"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get hostname":{"meta":{"name":"get hostname","namespace":"host-interaction/os/hostname","authors":["moritz.raabe@mandiant.com","joakim@intezer.com","anushka.virgaonkar@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Discovery","System Information Discovery"],"tactic":"Discovery","technique":"System Information Discovery","subtechnique":"","id":"T1082"}],"mbc":[{"parts":["Discovery","System Information Discovery"],"objective":"Discovery","behavior":"System Information Discovery","method":"","id":"E1082"}],"references":[],"examples":["9324D1A8AE37A36AE560C37448C9705A:0x4052A0","7351f8a40c5450557b24622417fc478d:0x405438"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: get hostname\n namespace: host-interaction/os/hostname\n authors:\n - moritz.raabe@mandiant.com\n - joakim@intezer.com\n - anushka.virgaonkar@mandiant.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Discovery::System Information Discovery [T1082]\n mbc:\n - Discovery::System Information Discovery [E1082]\n examples:\n - 9324D1A8AE37A36AE560C37448C9705A:0x4052A0\n - 7351f8a40c5450557b24622417fc478d:0x405438\n features:\n - or:\n - api: kernel32.GetComputerName\n - api: kernel32.GetComputerNameEx\n - api: GetComputerObjectName\n - api: ws2_32.gethostname\n - api: gethostname\n - property/read: System.Environment::MachineName\n","matches":[[{"type":"process","value":[1180,1852]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetComputerName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"kernel32.GetComputerNameEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetComputerObjectName"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ws2_32.gethostname"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"gethostname"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1099]},{"type":"call","value":[1180,1852,236,1461]},{"type":"call","value":[1180,1852,236,1102]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"property","access":"read","property":"System.Environment::MachineName"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"get local IPv4 addresses":{"meta":{"name":"get local IPv4 addresses","namespace":"host-interaction/network/address","authors":["moritz.raabe@mandiant.com","joakim@intezer.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Discovery","System Network Configuration Discovery"],"tactic":"Discovery","technique":"System Network Configuration Discovery","subtechnique":"","id":"T1016"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 05-01.dll_:0x100037e6","4C0553285D724DCAF5909924B4E3E90A:0x402010"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: get local IPv4 addresses\n namespace: host-interaction/network/address\n authors:\n - moritz.raabe@mandiant.com\n - joakim@intezer.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Discovery::System Network Configuration Discovery [T1016]\n examples:\n - Practical Malware Analysis Lab 05-01.dll_:0x100037e6\n - 4C0553285D724DCAF5909924B4E3E90A:0x402010\n features:\n - or:\n - api: getsockname\n - and:\n - api: GetAdaptersInfo\n - offset: 0x1B0 = IP_ADAPTER_INFO.IpAddressList.IpAddress\n # loop feature?\n - and:\n - api: GetAdaptersAddresses\n - optional:\n - or:\n - number: 0 = AF_UNSPEC\n - number: 2 = AF_INET\n - number: 23 = AF_INET6\n","matches":[[{"type":"process","value":[1180,1852]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"getsockname"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersInfo"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"offset","offset":432,"description":"IP_ADAPTER_INFO.IpAddressList.IpAddress"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"GetAdaptersAddresses"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1228]}],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"number","number":0,"description":"AF_UNSPEC"}},"children":[],"locations":[{"type":"call","value":[1180,1852,2596,4748]},{"type":"call","value":[1180,1852,764,577]},{"type":"call","value":[1180,1852,2596,3436]},{"type":"call","value":[1180,1852,2596,3863]},{"type":"call","value":[1180,1852,1156,3712]},{"type":"call","value":[1180,1852,2596,2780]},{"type":"call","value":[1180,1852,2596,4766]},{"type":"call","value":[1180,1852,2596,3454]},{"type":"call","value":[1180,1852,2596,2798]},{"type":"call","value":[1180,1852,2596,4784]},{"type":"call","value":[1180,1852,2596,2389]},{"type":"call","value":[1180,1852,764,433]},{"type":"call","value":[1180,1852,2596,4622]},{"type":"call","value":[1180,1852,236,1158]},{"type":"call","value":[1180,1852,2596,2407]},{"type":"call","value":[1180,1852,764,451]},{"type":"call","value":[1180,1852,1400,2538]},{"type":"call","value":[1180,1852,2596,1095]},{"type":"call","value":[1180,1852,2596,4640]},{"type":"call","value":[1180,1852,2596,2425]},{"type":"call","value":[1180,1852,764,469]},{"type":"call","value":[1180,1852,1808,4033]},{"type":"call","value":[1180,1852,920,91]},{"type":"call","value":[1180,1852,2856,1030]},{"type":"call","value":[1180,1852,920,109]},{"type":"call","value":[1180,1852,2596,2263]},{"type":"call","value":[1180,1852,2856,3263]},{"type":"call","value":[1180,1852,2596,3593]},{"type":"call","value":[1180,1852,2856,1048]},{"type":"call","value":[1180,1852,764,554]},{"type":"call","value":[1180,1852,2596,295]},{"type":"call","value":[1180,1852,2832,4001]},{"type":"call","value":[1180,1852,1020,2657]},{"type":"call","value":[1180,1852,2596,4743]},{"type":"call","value":[1180,1852,2596,4087]},{"type":"call","value":[1180,1852,764,572]},{"type":"call","value":[1180,1852,1020,2904]},{"type":"call","value":[1180,1852,2596,4761]},{"type":"call","value":[1180,1852,1156,836]},{"type":"call","value":[1180,1852,2596,2119]},{"type":"call","value":[1180,1852,2596,4105]},{"type":"call","value":[1180,1852,764,590]},{"type":"call","value":[1180,1852,2832,986]},{"type":"call","value":[1180,1852,2596,2384]},{"type":"call","value":[1180,1852,2596,3943]},{"type":"call","value":[1180,1852,764,428]},{"type":"call","value":[1180,1852,2596,1728]},{"type":"call","value":[1180,1852,2596,2402]},{"type":"call","value":[1180,1852,2596,3961]},{"type":"call","value":[1180,1852,764,446]},{"type":"call","value":[1180,1852,2596,1746]},{"type":"call","value":[1180,1852,920,68]},{"type":"call","value":[1180,1852,2596,3552]},{"type":"call","value":[1180,1852,920,86]},{"type":"call","value":[1180,1852,1020,3043]},{"type":"call","value":[1180,1852,2596,3570]},{"type":"call","value":[1180,1852,2856,1025]},{"type":"call","value":[1180,1852,1808,4046]},{"type":"call","value":[1180,1852,920,104]},{"type":"call","value":[1180,1852,2596,2258]},{"type":"call","value":[1180,1852,1020,3061]},{"type":"call","value":[1180,1852,2596,3588]},{"type":"call","value":[1180,1852,764,549]},{"type":"call","value":[1180,1852,2596,290]},{"type":"call","value":[1180,1852,2596,1849]},{"type":"call","value":[1180,1852,2596,2276]},{"type":"call","value":[1180,1852,764,320]},{"type":"call","value":[1180,1852,1156,3684]},{"type":"call","value":[1180,1852,1020,2652]},{"type":"call","value":[1180,1852,2596,4082]},{"type":"call","value":[1180,1852,764,567]},{"type":"call","value":[1180,1852,676,3340]},{"type":"call","value":[1180,1852,2596,2770]},{"type":"call","value":[1180,1852,2596,2114]},{"type":"call","value":[1180,1852,2596,4100]},{"type":"call","value":[1180,1852,1028,2006]},{"type":"call","value":[1180,1852,1020,2917]},{"type":"call","value":[1180,1852,2596,3444]},{"type":"call","value":[1180,1852,2596,2788]},{"type":"call","value":[1180,1852,1200,3793]},{"type":"call","value":[1180,1852,2596,2132]},{"type":"call","value":[1180,1852,2596,4594]},{"type":"call","value":[1180,1852,236,1130]},{"type":"call","value":[1180,1852,2596,2379]},{"type":"call","value":[1180,1852,764,423]},{"type":"call","value":[1180,1852,2596,1723]},{"type":"call","value":[1180,1852,2596,4612]},{"type":"call","value":[1180,1852,2596,3956]},{"type":"call","value":[1180,1852,764,441]},{"type":"call","value":[1180,1852,2596,1741]},{"type":"call","value":[1180,1852,2596,3974]},{"type":"call","value":[1180,1852,2836,1068]},{"type":"call","value":[1180,1852,1020,3038]},{"type":"call","value":[1180,1852,1808,4041]},{"type":"call","value":[1180,1852,920,99]},{"type":"call","value":[1180,1852,764,297]},{"type":"call","value":[1180,1852,1020,3056]},{"type":"call","value":[1180,1852,1156,1873]},{"type":"call","value":[1180,1852,764,544]},{"type":"call","value":[1180,1852,2596,3403]},{"type":"call","value":[1180,1852,1156,3679]},{"type":"call","value":[1180,1852,1020,2647]},{"type":"call","value":[1180,1852,2596,2747]},{"type":"call","value":[1180,1852,2596,4733]},{"type":"call","value":[1180,1852,764,562]},{"type":"call","value":[1180,1852,1020,2665]},{"type":"call","value":[1180,1852,676,3335]},{"type":"call","value":[1180,1852,2596,2765]},{"type":"call","value":[1180,1852,2596,4751]},{"type":"call","value":[1180,1852,1156,826]},{"type":"call","value":[1180,1852,1020,2912]},{"type":"call","value":[1180,1852,676,3353]},{"type":"call","value":[1180,1852,2596,2783]},{"type":"call","value":[1180,1852,764,400]},{"type":"call","value":[1180,1852,1200,3788]},{"type":"call","value":[1180,1852,2596,4589]},{"type":"call","value":[1180,1852,764,418]},{"type":"call","value":[1180,1852,2596,4836]},{"type":"call","value":[1180,1852,2596,4607]},{"type":"call","value":[1180,1852,2596,2392]},{"type":"call","value":[1180,1852,764,436]},{"type":"call","value":[1180,1852,2596,1309]},{"type":"call","value":[1180,1852,2596,3542]},{"type":"call","value":[1180,1852,2596,3560]},{"type":"call","value":[1180,1852,1808,4036]},{"type":"call","value":[1180,1852,2596,2477]},{"type":"call","value":[1180,1852,764,521]},{"type":"call","value":[1180,1852,2596,262]},{"type":"call","value":[1180,1852,1020,3051]},{"type":"call","value":[1180,1852,764,539]},{"type":"call","value":[1180,1852,2596,280]},{"type":"call","value":[1180,1852,1020,2642]},{"type":"call","value":[1180,1852,2596,4072]},{"type":"call","value":[1180,1852,764,557]},{"type":"call","value":[1180,1852,676,3330]},{"type":"call","value":[1180,1852,2596,2104]},{"type":"call","value":[1180,1852,1020,2907]},{"type":"call","value":[1180,1852,676,3348]},{"type":"call","value":[1180,1852,920,197]},{"type":"call","value":[1180,1852,2596,3910]},{"type":"call","value":[1180,1852,764,395]},{"type":"call","value":[1180,1852,2596,2122]},{"type":"call","value":[1180,1852,764,413]},{"type":"call","value":[1180,1852,1020,2745]},{"type":"call","value":[1180,1852,2596,3519]},{"type":"call","value":[1180,1852,2596,3946]},{"type":"call","value":[1180,1852,2596,1304]},{"type":"call","value":[1180,1852,2596,1731]},{"type":"call","value":[1180,1852,236,1385]},{"type":"call","value":[1180,1852,2656,2626]},{"type":"call","value":[1180,1852,2596,2207]},{"type":"call","value":[1180,1852,1020,3010]},{"type":"call","value":[1180,1852,2596,3537]},{"type":"call","value":[1180,1852,2832,1483]},{"type":"call","value":[1180,1852,920,71]},{"type":"call","value":[1180,1852,2596,2225]},{"type":"call","value":[1180,1852,2596,3555]},{"type":"call","value":[1180,1852,236,1223]},{"type":"call","value":[1180,1852,1808,4031]},{"type":"call","value":[1180,1852,764,516]},{"type":"call","value":[1180,1852,2596,257]},{"type":"call","value":[1180,1852,2596,1816]},{"type":"call","value":[1180,1852,2596,2243]},{"type":"call","value":[1180,1852,2832,3307]},{"type":"call","value":[1180,1852,764,534]},{"type":"call","value":[1180,1852,2596,275]},{"type":"call","value":[1180,1852,2596,3393]},{"type":"call","value":[1180,1852,2596,2081]},{"type":"call","value":[1180,1852,2596,4067]},{"type":"call","value":[1180,1852,764,552]},{"type":"call","value":[1180,1852,2596,3411]},{"type":"call","value":[1180,1852,1156,3687]},{"type":"call","value":[1180,1852,2596,2755]},{"type":"call","value":[1180,1852,676,3343]},{"type":"call","value":[1180,1852,2596,3905]},{"type":"call","value":[1180,1852,764,390]},{"type":"call","value":[1180,1852,2596,3923]},{"type":"call","value":[1180,1852,764,408]},{"type":"call","value":[1180,1852,1020,2740]},{"type":"call","value":[1180,1852,2596,4826]},{"type":"call","value":[1180,1852,1156,901]},{"type":"call","value":[1180,1852,2596,4597]},{"type":"call","value":[1180,1852,2616,3992]},{"type":"call","value":[1180,1852,2208,1531]},{"type":"call","value":[1180,1852,920,66]},{"type":"call","value":[1180,1852,2596,234]},{"type":"call","value":[1180,1852,2596,4682]},{"type":"call","value":[1180,1852,1156,4958]},{"type":"call","value":[1180,1852,2596,2467]},{"type":"call","value":[1180,1852,236,1218]},{"type":"call","value":[1180,1852,1156,775]},{"type":"call","value":[1180,1852,2596,2485]},{"type":"call","value":[1180,1852,764,529]},{"type":"call","value":[1180,1852,2596,3388]},{"type":"call","value":[1180,1852,920,151]},{"type":"call","value":[1180,1852,2832,3796]},{"type":"call","value":[1180,1852,2596,3406]},{"type":"call","value":[1180,1852,2596,2750]},{"type":"call","value":[1180,1852,764,367]},{"type":"call","value":[1180,1852,236,1092]},{"type":"call","value":[1180,1852,676,3338]},{"type":"call","value":[1180,1852,764,385]},{"type":"call","value":[1180,1852,764,403]},{"type":"call","value":[1180,1852,1020,2735]},{"type":"call","value":[1180,1852,2596,4821]},{"type":"call","value":[1180,1852,1156,896]},{"type":"call","value":[1180,1852,2596,4165]},{"type":"call","value":[1180,1852,1020,2982]},{"type":"call","value":[1180,1852,2596,3509]},{"type":"call","value":[1180,1852,2596,1294]},{"type":"call","value":[1180,1852,2616,3987]},{"type":"call","value":[1180,1852,2596,4839]},{"type":"call","value":[1180,1852,1156,914]},{"type":"call","value":[1180,1852,2596,2197]},{"type":"call","value":[1180,1852,2596,4183]},{"type":"call","value":[1180,1852,236,1375]},{"type":"call","value":[1180,1852,2736,2372]},{"type":"call","value":[1180,1852,2596,3527]},{"type":"call","value":[1180,1852,2208,1526]},{"type":"call","value":[1180,1852,2596,1312]},{"type":"call","value":[1180,1852,2700,3826]},{"type":"call","value":[1180,1852,2596,2215]},{"type":"call","value":[1180,1852,2700,3844]},{"type":"call","value":[1180,1852,2596,3118]},{"type":"call","value":[1180,1852,1156,4953]},{"type":"call","value":[1180,1852,2596,2462]},{"type":"call","value":[1180,1852,764,506]},{"type":"call","value":[1180,1852,2596,247]},{"type":"call","value":[1180,1852,2596,1806]},{"type":"call","value":[1180,1852,2832,3297]},{"type":"call","value":[1180,1852,1156,770]},{"type":"call","value":[1180,1852,2596,2053]},{"type":"call","value":[1180,1852,2596,2480]},{"type":"call","value":[1180,1852,2596,265]},{"type":"call","value":[1180,1852,2596,1824]},{"type":"call","value":[1180,1852,764,524]},{"type":"call","value":[1180,1852,2596,2071]},{"type":"call","value":[1180,1852,920,164]},{"type":"call","value":[1180,1852,764,362]},{"type":"call","value":[1180,1852,2596,2089]},{"type":"call","value":[1180,1852,236,1087]},{"type":"call","value":[1180,1852,676,3333]},{"type":"call","value":[1180,1852,2596,3895]},{"type":"call","value":[1180,1852,764,380]},{"type":"call","value":[1180,1852,2596,3913]},{"type":"call","value":[1180,1852,764,398]},{"type":"call","value":[1180,1852,2596,1271]},{"type":"call","value":[1180,1852,1156,891]},{"type":"call","value":[1180,1852,2596,4160]},{"type":"call","value":[1180,1852,2596,3504]},{"type":"call","value":[1180,1852,2596,1289]},{"type":"call","value":[1180,1852,2596,2848]},{"type":"call","value":[1180,1852,2596,2192]},{"type":"call","value":[1180,1852,2596,4178]},{"type":"call","value":[1180,1852,2596,3522]},{"type":"call","value":[1180,1852,2596,5081]},{"type":"call","value":[1180,1852,2596,1307]},{"type":"call","value":[1180,1852,2208,1521]},{"type":"call","value":[1180,1852,764,483]},{"type":"call","value":[1180,1852,1476,1663]},{"type":"call","value":[1180,1852,2596,2210]},{"type":"call","value":[1180,1852,2832,1944]},{"type":"call","value":[1180,1852,968,3034]},{"type":"call","value":[1180,1852,2700,3839]},{"type":"call","value":[1180,1852,2596,4672]},{"type":"call","value":[1180,1852,1476,1681]},{"type":"call","value":[1180,1852,2596,242]},{"type":"call","value":[1180,1852,2596,1801]},{"type":"call","value":[1180,1852,2596,4690]},{"type":"call","value":[1180,1852,1156,4966]},{"type":"call","value":[1180,1852,2596,2048]},{"type":"call","value":[1180,1852,764,519]},{"type":"call","value":[1180,1852,1156,765]},{"type":"call","value":[1180,1852,2596,1819]},{"type":"call","value":[1180,1852,2596,3378]},{"type":"call","value":[1180,1852,236,1226]},{"type":"call","value":[1180,1852,920,141]},{"type":"call","value":[1180,1852,1156,783]},{"type":"call","value":[1180,1852,2596,2066]},{"type":"call","value":[1180,1852,920,159]},{"type":"call","value":[1180,1852,2596,3872]},{"type":"call","value":[1180,1852,1400,4906]},{"type":"call","value":[1180,1852,2596,3890]},{"type":"call","value":[1180,1852,764,375]},{"type":"call","value":[1180,1852,2596,4793]},{"type":"call","value":[1180,1852,2596,3908]},{"type":"call","value":[1180,1852,920,15]},{"type":"call","value":[1180,1852,1020,2972]},{"type":"call","value":[1180,1852,2596,3499]},{"type":"call","value":[1180,1852,2616,1991]},{"type":"call","value":[1180,1852,1400,2547]},{"type":"call","value":[1180,1852,2596,2843]},{"type":"call","value":[1180,1852,2596,4829]},{"type":"call","value":[1180,1852,1156,904]},{"type":"call","value":[1180,1852,1020,2743]},{"type":"call","value":[1180,1852,2208,1516]},{"type":"call","value":[1180,1852,2596,2434]},{"type":"call","value":[1180,1852,2596,2861]},{"type":"call","value":[1180,1852,764,478]},{"type":"call","value":[1180,1852,1876,3172]},{"type":"call","value":[1180,1852,2700,3834]},{"type":"call","value":[1180,1852,2208,1534]},{"type":"call","value":[1180,1852,1156,742]},{"type":"call","value":[1180,1852,2596,2452]},{"type":"call","value":[1180,1852,2596,4685]},{"type":"call","value":[1180,1852,1156,4961]},{"type":"call","value":[1180,1852,2596,2470]},{"type":"call","value":[1180,1852,2596,3602]},{"type":"call","value":[1180,1852,764,514]},{"type":"call","value":[1180,1852,1156,760]},{"type":"call","value":[1180,1852,2596,3373]},{"type":"call","value":[1180,1852,920,136]},{"type":"call","value":[1180,1852,1020,3093]},{"type":"call","value":[1180,1852,920,154]},{"type":"call","value":[1180,1852,764,352]},{"type":"call","value":[1180,1852,1400,4901]},{"type":"call","value":[1180,1852,1156,2602]},{"type":"call","value":[1180,1852,764,370]},{"type":"call","value":[1180,1852,2596,4788]},{"type":"call","value":[1180,1852,2596,3476]},{"type":"call","value":[1180,1852,1020,2720]},{"type":"call","value":[1180,1852,2596,4806]},{"type":"call","value":[1180,1852,2596,4150]},{"type":"call","value":[1180,1852,1020,2967]},{"type":"call","value":[1180,1852,2616,1986]},{"type":"call","value":[1180,1852,1400,2542]},{"type":"call","value":[1180,1852,920,28]},{"type":"call","value":[1180,1852,2596,2182]},{"type":"call","value":[1180,1852,1156,899]},{"type":"call","value":[1180,1852,2596,2429]},{"type":"call","value":[1180,1852,764,473]},{"type":"call","value":[1180,1852,1876,3167]},{"type":"call","value":[1180,1852,2596,1773]},{"type":"call","value":[1180,1852,2596,2200]},{"type":"call","value":[1180,1852,2700,3829]},{"type":"call","value":[1180,1852,2596,232]},{"type":"call","value":[1180,1852,2596,1791]},{"type":"call","value":[1180,1852,920,113]},{"type":"call","value":[1180,1852,1156,755]},{"type":"call","value":[1180,1852,2596,2038]},{"type":"call","value":[1180,1852,2596,3597]},{"type":"call","value":[1180,1852,920,131]},{"type":"call","value":[1180,1852,2596,2285]},{"type":"call","value":[1180,1852,2596,2056]},{"type":"call","value":[1180,1852,920,149]},{"type":"call","value":[1180,1852,2596,3862]},{"type":"call","value":[1180,1852,764,594]},{"type":"call","value":[1180,1852,2828,4241]},{"type":"call","value":[1180,1852,2596,3880]},{"type":"call","value":[1180,1852,764,365]},{"type":"call","value":[1180,1852,2596,4127]},{"type":"call","value":[1180,1852,1020,2715]},{"type":"call","value":[1180,1852,1020,2962]},{"type":"call","value":[1180,1852,2616,1981]},{"type":"call","value":[1180,1852,1400,2537]},{"type":"call","value":[1180,1852,2596,2833]},{"type":"call","value":[1180,1852,2596,2177]},{"type":"call","value":[1180,1852,1020,2980]},{"type":"call","value":[1180,1852,2596,4639]},{"type":"call","value":[1180,1852,1476,1648]},{"type":"call","value":[1180,1852,1876,3162]},{"type":"call","value":[1180,1852,2596,1768]},{"type":"call","value":[1180,1852,2856,1029]},{"type":"call","value":[1180,1852,920,108]},{"type":"call","value":[1180,1852,764,733]},{"type":"call","value":[1180,1852,1156,750]},{"type":"call","value":[1180,1852,2596,2033]},{"type":"call","value":[1180,1852,2596,3363]},{"type":"call","value":[1180,1852,236,1458]},{"type":"call","value":[1180,1852,920,126]},{"type":"call","value":[1180,1852,2832,4000]},{"type":"call","value":[1180,1852,2596,2051]},{"type":"call","value":[1180,1852,920,144]},{"type":"call","value":[1180,1852,2596,4760]},{"type":"call","value":[1180,1852,764,589]},{"type":"call","value":[1180,1852,2596,3448]},{"type":"call","value":[1180,1852,2596,3875]},{"type":"call","value":[1180,1852,764,360]},{"type":"call","value":[1180,1852,2596,2792]},{"type":"call","value":[1180,1852,2596,4778]},{"type":"call","value":[1180,1852,2596,3466]},{"type":"call","value":[1180,1852,2596,2810]},{"type":"call","value":[1180,1852,1020,2957]},{"type":"call","value":[1180,1852,2616,1976]},{"type":"call","value":[1180,1852,1400,2532]},{"type":"call","value":[1180,1852,2596,2401]},{"type":"call","value":[1180,1852,764,445]},{"type":"call","value":[1180,1852,2596,2172]},{"type":"call","value":[1180,1852,2596,4634]},{"type":"call","value":[1180,1852,236,1170]},{"type":"call","value":[1180,1852,2596,2419]},{"type":"call","value":[1180,1852,764,463]},{"type":"call","value":[1180,1852,1876,3157]},{"type":"call","value":[1180,1852,2596,4652]},{"type":"call","value":[1180,1852,764,481]},{"type":"call","value":[1180,1852,2832,1942]},{"type":"call","value":[1180,1852,1808,4045]},{"type":"call","value":[1180,1852,920,103]},{"type":"call","value":[1180,1852,1020,3060]},{"type":"call","value":[1180,1852,1156,745]},{"type":"call","value":[1180,1852,2596,3587]},{"type":"call","value":[1180,1852,2856,1042]},{"type":"call","value":[1180,1852,920,121]},{"type":"call","value":[1180,1852,2596,2275]},{"type":"call","value":[1180,1852,2596,3605]},{"type":"call","value":[1180,1852,764,566]},{"type":"call","value":[1180,1852,1020,2669]},{"type":"call","value":[1180,1852,1020,3096]},{"type":"call","value":[1180,1852,2596,4755]},{"type":"call","value":[1180,1852,2596,4099]},{"type":"call","value":[1180,1852,2596,4773]},{"type":"call","value":[1180,1852,2596,4117]},{"type":"call","value":[1180,1852,2596,1246]},{"type":"call","value":[1180,1852,1156,866]},{"type":"call","value":[1180,1852,236,1147]},{"type":"call","value":[1180,1852,2832,998]},{"type":"call","value":[1180,1852,2596,2396]},{"type":"call","value":[1180,1852,2596,3955]},{"type":"call","value":[1180,1852,764,440]},{"type":"call","value":[1180,1852,2596,1740]},{"type":"call","value":[1180,1852,2596,2414]},{"type":"call","value":[1180,1852,764,458]},{"type":"call","value":[1180,1852,2596,1758]},{"type":"call","value":[1180,1852,1808,4040]},{"type":"call","value":[1180,1852,920,98]},{"type":"call","value":[1180,1852,764,296]},{"type":"call","value":[1180,1852,2596,2023]},{"type":"call","value":[1180,1852,2596,3582]},{"type":"call","value":[1180,1852,2856,1037]},{"type":"call","value":[1180,1852,920,116]},{"type":"call","value":[1180,1852,2596,2270]},{"type":"call","value":[1180,1852,2596,3600]},{"type":"call","value":[1180,1852,764,561]},{"type":"call","value":[1180,1852,1156,2564]},{"type":"call","value":[1180,1852,764,332]},{"type":"call","value":[1180,1852,1020,2664]},{"type":"call","value":[1180,1852,1156,5026]},{"type":"call","value":[1180,1852,2596,4094]},{"type":"call","value":[1180,1852,1020,2911]},{"type":"call","value":[1180,1852,2596,3865]},{"type":"call","value":[1180,1852,2596,2782]},{"type":"call","value":[1180,1852,2596,3209]},{"type":"call","value":[1180,1852,2596,2126]},{"type":"call","value":[1180,1852,2596,4112]},{"type":"call","value":[1180,1852,2596,3456]},{"type":"call","value":[1180,1852,2596,2800]},{"type":"call","value":[1180,1852,2596,4606]},{"type":"call","value":[1180,1852,236,1142]},{"type":"call","value":[1180,1852,2596,3950]},{"type":"call","value":[1180,1852,2596,176]},{"type":"call","value":[1180,1852,2596,1735]},{"type":"call","value":[1180,1852,764,435]},{"type":"call","value":[1180,1852,236,1389]},{"type":"call","value":[1180,1852,2596,4624]},{"type":"call","value":[1180,1852,236,1160]},{"type":"call","value":[1180,1852,2596,3968]},{"type":"call","value":[1180,1852,764,453]},{"type":"call","value":[1180,1852,2596,1753]},{"type":"call","value":[1180,1852,920,75]},{"type":"call","value":[1180,1852,2596,4642]},{"type":"call","value":[1180,1852,2284,4920]},{"type":"call","value":[1180,1852,1808,4035]},{"type":"call","value":[1180,1852,920,93]},{"type":"call","value":[1180,1852,1020,3050]},{"type":"call","value":[1180,1852,2596,2018]},{"type":"call","value":[1180,1852,2856,1032]},{"type":"call","value":[1180,1852,920,111]},{"type":"call","value":[1180,1852,1020,3068]},{"type":"call","value":[1180,1852,764,556]},{"type":"call","value":[1180,1852,1020,2659]},{"type":"call","value":[1180,1852,2596,4745]},{"type":"call","value":[1180,1852,764,574]},{"type":"call","value":[1180,1852,1020,2906]},{"type":"call","value":[1180,1852,2596,3433]},{"type":"call","value":[1180,1852,920,196]},{"type":"call","value":[1180,1852,2596,2777]},{"type":"call","value":[1180,1852,2596,4763]},{"type":"call","value":[1180,1852,1156,838]},{"type":"call","value":[1180,1852,2596,3451]},{"type":"call","value":[1180,1852,2596,2795]},{"type":"call","value":[1180,1852,764,412]},{"type":"call","value":[1180,1852,2596,4601]},{"type":"call","value":[1180,1852,2596,2386]},{"type":"call","value":[1180,1852,764,430]},{"type":"call","value":[1180,1852,2596,171]},{"type":"call","value":[1180,1852,2596,4619]},{"type":"call","value":[1180,1852,2596,2404]},{"type":"call","value":[1180,1852,764,448]},{"type":"call","value":[1180,1852,2832,1482]},{"type":"call","value":[1180,1852,920,70]},{"type":"call","value":[1180,1852,2596,3554]},{"type":"call","value":[1180,1852,1808,4030]},{"type":"call","value":[1180,1852,920,88]},{"type":"call","value":[1180,1852,2596,2242]},{"type":"call","value":[1180,1852,2596,3572]},{"type":"call","value":[1180,1852,2856,1027]},{"type":"call","value":[1180,1852,1808,4048]},{"type":"call","value":[1180,1852,2596,274]},{"type":"call","value":[1180,1852,2596,2260]},{"type":"call","value":[1180,1852,1020,2636]},{"type":"call","value":[1180,1852,2596,4066]},{"type":"call","value":[1180,1852,2596,292]},{"type":"call","value":[1180,1852,2596,1851]},{"type":"call","value":[1180,1852,764,551]},{"type":"call","value":[1180,1852,1156,3686]},{"type":"call","value":[1180,1852,2596,4740]},{"type":"call","value":[1180,1852,2596,4084]},{"type":"call","value":[1180,1852,764,569]},{"type":"call","value":[1180,1852,1020,2672]},{"type":"call","value":[1180,1852,676,3342]},{"type":"call","value":[1180,1852,2596,4758]},{"type":"call","value":[1180,1852,2596,2116]},{"type":"call","value":[1180,1852,2596,4102]},{"type":"call","value":[1180,1852,1020,2919]},{"type":"call","value":[1180,1852,2832,965]},{"type":"call","value":[1180,1852,764,407]},{"type":"call","value":[1180,1852,2596,2381]},{"type":"call","value":[1180,1852,764,425]},{"type":"call","value":[1180,1852,2596,1725]},{"type":"call","value":[1180,1852,2596,2399]},{"type":"call","value":[1180,1852,2596,3531]},{"type":"call","value":[1180,1852,2596,3958]},{"type":"call","value":[1180,1852,2596,1743]},{"type":"call","value":[1180,1852,764,443]},{"type":"call","value":[1180,1852,2596,4861]},{"type":"call","value":[1180,1852,920,65]},{"type":"call","value":[1180,1852,2596,3549]},{"type":"call","value":[1180,1852,2596,1334]},{"type":"call","value":[1180,1852,920,83]},{"type":"call","value":[1180,1852,2836,1070]},{"type":"call","value":[1180,1852,1020,3040]},{"type":"call","value":[1180,1852,2856,1022]},{"type":"call","value":[1180,1852,1808,4043]},{"type":"call","value":[1180,1852,764,528]},{"type":"call","value":[1180,1852,2596,269]},{"type":"call","value":[1180,1852,2596,2255]},{"type":"call","value":[1180,1852,1020,3058]},{"type":"call","value":[1180,1852,764,546]},{"type":"call","value":[1180,1852,2596,287]},{"type":"call","value":[1180,1852,236,2156]},{"type":"call","value":[1180,1852,2596,3405]},{"type":"call","value":[1180,1852,1156,3681]},{"type":"call","value":[1180,1852,1020,2649]},{"type":"call","value":[1180,1852,2596,2749]},{"type":"call","value":[1180,1852,1156,810]},{"type":"call","value":[1180,1852,2596,2093]},{"type":"call","value":[1180,1852,2596,4079]},{"type":"call","value":[1180,1852,764,564]},{"type":"call","value":[1180,1852,2596,1864]},{"type":"call","value":[1180,1852,2596,3423]},{"type":"call","value":[1180,1852,676,3337]},{"type":"call","value":[1180,1852,2596,2767]},{"type":"call","value":[1180,1852,1028,4874]},{"type":"call","value":[1180,1852,1156,828]},{"type":"call","value":[1180,1852,2596,2111]},{"type":"call","value":[1180,1852,1020,2914]},{"type":"call","value":[1180,1852,2596,2785]},{"type":"call","value":[1180,1852,2596,3917]},{"type":"call","value":[1180,1852,764,402]},{"type":"call","value":[1180,1852,2596,4591]},{"type":"call","value":[1180,1852,2596,3935]},{"type":"call","value":[1180,1852,764,420]},{"type":"call","value":[1180,1852,2596,1720]},{"type":"call","value":[1180,1852,2596,4838]},{"type":"call","value":[1180,1852,920,42]},{"type":"call","value":[1180,1852,2596,4609]},{"type":"call","value":[1180,1852,2596,3953]},{"type":"call","value":[1180,1852,1732,5020]},{"type":"call","value":[1180,1852,2832,3296]},{"type":"call","value":[1180,1852,1476,1703]},{"type":"call","value":[1180,1852,1808,4038]},{"type":"call","value":[1180,1852,2596,2479]},{"type":"call","value":[1180,1852,764,523]},{"type":"call","value":[1180,1852,1156,1870]},{"type":"call","value":[1180,1852,764,541]},{"type":"call","value":[1180,1852,2596,3400]},{"type":"call","value":[1180,1852,1020,2644]},{"type":"call","value":[1180,1852,764,559]},{"type":"call","value":[1180,1852,2596,3418]},{"type":"call","value":[1180,1852,676,3332]},{"type":"call","value":[1180,1852,2596,2762]},{"type":"call","value":[1180,1852,1020,2909]},{"type":"call","value":[1180,1852,236,1104]},{"type":"call","value":[1180,1852,920,199]},{"type":"call","value":[1180,1852,764,397]},{"type":"call","value":[1180,1852,236,1351]},{"type":"call","value":[1180,1852,764,415]},{"type":"call","value":[1180,1852,2596,1288]},{"type":"call","value":[1180,1852,2596,1715]},{"type":"call","value":[1180,1852,2596,4833]},{"type":"call","value":[1180,1852,920,37]},{"type":"call","value":[1180,1852,236,1369]},{"type":"call","value":[1180,1852,2596,4604]},{"type":"call","value":[1180,1852,2596,3521]},{"type":"call","value":[1180,1852,2596,1306]},{"type":"call","value":[1180,1852,2596,2209]},{"type":"call","value":[1180,1852,2596,3539]},{"type":"call","value":[1180,1852,1732,5015]},{"type":"call","value":[1180,1852,2596,241]},{"type":"call","value":[1180,1852,2596,2227]},{"type":"call","value":[1180,1852,2596,1571]},{"type":"call","value":[1180,1852,236,1225]},{"type":"call","value":[1180,1852,2596,2474]},{"type":"call","value":[1180,1852,764,518]},{"type":"call","value":[1180,1852,2596,259]},{"type":"call","value":[1180,1852,2596,1818]},{"type":"call","value":[1180,1852,2596,2245]},{"type":"call","value":[1180,1852,2596,2492]},{"type":"call","value":[1180,1852,764,536]},{"type":"call","value":[1180,1852,2596,277]},{"type":"call","value":[1180,1852,920,158]},{"type":"call","value":[1180,1852,2596,4069]},{"type":"call","value":[1180,1852,676,3327]},{"type":"call","value":[1180,1852,764,374]},{"type":"call","value":[1180,1852,2596,2101]},{"type":"call","value":[1180,1852,676,3345]},{"type":"call","value":[1180,1852,2596,3907]},{"type":"call","value":[1180,1852,764,392]},{"type":"call","value":[1180,1852,764,410]},{"type":"call","value":[1180,1852,1020,2742]},{"type":"call","value":[1180,1852,920,32]},{"type":"call","value":[1180,1852,1156,903]},{"type":"call","value":[1180,1852,2596,4172]},{"type":"call","value":[1180,1852,2596,3516]},{"type":"call","value":[1180,1852,2596,1301]},{"type":"call","value":[1180,1852,2596,4846]},{"type":"call","value":[1180,1852,920,50]},{"type":"call","value":[1180,1852,2596,2204]},{"type":"call","value":[1180,1852,236,1382]},{"type":"call","value":[1180,1852,1020,3007]},{"type":"call","value":[1180,1852,2700,3833]},{"type":"call","value":[1180,1852,2596,3534]},{"type":"call","value":[1180,1852,2208,1533]},{"type":"call","value":[1180,1852,2596,236]},{"type":"call","value":[1180,1852,2596,2222]},{"type":"call","value":[1180,1852,2596,4684]},{"type":"call","value":[1180,1852,1156,759]},{"type":"call","value":[1180,1852,2596,254]},{"type":"call","value":[1180,1852,2596,1813]},{"type":"call","value":[1180,1852,2596,3372]},{"type":"call","value":[1180,1852,2596,2060]},{"type":"call","value":[1180,1852,764,531]},{"type":"call","value":[1180,1852,2596,272]},{"type":"call","value":[1180,1852,2596,1831]},{"type":"call","value":[1180,1852,2596,3390]},{"type":"call","value":[1180,1852,920,153]},{"type":"call","value":[1180,1852,2596,4064]},{"type":"call","value":[1180,1852,2832,3798]},{"type":"call","value":[1180,1852,2596,3408]},{"type":"call","value":[1180,1852,2596,2752]},{"type":"call","value":[1180,1852,764,369]},{"type":"call","value":[1180,1852,2596,3902]},{"type":"call","value":[1180,1852,764,387]},{"type":"call","value":[1180,1852,2596,4805]},{"type":"call","value":[1180,1852,764,405]},{"type":"call","value":[1180,1852,1020,2737]},{"type":"call","value":[1180,1852,968,3005]},{"type":"call","value":[1180,1852,2596,2837]},{"type":"call","value":[1180,1852,2596,4823]},{"type":"call","value":[1180,1852,920,27]},{"type":"call","value":[1180,1852,1156,898]},{"type":"call","value":[1180,1852,2596,2855]},{"type":"call","value":[1180,1852,920,45]},{"type":"call","value":[1180,1852,2596,640]},{"type":"call","value":[1180,1852,1156,916]},{"type":"call","value":[1180,1852,2700,3828]},{"type":"call","value":[1180,1852,2208,1528]},{"type":"call","value":[1180,1852,1476,1670]},{"type":"call","value":[1180,1852,1876,3184]},{"type":"call","value":[1180,1852,2596,4679]},{"type":"call","value":[1180,1852,1156,754]},{"type":"call","value":[1180,1852,2596,2464]},{"type":"call","value":[1180,1852,236,1215]},{"type":"call","value":[1180,1852,2596,3367]},{"type":"call","value":[1180,1852,2596,4697]},{"type":"call","value":[1180,1852,1156,772]},{"type":"call","value":[1180,1852,2596,2482]},{"type":"call","value":[1180,1852,764,526]},{"type":"call","value":[1180,1852,2596,3385]},{"type":"call","value":[1180,1852,920,148]},{"type":"call","value":[1180,1852,1156,2578]},{"type":"call","value":[1180,1852,1156,790]},{"type":"call","value":[1180,1852,920,166]},{"type":"call","value":[1180,1852,236,1089]},{"type":"call","value":[1180,1852,2832,2499]},{"type":"call","value":[1180,1852,764,382]},{"type":"call","value":[1180,1852,1020,2714]},{"type":"call","value":[1180,1852,1200,3770]},{"type":"call","value":[1180,1852,1020,2732]},{"type":"call","value":[1180,1852,2616,1980]},{"type":"call","value":[1180,1852,2596,4818]},{"type":"call","value":[1180,1852,920,22]},{"type":"call","value":[1180,1852,2596,2176]},{"type":"call","value":[1180,1852,2596,4162]},{"type":"call","value":[1180,1852,1156,893]},{"type":"call","value":[1180,1852,2596,3506]},{"type":"call","value":[1180,1852,2596,1291]},{"type":"call","value":[1180,1852,2596,2194]},{"type":"call","value":[1180,1852,2596,3524]},{"type":"call","value":[1180,1852,2208,1523]},{"type":"call","value":[1180,1852,2596,2441]},{"type":"call","value":[1180,1852,1876,3179]},{"type":"call","value":[1180,1852,2596,2212]},{"type":"call","value":[1180,1852,2700,3841]},{"type":"call","value":[1180,1852,2596,1556]},{"type":"call","value":[1180,1852,2596,3115]},{"type":"call","value":[1180,1852,2596,244]},{"type":"call","value":[1180,1852,2596,1803]},{"type":"call","value":[1180,1852,2596,3362]},{"type":"call","value":[1180,1852,1028,3483]},{"type":"call","value":[1180,1852,1156,767]},{"type":"call","value":[1180,1852,2596,2050]},{"type":"call","value":[1180,1852,2596,1821]},{"type":"call","value":[1180,1852,1156,2573]},{"type":"call","value":[1180,1852,1020,3100]},{"type":"call","value":[1180,1852,2596,2068]},{"type":"call","value":[1180,1852,920,161]},{"type":"call","value":[1180,1852,2596,3874]},{"type":"call","value":[1180,1852,764,359]},{"type":"call","value":[1180,1852,2596,3892]},{"type":"call","value":[1180,1852,764,377]},{"type":"call","value":[1180,1852,2596,1250]},{"type":"call","value":[1180,1852,2596,4139]},{"type":"call","value":[1180,1852,2616,1975]},{"type":"call","value":[1180,1852,236,1349]},{"type":"call","value":[1180,1852,1156,888]},{"type":"call","value":[1180,1852,2596,2171]},{"type":"call","value":[1180,1852,2596,4157]},{"type":"call","value":[1180,1852,1020,2974]},{"type":"call","value":[1180,1852,2596,3501]},{"type":"call","value":[1180,1852,2596,2845]},{"type":"call","value":[1180,1852,1156,906]},{"type":"call","value":[1180,1852,2596,2189]},{"type":"call","value":[1180,1852,1876,3156]},{"type":"call","value":[1180,1852,2596,4651]},{"type":"call","value":[1180,1852,2208,1518]},{"type":"call","value":[1180,1852,764,480]},{"type":"call","value":[1180,1852,2596,221]},{"type":"call","value":[1180,1852,2596,1780]},{"type":"call","value":[1180,1852,1876,3174]},{"type":"call","value":[1180,1852,2700,3836]},{"type":"call","value":[1180,1852,2596,2027]},{"type":"call","value":[1180,1852,2596,239]},{"type":"call","value":[1180,1852,920,120]},{"type":"call","value":[1180,1852,2596,4687]},{"type":"call","value":[1180,1852,1156,762]},{"type":"call","value":[1180,1852,2596,2045]},{"type":"call","value":[1180,1852,2596,3375]},{"type":"call","value":[1180,1852,920,138]},{"type":"call","value":[1180,1852,1156,2568]},{"type":"call","value":[1180,1852,764,336]},{"type":"call","value":[1180,1852,1020,3095]},{"type":"call","value":[1180,1852,2596,2063]},{"type":"call","value":[1180,1852,2832,3127]},{"type":"call","value":[1180,1852,920,156]},{"type":"call","value":[1180,1852,2596,3869]},{"type":"call","value":[1180,1852,764,354]},{"type":"call","value":[1180,1852,1020,3113]},{"type":"call","value":[1180,1852,2596,4772]},{"type":"call","value":[1180,1852,2596,3887]},{"type":"call","value":[1180,1852,764,372]},{"type":"call","value":[1180,1852,2596,1263]},{"type":"call","value":[1180,1852,2596,2822]},{"type":"call","value":[1180,1852,920,12]},{"type":"call","value":[1180,1852,1020,2969]},{"type":"call","value":[1180,1852,236,1164]},{"type":"call","value":[1180,1852,1476,1637]},{"type":"call","value":[1180,1852,2596,2413]},{"type":"call","value":[1180,1852,2596,2840]},{"type":"call","value":[1180,1852,2616,1988]},{"type":"call","value":[1180,1852,1400,2544]},{"type":"call","value":[1180,1852,2596,4646]},{"type":"call","value":[1180,1852,2596,2431]},{"type":"call","value":[1180,1852,764,475]},{"type":"call","value":[1180,1852,1876,3169]},{"type":"call","value":[1180,1852,2700,3831]},{"type":"call","value":[1180,1852,2596,4664]},{"type":"call","value":[1180,1852,2596,2449]},{"type":"call","value":[1180,1852,2856,1036]},{"type":"call","value":[1180,1852,920,115]},{"type":"call","value":[1180,1852,1156,757]},{"type":"call","value":[1180,1852,2596,3599]},{"type":"call","value":[1180,1852,2596,3370]},{"type":"call","value":[1180,1852,920,133]},{"type":"call","value":[1180,1852,1156,2563]},{"type":"call","value":[1180,1852,2596,1631]},{"type":"call","value":[1180,1852,2596,3617]},{"type":"call","value":[1180,1852,2596,4767]},{"type":"call","value":[1180,1852,2596,4111]},{"type":"call","value":[1180,1852,2596,4785]},{"type":"call","value":[1180,1852,1156,860]},{"type":"call","value":[1180,1852,2832,992]},{"type":"call","value":[1180,1852,2596,4803]},{"type":"call","value":[1180,1852,2596,4147]},{"type":"call","value":[1180,1852,1020,2964]},{"type":"call","value":[1180,1852,2616,1983]},{"type":"call","value":[1180,1852,1400,2539]},{"type":"call","value":[1180,1852,2596,2408]},{"type":"call","value":[1180,1852,764,452]},{"type":"call","value":[1180,1852,2596,1752]},{"type":"call","value":[1180,1852,2596,2179]},{"type":"call","value":[1180,1852,2596,2426]},{"type":"call","value":[1180,1852,764,470]},{"type":"call","value":[1180,1852,1876,3164]},{"type":"call","value":[1180,1852,2596,1770]},{"type":"call","value":[1180,1852,1156,2949]},{"type":"call","value":[1180,1852,2856,1031]},{"type":"call","value":[1180,1852,2596,1788]},{"type":"call","value":[1180,1852,1808,4052]},{"type":"call","value":[1180,1852,920,110]},{"type":"call","value":[1180,1852,1020,3067]},{"type":"call","value":[1180,1852,2596,2035]},{"type":"call","value":[1180,1852,2596,3594]},{"type":"call","value":[1180,1852,2596,4924]},{"type":"call","value":[1180,1852,920,128]},{"type":"call","value":[1180,1852,2832,4002]},{"type":"call","value":[1180,1852,2596,3612]},{"type":"call","value":[1180,1852,764,573]},{"type":"call","value":[1180,1852,1020,2676]},{"type":"call","value":[1180,1852,2444,5051]},{"type":"call","value":[1180,1852,2596,3203]},{"type":"call","value":[1180,1852,2596,4106]},{"type":"call","value":[1180,1852,2596,3450]},{"type":"call","value":[1180,1852,2596,3877]},{"type":"call","value":[1180,1852,2596,2794]},{"type":"call","value":[1180,1852,2596,3468]},{"type":"call","value":[1180,1852,2596,170]},{"type":"call","value":[1180,1852,1020,2959]},{"type":"call","value":[1180,1852,2596,4618]},{"type":"call","value":[1180,1852,2616,1978]},{"type":"call","value":[1180,1852,2596,2830]},{"type":"call","value":[1180,1852,2596,3962]},{"type":"call","value":[1180,1852,764,447]},{"type":"call","value":[1180,1852,2596,1747]},{"type":"call","value":[1180,1852,2596,2174]},{"type":"call","value":[1180,1852,1400,2534]},{"type":"call","value":[1180,1852,2596,4636]},{"type":"call","value":[1180,1852,764,465]},{"type":"call","value":[1180,1852,2596,206]},{"type":"call","value":[1180,1852,2596,1765]},{"type":"call","value":[1180,1852,1876,3159]},{"type":"call","value":[1180,1852,920,87]},{"type":"call","value":[1180,1852,2856,1026]},{"type":"call","value":[1180,1852,1808,4047]},{"type":"call","value":[1180,1852,920,105]},{"type":"call","value":[1180,1852,1020,3062]},{"type":"call","value":[1180,1852,2596,2030]},{"type":"call","value":[1180,1852,920,123]},{"type":"call","value":[1180,1852,764,321]},{"type":"call","value":[1180,1852,764,568]},{"type":"call","value":[1180,1852,2596,4757]},{"type":"call","value":[1180,1852,1020,2918]},{"type":"call","value":[1180,1852,1028,2007]},{"type":"call","value":[1180,1852,2596,3445]},{"type":"call","value":[1180,1852,2596,2789]},{"type":"call","value":[1180,1852,2596,4775]},{"type":"call","value":[1180,1852,2596,2133]},{"type":"call","value":[1180,1852,2596,3463]},{"type":"call","value":[1180,1852,2596,4613]},{"type":"call","value":[1180,1852,2832,1000]},{"type":"call","value":[1180,1852,2596,2398]},{"type":"call","value":[1180,1852,764,442]},{"type":"call","value":[1180,1852,2616,1973]},{"type":"call","value":[1180,1852,1400,2529]},{"type":"call","value":[1180,1852,2596,4631]},{"type":"call","value":[1180,1852,236,1167]},{"type":"call","value":[1180,1852,2596,2416]},{"type":"call","value":[1180,1852,2596,3975]},{"type":"call","value":[1180,1852,764,460]},{"type":"call","value":[1180,1852,920,82]},{"type":"call","value":[1180,1852,1808,4042]},{"type":"call","value":[1180,1852,920,100]},{"type":"call","value":[1180,1852,2596,2254]},{"type":"call","value":[1180,1852,1020,3057]},{"type":"call","value":[1180,1852,2596,3584]},{"type":"call","value":[1180,1852,2856,1039]},{"type":"call","value":[1180,1852,920,118]},{"type":"call","value":[1180,1852,2596,286]},{"type":"call","value":[1180,1852,2596,2272]},{"type":"call","value":[1180,1852,1020,2648]},{"type":"call","value":[1180,1852,2596,4734]},{"type":"call","value":[1180,1852,2596,4078]},{"type":"call","value":[1180,1852,764,563]},{"type":"call","value":[1180,1852,2596,2290]},{"type":"call","value":[1180,1852,764,334]},{"type":"call","value":[1180,1852,2596,3193]},{"type":"call","value":[1180,1852,2596,4752]},{"type":"call","value":[1180,1852,2596,4096]},{"type":"call","value":[1180,1852,1020,2913]},{"type":"call","value":[1180,1852,2596,4770]},{"type":"call","value":[1180,1852,2596,4114]},{"type":"call","value":[1180,1852,764,419]},{"type":"call","value":[1180,1852,2596,1719]},{"type":"call","value":[1180,1852,2596,2393]},{"type":"call","value":[1180,1852,2596,3952]},{"type":"call","value":[1180,1852,764,437]},{"type":"call","value":[1180,1852,2596,1737]},{"type":"call","value":[1180,1852,2596,2411]},{"type":"call","value":[1180,1852,764,455]},{"type":"call","value":[1180,1852,2596,1328]},{"type":"call","value":[1180,1852,2596,1755]},{"type":"call","value":[1180,1852,2596,3561]},{"type":"call","value":[1180,1852,1808,4037]},{"type":"call","value":[1180,1852,920,95]},{"type":"call","value":[1180,1852,1020,3052]},{"type":"call","value":[1180,1852,2596,2020]},{"type":"call","value":[1180,1852,2856,1034]},{"type":"call","value":[1180,1852,2596,281]},{"type":"call","value":[1180,1852,2596,2267]},{"type":"call","value":[1180,1852,1020,2643]},{"type":"call","value":[1180,1852,1020,3070]},{"type":"call","value":[1180,1852,2596,4073]},{"type":"call","value":[1180,1852,764,558]},{"type":"call","value":[1180,1852,2596,3417]},{"type":"call","value":[1180,1852,2596,2761]},{"type":"call","value":[1180,1852,1156,822]},{"type":"call","value":[1180,1852,2596,2105]},{"type":"call","value":[1180,1852,2596,4091]},{"type":"call","value":[1180,1852,764,576]},{"type":"call","value":[1180,1852,1020,2908]},{"type":"call","value":[1180,1852,2596,3435]},{"type":"call","value":[1180,1852,920,198]},{"type":"call","value":[1180,1852,2596,2779]},{"type":"call","value":[1180,1852,2596,2123]},{"type":"call","value":[1180,1852,2596,4109]},{"type":"call","value":[1180,1852,2596,3453]},{"type":"call","value":[1180,1852,236,1121]},{"type":"call","value":[1180,1852,2596,2797]},{"type":"call","value":[1180,1852,764,414]},{"type":"call","value":[1180,1852,2596,1714]},{"type":"call","value":[1180,1852,2596,4603]},{"type":"call","value":[1180,1852,2596,3947]},{"type":"call","value":[1180,1852,764,432]},{"type":"call","value":[1180,1852,2596,1732]},{"type":"call","value":[1180,1852,2596,4621]},{"type":"call","value":[1180,1852,236,1157]},{"type":"call","value":[1180,1852,2596,3965]},{"type":"call","value":[1180,1852,764,450]},{"type":"call","value":[1180,1852,2596,1750]},{"type":"call","value":[1180,1852,2596,4868]},{"type":"call","value":[1180,1852,920,72]},{"type":"call","value":[1180,1852,2828,1046]},{"type":"call","value":[1180,1852,1808,4032]},{"type":"call","value":[1180,1852,920,90]},{"type":"call","value":[1180,1852,1020,3047]},{"type":"call","value":[1180,1852,764,535]},{"type":"call","value":[1180,1852,764,553]},{"type":"call","value":[1180,1852,2596,3412]},{"type":"call","value":[1180,1852,1020,2656]},{"type":"call","value":[1180,1852,2596,2756]},{"type":"call","value":[1180,1852,2596,4742]},{"type":"call","value":[1180,1852,764,571]},{"type":"call","value":[1180,1852,1020,2903]},{"type":"call","value":[1180,1852,676,3344]},{"type":"call","value":[1180,1852,2596,2774]},{"type":"call","value":[1180,1852,764,409]},{"type":"call","value":[1180,1852,2596,4598]},{"type":"call","value":[1180,1852,2596,2383]},{"type":"call","value":[1180,1852,764,427]},{"type":"call","value":[1180,1852,2596,4845]},{"type":"call","value":[1180,1852,920,49]},{"type":"call","value":[1180,1852,1156,920]},{"type":"call","value":[1180,1852,2596,4616]},{"type":"call","value":[1180,1852,2596,3533]},{"type":"call","value":[1180,1852,2596,2221]},{"type":"call","value":[1180,1852,2596,3551]},{"type":"call","value":[1180,1852,920,85]},{"type":"call","value":[1180,1852,2596,3569]},{"type":"call","value":[1180,1852,2596,2486]},{"type":"call","value":[1180,1852,764,530]},{"type":"call","value":[1180,1852,2596,271]},{"type":"call","value":[1180,1852,2596,2257]},{"type":"call","value":[1180,1852,1156,1877]},{"type":"call","value":[1180,1852,1156,4995]},{"type":"call","value":[1180,1852,1156,2353]},{"type":"call","value":[1180,1852,764,548]},{"type":"call","value":[1180,1852,2596,289]},{"type":"call","value":[1180,1852,2596,1848]},{"type":"call","value":[1180,1852,1020,2651]},{"type":"call","value":[1180,1852,2596,4737]},{"type":"call","value":[1180,1852,1156,812]},{"type":"call","value":[1180,1852,2596,4081]},{"type":"call","value":[1180,1852,676,3339]},{"type":"call","value":[1180,1852,764,386]},{"type":"call","value":[1180,1852,2596,2113]},{"type":"call","value":[1180,1852,1020,2916]},{"type":"call","value":[1180,1852,764,404]},{"type":"call","value":[1180,1852,1028,940]},{"type":"call","value":[1180,1852,236,1129]},{"type":"call","value":[1180,1852,2596,2378]},{"type":"call","value":[1180,1852,764,422]},{"type":"call","value":[1180,1852,1476,1602]},{"type":"call","value":[1180,1852,2596,1295]},{"type":"call","value":[1180,1852,2596,1722]},{"type":"call","value":[1180,1852,236,1376]},{"type":"call","value":[1180,1852,2736,2373]},{"type":"call","value":[1180,1852,2596,4184]},{"type":"call","value":[1180,1852,2596,3528]},{"type":"call","value":[1180,1852,2596,1313]},{"type":"call","value":[1180,1852,2596,2216]},{"type":"call","value":[1180,1852,2700,3845]},{"type":"call","value":[1180,1852,2596,3546]},{"type":"call","value":[1180,1852,920,80]},{"type":"call","value":[1180,1852,2596,248]},{"type":"call","value":[1180,1852,2596,2234]},{"type":"call","value":[1180,1852,1020,3037]},{"type":"call","value":[1180,1852,2832,3298]},{"type":"call","value":[1180,1852,2596,4696]},{"type":"call","value":[1180,1852,764,525]},{"type":"call","value":[1180,1852,2596,266]},{"type":"call","value":[1180,1852,2596,1825]},{"type":"call","value":[1180,1852,2596,3384]},{"type":"call","value":[1180,1852,2596,2072]},{"type":"call","value":[1180,1852,764,543]},{"type":"call","value":[1180,1852,2596,284]},{"type":"call","value":[1180,1852,2596,3402]},{"type":"call","value":[1180,1852,1020,2646]},{"type":"call","value":[1180,1852,920,165]},{"type":"call","value":[1180,1852,2596,4732]},{"type":"call","value":[1180,1852,2596,2090]},{"type":"call","value":[1180,1852,2596,4076]},{"type":"call","value":[1180,1852,1156,3696]},{"type":"call","value":[1180,1852,676,3334]},{"type":"call","value":[1180,1852,920,183]},{"type":"call","value":[1180,1852,2596,2764]},{"type":"call","value":[1180,1852,764,381]},{"type":"call","value":[1180,1852,1200,3769]},{"type":"call","value":[1180,1852,2596,2108]},{"type":"call","value":[1180,1852,2596,3914]},{"type":"call","value":[1180,1852,764,399]},{"type":"call","value":[1180,1852,2596,4817]},{"type":"call","value":[1180,1852,2596,3932]},{"type":"call","value":[1180,1852,764,417]},{"type":"call","value":[1180,1852,2596,1717]},{"type":"call","value":[1180,1852,2596,4835]},{"type":"call","value":[1180,1852,2596,4179]},{"type":"call","value":[1180,1852,2596,5082]},{"type":"call","value":[1180,1852,1156,1584]},{"type":"call","value":[1180,1852,1020,3014]},{"type":"call","value":[1180,1852,2700,3840]},{"type":"call","value":[1180,1852,1732,5017]},{"type":"call","value":[1180,1852,2596,1573]},{"type":"call","value":[1180,1852,2596,4691]},{"type":"call","value":[1180,1852,1156,766]},{"type":"call","value":[1180,1852,2596,2476]},{"type":"call","value":[1180,1852,764,520]},{"type":"call","value":[1180,1852,2596,3379]},{"type":"call","value":[1180,1852,764,538]},{"type":"call","value":[1180,1852,2596,3397]},{"type":"call","value":[1180,1852,920,160]},{"type":"call","value":[1180,1852,1156,802]},{"type":"call","value":[1180,1852,2596,3415]},{"type":"call","value":[1180,1852,676,3329]},{"type":"call","value":[1180,1852,2596,2759]},{"type":"call","value":[1180,1852,764,376]},{"type":"call","value":[1180,1852,764,394]},{"type":"call","value":[1180,1852,920,16]},{"type":"call","value":[1180,1852,2596,4156]},{"type":"call","value":[1180,1852,2596,3500]},{"type":"call","value":[1180,1852,1020,2744]},{"type":"call","value":[1180,1852,2596,4830]},{"type":"call","value":[1180,1852,1156,905]},{"type":"call","value":[1180,1852,2596,2188]},{"type":"call","value":[1180,1852,2596,3518]},{"type":"call","value":[1180,1852,2208,1517]},{"type":"call","value":[1180,1852,2596,1303]},{"type":"call","value":[1180,1852,2596,2862]},{"type":"call","value":[1180,1852,2596,4848]},{"type":"call","value":[1180,1852,2596,2206]},{"type":"call","value":[1180,1852,1020,3009]},{"type":"call","value":[1180,1852,2700,3835]},{"type":"call","value":[1180,1852,2596,1550]},{"type":"call","value":[1180,1852,2596,3536]},{"type":"call","value":[1180,1852,2596,2453]},{"type":"call","value":[1180,1852,2596,238]},{"type":"call","value":[1180,1852,2596,2224]},{"type":"call","value":[1180,1852,2700,3853]},{"type":"call","value":[1180,1852,236,1222]},{"type":"call","value":[1180,1852,1156,761]},{"type":"call","value":[1180,1852,2596,2471]},{"type":"call","value":[1180,1852,764,515]},{"type":"call","value":[1180,1852,2596,256]},{"type":"call","value":[1180,1852,2596,1815]},{"type":"call","value":[1180,1852,2596,4704]},{"type":"call","value":[1180,1852,1156,779]},{"type":"call","value":[1180,1852,2596,2062]},{"type":"call","value":[1180,1852,764,533]},{"type":"call","value":[1180,1852,236,2143]},{"type":"call","value":[1180,1852,920,155]},{"type":"call","value":[1180,1852,2596,2080]},{"type":"call","value":[1180,1852,2596,3886]},{"type":"call","value":[1180,1852,764,371]},{"type":"call","value":[1180,1852,2596,3904]},{"type":"call","value":[1180,1852,764,389]},{"type":"call","value":[1180,1852,920,11]},{"type":"call","value":[1180,1852,2596,4151]},{"type":"call","value":[1180,1852,2596,3922]},{"type":"call","value":[1180,1852,2616,1987]},{"type":"call","value":[1180,1852,1020,2739]},{"type":"call","value":[1180,1852,2596,2839]},{"type":"call","value":[1180,1852,1156,900]},{"type":"call","value":[1180,1852,2596,2183]},{"type":"call","value":[1180,1852,2596,4169]},{"type":"call","value":[1180,1852,2596,3513]},{"type":"call","value":[1180,1852,2596,1298]},{"type":"call","value":[1180,1852,2596,642]},{"type":"call","value":[1180,1852,2596,2201]},{"type":"call","value":[1180,1852,1156,918]},{"type":"call","value":[1180,1852,1876,3168]},{"type":"call","value":[1180,1852,2700,3830]},{"type":"call","value":[1180,1852,2596,4663]},{"type":"call","value":[1180,1852,2208,1530]},{"type":"call","value":[1180,1852,2596,233]},{"type":"call","value":[1180,1852,2596,1792]},{"type":"call","value":[1180,1852,2596,2219]},{"type":"call","value":[1180,1852,2832,1953]},{"type":"call","value":[1180,1852,2700,3848]},{"type":"call","value":[1180,1852,2596,4681]},{"type":"call","value":[1180,1852,1156,756]},{"type":"call","value":[1180,1852,2596,251]},{"type":"call","value":[1180,1852,2596,1810]},{"type":"call","value":[1180,1852,2596,3369]},{"type":"call","value":[1180,1852,920,132]},{"type":"call","value":[1180,1852,2596,2057]},{"type":"call","value":[1180,1852,2596,3387]},{"type":"call","value":[1180,1852,920,150]},{"type":"call","value":[1180,1852,2596,2075]},{"type":"call","value":[1180,1852,1156,2351]},{"type":"call","value":[1180,1852,2828,4242]},{"type":"call","value":[1180,1852,920,168]},{"type":"call","value":[1180,1852,2596,3881]},{"type":"call","value":[1180,1852,764,366]},{"type":"call","value":[1180,1852,236,1091]},{"type":"call","value":[1180,1852,2832,2501]},{"type":"call","value":[1180,1852,2596,3899]},{"type":"call","value":[1180,1852,764,384]},{"type":"call","value":[1180,1852,1020,2716]},{"type":"call","value":[1180,1852,2596,4802]},{"type":"call","value":[1180,1852,1020,2963]},{"type":"call","value":[1180,1852,1020,2734]},{"type":"call","value":[1180,1852,2616,1982]},{"type":"call","value":[1180,1852,2596,2834]},{"type":"call","value":[1180,1852,2596,4820]},{"type":"call","value":[1180,1852,920,24]},{"type":"call","value":[1180,1852,1156,895]},{"type":"call","value":[1180,1852,1020,2981]},{"type":"call","value":[1180,1852,1400,2556]},{"type":"call","value":[1180,1852,2596,2852]},{"type":"call","value":[1180,1852,2596,210]},{"type":"call","value":[1180,1852,2596,637]},{"type":"call","value":[1180,1852,1876,3163]},{"type":"call","value":[1180,1852,2208,1525]},{"type":"call","value":[1180,1852,2596,228]},{"type":"call","value":[1180,1852,2700,3843]},{"type":"call","value":[1180,1852,2596,4676]},{"type":"call","value":[1180,1852,764,734]},{"type":"call","value":[1180,1852,2596,2461]},{"type":"call","value":[1180,1852,764,505]},{"type":"call","value":[1180,1852,1156,751]},{"type":"call","value":[1180,1852,1476,1685]},{"type":"call","value":[1180,1852,2596,3364]},{"type":"call","value":[1180,1852,920,127]},{"type":"call","value":[1180,1852,2596,4694]},{"type":"call","value":[1180,1852,1156,769]},{"type":"call","value":[1180,1852,2596,3382]},{"type":"call","value":[1180,1852,1156,2575]},{"type":"call","value":[1180,1852,920,163]},{"type":"call","value":[1180,1852,764,361]},{"type":"call","value":[1180,1852,2596,4779]},{"type":"call","value":[1180,1852,236,1086]},{"type":"call","value":[1180,1852,764,379]},{"type":"call","value":[1180,1852,2596,1252]},{"type":"call","value":[1180,1852,1020,2958]},{"type":"call","value":[1180,1852,2616,1977]},{"type":"call","value":[1180,1852,1400,2533]},{"type":"call","value":[1180,1852,2596,4815]},{"type":"call","value":[1180,1852,1156,890]},{"type":"call","value":[1180,1852,2596,2173]},{"type":"call","value":[1180,1852,2596,4159]},{"type":"call","value":[1180,1852,2596,3503]},{"type":"call","value":[1180,1852,236,1171]},{"type":"call","value":[1180,1852,1400,2551]},{"type":"call","value":[1180,1852,2596,2420]},{"type":"call","value":[1180,1852,764,464]},{"type":"call","value":[1180,1852,2596,205]},{"type":"call","value":[1180,1852,2596,1764]},{"type":"call","value":[1180,1852,2596,2191]},{"type":"call","value":[1180,1852,1876,3158]},{"type":"call","value":[1180,1852,2208,1520]},{"type":"call","value":[1180,1852,764,482]},{"type":"call","value":[1180,1852,2832,1943]},{"type":"call","value":[1180,1852,2700,3838]},{"type":"call","value":[1180,1852,1156,4947]},{"type":"call","value":[1180,1852,1156,746]},{"type":"call","value":[1180,1852,2596,2029]},{"type":"call","value":[1180,1852,2596,1800]},{"type":"call","value":[1180,1852,920,122]},{"type":"call","value":[1180,1852,1156,764]},{"type":"call","value":[1180,1852,2596,2047]},{"type":"call","value":[1180,1852,2596,3606]},{"type":"call","value":[1180,1852,920,140]},{"type":"call","value":[1180,1852,2596,2065]},{"type":"call","value":[1180,1852,2832,3129]},{"type":"call","value":[1180,1852,2596,3871]},{"type":"call","value":[1180,1852,764,356]},{"type":"call","value":[1180,1852,2596,4118]},{"type":"call","value":[1180,1852,2596,3462]},{"type":"call","value":[1180,1852,2596,3889]},{"type":"call","value":[1180,1852,2596,1247]},{"type":"call","value":[1180,1852,2596,4136]},{"type":"call","value":[1180,1852,2616,1972]},{"type":"call","value":[1180,1852,920,14]},{"type":"call","value":[1180,1852,2596,4154]},{"type":"call","value":[1180,1852,1020,2971]},{"type":"call","value":[1180,1852,2596,3498]},{"type":"call","value":[1180,1852,2596,4630]},{"type":"call","value":[1180,1852,236,1166]},{"type":"call","value":[1180,1852,2596,2842]},{"type":"call","value":[1180,1852,764,459]},{"type":"call","value":[1180,1852,2616,1990]},{"type":"call","value":[1180,1852,2596,1759]},{"type":"call","value":[1180,1852,2596,2186]},{"type":"call","value":[1180,1852,1400,2546]},{"type":"call","value":[1180,1852,1876,5139]},{"type":"call","value":[1180,1852,2208,1515]},{"type":"call","value":[1180,1852,764,477]},{"type":"call","value":[1180,1852,1876,3171]},{"type":"call","value":[1180,1852,2596,2024]},{"type":"call","value":[1180,1852,2856,1038]},{"type":"call","value":[1180,1852,920,117]},{"type":"call","value":[1180,1852,2596,2042]},{"type":"call","value":[1180,1852,920,135]},{"type":"call","value":[1180,1852,1156,2565]},{"type":"call","value":[1180,1852,1020,3092]},{"type":"call","value":[1180,1852,2596,1633]},{"type":"call","value":[1180,1852,2596,3866]},{"type":"call","value":[1180,1852,2596,3210]},{"type":"call","value":[1180,1852,2596,4769]},{"type":"call","value":[1180,1852,2596,3457]},{"type":"call","value":[1180,1852,2596,3884]},{"type":"call","value":[1180,1852,2596,2801]},{"type":"call","value":[1180,1852,2596,4787]},{"type":"call","value":[1180,1852,1156,862]},{"type":"call","value":[1180,1852,2596,3475]},{"type":"call","value":[1180,1852,2832,994]},{"type":"call","value":[1180,1852,2596,2819]},{"type":"call","value":[1180,1852,920,9]},{"type":"call","value":[1180,1852,1020,2966]},{"type":"call","value":[1180,1852,2596,4625]},{"type":"call","value":[1180,1852,2616,1985]},{"type":"call","value":[1180,1852,2596,2410]},{"type":"call","value":[1180,1852,764,454]},{"type":"call","value":[1180,1852,1400,2541]},{"type":"call","value":[1180,1852,1156,2933]},{"type":"call","value":[1180,1852,2596,4643]},{"type":"call","value":[1180,1852,1476,1652]},{"type":"call","value":[1180,1852,2596,2428]},{"type":"call","value":[1180,1852,764,472]},{"type":"call","value":[1180,1852,2596,213]},{"type":"call","value":[1180,1852,1876,3166]},{"type":"call","value":[1180,1852,920,94]},{"type":"call","value":[1180,1852,2596,4661]},{"type":"call","value":[1180,1852,2596,2019]},{"type":"call","value":[1180,1852,2856,1033]},{"type":"call","value":[1180,1852,920,112]},{"type":"call","value":[1180,1852,2596,2266]},{"type":"call","value":[1180,1852,2596,3596]},{"type":"call","value":[1180,1852,920,130]},{"type":"call","value":[1180,1852,1020,2660]},{"type":"call","value":[1180,1852,2596,4746]},{"type":"call","value":[1180,1852,2596,4090]},{"type":"call","value":[1180,1852,2596,3861]},{"type":"call","value":[1180,1852,2596,4764]},{"type":"call","value":[1180,1852,2596,4108]},{"type":"call","value":[1180,1852,764,593]},{"type":"call","value":[1180,1852,1156,3728]},{"type":"call","value":[1180,1852,2596,4782]},{"type":"call","value":[1180,1852,2596,4126]},{"type":"call","value":[1180,1852,2596,2387]},{"type":"call","value":[1180,1852,764,431]},{"type":"call","value":[1180,1852,1020,2961]},{"type":"call","value":[1180,1852,1400,2536]},{"type":"call","value":[1180,1852,2596,2405]},{"type":"call","value":[1180,1852,2596,3964]},{"type":"call","value":[1180,1852,764,449]},{"type":"call","value":[1180,1852,2596,1749]},{"type":"call","value":[1180,1852,2596,2423]},{"type":"call","value":[1180,1852,764,467]},{"type":"call","value":[1180,1852,1876,3161]},{"type":"call","value":[1180,1852,2596,1767]},{"type":"call","value":[1180,1852,2596,4885]},{"type":"call","value":[1180,1852,920,89]},{"type":"call","value":[1180,1852,236,1421]},{"type":"call","value":[1180,1852,1020,3046]},{"type":"call","value":[1180,1852,2596,3573]},{"type":"call","value":[1180,1852,2856,1028]},{"type":"call","value":[1180,1852,1808,4049]},{"type":"call","value":[1180,1852,920,107]},{"type":"call","value":[1180,1852,2596,2261]},{"type":"call","value":[1180,1852,764,732]},{"type":"call","value":[1180,1852,2596,2032]},{"type":"call","value":[1180,1852,2596,3591]},{"type":"call","value":[1180,1852,920,125]},{"type":"call","value":[1180,1852,2596,293]},{"type":"call","value":[1180,1852,2596,2279]},{"type":"call","value":[1180,1852,764,323]},{"type":"call","value":[1180,1852,2596,4085]},{"type":"call","value":[1180,1852,764,570]},{"type":"call","value":[1180,1852,2596,2773]},{"type":"call","value":[1180,1852,1156,834]},{"type":"call","value":[1180,1852,2596,2117]},{"type":"call","value":[1180,1852,2596,4103]},{"type":"call","value":[1180,1852,2596,1888]},{"type":"call","value":[1180,1852,2596,3447]},{"type":"call","value":[1180,1852,2596,2791]},{"type":"call","value":[1180,1852,2596,4121]},{"type":"call","value":[1180,1852,2596,3465]},{"type":"call","value":[1180,1852,236,1133]},{"type":"call","value":[1180,1852,1476,1606]},{"type":"call","value":[1180,1852,2596,2809]},{"type":"call","value":[1180,1852,764,426]},{"type":"call","value":[1180,1852,2596,1726]},{"type":"call","value":[1180,1852,2596,4615]},{"type":"call","value":[1180,1852,2832,1002]},{"type":"call","value":[1180,1852,1400,2531]},{"type":"call","value":[1180,1852,2596,3959]},{"type":"call","value":[1180,1852,764,444]},{"type":"call","value":[1180,1852,2596,1744]},{"type":"call","value":[1180,1852,2208,3288]},{"type":"call","value":[1180,1852,2596,4633]},{"type":"call","value":[1180,1852,236,1169]},{"type":"call","value":[1180,1852,764,462]},{"type":"call","value":[1180,1852,2596,1762]},{"type":"call","value":[1180,1852,2832,1496]},{"type":"call","value":[1180,1852,920,84]},{"type":"call","value":[1180,1852,2856,1023]},{"type":"call","value":[1180,1852,1808,4044]},{"type":"call","value":[1180,1852,920,102]},{"type":"call","value":[1180,1852,1020,3059]},{"type":"call","value":[1180,1852,2856,1041]},{"type":"call","value":[1180,1852,764,547]},{"type":"call","value":[1180,1852,764,318]},{"type":"call","value":[1180,1852,1020,2650]},{"type":"call","value":[1180,1852,2596,4736]},{"type":"call","value":[1180,1852,764,565]},{"type":"call","value":[1180,1852,2596,3424]},{"type":"call","value":[1180,1852,2596,2768]},{"type":"call","value":[1180,1852,2596,4754]},{"type":"call","value":[1180,1852,1028,4875]},{"type":"call","value":[1180,1852,1020,2915]},{"type":"call","value":[1180,1852,2596,2786]},{"type":"call","value":[1180,1852,1156,847]},{"type":"call","value":[1180,1852,2596,3460]},{"type":"call","value":[1180,1852,2596,4592]},{"type":"call","value":[1180,1852,2596,2804]},{"type":"call","value":[1180,1852,764,421]},{"type":"call","value":[1180,1852,2596,4610]},{"type":"call","value":[1180,1852,2596,2395]},{"type":"call","value":[1180,1852,764,439]},{"type":"call","value":[1180,1852,2208,3283]},{"type":"call","value":[1180,1852,2596,4628]},{"type":"call","value":[1180,1852,2596,3545]},{"type":"call","value":[1180,1852,2832,1491]},{"type":"call","value":[1180,1852,2596,2233]},{"type":"call","value":[1180,1852,2828,1053]},{"type":"call","value":[1180,1852,1808,4039]},{"type":"call","value":[1180,1852,920,97]},{"type":"call","value":[1180,1852,1020,3054]},{"type":"call","value":[1180,1852,2596,3581]},{"type":"call","value":[1180,1852,1808,4057]},{"type":"call","value":[1180,1852,764,542]},{"type":"call","value":[1180,1852,2596,283]},{"type":"call","value":[1180,1852,2596,1842]},{"type":"call","value":[1180,1852,2596,2269]},{"type":"call","value":[1180,1852,1020,2645]},{"type":"call","value":[1180,1852,2596,4731]},{"type":"call","value":[1180,1852,2596,4075]},{"type":"call","value":[1180,1852,764,560]},{"type":"call","value":[1180,1852,236,2170]},{"type":"call","value":[1180,1852,1020,2663]},{"type":"call","value":[1180,1852,2596,4749]},{"type":"call","value":[1180,1852,2596,2107]},{"type":"call","value":[1180,1852,2596,4093]},{"type":"call","value":[1180,1852,1020,2910]},{"type":"call","value":[1180,1852,2596,2125]},{"type":"call","value":[1180,1852,2596,3931]},{"type":"call","value":[1180,1852,764,416]},{"type":"call","value":[1180,1852,2596,1716]},{"type":"call","value":[1180,1852,1476,1614]},{"type":"call","value":[1180,1852,2596,2390]},{"type":"call","value":[1180,1852,2596,3949]},{"type":"call","value":[1180,1852,2596,175]},{"type":"call","value":[1180,1852,2596,1734]},{"type":"call","value":[1180,1852,764,434]},{"type":"call","value":[1180,1852,2596,3540]},{"type":"call","value":[1180,1852,2596,3967]},{"type":"call","value":[1180,1852,1732,5016]},{"type":"call","value":[1180,1852,920,74]},{"type":"call","value":[1180,1852,2596,2228]},{"type":"call","value":[1180,1852,2596,1572]},{"type":"call","value":[1180,1852,1808,4034]},{"type":"call","value":[1180,1852,920,92]},{"type":"call","value":[1180,1852,2596,260]},{"type":"call","value":[1180,1852,2596,2246]},{"type":"call","value":[1180,1852,1020,3049]},{"type":"call","value":[1180,1852,2596,2493]},{"type":"call","value":[1180,1852,764,537]},{"type":"call","value":[1180,1852,2596,278]},{"type":"call","value":[1180,1852,2596,2264]},{"type":"call","value":[1180,1852,2596,3396]},{"type":"call","value":[1180,1852,2596,4070]},{"type":"call","value":[1180,1852,764,555]},{"type":"call","value":[1180,1852,2596,3414]},{"type":"call","value":[1180,1852,1020,2658]},{"type":"call","value":[1180,1852,676,3328]},{"type":"call","value":[1180,1852,2596,2758]},{"type":"call","value":[1180,1852,1156,819]},{"type":"call","value":[1180,1852,2596,2102]},{"type":"call","value":[1180,1852,2596,4088]},{"type":"call","value":[1180,1852,1020,2905]},{"type":"call","value":[1180,1852,2596,3432]},{"type":"call","value":[1180,1852,2596,2776]},{"type":"call","value":[1180,1852,764,393]},{"type":"call","value":[1180,1852,2832,2510]},{"type":"call","value":[1180,1852,2596,2120]},{"type":"call","value":[1180,1852,764,411]},{"type":"call","value":[1180,1852,2596,4600]},{"type":"call","value":[1180,1852,2596,3944]},{"type":"call","value":[1180,1852,764,429]},{"type":"call","value":[1180,1852,2596,1729]},{"type":"call","value":[1180,1852,968,3029]},{"type":"call","value":[1180,1852,236,1383]},{"type":"call","value":[1180,1852,1020,3008]},{"type":"call","value":[1180,1852,2832,1481]},{"type":"call","value":[1180,1852,920,69]},{"type":"call","value":[1180,1852,1020,3044]},{"type":"call","value":[1180,1852,2596,4703]},{"type":"call","value":[1180,1852,1156,4979]},{"type":"call","value":[1180,1852,764,532]},{"type":"call","value":[1180,1852,2596,3391]},{"type":"call","value":[1180,1852,1020,2635]},{"type":"call","value":[1180,1852,1156,796]},{"type":"call","value":[1180,1852,2596,4065]},{"type":"call","value":[1180,1852,764,550]},{"type":"call","value":[1180,1852,2596,3409]},{"type":"call","value":[1180,1852,1020,2653]},{"type":"call","value":[1180,1852,2596,2753]},{"type":"call","value":[1180,1852,2596,4739]},{"type":"call","value":[1180,1852,676,3341]},{"type":"call","value":[1180,1852,2596,2771]},{"type":"call","value":[1180,1852,764,388]},{"type":"call","value":[1180,1852,236,1113]},{"type":"call","value":[1180,1852,764,406]},{"type":"call","value":[1180,1852,1020,2738]},{"type":"call","value":[1180,1852,2596,4824]},{"type":"call","value":[1180,1852,2596,4168]},{"type":"call","value":[1180,1852,2596,4595]},{"type":"call","value":[1180,1852,2596,2380]},{"type":"call","value":[1180,1852,2596,3512]},{"type":"call","value":[1180,1852,764,424]},{"type":"call","value":[1180,1852,2596,1297]},{"type":"call","value":[1180,1852,236,1378]},{"type":"call","value":[1180,1852,2596,3530]},{"type":"call","value":[1180,1852,2208,1529]},{"type":"call","value":[1180,1852,2596,1315]},{"type":"call","value":[1180,1852,2596,2218]},{"type":"call","value":[1180,1852,2596,3548]},{"type":"call","value":[1180,1852,1156,4956]},{"type":"call","value":[1180,1852,236,1216]},{"type":"call","value":[1180,1852,2596,2465]},{"type":"call","value":[1180,1852,2596,250]},{"type":"call","value":[1180,1852,2596,1809]},{"type":"call","value":[1180,1852,2836,1069]},{"type":"call","value":[1180,1852,2596,2483]},{"type":"call","value":[1180,1852,764,527]},{"type":"call","value":[1180,1852,2596,268]},{"type":"call","value":[1180,1852,2596,2074]},{"type":"call","value":[1180,1852,764,545]},{"type":"call","value":[1180,1852,2832,3138]},{"type":"call","value":[1180,1852,920,167]},{"type":"call","value":[1180,1852,2596,2748]},{"type":"call","value":[1180,1852,2596,2092]},{"type":"call","value":[1180,1852,676,3336]},{"type":"call","value":[1180,1852,2832,2500]},{"type":"call","value":[1180,1852,2596,3898]},{"type":"call","value":[1180,1852,764,383]},{"type":"call","value":[1180,1852,2596,2110]},{"type":"call","value":[1180,1852,2596,3916]},{"type":"call","value":[1180,1852,764,401]},{"type":"call","value":[1180,1852,1020,2733]},{"type":"call","value":[1180,1852,920,23]},{"type":"call","value":[1180,1852,1156,894]},{"type":"call","value":[1180,1852,2596,4163]},{"type":"call","value":[1180,1852,2596,4590]},{"type":"call","value":[1180,1852,2596,3507]},{"type":"call","value":[1180,1852,2596,3934]},{"type":"call","value":[1180,1852,2596,1292]},{"type":"call","value":[1180,1852,2596,2851]},{"type":"call","value":[1180,1852,2616,1999]},{"type":"call","value":[1180,1852,1156,912]},{"type":"call","value":[1180,1852,2596,2195]},{"type":"call","value":[1180,1852,2596,3525]},{"type":"call","value":[1180,1852,2208,1524]},{"type":"call","value":[1180,1852,2596,1310]},{"type":"call","value":[1180,1852,1156,930]},{"type":"call","value":[1180,1852,2596,2213]},{"type":"call","value":[1180,1852,2700,3842]},{"type":"call","value":[1180,1852,2596,3116]},{"type":"call","value":[1180,1852,2596,3543]},{"type":"call","value":[1180,1852,2596,4675]},{"type":"call","value":[1180,1852,2596,2887]},{"type":"call","value":[1180,1852,2208,1542]},{"type":"call","value":[1180,1852,2596,245]},{"type":"call","value":[1180,1852,2596,1804]},{"type":"call","value":[1180,1852,2596,4693]},{"type":"call","value":[1180,1852,1156,4969]},{"type":"call","value":[1180,1852,1156,768]},{"type":"call","value":[1180,1852,764,522]},{"type":"call","value":[1180,1852,2596,263]},{"type":"call","value":[1180,1852,2596,1822]},{"type":"call","value":[1180,1852,2596,3381]},{"type":"call","value":[1180,1852,2596,2069]},{"type":"call","value":[1180,1852,764,540]},{"type":"call","value":[1180,1852,1156,2345]},{"type":"call","value":[1180,1852,2596,3399]},{"type":"call","value":[1180,1852,920,162]},{"type":"call","value":[1180,1852,1156,2592]},{"type":"call","value":[1180,1852,2832,3807]},{"type":"call","value":[1180,1852,676,3331]},{"type":"call","value":[1180,1852,2596,3893]},{"type":"call","value":[1180,1852,764,378]},{"type":"call","value":[1180,1852,2596,3911]},{"type":"call","value":[1180,1852,764,396]},{"type":"call","value":[1180,1852,2596,4814]},{"type":"call","value":[1180,1852,1156,889]},{"type":"call","value":[1180,1852,1020,2746]},{"type":"call","value":[1180,1852,2616,1994]},{"type":"call","value":[1180,1852,2596,2846]},{"type":"call","value":[1180,1852,2596,4832]},{"type":"call","value":[1180,1852,920,36]},{"type":"call","value":[1180,1852,1156,907]},{"type":"call","value":[1180,1852,2784,1062]},{"type":"call","value":[1180,1852,2208,1519]},{"type":"call","value":[1180,1852,2596,2864]},{"type":"call","value":[1180,1852,2700,3837]},{"type":"call","value":[1180,1852,2208,1537]},{"type":"call","value":[1180,1852,2596,4688]},{"type":"call","value":[1180,1852,1156,4964]},{"type":"call","value":[1180,1852,2596,2473]},{"type":"call","value":[1180,1852,764,517]},{"type":"call","value":[1180,1852,1156,763]},{"type":"call","value":[1180,1852,236,1224]},{"type":"call","value":[1180,1852,2596,3376]},{"type":"call","value":[1180,1852,920,139]},{"type":"call","value":[1180,1852,2596,3394]},{"type":"call","value":[1180,1852,2832,3128]},{"type":"call","value":[1180,1852,920,157]},{"type":"call","value":[1180,1852,764,355]},{"type":"call","value":[1180,1852,676,3326]},{"type":"call","value":[1180,1852,764,373]},{"type":"call","value":[1180,1852,2596,4135]},{"type":"call","value":[1180,1852,764,391]},{"type":"call","value":[1180,1852,920,13]},{"type":"call","value":[1180,1852,2596,4153]},{"type":"call","value":[1180,1852,1020,2970]},{"type":"call","value":[1180,1852,1020,2741]},{"type":"call","value":[1180,1852,2616,1989]},{"type":"call","value":[1180,1852,2596,1282]},{"type":"call","value":[1180,1852,1400,2545]},{"type":"call","value":[1180,1852,2596,4827]},{"type":"call","value":[1180,1852,1156,902]},{"type":"call","value":[1180,1852,2596,2185]},{"type":"call","value":[1180,1852,2596,4171]},{"type":"call","value":[1180,1852,2596,3515]},{"type":"call","value":[1180,1852,2596,1300]},{"type":"call","value":[1180,1852,2596,2432]},{"type":"call","value":[1180,1852,764,476]},{"type":"call","value":[1180,1852,2596,217]},{"type":"call","value":[1180,1852,2596,2203]},{"type":"call","value":[1180,1852,1020,3006]},{"type":"call","value":[1180,1852,1876,3170]},{"type":"call","value":[1180,1852,2700,3832]},{"type":"call","value":[1180,1852,2208,1532]},{"type":"call","value":[1180,1852,1476,1674]},{"type":"call","value":[1180,1852,2596,2450]},{"type":"call","value":[1180,1852,2596,235]},{"type":"call","value":[1180,1852,764,741]},{"type":"call","value":[1180,1852,1156,758]},{"type":"call","value":[1180,1852,2596,2041]},{"type":"call","value":[1180,1852,2596,2468]},{"type":"call","value":[1180,1852,2596,253]},{"type":"call","value":[1180,1852,2596,1812]},{"type":"call","value":[1180,1852,764,512]},{"type":"call","value":[1180,1852,920,134]},{"type":"call","value":[1180,1852,1020,3091]},{"type":"call","value":[1180,1852,2596,2059]},{"type":"call","value":[1180,1852,2596,3618]},{"type":"call","value":[1180,1852,920,152]},{"type":"call","value":[1180,1852,2832,3797]},{"type":"call","value":[1180,1852,2596,3883]},{"type":"call","value":[1180,1852,764,368]},{"type":"call","value":[1180,1852,2444,5075]},{"type":"call","value":[1180,1852,2596,3901]},{"type":"call","value":[1180,1852,2596,2818]},{"type":"call","value":[1180,1852,2596,4148]},{"type":"call","value":[1180,1852,1020,2965]},{"type":"call","value":[1180,1852,1020,2736]},{"type":"call","value":[1180,1852,2616,1984]},{"type":"call","value":[1180,1852,1400,2540]},{"type":"call","value":[1180,1852,2596,2836]},{"type":"call","value":[1180,1852,968,3004]},{"type":"call","value":[1180,1852,1156,897]},{"type":"call","value":[1180,1852,2596,2180]},{"type":"call","value":[1180,1852,2596,4166]},{"type":"call","value":[1180,1852,2596,3510]},{"type":"call","value":[1180,1852,2596,2854]},{"type":"call","value":[1180,1852,764,471]},{"type":"call","value":[1180,1852,1876,3165]},{"type":"call","value":[1180,1852,2596,1771]},{"type":"call","value":[1180,1852,2596,2198]},{"type":"call","value":[1180,1852,2700,3827]},{"type":"call","value":[1180,1852,2596,4660]},{"type":"call","value":[1180,1852,2208,1527]},{"type":"call","value":[1180,1852,2596,1789]},{"type":"call","value":[1180,1852,2596,4678]},{"type":"call","value":[1180,1852,1156,753]},{"type":"call","value":[1180,1852,2596,2036]},{"type":"call","value":[1180,1852,764,507]},{"type":"call","value":[1180,1852,2596,1807]},{"type":"call","value":[1180,1852,2596,3366]},{"type":"call","value":[1180,1852,920,129]},{"type":"call","value":[1180,1852,1020,3086]},{"type":"call","value":[1180,1852,2596,2054]},{"type":"call","value":[1180,1852,2596,3613]},{"type":"call","value":[1180,1852,920,147]},{"type":"call","value":[1180,1852,2596,3860]},{"type":"call","value":[1180,1852,2444,5052]},{"type":"call","value":[1180,1852,2596,3204]},{"type":"call","value":[1180,1852,764,592]},{"type":"call","value":[1180,1852,2596,3878]},{"type":"call","value":[1180,1852,764,363]},{"type":"call","value":[1180,1852,2444,5070]},{"type":"call","value":[1180,1852,2596,4781]},{"type":"call","value":[1180,1852,2596,3469]},{"type":"call","value":[1180,1852,2596,3896]},{"type":"call","value":[1180,1852,1020,2960]},{"type":"call","value":[1180,1852,2616,1979]},{"type":"call","value":[1180,1852,1400,2535]},{"type":"call","value":[1180,1852,2596,2831]},{"type":"call","value":[1180,1852,1156,892]},{"type":"call","value":[1180,1852,2596,4637]},{"type":"call","value":[1180,1852,236,1173]},{"type":"call","value":[1180,1852,2596,2422]},{"type":"call","value":[1180,1852,2596,2849]},{"type":"call","value":[1180,1852,764,466]},{"type":"call","value":[1180,1852,1876,3160]},{"type":"call","value":[1180,1852,2208,1522]},{"type":"call","value":[1180,1852,2596,2440]},{"type":"call","value":[1180,1852,764,484]},{"type":"call","value":[1180,1852,920,106]},{"type":"call","value":[1180,1852,2596,4673]},{"type":"call","value":[1180,1852,764,731]},{"type":"call","value":[1180,1852,1156,748]},{"type":"call","value":[1180,1852,2596,3590]},{"type":"call","value":[1180,1852,1028,3482]},{"type":"call","value":[1180,1852,2596,3361]},{"type":"call","value":[1180,1852,920,124]},{"type":"call","value":[1180,1852,2596,2278]},{"type":"call","value":[1180,1852,1020,3081]},{"type":"call","value":[1180,1852,920,142]},{"type":"call","value":[1180,1852,1020,3099]},{"type":"call","value":[1180,1852,764,587]},{"type":"call","value":[1180,1852,2596,1887]},{"type":"call","value":[1180,1852,764,358]},{"type":"call","value":[1180,1852,2596,4776]},{"type":"call","value":[1180,1852,2596,4120]},{"type":"call","value":[1180,1852,2596,1249]},{"type":"call","value":[1180,1852,2596,4794]},{"type":"call","value":[1180,1852,2596,4138]},{"type":"call","value":[1180,1852,2616,1974]},{"type":"call","value":[1180,1852,1400,2530]},{"type":"call","value":[1180,1852,1020,2973]},{"type":"call","value":[1180,1852,236,1168]},{"type":"call","value":[1180,1852,1476,1641]},{"type":"call","value":[1180,1852,2596,2417]},{"type":"call","value":[1180,1852,764,461]},{"type":"call","value":[1180,1852,1400,2548]},{"type":"call","value":[1180,1852,2596,1761]},{"type":"call","value":[1180,1852,1876,3155]},{"type":"call","value":[1180,1852,2828,2369]},{"type":"call","value":[1180,1852,1476,1659]},{"type":"call","value":[1180,1852,2596,2435]},{"type":"call","value":[1180,1852,764,479]},{"type":"call","value":[1180,1852,1876,3173]},{"type":"call","value":[1180,1852,2596,1779]},{"type":"call","value":[1180,1852,920,101]},{"type":"call","value":[1180,1852,2596,2026]},{"type":"call","value":[1180,1852,2596,3585]},{"type":"call","value":[1180,1852,2856,1040]},{"type":"call","value":[1180,1852,920,119]},{"type":"call","value":[1180,1852,2596,2273]},{"type":"call","value":[1180,1852,2596,2044]},{"type":"call","value":[1180,1852,2596,3603]},{"type":"call","value":[1180,1852,2856,1058]},{"type":"call","value":[1180,1852,920,137]},{"type":"call","value":[1180,1852,2596,2291]},{"type":"call","value":[1180,1852,1156,2567]},{"type":"call","value":[1180,1852,2832,4011]},{"type":"call","value":[1180,1852,1020,3094]},{"type":"call","value":[1180,1852,2596,4097]},{"type":"call","value":[1180,1852,2596,3868]},{"type":"call","value":[1180,1852,764,353]},{"type":"call","value":[1180,1852,2596,4115]},{"type":"call","value":[1180,1852,2596,3459]},{"type":"call","value":[1180,1852,2688,3743]},{"type":"call","value":[1180,1852,2596,2803]},{"type":"call","value":[1180,1852,1156,864]},{"type":"call","value":[1180,1852,236,1145]},{"type":"call","value":[1180,1852,2832,996]},{"type":"call","value":[1180,1852,2596,2821]},{"type":"call","value":[1180,1852,764,438]},{"type":"call","value":[1180,1852,1476,1618]},{"type":"call","value":[1180,1852,2596,1738]},{"type":"call","value":[1180,1852,1020,2968]},{"type":"call","value":[1180,1852,2596,4627]},{"type":"call","value":[1180,1852,1400,2543]},{"type":"call","value":[1180,1852,764,456]},{"type":"call","value":[1180,1852,2596,1756]},{"type":"call","value":[1180,1852,2828,2364]},{"type":"call","value":[1180,1852,2596,4645]},{"type":"call","value":[1180,1852,236,1181]},{"type":"call","value":[1180,1852,764,474]},{"type":"call","value":[1180,1852,2596,1774]},{"type":"call","value":[1180,1852,920,96]},{"type":"call","value":[1180,1852,2596,2021]},{"type":"call","value":[1180,1852,2856,1035]},{"type":"call","value":[1180,1852,920,114]},{"type":"call","value":[1180,1852,1020,3071]},{"type":"call","value":[1180,1852,2856,3268]},{"type":"call","value":[1180,1852,2596,2039]},{"type":"call","value":[1180,1852,2596,2286]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":2,"description":"AF_INET"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1464]},{"type":"call","value":[1180,1852,676,3350]},{"type":"call","value":[1180,1852,236,1467]},{"type":"call","value":[1180,1852,2828,2366]},{"type":"call","value":[1180,1852,2596,3860]},{"type":"call","value":[1180,1852,2832,967]},{"type":"call","value":[1180,1852,764,589]},{"type":"call","value":[1180,1852,2596,4589]},{"type":"call","value":[1180,1852,1400,4903]},{"type":"call","value":[1180,1852,2596,4064]},{"type":"call","value":[1180,1852,2596,4183]},{"type":"call","value":[1180,1852,920,174]},{"type":"call","value":[1180,1852,2700,3850]},{"type":"call","value":[1180,1852,2856,1055]},{"type":"call","value":[1180,1852,236,1350]},{"type":"call","value":[1180,1852,1200,3790]},{"type":"call","value":[1180,1852,1400,2553]},{"type":"call","value":[1180,1852,2596,3209]},{"type":"call","value":[1180,1852,236,1362]},{"type":"call","value":[1180,1852,2828,1050]},{"type":"call","value":[1180,1852,764,597]},{"type":"call","value":[1180,1852,2320,1080]},{"type":"call","value":[1180,1852,2828,4241]},{"type":"call","value":[1180,1852,2596,1714]},{"type":"call","value":[1180,1852,2616,3989]},{"type":"call","value":[1180,1852,1808,4054]},{"type":"call","value":[1180,1852,1876,3181]},{"type":"call","value":[1180,1852,2444,5072]},{"type":"call","value":[1180,1852,2596,4731]},{"type":"call","value":[1180,1852,2596,176]},{"type":"call","value":[1180,1852,2596,3361]},{"type":"call","value":[1180,1852,2208,3285]},{"type":"call","value":[1180,1852,2284,2013]},{"type":"call","value":[1180,1852,2596,2290]},{"type":"call","value":[1180,1852,764,578]},{"type":"call","value":[1180,1852,2596,3498]},{"type":"call","value":[1180,1852,2596,2171]},{"type":"call","value":[1180,1852,2596,3617]},{"type":"call","value":[1180,1852,920,200]},{"type":"call","value":[1180,1852,2828,4585]},{"type":"call","value":[1180,1852,2616,1996]},{"type":"call","value":[1180,1852,2596,1887]},{"type":"call","value":[1180,1852,2596,2018]},{"type":"call","value":[1180,1852,2596,2378]},{"type":"call","value":[1180,1852,2596,5081]},{"type":"call","value":[1180,1852,968,3031]},{"type":"call","value":[1180,1852,2856,3265]},{"type":"call","value":[1180,1852,2596,175]},{"type":"call","value":[1180,1852,2596,2747]},{"type":"call","value":[1180,1852,2596,233]},{"type":"call","value":[1180,1852,2208,1539]},{"type":"call","value":[1180,1852,764,330]}],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"number","number":23,"description":"AF_INET6"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1346]},{"type":"call","value":[1180,1852,236,1106]}],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"query or enumerate registry key":{"meta":{"name":"query or enumerate registry key","namespace":"host-interaction/registry","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Discovery","Query Registry"],"tactic":"Discovery","technique":"Query Registry","subtechnique":"","id":"T1012"}],"mbc":[{"parts":["Operating System","Registry","Query Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Query Registry Key","id":"C0036.005"}],"references":[],"examples":["493167E85E45363D09495D0841C30648:0x404930","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: query or enumerate registry key\n namespace: host-interaction/registry\n authors:\n - michael.hunhoff@mandiant.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Discovery::Query Registry [T1012]\n mbc:\n - Operating System::Registry::Query Registry Key [C0036.005]\n examples:\n - 493167E85E45363D09495D0841C30648:0x404930\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x402608\n features:\n - and:\n - optional:\n - match: create or open registry key\n - or:\n - api: advapi32.RegEnumKey\n - api: advapi32.RegEnumKeyEx\n - api: advapi32.RegQueryInfoKeyA\n - api: ZwQueryKey\n - api: ZwEnumerateKey\n - api: NtQueryKey\n - api: NtEnumerateKey\n - api: RtlCheckRegistryKey\n - api: SHEnumKeyEx\n - api: SHQueryInfoKey\n - api: SHRegEnumUSKey\n - api: SHRegQueryInfoUSKey\n - api: Microsoft.Win32.RegistryKey::GetSubKeyNames\n - api: Microsoft.Win32.RegistryKey::OpenBaseKey\n - api: Microsoft.Win32.RegistryKey::OpenRemoteBaseKey\n - api: Microsoft.Win32.RegistryKey::OpenSubKey\n","matches":[[{"type":"process","value":[1180,1852]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,1156,2351]},{"type":"call","value":[1180,1852,1156,3679]},{"type":"call","value":[1180,1852,1156,2573]},{"type":"call","value":[1180,1852,1156,4964]},{"type":"call","value":[1180,1852,1156,4956]},{"type":"call","value":[1180,1852,1156,2567]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1181]},{"type":"call","value":[1180,1852,236,1160]},{"type":"call","value":[1180,1852,236,1133]},{"type":"call","value":[1180,1852,236,1173]},{"type":"call","value":[1180,1852,236,1113]},{"type":"call","value":[1180,1852,236,1121]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,920,45]},{"type":"call","value":[1180,1852,920,42]},{"type":"call","value":[1180,1852,920,32]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1180,1852,1156]},{"type":"thread","value":[1180,1852,236]},{"type":"thread","value":[1180,1852,920]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryInfoKeyA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryKey"}},"children":[],"locations":[{"type":"call","value":[1180,1852,236,1143]},{"type":"call","value":[1180,1852,236,1144]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCheckRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryInfoKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryInfoUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetSubKeyNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1200,1248]},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1560,6276]},{"type":"call","value":[1200,1248,1560,6255]},{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,1560,6280]},{"type":"call","value":[1200,1248,1560,6254]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1200,1248,1560]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegQueryInfoKeyA"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwQueryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtQueryKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2324,6184]},{"type":"call","value":[1200,1248,2324,6187]},{"type":"call","value":[1200,1248,2324,6190]},{"type":"call","value":[1200,1248,2324,6205]},{"type":"call","value":[1200,1248,2324,6176]},{"type":"call","value":[1200,1248,2324,6182]},{"type":"call","value":[1200,1248,2324,6211]},{"type":"call","value":[1200,1248,2324,6191]},{"type":"call","value":[1200,1248,2324,6194]},{"type":"call","value":[1200,1248,2324,6177]},{"type":"call","value":[1200,1248,2324,6206]},{"type":"call","value":[1200,1248,2324,6212]},{"type":"call","value":[1200,1248,2324,6180]},{"type":"call","value":[1200,1248,2324,6209]},{"type":"call","value":[1200,1248,2324,6215]},{"type":"call","value":[1200,1248,2324,6183]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtEnumerateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCheckRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHEnumKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHQueryInfoKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegEnumUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegQueryInfoUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::GetSubKeyNames"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"set registry value":{"meta":{"name":"set registry value","namespace":"host-interaction/registry/create","authors":["moritz.raabe@mandiant.com","michael.hunhoff@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[],"mbc":[{"parts":["Operating System","Registry","Set Registry Key"],"objective":"Operating System","behavior":"Registry","method":"Set Registry Key","id":"C0036.001"}],"references":[],"examples":["BFB9B5391A13D0AFD787E87AB90F14F5:0x13147AF0","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E","B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40415E","98c37c3c23bbfb362dac7754c6ba48e75cf24d73bc963a4cdfca557b9e016909:0x40294D"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: set registry value\n namespace: host-interaction/registry/create\n authors:\n - moritz.raabe@mandiant.com\n - michael.hunhoff@mandiant.com\n scopes:\n static: function\n dynamic: process\n mbc:\n - Operating System::Registry::Set Registry Key [C0036.001]\n examples:\n - BFB9B5391A13D0AFD787E87AB90F14F5:0x13147AF0\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E\n - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40415E\n - 98c37c3c23bbfb362dac7754c6ba48e75cf24d73bc963a4cdfca557b9e016909:0x40294D\n features:\n - or:\n - and:\n - optional:\n - match: create or open registry key\n - or:\n - api: advapi32.RegSetValue\n - api: advapi32.RegSetValueEx\n - api: advapi32.RegSetKeyValue\n - api: ZwSetValueKey\n - api: NtSetValueKey\n - api: RtlWriteRegistryValue\n - api: SHSetValue\n - api: SHRegSetPath\n - api: SHRegSetValue\n - api: SHRegSetUSValue\n - api: SHRegWriteUSValue\n - api: Microsoft.Win32.RegistryKey::SetValue\n - api: Microsoft.Win32.Registry::SetValue\n - and:\n - match: host-interaction/process/create\n - string: \"/add/i\"\n - or:\n - string: \"/reg(|.exe)/i\"\n - string: \"/hklm/i\"\n - string: \"/HKEY_LOCAL_MACHINE/i\"\n - string: \"/hkcu/i\"\n - string: \"/HKEY_CURRENT_USER/i\"\n","matches":[[{"type":"process","value":[1200,1248]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"match","match":"host-interaction/process/create"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/add/i"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1460,5981]},{"type":"call","value":[1200,1248,1460,5943]},{"type":"call","value":[1200,1248,1460,6161]},{"type":"call","value":[1200,1248,1460,5955]},{"type":"call","value":[1200,1248,1460,5894]},{"type":"call","value":[1200,1248,1460,6167]},{"type":"call","value":[1200,1248,1460,5926]},{"type":"call","value":[1200,1248,1656,6112]},{"type":"call","value":[1200,1248,1460,5967]},{"type":"call","value":[1200,1248,1460,5990]},{"type":"call","value":[1200,1248,1460,5996]},{"type":"call","value":[1200,1248,1460,6147]},{"type":"call","value":[1200,1248,2544,282]},{"type":"call","value":[1200,1248,2544,53]},{"type":"call","value":[1200,1248,2544,294]},{"type":"call","value":[1200,1248,1460,5947]},{"type":"call","value":[1200,1248,424,1782]},{"type":"call","value":[1200,1248,1656,5602]},{"type":"call","value":[1200,1248,1460,5959]},{"type":"call","value":[1200,1248,1460,5910]},{"type":"call","value":[1200,1248,1460,5939]},{"type":"call","value":[1200,1248,2544,254]},{"type":"call","value":[1200,1248,1460,5971]},{"type":"call","value":[1200,1248,1460,5977]},{"type":"call","value":[1200,1248,1460,5916]},{"type":"call","value":[1200,1248,1460,5922]},{"type":"call","value":[1200,1248,1460,5951]},{"type":"call","value":[1200,1248,2544,147]},{"type":"call","value":[1200,1248,1460,5986]},{"type":"call","value":[1200,1248,1460,5963]},{"type":"call","value":[1200,1248,1460,6155]}],"captures":{"LdrLoadDll":[{"type":"call","value":[1200,1248,424,1782]},{"type":"call","value":[1200,1248,2544,294]}],"A2A9545D-A0C2-42B4-9708-A0B2BADD77C8":[{"type":"call","value":[1200,1248,1460,5981]},{"type":"call","value":[1200,1248,1460,5943]},{"type":"call","value":[1200,1248,1460,6161]},{"type":"call","value":[1200,1248,1460,5955]},{"type":"call","value":[1200,1248,1460,5894]},{"type":"call","value":[1200,1248,1460,6167]},{"type":"call","value":[1200,1248,1460,5926]},{"type":"call","value":[1200,1248,1656,6112]},{"type":"call","value":[1200,1248,1460,5967]},{"type":"call","value":[1200,1248,1460,5990]},{"type":"call","value":[1200,1248,1460,5996]},{"type":"call","value":[1200,1248,1460,6147]},{"type":"call","value":[1200,1248,1460,5947]},{"type":"call","value":[1200,1248,1656,5602]},{"type":"call","value":[1200,1248,1460,5959]},{"type":"call","value":[1200,1248,1460,5910]},{"type":"call","value":[1200,1248,1460,5939]},{"type":"call","value":[1200,1248,1460,5971]},{"type":"call","value":[1200,1248,1460,5977]},{"type":"call","value":[1200,1248,1460,5916]},{"type":"call","value":[1200,1248,1460,5922]},{"type":"call","value":[1200,1248,1460,5951]},{"type":"call","value":[1200,1248,1460,5986]},{"type":"call","value":[1200,1248,1460,5963]},{"type":"call","value":[1200,1248,1460,6155]}],"GetProcAddress":[{"type":"call","value":[1200,1248,2544,53]},{"type":"call","value":[1200,1248,2544,147]}],"HttpAddRequestHeadersA":[{"type":"call","value":[1200,1248,2544,282]},{"type":"call","value":[1200,1248,2544,254]}]}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/reg(|.exe)/i"}},"children":[],"locations":[{"type":"call","value":[1200,1248,2544,195]},{"type":"call","value":[1200,1248,2544,192]},{"type":"call","value":[1200,1248,2544,198]},{"type":"call","value":[1200,1248,2324,6190]},{"type":"call","value":[1200,1248,1860,4467]},{"type":"call","value":[1200,1248,2324,6193]},{"type":"call","value":[1200,1248,2324,6205]},{"type":"call","value":[1200,1248,2324,6179]},{"type":"call","value":[1200,1248,2324,6208]},{"type":"call","value":[1200,1248,2544,193]},{"type":"call","value":[1200,1248,2324,6176]},{"type":"call","value":[1200,1248,2324,6211]},{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,2544,196]},{"type":"call","value":[1200,1248,1560,6276]},{"type":"call","value":[1200,1248,2324,6214]},{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,2544,199]},{"type":"call","value":[1200,1248,1460,31]},{"type":"call","value":[1200,1248,1860,4468]},{"type":"call","value":[1200,1248,2544,191]},{"type":"call","value":[1200,1248,2324,6186]},{"type":"call","value":[1200,1248,2544,194]},{"type":"call","value":[1200,1248,2324,6183]},{"type":"call","value":[1200,1248,2544,197]},{"type":"call","value":[1200,1248,1560,6254]}],"captures":{"WerRegisterMemoryBlock":[{"type":"call","value":[1200,1248,1460,31]}],"RegOpenKeyExA":[{"type":"call","value":[1200,1248,2544,191]}],"RegCreateKeyExA":[{"type":"call","value":[1200,1248,2544,192]}],"RegQueryInfoKeyA":[{"type":"call","value":[1200,1248,2544,193]}],"RegEnumValueA":[{"type":"call","value":[1200,1248,2544,194]}],"RegEnumKeyExA":[{"type":"call","value":[1200,1248,2544,195]}],"RegSetValueExA":[{"type":"call","value":[1200,1248,2544,196]}],"RegQueryValueExA":[{"type":"call","value":[1200,1248,2544,197]}],"RegCloseKey":[{"type":"call","value":[1200,1248,2544,198]}],"RegDeleteValueA":[{"type":"call","value":[1200,1248,2544,199]}],"HKEY_CLASSES_ROOT\\.reg":[{"type":"call","value":[1200,1248,1860,4467]}],".reg":[{"type":"call","value":[1200,1248,1860,4467]}],"HKEY_CLASSES_ROOT\\SystemFileAssociations\\.reg":[{"type":"call","value":[1200,1248,1860,4468]}],"SystemFileAssociations\\.reg":[{"type":"call","value":[1200,1248,1860,4468]}],"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}":[{"type":"call","value":[1200,1248,2324,6176]},{"type":"call","value":[1200,1248,2324,6183]},{"type":"call","value":[1200,1248,2324,6205]},{"type":"call","value":[1200,1248,2324,6211]}],"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs":[{"type":"call","value":[1200,1248,2324,6179]}],"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid":[{"type":"call","value":[1200,1248,2324,6186]}],"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}":[{"type":"call","value":[1200,1248,2324,6190]}],"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid":[{"type":"call","value":[1200,1248,2324,6193]}],"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32":[{"type":"call","value":[1200,1248,2324,6208]}],"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000_Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler":[{"type":"call","value":[1200,1248,2324,6214]}],"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings":[{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,1560,6276]}],"\\REGISTRY\\USER\\S-1-5-21-2237850072-885592287-911325625-1000":[{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1560,6254]}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/hklm/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HKEY_LOCAL_MACHINE/i"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1860,3325]},{"type":"call","value":[1200,1248,1860,2498]},{"type":"call","value":[1200,1248,1860,4740]},{"type":"call","value":[1200,1248,1860,3428]},{"type":"call","value":[1200,1248,1860,3019]},{"type":"call","value":[1200,1248,1860,5243]},{"type":"call","value":[1200,1248,1860,5252]},{"type":"call","value":[1200,1248,1860,3046]},{"type":"call","value":[1200,1248,1560,6237]},{"type":"call","value":[1200,1248,1860,3302]},{"type":"call","value":[1200,1248,1860,3549]},{"type":"call","value":[1200,1248,1860,2228]},{"type":"call","value":[1200,1248,1860,4452]},{"type":"call","value":[1200,1248,1860,2246]},{"type":"call","value":[1200,1248,1860,4479]},{"type":"call","value":[1200,1248,1860,2264]},{"type":"call","value":[1200,1248,1860,4717]},{"type":"call","value":[1200,1248,1860,3405]},{"type":"call","value":[1200,1248,1860,4070]},{"type":"call","value":[1200,1248,1860,3176]},{"type":"call","value":[1200,1248,1860,4735]},{"type":"call","value":[1200,1248,1860,3414]},{"type":"call","value":[1200,1248,1860,2758]},{"type":"call","value":[1200,1248,1860,2529]},{"type":"call","value":[1200,1248,1860,5409]},{"type":"call","value":[1200,1248,1860,4326]},{"type":"call","value":[1200,1248,1860,2111]},{"type":"call","value":[1200,1248,1860,4097]},{"type":"call","value":[1200,1248,1860,2776]},{"type":"call","value":[1200,1248,1860,2120]},{"type":"call","value":[1200,1248,1860,4344]},{"type":"call","value":[1200,1248,1860,3688]},{"type":"call","value":[1200,1248,1860,4591]},{"type":"call","value":[1200,1248,1860,3935]},{"type":"call","value":[1200,1248,1860,4838]},{"type":"call","value":[1200,1248,1860,4182]},{"type":"call","value":[1200,1248,1860,5274]},{"type":"call","value":[1200,1248,1860,3953]},{"type":"call","value":[1200,1248,1860,4618]},{"type":"call","value":[1200,1248,1560,6232]},{"type":"call","value":[1200,1248,1860,1976]},{"type":"call","value":[1200,1248,1860,4856]},{"type":"call","value":[1200,1248,1860,4200]},{"type":"call","value":[1200,1248,1860,5103]},{"type":"call","value":[1200,1248,1860,5530]},{"type":"call","value":[1200,1248,1860,2888]},{"type":"call","value":[1200,1248,1860,1994]},{"type":"call","value":[1200,1248,1860,4874]},{"type":"call","value":[1200,1248,1860,4218]},{"type":"call","value":[1200,1248,1860,3135]},{"type":"call","value":[1200,1248,1860,3562]},{"type":"call","value":[1200,1248,1860,3800]},{"type":"call","value":[1200,1248,1860,2906]},{"type":"call","value":[1200,1248,1860,3571]},{"type":"call","value":[1200,1248,1860,4703]},{"type":"call","value":[1200,1248,1860,5130]},{"type":"call","value":[1200,1248,1860,1832]},{"type":"call","value":[1200,1248,1860,5377]},{"type":"call","value":[1200,1248,1860,3827]},{"type":"call","value":[1200,1248,1860,3171]},{"type":"call","value":[1200,1248,1860,2515]},{"type":"call","value":[1200,1248,1860,4083]},{"type":"call","value":[1200,1248,1860,2344]},{"type":"call","value":[1200,1248,1860,3674]},{"type":"call","value":[1200,1248,1252,6072]},{"type":"call","value":[1200,1248,1860,2362]},{"type":"call","value":[1200,1248,1860,5260]},{"type":"call","value":[1200,1248,1860,4604]},{"type":"call","value":[1200,1248,1860,1962]},{"type":"call","value":[1200,1248,1560,6227]},{"type":"call","value":[1200,1248,1860,4851]},{"type":"call","value":[1200,1248,1860,3795]},{"type":"call","value":[1200,1248,1860,1818]},{"type":"call","value":[1200,1248,1860,2483]},{"type":"call","value":[1200,1248,1860,5363]},{"type":"call","value":[1200,1248,1860,3166]},{"type":"call","value":[1200,1248,1860,2083]},{"type":"call","value":[1200,1248,1860,2510]},{"type":"call","value":[1200,1248,1860,4972]},{"type":"call","value":[1200,1248,1860,3422]},{"type":"call","value":[1200,1248,1860,2101]},{"type":"call","value":[1200,1248,1860,4981]},{"type":"call","value":[1200,1248,1860,4990]},{"type":"call","value":[1200,1248,1860,3013]},{"type":"call","value":[1200,1248,1860,3251]},{"type":"call","value":[1200,1248,1252,6076]},{"type":"call","value":[1200,1248,1860,3031]},{"type":"call","value":[1200,1248,1860,3269]},{"type":"call","value":[1200,1248,1860,3507]},{"type":"call","value":[1200,1248,1860,5493]},{"type":"call","value":[1200,1248,1860,3287]},{"type":"call","value":[1200,1248,1860,3525]},{"type":"call","value":[1200,1248,1860,4428]},{"type":"call","value":[1200,1248,1860,3772]},{"type":"call","value":[1200,1248,1860,2222]},{"type":"call","value":[1200,1248,1860,4446]},{"type":"call","value":[1200,1248,1860,3790]},{"type":"call","value":[1200,1248,1860,2240]},{"type":"call","value":[1200,1248,1860,4464]},{"type":"call","value":[1200,1248,1860,4046]},{"type":"call","value":[1200,1248,1860,4711]},{"type":"call","value":[1200,1248,1860,3390]},{"type":"call","value":[1200,1248,1860,4949]},{"type":"call","value":[1200,1248,1860,2734]},{"type":"call","value":[1200,1248,1860,3399]},{"type":"call","value":[1200,1248,1860,2078]},{"type":"call","value":[1200,1248,1860,4064]},{"type":"call","value":[1200,1248,1860,4302]},{"type":"call","value":[1200,1248,1860,3646]},{"type":"call","value":[1200,1248,1860,2752]},{"type":"call","value":[1200,1248,1860,4320]},{"type":"call","value":[1200,1248,1860,5223]},{"type":"call","value":[1200,1248,1860,4567]},{"type":"call","value":[1200,1248,1860,3911]},{"type":"call","value":[1200,1248,1860,1934]},{"type":"call","value":[1200,1248,1860,4814]},{"type":"call","value":[1200,1248,1860,4158]},{"type":"call","value":[1200,1248,1860,4585]},{"type":"call","value":[1200,1248,1860,3929]},{"type":"call","value":[1200,1248,1860,2608]},{"type":"call","value":[1200,1248,1860,1952]},{"type":"call","value":[1200,1248,1860,4832]},{"type":"call","value":[1200,1248,1860,2617]},{"type":"call","value":[1200,1248,1860,4176]},{"type":"call","value":[1200,1248,1860,2626]},{"type":"call","value":[1200,1248,1860,5079]},{"type":"call","value":[1200,1248,1860,2864]},{"type":"call","value":[1200,1248,1860,1970]},{"type":"call","value":[1200,1248,1860,4194]},{"type":"call","value":[1200,1248,1860,5097]},{"type":"call","value":[1200,1248,1860,2882]},{"type":"call","value":[1200,1248,1560,6293]},{"type":"call","value":[1200,1248,1860,5344]},{"type":"call","value":[1200,1248,1860,3129]},{"type":"call","value":[1200,1248,1860,2055]},{"type":"call","value":[1200,1248,1860,4041]},{"type":"call","value":[1200,1248,1860,3623]},{"type":"call","value":[1200,1248,1860,2073]},{"type":"call","value":[1200,1248,1860,3632]},{"type":"call","value":[1200,1248,1860,2985]},{"type":"call","value":[1200,1248,1860,4553]},{"type":"call","value":[1200,1248,1860,3659]},{"type":"call","value":[1200,1248,1860,2338]},{"type":"call","value":[1200,1248,1860,3897]},{"type":"call","value":[1200,1248,1860,4800]},{"type":"call","value":[1200,1248,1860,2585]},{"type":"call","value":[1200,1248,1860,2356]},{"type":"call","value":[1200,1248,1860,2603]},{"type":"call","value":[1200,1248,1860,2185]},{"type":"call","value":[1200,1248,1560,6288]},{"type":"call","value":[1200,1248,1860,2459]},{"type":"call","value":[1200,1248,1860,1812]},{"type":"call","value":[1200,1248,1860,2477]},{"type":"call","value":[1200,1248,1860,4036]},{"type":"call","value":[1200,1248,1860,2068]},{"type":"call","value":[1200,1248,2324,6216]},{"type":"call","value":[1200,1248,1860,5451]},{"type":"call","value":[1200,1248,1860,3236]},{"type":"call","value":[1200,1248,1860,4139]},{"type":"call","value":[1200,1248,1860,5469]},{"type":"call","value":[1200,1248,1860,2171]},{"type":"call","value":[1200,1248,1860,2836]},{"type":"call","value":[1200,1248,1860,1942]},{"type":"call","value":[1200,1248,1860,3501]},{"type":"call","value":[1200,1248,1860,4404]},{"type":"call","value":[1200,1248,1860,3748]},{"type":"call","value":[1200,1248,1860,3519]},{"type":"call","value":[1200,1248,1860,4422]},{"type":"call","value":[1200,1248,1860,2207]},{"type":"call","value":[1200,1248,1860,3766]},{"type":"call","value":[1200,1248,1860,2454]},{"type":"call","value":[1200,1248,1860,2036]},{"type":"call","value":[1200,1248,1860,4916]},{"type":"call","value":[1200,1248,1860,4260]},{"type":"call","value":[1200,1248,1860,4031]},{"type":"call","value":[1200,1248,1860,2710]},{"type":"call","value":[1200,1248,1860,3375]},{"type":"call","value":[1200,1248,1860,4934]},{"type":"call","value":[1200,1248,1860,5172]},{"type":"call","value":[1200,1248,1860,4278]},{"type":"call","value":[1200,1248,1860,2063]},{"type":"call","value":[1200,1248,1860,2728]},{"type":"call","value":[1200,1248,1860,5190]},{"type":"call","value":[1200,1248,1860,4296]},{"type":"call","value":[1200,1248,2324,6202]},{"type":"call","value":[1200,1248,1860,4534]},{"type":"call","value":[1200,1248,1860,3213]},{"type":"call","value":[1200,1248,1860,3640]},{"type":"call","value":[1200,1248,1860,3878]},{"type":"call","value":[1200,1248,1860,2557]},{"type":"call","value":[1200,1248,1860,3222]},{"type":"call","value":[1200,1248,1252,6038]},{"type":"call","value":[1200,1248,1860,4781]},{"type":"call","value":[1200,1248,1860,3905]},{"type":"call","value":[1200,1248,1860,5037]},{"type":"call","value":[1200,1248,1860,5464]},{"type":"call","value":[1200,1248,1860,4808]},{"type":"call","value":[1200,1248,1860,5055]},{"type":"call","value":[1200,1248,1860,5073]},{"type":"call","value":[1200,1248,1860,2431]},{"type":"call","value":[1200,1248,1860,2202]},{"type":"call","value":[1200,1248,1860,4664]},{"type":"call","value":[1200,1248,1860,2449]},{"type":"call","value":[1200,1248,1560,6287]},{"type":"call","value":[1200,1248,1860,5338]},{"type":"call","value":[1200,1248,1860,4026]},{"type":"call","value":[1200,1248,1860,3608]},{"type":"call","value":[1200,1248,1860,2287]},{"type":"call","value":[1200,1248,1860,2296]},{"type":"call","value":[1200,1248,2324,6188]},{"type":"call","value":[1200,1248,1860,4520]},{"type":"call","value":[1200,1248,1860,2305]},{"type":"call","value":[1200,1248,2324,6197]},{"type":"call","value":[1200,1248,1860,2979]},{"type":"call","value":[1200,1248,1860,5203]},{"type":"call","value":[1200,1248,1860,2152]},{"type":"call","value":[1200,1248,1860,2579]},{"type":"call","value":[1200,1248,1860,3064]},{"type":"call","value":[1200,1248,1860,5288]},{"type":"call","value":[1200,1248,1860,2179]},{"type":"call","value":[1200,1248,1860,3082]},{"type":"call","value":[1200,1248,1860,4659]},{"type":"call","value":[1200,1248,1860,3338]},{"type":"call","value":[1200,1248,1860,5324]},{"type":"call","value":[1200,1248,1860,3347]},{"type":"call","value":[1200,1248,1560,6291]},{"type":"call","value":[1200,1248,1860,3356]},{"type":"call","value":[1200,1248,1860,3365]},{"type":"call","value":[1200,1248,1860,4506]},{"type":"call","value":[1200,1248,2324,6201]},{"type":"call","value":[1200,1248,2324,6210]},{"type":"call","value":[1200,1248,1860,4115]},{"type":"call","value":[1200,1248,1860,5445]},{"type":"call","value":[1200,1248,1860,3230]},{"type":"call","value":[1200,1248,1860,4362]},{"type":"call","value":[1200,1248,1860,4133]},{"type":"call","value":[1200,1248,1860,2812]},{"type":"call","value":[1200,1248,1860,3715]},{"type":"call","value":[1200,1248,1860,4380]},{"type":"call","value":[1200,1248,1860,2403]},{"type":"call","value":[1200,1248,1860,2830]},{"type":"call","value":[1200,1248,1860,4627]},{"type":"call","value":[1200,1248,1860,3971]},{"type":"call","value":[1200,1248,1860,4398]},{"type":"call","value":[1200,1248,1560,6250]},{"type":"call","value":[1200,1248,1860,3742]},{"type":"call","value":[1200,1248,1860,3989]},{"type":"call","value":[1200,1248,1860,5548]},{"type":"call","value":[1200,1248,1860,4654]},{"type":"call","value":[1200,1248,1860,2012]},{"type":"call","value":[1200,1248,1860,5319]},{"type":"call","value":[1200,1248,1860,2677]},{"type":"call","value":[1200,1248,1860,4236]},{"type":"call","value":[1200,1248,1560,6277]},{"type":"call","value":[1200,1248,1860,3580]},{"type":"call","value":[1200,1248,1860,2924]},{"type":"call","value":[1200,1248,1860,2030]},{"type":"call","value":[1200,1248,1860,3589]},{"type":"call","value":[1200,1248,1860,2695]},{"type":"call","value":[1200,1248,1860,4254]},{"type":"call","value":[1200,1248,1860,4910]},{"type":"call","value":[1200,1248,1860,5148]},{"type":"call","value":[1200,1248,1860,3598]},{"type":"call","value":[1200,1248,1860,5575]},{"type":"call","value":[1200,1248,1860,3616]},{"type":"call","value":[1200,1248,1860,3854]},{"type":"call","value":[1200,1248,1860,4092]},{"type":"call","value":[1200,1248,1860,1877]},{"type":"call","value":[1200,1248,1860,4757]},{"type":"call","value":[1200,1248,1860,2542]},{"type":"call","value":[1200,1248,1860,4528]},{"type":"call","value":[1200,1248,1860,3445]},{"type":"call","value":[1200,1248,1860,3872]},{"type":"call","value":[1200,1248,1860,4110]},{"type":"call","value":[1200,1248,1860,4775]},{"type":"call","value":[1200,1248,1860,5013]},{"type":"call","value":[1200,1248,1860,5031]},{"type":"call","value":[1200,1248,1860,3481]},{"type":"call","value":[1200,1248,1860,5049]},{"type":"call","value":[1200,1248,1860,3728]},{"type":"call","value":[1200,1248,1860,2654]},{"type":"call","value":[1200,1248,1860,4640]},{"type":"call","value":[1200,1248,1860,3319]},{"type":"call","value":[1200,1248,1860,2425]},{"type":"call","value":[1200,1248,1860,5305]},{"type":"call","value":[1200,1248,1860,2663]},{"type":"call","value":[1200,1248,1860,5561]},{"type":"call","value":[1200,1248,1860,2281]},{"type":"call","value":[1200,1248,1860,3840]},{"type":"call","value":[1200,1248,1860,2946]},{"type":"call","value":[1200,1248,1860,4999]},{"type":"call","value":[1200,1248,1860,2128]},{"type":"call","value":[1200,1248,1860,2146]},{"type":"call","value":[1200,1248,1560,6222]},{"type":"call","value":[1200,1248,1860,3058]},{"type":"call","value":[1200,1248,1860,5282]},{"type":"call","value":[1200,1248,1560,6240]},{"type":"call","value":[1200,1248,1860,3076]},{"type":"call","value":[1200,1248,1860,4473]},{"type":"call","value":[1200,1248,1860,2258]},{"type":"call","value":[1200,1248,1860,5385]},{"type":"call","value":[1200,1248,1860,4491]},{"type":"call","value":[1200,1248,1860,2276]},{"type":"call","value":[1200,1248,1860,4729]},{"type":"call","value":[1200,1248,1860,2941]},{"type":"call","value":[1200,1248,1860,5165]},{"type":"call","value":[1200,1248,1860,5403]},{"type":"call","value":[1200,1248,1860,2770]},{"type":"call","value":[1200,1248,1860,3197]},{"type":"call","value":[1200,1248,1860,5421]},{"type":"call","value":[1200,1248,1860,4338]},{"type":"call","value":[1200,1248,1860,3682]},{"type":"call","value":[1200,1248,1860,2797]},{"type":"call","value":[1200,1248,1860,4356]},{"type":"call","value":[1200,1248,1860,2379]},{"type":"call","value":[1200,1248,1860,3709]},{"type":"call","value":[1200,1248,1860,3947]},{"type":"call","value":[1200,1248,1860,4374]},{"type":"call","value":[1200,1248,1860,4612]},{"type":"call","value":[1200,1248,1860,2397]},{"type":"call","value":[1200,1248,1860,2635]},{"type":"call","value":[1200,1248,1860,3965]},{"type":"call","value":[1200,1248,1860,2644]},{"type":"call","value":[1200,1248,1860,5524]},{"type":"call","value":[1200,1248,1860,1988]},{"type":"call","value":[1200,1248,1860,4868]},{"type":"call","value":[1200,1248,1860,4212]},{"type":"call","value":[1200,1248,1860,5542]},{"type":"call","value":[1200,1248,1860,2900]},{"type":"call","value":[1200,1248,1860,2006]},{"type":"call","value":[1200,1248,1860,2671]},{"type":"call","value":[1200,1248,1860,4230]},{"type":"call","value":[1200,1248,1860,5124]},{"type":"call","value":[1200,1248,1860,3147]},{"type":"call","value":[1200,1248,1860,2918]},{"type":"call","value":[1200,1248,1860,5371]},{"type":"call","value":[1200,1248,1860,5142]},{"type":"call","value":[1200,1248,1860,3821]},{"type":"call","value":[1200,1248,1860,5398]},{"type":"call","value":[1200,1248,1860,3183]},{"type":"call","value":[1200,1248,1860,1871]},{"type":"call","value":[1200,1248,1860,4751]},{"type":"call","value":[1200,1248,1860,2536]},{"type":"call","value":[1200,1248,1860,3439]},{"type":"call","value":[1200,1248,1860,2783]},{"type":"call","value":[1200,1248,1860,5007]},{"type":"call","value":[1200,1248,1860,3695]},{"type":"call","value":[1200,1248,1860,2374]},{"type":"call","value":[1200,1248,1560,6221]},{"type":"call","value":[1200,1248,1860,2392]},{"type":"call","value":[1200,1248,1860,5510]},{"type":"call","value":[1200,1248,1860,3313]},{"type":"call","value":[1200,1248,1860,5110]},{"type":"call","value":[1200,1248,1860,4881]},{"type":"call","value":[1200,1248,1860,3807]},{"type":"call","value":[1200,1248,1860,3160]},{"type":"call","value":[1200,1248,1860,1839]},{"type":"call","value":[1200,1248,1860,2504]},{"type":"call","value":[1200,1248,1860,1848]},{"type":"call","value":[1200,1248,1860,5393]},{"type":"call","value":[1200,1248,1860,1857]},{"type":"call","value":[1200,1248,1860,3007]},{"type":"call","value":[1200,1248,1860,3434]},{"type":"call","value":[1200,1248,1860,3025]},{"type":"call","value":[1200,1248,1860,3263]},{"type":"call","value":[1200,1248,1860,3281]},{"type":"call","value":[1200,1248,1860,2387]},{"type":"call","value":[1200,1248,1860,5505]},{"type":"call","value":[1200,1248,1560,6225]},{"type":"call","value":[1200,1248,1560,6234]},{"type":"call","value":[1200,1248,1860,4440]},{"type":"call","value":[1200,1248,1860,3784]},{"type":"call","value":[1200,1248,1860,3555]},{"type":"call","value":[1200,1248,1860,2234]},{"type":"call","value":[1200,1248,1860,4458]},{"type":"call","value":[1200,1248,1860,2252]},{"type":"call","value":[1200,1248,1860,2490]},{"type":"call","value":[1200,1248,1860,3155]},{"type":"call","value":[1200,1248,1860,4058]},{"type":"call","value":[1200,1248,1860,4723]},{"type":"call","value":[1200,1248,1860,2746]},{"type":"call","value":[1200,1248,1860,4076]},{"type":"call","value":[1200,1248,1860,4314]},{"type":"call","value":[1200,1248,1860,2764]},{"type":"call","value":[1200,1248,1860,5217]},{"type":"call","value":[1200,1248,1860,3002]},{"type":"call","value":[1200,1248,1860,4561]},{"type":"call","value":[1200,1248,1860,3667]},{"type":"call","value":[1200,1248,1860,4332]},{"type":"call","value":[1200,1248,1860,5235]},{"type":"call","value":[1200,1248,1860,4579]},{"type":"call","value":[1200,1248,1252,6074]},{"type":"call","value":[1200,1248,1860,3923]},{"type":"call","value":[1200,1248,1860,4826]},{"type":"call","value":[1200,1248,1860,4170]},{"type":"call","value":[1200,1248,1860,4597]},{"type":"call","value":[1200,1248,1860,3941]},{"type":"call","value":[1200,1248,1860,2858]},{"type":"call","value":[1200,1248,1860,4844]},{"type":"call","value":[1200,1248,1860,4188]},{"type":"call","value":[1200,1248,1860,3294]},{"type":"call","value":[1200,1248,1860,3532]},{"type":"call","value":[1200,1248,1860,5091]},{"type":"call","value":[1200,1248,1860,5518]},{"type":"call","value":[1200,1248,1860,2876]},{"type":"call","value":[1200,1248,1860,1982]},{"type":"call","value":[1200,1248,1860,3541]},{"type":"call","value":[1200,1248,1860,4862]},{"type":"call","value":[1200,1248,1860,4206]},{"type":"call","value":[1200,1248,1860,3123]},{"type":"call","value":[1200,1248,1860,2894]},{"type":"call","value":[1200,1248,1860,5118]},{"type":"call","value":[1200,1248,1860,5356]},{"type":"call","value":[1200,1248,1860,3141]},{"type":"call","value":[1200,1248,1860,3815]},{"type":"call","value":[1200,1248,1860,4965]},{"type":"call","value":[1200,1248,1860,2094]},{"type":"call","value":[1200,1248,1860,2332]},{"type":"call","value":[1200,1248,1860,2997]},{"type":"call","value":[1200,1248,1860,2350]},{"type":"call","value":[1200,1248,1860,2597]},{"type":"call","value":[1200,1248,1252,6078]},{"type":"call","value":[1200,1248,1860,2368]},{"type":"call","value":[1200,1248,2304,6025]},{"type":"call","value":[1200,1248,1860,2853]},{"type":"call","value":[1200,1248,1860,2197]},{"type":"call","value":[1200,1248,1860,3109]},{"type":"call","value":[1200,1248,1860,5333]},{"type":"call","value":[1200,1248,1560,6300]},{"type":"call","value":[1200,1248,1860,2471]},{"type":"call","value":[1200,1248,1860,4695]},{"type":"call","value":[1200,1248,1860,1824]},{"type":"call","value":[1200,1248,1860,3383]},{"type":"call","value":[1200,1248,1860,4960]},{"type":"call","value":[1200,1248,1860,2089]},{"type":"call","value":[1200,1248,1860,2327]},{"type":"call","value":[1200,1248,1860,3257]},{"type":"call","value":[1200,1248,1860,3495]},{"type":"call","value":[1200,1248,1860,2848]},{"type":"call","value":[1200,1248,1860,3275]},{"type":"call","value":[1200,1248,1860,3513]},{"type":"call","value":[1200,1248,1860,5499]},{"type":"call","value":[1200,1248,2304,6029]},{"type":"call","value":[1200,1248,1860,4416]},{"type":"call","value":[1200,1248,1860,3760]},{"type":"call","value":[1200,1248,1860,3104]},{"type":"call","value":[1200,1248,1860,4434]},{"type":"call","value":[1200,1248,1860,3778]},{"type":"call","value":[1200,1248,1560,6295]},{"type":"call","value":[1200,1248,1860,2048]},{"type":"call","value":[1200,1248,1860,4928]},{"type":"call","value":[1200,1248,1860,4272]},{"type":"call","value":[1200,1248,1860,2722]},{"type":"call","value":[1200,1248,1860,4052]},{"type":"call","value":[1200,1248,1860,4290]},{"type":"call","value":[1200,1248,1860,4955]},{"type":"call","value":[1200,1248,1860,2740]},{"type":"call","value":[1200,1248,1860,2322]},{"type":"call","value":[1200,1248,1860,4308]},{"type":"call","value":[1200,1248,1860,4546]},{"type":"call","value":[1200,1248,1860,3652]},{"type":"call","value":[1200,1248,1860,5211]},{"type":"call","value":[1200,1248,1860,3890]},{"type":"call","value":[1200,1248,1860,1913]},{"type":"call","value":[1200,1248,1860,4793]},{"type":"call","value":[1200,1248,1860,5458]},{"type":"call","value":[1200,1248,1860,3243]},{"type":"call","value":[1200,1248,1860,5229]},{"type":"call","value":[1200,1248,1860,4573]},{"type":"call","value":[1200,1248,1860,3917]},{"type":"call","value":[1200,1248,1860,5476]},{"type":"call","value":[1200,1248,1860,4820]},{"type":"call","value":[1200,1248,1460,6065]},{"type":"call","value":[1200,1248,1860,5485]},{"type":"call","value":[1200,1248,1860,4164]},{"type":"call","value":[1200,1248,1860,5067]},{"type":"call","value":[1200,1248,1860,5085]},{"type":"call","value":[1200,1248,1860,2443]},{"type":"call","value":[1200,1248,1860,2870]},{"type":"call","value":[1200,1248,1860,2214]},{"type":"call","value":[1200,1248,1860,4011]},{"type":"call","value":[1200,1248,1860,3117]},{"type":"call","value":[1200,1248,1860,4020]},{"type":"call","value":[1200,1248,1860,5350]},{"type":"call","value":[1200,1248,1860,2955]},{"type":"call","value":[1200,1248,1860,4941]},{"type":"call","value":[1200,1248,2324,6200]},{"type":"call","value":[1200,1248,1252,6036]},{"type":"call","value":[1200,1248,1860,2991]},{"type":"call","value":[1200,1248,1860,1908]},{"type":"call","value":[1200,1248,1860,2573]},{"type":"call","value":[1200,1248,1860,1926]},{"type":"call","value":[1200,1248,1860,2164]},{"type":"call","value":[1200,1248,1860,2591]},{"type":"call","value":[1200,1248,1860,4150]},{"type":"call","value":[1200,1248,1860,2191]},{"type":"call","value":[1200,1248,1560,6276]},{"type":"call","value":[1200,1248,1860,4006]},{"type":"call","value":[1200,1248,1860,2465]},{"type":"call","value":[1200,1248,1860,4689]},{"type":"call","value":[1200,1248,2324,6195]},{"type":"call","value":[1200,1248,1860,2312]},{"type":"call","value":[1200,1248,1860,2550]},{"type":"call","value":[1200,1248,1860,1894]},{"type":"call","value":[1200,1248,1860,5439]},{"type":"call","value":[1200,1248,1252,6040]},{"type":"call","value":[1200,1248,1860,2568]},{"type":"call","value":[1200,1248,1860,4127]},{"type":"call","value":[1200,1248,1860,3471]},{"type":"call","value":[1200,1248,1860,1921]},{"type":"call","value":[1200,1248,1860,4145]},{"type":"call","value":[1200,1248,1860,2824]},{"type":"call","value":[1200,1248,1860,3489]},{"type":"call","value":[1200,1248,1860,4392]},{"type":"call","value":[1200,1248,1860,3736]},{"type":"call","value":[1200,1248,1860,2842]},{"type":"call","value":[1200,1248,1860,5295]},{"type":"call","value":[1200,1248,1860,3983]},{"type":"call","value":[1200,1248,1860,4410]},{"type":"call","value":[1200,1248,1860,4648]},{"type":"call","value":[1200,1248,1860,3754]},{"type":"call","value":[1200,1248,1860,5313]},{"type":"call","value":[1200,1248,1560,6262]},{"type":"call","value":[1200,1248,1860,3098]},{"type":"call","value":[1200,1248,1860,4001]},{"type":"call","value":[1200,1248,1860,2024]},{"type":"call","value":[1200,1248,1860,4904]},{"type":"call","value":[1200,1248,1860,2689]},{"type":"call","value":[1200,1248,1860,4248]},{"type":"call","value":[1200,1248,1860,5569]},{"type":"call","value":[1200,1248,1560,6298]},{"type":"call","value":[1200,1248,1860,2936]},{"type":"call","value":[1200,1248,1860,2042]},{"type":"call","value":[1200,1248,1860,4922]},{"type":"call","value":[1200,1248,1860,4266]},{"type":"call","value":[1200,1248,1860,2716]},{"type":"call","value":[1200,1248,1860,3848]},{"type":"call","value":[1200,1248,2324,6181]},{"type":"call","value":[1200,1248,1860,4284]},{"type":"call","value":[1200,1248,1860,3866]},{"type":"call","value":[1200,1248,2324,6199]},{"type":"call","value":[1200,1248,1860,1889]},{"type":"call","value":[1200,1248,1860,4769]},{"type":"call","value":[1200,1248,1860,5196]},{"type":"call","value":[1200,1248,1860,4540]},{"type":"call","value":[1200,1248,1860,3884]},{"type":"call","value":[1200,1248,1860,4787]},{"type":"call","value":[1200,1248,1860,5025]},{"type":"call","value":[1200,1248,1860,5043]},{"type":"call","value":[1200,1248,1860,5061]},{"type":"call","value":[1200,1248,1860,2419]},{"type":"call","value":[1200,1248,1860,3093]},{"type":"call","value":[1200,1248,1860,3331]},{"type":"call","value":[1200,1248,1860,2437]},{"type":"call","value":[1200,1248,1860,4890]},{"type":"call","value":[1200,1248,1560,6275]},{"type":"call","value":[1200,1248,1860,4670]},{"type":"call","value":[1200,1248,1860,2702]},{"type":"call","value":[1200,1248,1860,5182]},{"type":"call","value":[1200,1248,2324,6203]},{"type":"call","value":[1200,1248,1860,3452]},{"type":"call","value":[1200,1248,1860,1902]},{"type":"call","value":[1200,1248,1860,3461]},{"type":"call","value":[1200,1248,1860,2140]},{"type":"call","value":[1200,1248,1860,3052]},{"type":"call","value":[1200,1248,1860,2158]},{"type":"call","value":[1200,1248,1860,3070]},{"type":"call","value":[1200,1248,1860,2414]},{"type":"call","value":[1200,1248,1560,6252]},{"type":"call","value":[1200,1248,1860,3088]},{"type":"call","value":[1200,1248,1860,4485]},{"type":"call","value":[1200,1248,1860,2270]},{"type":"call","value":[1200,1248,1860,5159]},{"type":"call","value":[1200,1248,1860,4512]},{"type":"call","value":[1200,1248,1860,3191]},{"type":"call","value":[1200,1248,1860,5415]},{"type":"call","value":[1200,1248,2324,6198]},{"type":"call","value":[1200,1248,1860,4103]},{"type":"call","value":[1200,1248,1860,2791]},{"type":"call","value":[1200,1248,1860,4350]},{"type":"call","value":[1200,1248,1860,2562]},{"type":"call","value":[1200,1248,1860,4121]},{"type":"call","value":[1200,1248,1860,3038]},{"type":"call","value":[1200,1248,1860,3703]},{"type":"call","value":[1200,1248,1860,4368]},{"type":"call","value":[1200,1248,1860,2818]},{"type":"call","value":[1200,1248,1560,6229]},{"type":"call","value":[1200,1248,1860,3721]},{"type":"call","value":[1200,1248,1860,3959]},{"type":"call","value":[1200,1248,1860,4386]},{"type":"call","value":[1200,1248,1860,2409]},{"type":"call","value":[1200,1248,1860,4633]},{"type":"call","value":[1200,1248,1860,3977]},{"type":"call","value":[1200,1248,1860,5536]},{"type":"call","value":[1200,1248,1860,2000]},{"type":"call","value":[1200,1248,1860,4224]},{"type":"call","value":[1200,1248,1560,6265]},{"type":"call","value":[1200,1248,1860,3995]},{"type":"call","value":[1200,1248,1860,5554]},{"type":"call","value":[1200,1248,1860,2912]},{"type":"call","value":[1200,1248,1860,2018]},{"type":"call","value":[1200,1248,1860,4898]},{"type":"call","value":[1200,1248,1860,2683]},{"type":"call","value":[1200,1248,1860,4242]},{"type":"call","value":[1200,1248,1860,5136]},{"type":"call","value":[1200,1248,1860,2930]},{"type":"call","value":[1200,1248,1860,5154]},{"type":"call","value":[1200,1248,1860,3833]},{"type":"call","value":[1200,1248,1860,4498]},{"type":"call","value":[1200,1248,1860,2521]},{"type":"call","value":[1200,1248,1860,1865]},{"type":"call","value":[1200,1248,1860,4745]},{"type":"call","value":[1200,1248,1860,3860]},{"type":"call","value":[1200,1248,1860,3204]},{"type":"call","value":[1200,1248,1860,1883]},{"type":"call","value":[1200,1248,1860,4763]},{"type":"call","value":[1200,1248,1860,5019]},{"type":"call","value":[1200,1248,1860,2804]},{"type":"call","value":[1200,1248,1860,5266]},{"type":"call","value":[1200,1248,1860,3307]},{"type":"call","value":[1200,1248,1560,6251]}],"captures":{"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses":[{"type":"call","value":[1200,1248,1252,6074]},{"type":"call","value":[1200,1248,1252,6038]},{"type":"call","value":[1200,1248,1252,6076]},{"type":"call","value":[1200,1248,1252,6040]},{"type":"call","value":[1200,1248,1252,6072]},{"type":"call","value":[1200,1248,1252,6078]},{"type":"call","value":[1200,1248,1252,6036]},{"type":"call","value":[1200,1248,1460,6065]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.001\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1812]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.386\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1818]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3g2\\(Default)":[{"type":"call","value":[1200,1248,1860,1824]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3ga\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1832]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gp\\(Default)":[{"type":"call","value":[1200,1248,1860,1839]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gp2\\(Default)":[{"type":"call","value":[1200,1248,1860,1848]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gpp\\(Default)":[{"type":"call","value":[1200,1248,1860,1857]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.669\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1865]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.7z\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1871]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.a\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1877]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.a52\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1883]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.AAC\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1889]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.AAC\\(Default)":[{"type":"call","value":[1200,1248,1860,1894]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ac3\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1902]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADT\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1908]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADT\\(Default)":[{"type":"call","value":[1200,1248,1860,1913]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADTS\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1921]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ADTS\\(Default)":[{"type":"call","value":[1200,1248,1860,1926]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ai\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1934]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aif\\(Default)":[{"type":"call","value":[1200,1248,1860,1942]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aifc\\(Default)":[{"type":"call","value":[1200,1248,1860,1952]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aiff\\(Default)":[{"type":"call","value":[1200,1248,1860,1962]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.amr\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1970]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.amv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1976]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ani\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1982]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ans\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1988]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aob\\PerceivedType":[{"type":"call","value":[1200,1248,1860,1994]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ape\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2000]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.application\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2006]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.appref-ms\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2012]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aps\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2018]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.arj\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2024]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.art\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2030]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asa\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2036]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2042]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ascx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2048]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asf\\(Default)":[{"type":"call","value":[1200,1248,1860,2055]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2063]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asm\\(Default)":[{"type":"call","value":[1200,1248,1860,2068]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asmx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2073]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asmx\\(Default)":[{"type":"call","value":[1200,1248,1860,2078]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2083]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aspx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2089]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aspx\\(Default)":[{"type":"call","value":[1200,1248,1860,2094]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asx\\(Default)":[{"type":"call","value":[1200,1248,1860,2101]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.au\\(Default)":[{"type":"call","value":[1200,1248,1860,2111]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.avi\\(Default)":[{"type":"call","value":[1200,1248,1860,2120]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.b4s\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2128]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bcp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2140]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bik\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2146]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bin\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2152]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bkf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2158]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.blg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2164]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bmp\\(Default)":[{"type":"call","value":[1200,1248,1860,2171]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bsc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2179]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2185]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bz2\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2191]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.c\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2197]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.c\\(Default)":[{"type":"call","value":[1200,1248,1860,2202]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.c2r\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2207]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cab\\(Default)":[{"type":"call","value":[1200,1248,1860,2214]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.caf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2222]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.camp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2228]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cat\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2234]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2240]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cda\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2246]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cdmp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2252]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cdx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2258]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cer\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2264]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cgm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2270]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.chk\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2276]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.chm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2281]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cls\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2287]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cod\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2296]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.compositefont\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2305]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.contact\\(Default)":[{"type":"call","value":[1200,1248,1860,2312]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cpp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2322]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cpp\\(Default)":[{"type":"call","value":[1200,1248,1860,2327]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2332]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crds\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2338]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2344]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.crt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2350]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cs\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2356]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csa\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2362]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csproj\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2368]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.css\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2374]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.css\\(Default)":[{"type":"call","value":[1200,1248,1860,2379]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2387]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.csv\\(Default)":[{"type":"call","value":[1200,1248,1860,2392]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cue\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2397]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cur\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2403]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cxx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2409]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cxx\\(Default)":[{"type":"call","value":[1200,1248,1860,2414]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dat\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2419]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.db\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2425]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dbg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2431]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dbs\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2437]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dct\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2443]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.def\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2449]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.def\\(Default)":[{"type":"call","value":[1200,1248,1860,2454]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.der\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2459]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.desklink\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2465]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diagcab\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2471]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diagcfg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2477]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diagpkg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2483]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dib\\(Default)":[{"type":"call","value":[1200,1248,1860,2490]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dic\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2498]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.divx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2504]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2510]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.diz\\(Default)":[{"type":"call","value":[1200,1248,1860,2515]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dll\\(Default)":[{"type":"call","value":[1200,1248,1860,2521]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dl_\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2529]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.doc\\(Default)":[{"type":"call","value":[1200,1248,1860,2536]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.docx\\(Default)":[{"type":"call","value":[1200,1248,1860,2542]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dos\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2550]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dot\\(Default)":[{"type":"call","value":[1200,1248,1860,2557]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.drc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2562]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.drv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2568]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dsn\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2573]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dsp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2579]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dsw\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2585]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dts\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2591]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2597]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.DVR\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2603]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.DVR\\(Default)":[{"type":"call","value":[1200,1248,1860,2608]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.DVR-MS\\(Default)":[{"type":"call","value":[1200,1248,1860,2617]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dwfx\\(Default)":[{"type":"call","value":[1200,1248,1860,2626]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.easmx\\(Default)":[{"type":"call","value":[1200,1248,1860,2635]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.edrwx\\(Default)":[{"type":"call","value":[1200,1248,1860,2644]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.emf\\(Default)":[{"type":"call","value":[1200,1248,1860,2654]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.eprtx\\(Default)":[{"type":"call","value":[1200,1248,1860,2663]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.eps\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2671]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.etp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2677]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.evo\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2683]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.evt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2689]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.evtx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2695]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)":[{"type":"call","value":[1200,1248,1860,2702]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2710]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ext\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2716]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ex_\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2722]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.eyb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2728]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.f4v\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2734]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.faq\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2740]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fif\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2746]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fky\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2752]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.flac\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2758]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.flv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2764]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fnd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2770]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fnt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2776]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.fon\\(Default)":[{"type":"call","value":[1200,1248,1860,2783]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gadget\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2791]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ghi\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2797]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gif\\(Default)":[{"type":"call","value":[1200,1248,1860,2804]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gmmp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2812]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.group\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2818]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.grp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2824]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gvi\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2830]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gxf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2836]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2842]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.h\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2848]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.h\\(Default)":[{"type":"call","value":[1200,1248,1860,2853]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1C\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2858]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1D\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2864]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1F\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2870]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1H\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2876]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1K\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2882]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1Q\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2888]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1S\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2894]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1T\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2900]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1V\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2906]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.H1W\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2912]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hdp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2918]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hhc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2924]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hlp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2930]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hpp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2936]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hpp\\(Default)":[{"type":"call","value":[1200,1248,1860,2941]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hqx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2946]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2955]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2979]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htw\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2985]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.htx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2991]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hxx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,2997]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.hxx\\(Default)":[{"type":"call","value":[1200,1248,1860,3002]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.i\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3007]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ibq\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3013]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.icc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3019]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.icl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3025]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.icm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3031]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ico\\(Default)":[{"type":"call","value":[1200,1248,1860,3038]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ics\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3046]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.idl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3052]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.idq\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3058]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ifo\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3064]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ilk\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3070]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.imc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3076]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.img\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3082]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3088]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inc\\(Default)":[{"type":"call","value":[1200,1248,1860,3093]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3098]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3104]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ini\\(Default)":[{"type":"call","value":[1200,1248,1860,3109]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3117]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3123]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.inx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3129]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.in_\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3135]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.iso\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3141]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.it\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3147]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.IVF\\(Default)":[{"type":"call","value":[1200,1248,1860,3155]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jav\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3160]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.java\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3166]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.java\\(Default)":[{"type":"call","value":[1200,1248,1860,3171]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jbf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3176]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jfif\\(Default)":[{"type":"call","value":[1200,1248,1860,3183]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.Job\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3191]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jod\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3197]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpe\\(Default)":[{"type":"call","value":[1200,1248,1860,3204]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpeg\\(Default)":[{"type":"call","value":[1200,1248,1860,3213]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpg\\(Default)":[{"type":"call","value":[1200,1248,1860,3222]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.js\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3230]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.JSE\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3236]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jtx\\(Default)":[{"type":"call","value":[1200,1248,1860,3243]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.kci\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3251]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.label\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3257]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.latex\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3263]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lgn\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3269]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lha\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3275]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lib\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3281]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.library-ms\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3287]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)":[{"type":"call","value":[1200,1248,1860,3294]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.local\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3302]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.log\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3307]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lst\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3313]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3319]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lzh\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3325]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m14\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3331]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m1v\\(Default)":[{"type":"call","value":[1200,1248,1860,3338]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2T\\(Default)":[{"type":"call","value":[1200,1248,1860,3347]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2TS\\(Default)":[{"type":"call","value":[1200,1248,1860,3356]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2V\\(Default)":[{"type":"call","value":[1200,1248,1860,3365]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m3u\\(Default)":[{"type":"call","value":[1200,1248,1860,3375]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m3u8\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3383]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4a\\(Default)":[{"type":"call","value":[1200,1248,1860,3390]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4b\\(Default)":[{"type":"call","value":[1200,1248,1860,3399]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4p\\(Default)":[{"type":"call","value":[1200,1248,1860,3405]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4v\\(Default)":[{"type":"call","value":[1200,1248,1860,3414]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mak\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3422]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.man\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3428]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.manifest\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3434]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mapimail\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3439]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mcl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3445]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mht\\(Default)":[{"type":"call","value":[1200,1248,1860,3452]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mhtml\\(Default)":[{"type":"call","value":[1200,1248,1860,3461]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mid\\(Default)":[{"type":"call","value":[1200,1248,1860,3471]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.midi\\(Default)":[{"type":"call","value":[1200,1248,1860,3481]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mig\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3489]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mk\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3495]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mka\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3501]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mkv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3507]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mlc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3513]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mlp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3519]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mmf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3525]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.MOD\\(Default)":[{"type":"call","value":[1200,1248,1860,3532]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mov\\(Default)":[{"type":"call","value":[1200,1248,1860,3541]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.movie\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3549]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp1\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3555]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp2\\(Default)":[{"type":"call","value":[1200,1248,1860,3562]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp2v\\(Default)":[{"type":"call","value":[1200,1248,1860,3571]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp3\\(Default)":[{"type":"call","value":[1200,1248,1860,3580]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp4\\(Default)":[{"type":"call","value":[1200,1248,1860,3589]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp4v\\(Default)":[{"type":"call","value":[1200,1248,1860,3598]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpa\\(Default)":[{"type":"call","value":[1200,1248,1860,3608]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3616]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpe\\(Default)":[{"type":"call","value":[1200,1248,1860,3623]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg\\(Default)":[{"type":"call","value":[1200,1248,1860,3632]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg1\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3640]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg2\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3646]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg4\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3652]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpg\\(Default)":[{"type":"call","value":[1200,1248,1860,3659]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpga\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3667]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpv2\\(Default)":[{"type":"call","value":[1200,1248,1860,3674]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3682]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msdvd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3688]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msg\\(Default)":[{"type":"call","value":[1200,1248,1860,3695]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3703]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msrcincident\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3709]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msstyles\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3715]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.msu\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3721]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.MTS\\(Default)":[{"type":"call","value":[1200,1248,1860,3728]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mtv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3736]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3742]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mxf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3748]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mydocs\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3754]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ncb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3760]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nfo\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3766]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nls\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3772]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nsv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3778]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nuv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3784]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nvr\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3790]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.nvr\\(Default)":[{"type":"call","value":[1200,1248,1860,3795]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.obj\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3800]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ocx\\(Default)":[{"type":"call","value":[1200,1248,1860,3807]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oc_\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3815]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3821]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odh\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3827]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3833]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odt\\(Default)":[{"type":"call","value":[1200,1248,1860,3840]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oga\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3848]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3854]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3860]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3866]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ogx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3872]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oma\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3878]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.opus\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3884]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.osdx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3890]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.otf\\(Default)":[{"type":"call","value":[1200,1248,1860,3897]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.oxps\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3905]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p10\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3911]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p12\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3917]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7b\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3923]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7c\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3929]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7m\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3935]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7r\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3941]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.p7s\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3947]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pbk\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3953]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pch\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3959]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pdb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3965]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pdf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3971]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pds\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3977]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.perfmoncfg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3983]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pfm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3989]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pfx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,3995]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.php3\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4001]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.php3\\(Default)":[{"type":"call","value":[1200,1248,1860,4006]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pic\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4011]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pko\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4020]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4026]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pl\\(Default)":[{"type":"call","value":[1200,1248,1860,4031]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.plg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4036]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.plg\\(Default)":[{"type":"call","value":[1200,1248,1860,4041]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pls\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4046]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pma\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4052]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pmc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4058]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pml\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4064]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pmr\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4070]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pnf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4076]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.png\\(Default)":[{"type":"call","value":[1200,1248,1860,4083]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pot\\(Default)":[{"type":"call","value":[1200,1248,1860,4092]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ppk\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4097]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pps\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4103]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ppt\\(Default)":[{"type":"call","value":[1200,1248,1860,4110]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.prc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4115]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.prf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4121]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.printerExport\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4127]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4133]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps1\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4139]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps1xml\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4145]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ps1xml\\(Default)":[{"type":"call","value":[1200,1248,1860,4150]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psc1\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4158]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4164]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psd1\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4170]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.psm1\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4176]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.py\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4182]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4188]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4194]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyo\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4200]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyw\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4206]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4212]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.pyzw\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4218]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.qcp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4224]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.qds\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4230]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r00\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4236]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r01\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4242]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r02\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4248]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r03\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4254]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r04\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4260]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r05\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4266]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r06\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4272]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r07\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4278]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r08\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4284]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r09\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4290]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r10\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4296]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r11\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4302]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r12\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4308]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r13\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4314]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r14\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4320]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r15\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4326]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r16\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4332]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r17\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4338]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r18\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4344]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r19\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4350]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r20\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4356]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r21\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4362]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r22\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4368]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r23\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4374]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r24\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4380]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r25\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4386]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r26\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4392]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r27\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4398]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r28\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4404]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.r29\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4410]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ra\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4416]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ram\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4422]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rar\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4428]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rat\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4434]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4440]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rc2\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4446]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rct\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4452]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.RDP\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4458]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rec\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4464]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.res\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4473]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.resmoncfg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4479]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rev\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4485]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rgs\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4491]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rle\\(Default)":[{"type":"call","value":[1200,1248,1860,4498]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rll\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4506]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4512]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rmi\\(Default)":[{"type":"call","value":[1200,1248,1860,4520]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rmvb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4528]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rpc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4534]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rpl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4540]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rsp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4546]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rtf\\(Default)":[{"type":"call","value":[1200,1248,1860,4553]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rul\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4561]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.s\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4567]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.s3m\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4573]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sbr\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4579]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sc2\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4585]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4591]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4597]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scf\\(Default)":[{"type":"call","value":[1200,1248,1860,4604]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sch\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4612]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.scp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4618]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sct\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4627]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sdp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4633]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.search-ms\\(Default)":[{"type":"call","value":[1200,1248,1860,4640]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.searchConnector-ms\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4648]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sed\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4654]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sed\\(Default)":[{"type":"call","value":[1200,1248,1860,4659]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sfcache\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4664]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.shtm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4670]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sit\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4689]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.slupkg-ms\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4695]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.snd\\(Default)":[{"type":"call","value":[1200,1248,1860,4703]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sol\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4711]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sor\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4717]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.spc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4723]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.spx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4729]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sql\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4735]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sql\\(Default)":[{"type":"call","value":[1200,1248,1860,4740]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.srf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4745]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sr_\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4751]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sst\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4757]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.stl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4763]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.stm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4769]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.svg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4775]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.swf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4781]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sym\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4787]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.symlink\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4793]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sys\\(Default)":[{"type":"call","value":[1200,1248,1860,4800]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.sy_\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4808]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tab\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4814]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tar\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4820]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.taz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4826]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tbz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4832]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tbz2\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4838]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tdl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4844]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.text\\(Default)":[{"type":"call","value":[1200,1248,1860,4851]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tgz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4856]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.theme\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4862]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.themepack\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4868]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.thp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4874]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tif\\(Default)":[{"type":"call","value":[1200,1248,1860,4881]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tiff\\(Default)":[{"type":"call","value":[1200,1248,1860,4890]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tlb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4898]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tlh\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4904]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tli\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4910]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tlz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4916]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tod\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4922]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4928]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.trg\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4934]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.TS\\(Default)":[{"type":"call","value":[1200,1248,1860,4941]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tsp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4949]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tsv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4955]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tsv\\(Default)":[{"type":"call","value":[1200,1248,1860,4960]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tta\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4965]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ttc\\(Default)":[{"type":"call","value":[1200,1248,1860,4972]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.ttf\\(Default)":[{"type":"call","value":[1200,1248,1860,4981]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.TTS\\(Default)":[{"type":"call","value":[1200,1248,1860,4990]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.txt\\(Default)":[{"type":"call","value":[1200,1248,1860,4999]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.txz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5007]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.udf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5013]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.UDL\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5019]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.udt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5025]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.URL\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5031]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.user\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5037]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.usr\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5043]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.uu\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5049]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.uue\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5055]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.VBE\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5061]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vbproj\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5067]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vbs\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5073]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vbx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5079]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vcf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5085]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vcproj\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5091]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.viw\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5097]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vlc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5103]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vob\\(Default)":[{"type":"call","value":[1200,1248,1860,5110]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.voc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5118]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vqf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5124]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vro\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5130]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vspscc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5136]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vsscc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5142]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vssscc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5148]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vxd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5154]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.w64\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5159]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wab\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5165]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wav\\(Default)":[{"type":"call","value":[1200,1248,1860,5172]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wax\\(Default)":[{"type":"call","value":[1200,1248,1860,5182]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wbcat\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5190]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wcx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5196]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wdp\\(Default)":[{"type":"call","value":[1200,1248,1860,5203]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.webm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5211]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.webp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5217]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.webpnp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5223]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wll\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5229]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wlt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5235]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wm\\(Default)":[{"type":"call","value":[1200,1248,1860,5243]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wma\\(Default)":[{"type":"call","value":[1200,1248,1860,5252]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WMD\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5260]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmdb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5266]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmf\\(Default)":[{"type":"call","value":[1200,1248,1860,5274]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmp\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5282]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WMS\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5288]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmv\\(Default)":[{"type":"call","value":[1200,1248,1860,5295]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmx\\(Default)":[{"type":"call","value":[1200,1248,1860,5305]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wmz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5313]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wpl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5319]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wpl\\(Default)":[{"type":"call","value":[1200,1248,1860,5324]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wri\\(Default)":[{"type":"call","value":[1200,1248,1860,5333]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wsc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5338]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WSF\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5344]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WSH\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5350]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wsz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5356]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.WTV\\(Default)":[{"type":"call","value":[1200,1248,1860,5363]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wtx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5371]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wv\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5377]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wvx\\(Default)":[{"type":"call","value":[1200,1248,1860,5385]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.x\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5393]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.x\\(Default)":[{"type":"call","value":[1200,1248,1860,5398]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xa\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5403]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xaml\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5409]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xbap\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5415]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xesc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5421]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xix\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5439]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xlb\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5445]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xlc\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5451]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xls\\(Default)":[{"type":"call","value":[1200,1248,1860,5458]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xlt\\(Default)":[{"type":"call","value":[1200,1248,1860,5464]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xm\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5469]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xml\\(Default)":[{"type":"call","value":[1200,1248,1860,5476]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xps\\(Default)":[{"type":"call","value":[1200,1248,1860,5485]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xrm-ms\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5493]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xsd\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5499]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xsl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5505]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xsl\\(Default)":[{"type":"call","value":[1200,1248,1860,5510]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xslt\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5518]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xspf\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5524]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xxe\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5530]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.xz\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5536]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.z\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5542]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.z96\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5548]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zfsendtotarget\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5554]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zip\\(Default)":[{"type":"call","value":[1200,1248,1860,5561]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zipx\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5569]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.zpl\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5575]}],"HKEY_LOCAL_MACHINE\\Control Panel\\Personalization\\Desktop Slideshow":[{"type":"call","value":[1200,1248,2304,6029]},{"type":"call","value":[1200,1248,2304,6025]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs":[{"type":"call","value":[1200,1248,2324,6181]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid":[{"type":"call","value":[1200,1248,2324,6188]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid":[{"type":"call","value":[1200,1248,2324,6195]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\(Default)":[{"type":"call","value":[1200,1248,2324,6198]},{"type":"call","value":[1200,1248,2324,6197]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32":[{"type":"call","value":[1200,1248,2324,6199]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\InprocServer32":[{"type":"call","value":[1200,1248,2324,6200]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\(Default)":[{"type":"call","value":[1200,1248,2324,6201]},{"type":"call","value":[1200,1248,2324,6202]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocServer32\\ThreadingModel":[{"type":"call","value":[1200,1248,2324,6203]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32":[{"type":"call","value":[1200,1248,2324,6210]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler":[{"type":"call","value":[1200,1248,2324,6216]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\InProcServer32\\(Default)":[{"type":"call","value":[1200,1248,1560,6287]},{"type":"call","value":[1200,1248,1560,6221]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\InProcServer32\\LoadWithoutCOM":[{"type":"call","value":[1200,1248,1560,6222]},{"type":"call","value":[1200,1248,1560,6288]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}":[{"type":"call","value":[1200,1248,1560,6291]},{"type":"call","value":[1200,1248,1560,6225]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{21EC2020-3AEA-1069-A2DD-08002B30309D}\\SortOrderIndex":[{"type":"call","value":[1200,1248,1560,6227]},{"type":"call","value":[1200,1248,1560,6293]}],"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}":[{"type":"call","value":[1200,1248,1560,6295]},{"type":"call","value":[1200,1248,1560,6229]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\SortOrderIndex":[{"type":"call","value":[1200,1248,1560,6298]},{"type":"call","value":[1200,1248,1560,6232]}],"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}":[{"type":"call","value":[1200,1248,1560,6234]},{"type":"call","value":[1200,1248,1560,6300]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\System.ItemNameDisplay":[{"type":"call","value":[1200,1248,1560,6237]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10":[{"type":"call","value":[1200,1248,1560,6240]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}\\LocalizedString":[{"type":"call","value":[1200,1248,1560,6250]}],"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MUI\\StringCacheSettings":[{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,1560,6276]}],"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration":[{"type":"call","value":[1200,1248,1560,6252]},{"type":"call","value":[1200,1248,1560,6277]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\System.ItemNameDisplay":[{"type":"call","value":[1200,1248,1560,6262]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 10":[{"type":"call","value":[1200,1248,1560,6265]}],"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\\LocalizedString":[{"type":"call","value":[1200,1248,1560,6275]}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/hkcu/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/HKEY_CURRENT_USER/i"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1860,4884]},{"type":"call","value":[1200,1248,1860,2123]},{"type":"call","value":[1200,1248,1860,2962]},{"type":"call","value":[1200,1248,1860,4893]},{"type":"call","value":[1200,1248,1860,2971]},{"type":"call","value":[1200,1248,1860,3810]},{"type":"call","value":[1200,1248,1860,2315]},{"type":"call","value":[1200,1248,1860,2806]},{"type":"call","value":[1200,1248,1860,5387]},{"type":"call","value":[1200,1248,1860,1851]},{"type":"call","value":[1200,1248,1860,5277]},{"type":"call","value":[1200,1248,1860,4676]},{"type":"call","value":[1200,1248,1860,1915]},{"type":"call","value":[1200,1248,1560,6235]},{"type":"call","value":[1200,1248,1860,1860]},{"type":"call","value":[1200,1248,2324,6179]},{"type":"call","value":[1200,1248,1860,3245]},{"type":"call","value":[1200,1248,1860,3483]},{"type":"call","value":[1200,1248,1860,3611]},{"type":"call","value":[1200,1248,1860,5478]},{"type":"call","value":[1200,1248,1860,3565]},{"type":"call","value":[1200,1248,1860,2964]},{"type":"call","value":[1200,1248,1860,4523]},{"type":"call","value":[1200,1248,2304,6026]},{"type":"call","value":[1200,1248,1860,3455]},{"type":"call","value":[1200,1248,1860,3574]},{"type":"call","value":[1200,1248,1860,2973]},{"type":"call","value":[1200,1248,1860,5307]},{"type":"call","value":[1200,1248,1860,3583]},{"type":"call","value":[1200,1248,1860,2381]},{"type":"call","value":[1200,1248,1860,5206]},{"type":"call","value":[1200,1248,1560,6283]},{"type":"call","value":[1200,1248,1860,2628]},{"type":"call","value":[1200,1248,1860,2637]},{"type":"call","value":[1200,1248,1560,6301]},{"type":"call","value":[1200,1248,1860,2646]},{"type":"call","value":[1200,1248,1860,4086]},{"type":"call","value":[1200,1248,1560,6246]},{"type":"call","value":[1200,1248,1860,2173]},{"type":"call","value":[1200,1248,1860,1944]},{"type":"call","value":[1200,1248,1860,3677]},{"type":"call","value":[1200,1248,1860,4943]},{"type":"call","value":[1200,1248,2324,6193]},{"type":"call","value":[1200,1248,1860,5245]},{"type":"call","value":[1200,1248,1860,5254]},{"type":"call","value":[1200,1248,1860,2493]},{"type":"call","value":[1200,1248,1560,6267]},{"type":"call","value":[1200,1248,1860,3341]},{"type":"call","value":[1200,1248,1860,4607]},{"type":"call","value":[1200,1248,1860,5327]},{"type":"call","value":[1200,1248,1860,1965]},{"type":"call","value":[1200,1248,1860,3112]},{"type":"call","value":[1200,1248,1860,3350]},{"type":"call","value":[1200,1248,1560,6230]},{"type":"call","value":[1200,1248,1860,3359]},{"type":"call","value":[1200,1248,1860,3185]},{"type":"call","value":[1200,1248,1860,1928]},{"type":"call","value":[1200,1248,1860,3368]},{"type":"call","value":[1200,1248,1860,4152]},{"type":"call","value":[1200,1248,2304,6012]},{"type":"call","value":[1200,1248,1860,2657]},{"type":"call","value":[1200,1248,1860,3377]},{"type":"call","value":[1200,1248,1860,5174]},{"type":"call","value":[1200,1248,2304,6021]},{"type":"call","value":[1200,1248,1860,2785]},{"type":"call","value":[1200,1248,1860,3206]},{"type":"call","value":[1200,1248,1860,5366]},{"type":"call","value":[1200,1248,1860,3215]},{"type":"call","value":[1200,1248,1860,3041]},{"type":"call","value":[1200,1248,1860,3224]},{"type":"call","value":[1200,1248,1860,3407]},{"type":"call","value":[1200,1248,1860,5512]},{"type":"call","value":[1200,1248,1860,3297]},{"type":"call","value":[1200,1248,1860,3416]},{"type":"call","value":[1200,1248,1860,3535]},{"type":"call","value":[1200,1248,1860,4975]},{"type":"call","value":[1200,1248,1560,6296]},{"type":"call","value":[1200,1248,1860,2705]},{"type":"call","value":[1200,1248,1860,2104]},{"type":"call","value":[1200,1248,1860,3544]},{"type":"call","value":[1200,1248,1860,4984]},{"type":"call","value":[1200,1248,1860,2113]},{"type":"call","value":[1200,1248,1860,4993]},{"type":"call","value":[1200,1248,1860,2058]},{"type":"call","value":[1200,1248,1860,5112]},{"type":"call","value":[1200,1248,1860,2122]},{"type":"call","value":[1200,1248,1860,5002]},{"type":"call","value":[1200,1248,2304,6023]},{"type":"call","value":[1200,1248,1860,3626]},{"type":"call","value":[1200,1248,1860,5185]},{"type":"call","value":[1200,1248,1860,3809]},{"type":"call","value":[1200,1248,1860,3635]},{"type":"call","value":[1200,1248,1860,2314]},{"type":"call","value":[1200,1248,1860,5487]},{"type":"call","value":[1200,1248,1560,6271]},{"type":"call","value":[1200,1248,1860,1896]},{"type":"call","value":[1200,1248,1860,1841]},{"type":"call","value":[1200,1248,1560,6280]},{"type":"call","value":[1200,1248,1860,3464]},{"type":"call","value":[1200,1248,1860,1850]},{"type":"call","value":[1200,1248,1860,3473]},{"type":"call","value":[1200,1248,1860,1859]},{"type":"call","value":[1200,1248,1860,3592]},{"type":"call","value":[1200,1248,1860,2216]},{"type":"call","value":[1200,1248,1860,4803]},{"type":"call","value":[1200,1248,1860,3601]},{"type":"call","value":[1200,1248,1860,3610]},{"type":"call","value":[1200,1248,1860,3564]},{"type":"call","value":[1200,1248,1860,5297]},{"type":"call","value":[1200,1248,1860,4522]},{"type":"call","value":[1200,1248,1560,6255]},{"type":"call","value":[1200,1248,1860,5276]},{"type":"call","value":[1200,1248,1860,2545]},{"type":"call","value":[1200,1248,1860,4705]},{"type":"call","value":[1200,1248,2324,6208]},{"type":"call","value":[1200,1248,1860,3393]},{"type":"call","value":[1200,1248,1560,6273]},{"type":"call","value":[1200,1248,1860,5388]},{"type":"call","value":[1200,1248,1560,6282]},{"type":"call","value":[1200,1248,1860,1916]},{"type":"call","value":[1200,1248,1860,4085]},{"type":"call","value":[1200,1248,1860,3484]},{"type":"call","value":[1200,1248,1860,3731]},{"type":"call","value":[1200,1248,1860,3676]},{"type":"call","value":[1200,1248,1560,6248]},{"type":"call","value":[1200,1248,1860,2965]},{"type":"call","value":[1200,1248,1860,4643]},{"type":"call","value":[1200,1248,1560,6257]},{"type":"call","value":[1200,1248,1860,5308]},{"type":"call","value":[1200,1248,1860,1827]},{"type":"call","value":[1200,1248,1860,2666]},{"type":"call","value":[1200,1248,1860,2492]},{"type":"call","value":[1200,1248,1860,2611]},{"type":"call","value":[1200,1248,1860,5427]},{"type":"call","value":[1200,1248,1860,1955]},{"type":"call","value":[1200,1248,1860,2382]},{"type":"call","value":[1200,1248,1860,2620]},{"type":"call","value":[1200,1248,1860,3340]},{"type":"call","value":[1200,1248,1860,1964]},{"type":"call","value":[1200,1248,1860,5564]},{"type":"call","value":[1200,1248,1860,2629]},{"type":"call","value":[1200,1248,1860,3349]},{"type":"call","value":[1200,1248,1860,2638]},{"type":"call","value":[1200,1248,1860,3358]},{"type":"call","value":[1200,1248,1860,3843]},{"type":"call","value":[1200,1248,1860,2174]},{"type":"call","value":[1200,1248,1860,5246]},{"type":"call","value":[1200,1248,1860,5365]},{"type":"call","value":[1200,1248,1860,4883]},{"type":"call","value":[1200,1248,1860,4892]},{"type":"call","value":[1200,1248,1860,3534]},{"type":"call","value":[1200,1248,1860,4974]},{"type":"call","value":[1200,1248,1860,2103]},{"type":"call","value":[1200,1248,1860,3543]},{"type":"call","value":[1200,1248,1860,3662]},{"type":"call","value":[1200,1248,1860,3900]},{"type":"call","value":[1200,1248,1860,4501]},{"type":"call","value":[1200,1248,1860,4556]},{"type":"call","value":[1200,1248,1860,2524]},{"type":"call","value":[1200,1248,1860,4684]},{"type":"call","value":[1200,1248,1860,4983]},{"type":"call","value":[1200,1248,1860,5175]},{"type":"call","value":[1200,1248,1860,5184]},{"type":"call","value":[1200,1248,1860,3207]},{"type":"call","value":[1200,1248,1860,3216]},{"type":"call","value":[1200,1248,1560,6270]},{"type":"call","value":[1200,1248,1860,3454]},{"type":"call","value":[1200,1248,1860,3573]},{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1860,3463]},{"type":"call","value":[1200,1248,1860,3582]},{"type":"call","value":[1200,1248,1860,3408]},{"type":"call","value":[1200,1248,1860,2807]},{"type":"call","value":[1200,1248,1860,5205]},{"type":"call","value":[1200,1248,1860,3591]},{"type":"call","value":[1200,1248,1860,3600]},{"type":"call","value":[1200,1248,1860,3246]},{"type":"call","value":[1200,1248,1860,5113]},{"type":"call","value":[1200,1248,1560,6245]},{"type":"call","value":[1200,1248,2324,6189]},{"type":"call","value":[1200,1248,1560,6254]},{"type":"call","value":[1200,1248,1860,5479]},{"type":"call","value":[1200,1248,1860,2544]},{"type":"call","value":[1200,1248,1860,5488]},{"type":"call","value":[1200,1248,1860,5433]},{"type":"call","value":[1200,1248,1860,3392]},{"type":"call","value":[1200,1248,2304,6027]},{"type":"call","value":[1200,1248,1860,1897]},{"type":"call","value":[1200,1248,1860,1842]},{"type":"call","value":[1200,1248,1860,2974]},{"type":"call","value":[1200,1248,1860,3474]},{"type":"call","value":[1200,1248,1860,4606]},{"type":"call","value":[1200,1248,1860,5326]},{"type":"call","value":[1200,1248,1860,3111]},{"type":"call","value":[1200,1248,1860,2217]},{"type":"call","value":[1200,1248,1860,3730]},{"type":"call","value":[1200,1248,1860,2647]},{"type":"call","value":[1200,1248,1860,3367]},{"type":"call","value":[1200,1248,1860,5298]},{"type":"call","value":[1200,1248,1860,2656]},{"type":"call","value":[1200,1248,1860,4642]},{"type":"call","value":[1200,1248,1860,1826]},{"type":"call","value":[1200,1248,1860,1945]},{"type":"call","value":[1200,1248,1860,2665]},{"type":"call","value":[1200,1248,1860,2610]},{"type":"call","value":[1200,1248,1860,4706]},{"type":"call","value":[1200,1248,1860,4944]},{"type":"call","value":[1200,1248,1860,1954]},{"type":"call","value":[1200,1248,2304,6020]},{"type":"call","value":[1200,1248,1860,2619]},{"type":"call","value":[1200,1248,1860,5563]},{"type":"call","value":[1200,1248,1860,5255]},{"type":"call","value":[1200,1248,1860,3040]},{"type":"call","value":[1200,1248,1860,3296]},{"type":"call","value":[1200,1248,1860,3842]},{"type":"call","value":[1200,1248,1860,4681]},{"type":"call","value":[1200,1248,2324,6175]},{"type":"call","value":[1200,1248,1860,3186]},{"type":"call","value":[1200,1248,1860,2704]},{"type":"call","value":[1200,1248,1860,1929]},{"type":"call","value":[1200,1248,1860,4153]},{"type":"call","value":[1200,1248,1860,4992]},{"type":"call","value":[1200,1248,1860,3378]},{"type":"call","value":[1200,1248,1860,2057]},{"type":"call","value":[1200,1248,1560,6258]},{"type":"call","value":[1200,1248,1860,5001]},{"type":"call","value":[1200,1248,2304,6022]},{"type":"call","value":[1200,1248,1860,2786]},{"type":"call","value":[1200,1248,1860,3625]},{"type":"call","value":[1200,1248,1860,3634]},{"type":"call","value":[1200,1248,2324,6214]},{"type":"call","value":[1200,1248,1860,3225]},{"type":"call","value":[1200,1248,1860,4555]},{"type":"call","value":[1200,1248,1860,3661]},{"type":"call","value":[1200,1248,1860,4500]},{"type":"call","value":[1200,1248,1860,3899]},{"type":"call","value":[1200,1248,1860,5513]},{"type":"call","value":[1200,1248,1860,3417]},{"type":"call","value":[1200,1248,1860,2523]},{"type":"call","value":[1200,1248,1860,4683]},{"type":"call","value":[1200,1248,1860,4802]},{"type":"call","value":[1200,1248,1560,6242]},{"type":"call","value":[1200,1248,2324,6186]},{"type":"call","value":[1200,1248,1860,2114]}],"captures":{"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3g2\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1826]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3g2\\OpenWithProgids\\VLC.3g2":[{"type":"call","value":[1200,1248,1860,1827]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1841]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp\\OpenWithProgids\\VLC.3gp":[{"type":"call","value":[1200,1248,1860,1842]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp2\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1850]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gp2\\OpenWithProgids\\VLC.3gp2":[{"type":"call","value":[1200,1248,1860,1851]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gpp\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1859]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.3gpp\\OpenWithProgids\\VLC.3gpp":[{"type":"call","value":[1200,1248,1860,1860]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.AAC\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1896]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.AAC\\OpenWithProgids\\VLC.aac":[{"type":"call","value":[1200,1248,1860,1897]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADT\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1915]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADT\\OpenWithProgids\\VLC.adt":[{"type":"call","value":[1200,1248,1860,1916]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADTS\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1928]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ADTS\\OpenWithProgids\\VLC.adts":[{"type":"call","value":[1200,1248,1860,1929]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aif\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1944]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aif\\OpenWithProgids\\VLC.aif":[{"type":"call","value":[1200,1248,1860,1945]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aifc\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1954]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aifc\\OpenWithProgids\\VLC.aifc":[{"type":"call","value":[1200,1248,1860,1955]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aiff\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,1964]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.aiff\\OpenWithProgids\\VLC.aiff":[{"type":"call","value":[1200,1248,1860,1965]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2057]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asf\\OpenWithProgids\\VLC.asf":[{"type":"call","value":[1200,1248,1860,2058]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2103]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.asx\\OpenWithProgids\\VLC.asx":[{"type":"call","value":[1200,1248,1860,2104]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.au\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2113]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.au\\OpenWithProgids\\VLC.au":[{"type":"call","value":[1200,1248,1860,2114]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.avi\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2122]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.avi\\OpenWithProgids\\VLC.avi":[{"type":"call","value":[1200,1248,1860,2123]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2173]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids\\Paint.Picture":[{"type":"call","value":[1200,1248,1860,2174]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2216]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids\\WinRAR":[{"type":"call","value":[1200,1248,1860,2217]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2314]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids\\contact_wab_auto_file":[{"type":"call","value":[1200,1248,1860,2315]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2381]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids\\CSSfile":[{"type":"call","value":[1200,1248,1860,2382]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2492]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids\\Paint.Picture":[{"type":"call","value":[1200,1248,1860,2493]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2523]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids\\dllfile":[{"type":"call","value":[1200,1248,1860,2524]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2544]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids\\docxfile":[{"type":"call","value":[1200,1248,1860,2545]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2610]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR\\OpenWithProgids\\MediaCenter.DVR":[{"type":"call","value":[1200,1248,1860,2611]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR-MS\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2619]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.DVR-MS\\OpenWithProgids\\VLC.dvr-ms":[{"type":"call","value":[1200,1248,1860,2620]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2628]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids\\Windows.XPSReachViewer":[{"type":"call","value":[1200,1248,1860,2629]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2637]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids\\Windows.XPSReachViewer":[{"type":"call","value":[1200,1248,1860,2638]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2646]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids\\Windows.XPSReachViewer":[{"type":"call","value":[1200,1248,1860,2647]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2656]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids\\emffile":[{"type":"call","value":[1200,1248,1860,2657]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2665]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids\\Windows.XPSReachViewer":[{"type":"call","value":[1200,1248,1860,2666]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2704]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids\\exefile":[{"type":"call","value":[1200,1248,1860,2705]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2785]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids\\fonfile":[{"type":"call","value":[1200,1248,1860,2786]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2806]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids\\giffile":[{"type":"call","value":[1200,1248,1860,2807]}],"HKEY_CURRENT_USER\\Software\\Classes\\.htm\\(Default)":[{"type":"call","value":[1200,1248,1860,2962]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2964]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids\\ChromeHTML":[{"type":"call","value":[1200,1248,1860,2965]}],"HKEY_CURRENT_USER\\Software\\Classes\\.html\\(Default)":[{"type":"call","value":[1200,1248,1860,2971]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,2973]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids\\ChromeHTML":[{"type":"call","value":[1200,1248,1860,2974]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3040]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids\\icofile":[{"type":"call","value":[1200,1248,1860,3041]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3111]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids\\inifile":[{"type":"call","value":[1200,1248,1860,3112]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3185]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids\\pjpegfile":[{"type":"call","value":[1200,1248,1860,3186]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3206]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids\\jpegfile":[{"type":"call","value":[1200,1248,1860,3207]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3215]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids\\jpegfile":[{"type":"call","value":[1200,1248,1860,3216]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3224]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids\\jpegfile":[{"type":"call","value":[1200,1248,1860,3225]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3245]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids\\Windows.XPSReachViewer":[{"type":"call","value":[1200,1248,1860,3246]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3296]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids\\lnkfile":[{"type":"call","value":[1200,1248,1860,3297]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m1v\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3340]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m1v\\OpenWithProgids\\VLC.m1v":[{"type":"call","value":[1200,1248,1860,3341]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2T\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3349]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2T\\OpenWithProgids\\VLC.m2t":[{"type":"call","value":[1200,1248,1860,3350]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2TS\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3358]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2TS\\OpenWithProgids\\VLC.m2ts":[{"type":"call","value":[1200,1248,1860,3359]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2V\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3367]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.M2V\\OpenWithProgids\\VLC.m2v":[{"type":"call","value":[1200,1248,1860,3368]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m3u\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3377]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m3u\\OpenWithProgids\\VLC.m3u":[{"type":"call","value":[1200,1248,1860,3378]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4a\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3392]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4a\\OpenWithProgids\\VLC.m4a":[{"type":"call","value":[1200,1248,1860,3393]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4p\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3407]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4p\\OpenWithProgids\\VLC.m4p":[{"type":"call","value":[1200,1248,1860,3408]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4v\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3416]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.m4v\\OpenWithProgids\\VLC.m4v":[{"type":"call","value":[1200,1248,1860,3417]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3454]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids\\mhtmlfile":[{"type":"call","value":[1200,1248,1860,3455]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3463]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids\\mhtmlfile":[{"type":"call","value":[1200,1248,1860,3464]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mid\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3473]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mid\\OpenWithProgids\\VLC.mid":[{"type":"call","value":[1200,1248,1860,3474]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.midi\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3483]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.midi\\OpenWithProgids\\WMP11.AssocFile.MIDI":[{"type":"call","value":[1200,1248,1860,3484]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MOD\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3534]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MOD\\OpenWithProgids\\VLC.mod":[{"type":"call","value":[1200,1248,1860,3535]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mov\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3543]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mov\\OpenWithProgids\\VLC.mov":[{"type":"call","value":[1200,1248,1860,3544]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3564]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2\\OpenWithProgids\\VLC.mp2":[{"type":"call","value":[1200,1248,1860,3565]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2v\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3573]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp2v\\OpenWithProgids\\VLC.mp2v":[{"type":"call","value":[1200,1248,1860,3574]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp3\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3582]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp3\\OpenWithProgids\\VLC.mp3":[{"type":"call","value":[1200,1248,1860,3583]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3591]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4\\OpenWithProgids\\VLC.mp4":[{"type":"call","value":[1200,1248,1860,3592]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4v\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3600]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mp4v\\OpenWithProgids\\VLC.mp4v":[{"type":"call","value":[1200,1248,1860,3601]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpa\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3610]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpa\\OpenWithProgids\\VLC.mpa":[{"type":"call","value":[1200,1248,1860,3611]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpe\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3625]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpe\\OpenWithProgids\\VLC.mpe":[{"type":"call","value":[1200,1248,1860,3626]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpeg\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3634]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpeg\\OpenWithProgids\\VLC.mpeg":[{"type":"call","value":[1200,1248,1860,3635]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpg\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3661]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpg\\OpenWithProgids\\VLC.mpg":[{"type":"call","value":[1200,1248,1860,3662]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpv2\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3676]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpv2\\OpenWithProgids\\VLC.mpv2":[{"type":"call","value":[1200,1248,1860,3677]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MTS\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3730]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.MTS\\OpenWithProgids\\VLC.mts":[{"type":"call","value":[1200,1248,1860,3731]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3809]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids\\ocxfile":[{"type":"call","value":[1200,1248,1860,3810]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3842]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids\\odtfile":[{"type":"call","value":[1200,1248,1860,3843]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,3899]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids\\otffile":[{"type":"call","value":[1200,1248,1860,3900]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4085]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids\\pngfile":[{"type":"call","value":[1200,1248,1860,4086]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4152]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids\\Microsoft.PowerShellXMLData.1":[{"type":"call","value":[1200,1248,1860,4153]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4500]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids\\rlefile":[{"type":"call","value":[1200,1248,1860,4501]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rmi\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4522]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rmi\\OpenWithProgids\\VLC.rmi":[{"type":"call","value":[1200,1248,1860,4523]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4555]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids\\rtffile":[{"type":"call","value":[1200,1248,1860,4556]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4606]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids\\SHCmdFile":[{"type":"call","value":[1200,1248,1860,4607]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4642]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids\\SearchFolder":[{"type":"call","value":[1200,1248,1860,4643]}],"HKEY_CURRENT_USER\\Software\\Classes\\.shtml\\PerceivedType":[{"type":"call","value":[1200,1248,1860,4676]}],"HKEY_CURRENT_USER\\Software\\Classes\\.shtml\\(Default)":[{"type":"call","value":[1200,1248,1860,4681]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4683]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids\\ChromeHTML":[{"type":"call","value":[1200,1248,1860,4684]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.snd\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4705]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.snd\\OpenWithProgids\\VLC.snd":[{"type":"call","value":[1200,1248,1860,4706]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4802]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids\\sysfile":[{"type":"call","value":[1200,1248,1860,4803]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4883]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids\\TIFImage.Document":[{"type":"call","value":[1200,1248,1860,4884]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4892]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids\\TIFImage.Document":[{"type":"call","value":[1200,1248,1860,4893]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TS\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4943]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TS\\OpenWithProgids\\VLC.ts":[{"type":"call","value":[1200,1248,1860,4944]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4974]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids\\ttcfile":[{"type":"call","value":[1200,1248,1860,4975]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4983]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids\\ttffile":[{"type":"call","value":[1200,1248,1860,4984]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TTS\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,4992]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.TTS\\OpenWithProgids\\VLC.tts":[{"type":"call","value":[1200,1248,1860,4993]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5001]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids\\txtfile":[{"type":"call","value":[1200,1248,1860,5002]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vob\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5112]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vob\\OpenWithProgids\\VLC.vob":[{"type":"call","value":[1200,1248,1860,5113]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wav\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5174]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wav\\OpenWithProgids\\VLC.wav":[{"type":"call","value":[1200,1248,1860,5175]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wax\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5184]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wax\\OpenWithProgids\\WMP11.AssocFile.WAX":[{"type":"call","value":[1200,1248,1860,5185]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5205]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids\\wdpfile":[{"type":"call","value":[1200,1248,1860,5206]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wm\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5245]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wm\\OpenWithProgids\\WMP11.AssocFile.ASF":[{"type":"call","value":[1200,1248,1860,5246]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wma\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5254]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wma\\OpenWithProgids\\VLC.wma":[{"type":"call","value":[1200,1248,1860,5255]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5276]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids\\wmffile":[{"type":"call","value":[1200,1248,1860,5277]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmv\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5297]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmv\\OpenWithProgids\\VLC.wmv":[{"type":"call","value":[1200,1248,1860,5298]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5307]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmx\\OpenWithProgids\\WMP11.AssocFile.ASX":[{"type":"call","value":[1200,1248,1860,5308]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wpl\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5326]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wpl\\OpenWithProgids\\VLC.wpl":[{"type":"call","value":[1200,1248,1860,5327]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.WTV\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5365]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.WTV\\OpenWithProgids\\VLC.wtv":[{"type":"call","value":[1200,1248,1860,5366]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wvx\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5387]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wvx\\OpenWithProgids\\VLC.wvx":[{"type":"call","value":[1200,1248,1860,5388]}],"HKEY_CURRENT_USER\\Software\\Classes\\.xht\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5427]}],"HKEY_CURRENT_USER\\Software\\Classes\\.xhtml\\PerceivedType":[{"type":"call","value":[1200,1248,1860,5433]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5478]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids\\xmlfile":[{"type":"call","value":[1200,1248,1860,5479]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5487]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids\\Windows.XPSReachViewer":[{"type":"call","value":[1200,1248,1860,5488]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5512]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids\\xslfile":[{"type":"call","value":[1200,1248,1860,5513]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids":[{"type":"call","value":[1200,1248,1860,5563]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids\\WinRAR.ZIP":[{"type":"call","value":[1200,1248,1860,5564]}],"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow":[{"type":"call","value":[1200,1248,2304,6012]},{"type":"call","value":[1200,1248,2304,6026]},{"type":"call","value":[1200,1248,2304,6022]}],"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\Interval":[{"type":"call","value":[1200,1248,2304,6020]}],"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\Shuffle":[{"type":"call","value":[1200,1248,2304,6021]}],"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\AnimationDuration":[{"type":"call","value":[1200,1248,2304,6023]}],"HKEY_CURRENT_USER\\Control Panel\\Personalization\\Desktop Slideshow\\Flags":[{"type":"call","value":[1200,1248,2304,6027]}],"HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}":[{"type":"call","value":[1200,1248,2324,6189]},{"type":"call","value":[1200,1248,2324,6175]}],"HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\TreatAs":[{"type":"call","value":[1200,1248,2324,6179]}],"HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid":[{"type":"call","value":[1200,1248,2324,6186]}],"HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\Progid":[{"type":"call","value":[1200,1248,2324,6193]}],"HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler32":[{"type":"call","value":[1200,1248,2324,6208]}],"HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B196B286-BAB4-101A-B69C-00AA00341D07}\\InprocHandler":[{"type":"call","value":[1200,1248,2324,6214]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\{21EC2020-3AEA-1069-A2DD-08002B30309D}":[{"type":"call","value":[1200,1248,1560,6296]},{"type":"call","value":[1200,1248,1560,6230]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ControlPanel\\NameSpace\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}":[{"type":"call","value":[1200,1248,1560,6301]},{"type":"call","value":[1200,1248,1560,6235]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{2227A280-3AEA-1069-A2DE-08002B30309D}":[{"type":"call","value":[1200,1248,1560,6248]},{"type":"call","value":[1200,1248,1560,6242]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1":[{"type":"call","value":[1200,1248,1560,6245]},{"type":"call","value":[1200,1248,1560,6270]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\ControlPanel\\NameSpace\\NameCustomizations":[{"type":"call","value":[1200,1248,1560,6246]},{"type":"call","value":[1200,1248,1560,6271]}],"HKEY_CURRENT_USER":[{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1560,6254]}],"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E":[{"type":"call","value":[1200,1248,1560,6280]},{"type":"call","value":[1200,1248,1560,6255]}],"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\LanguageList":[{"type":"call","value":[1200,1248,1560,6257]},{"type":"call","value":[1200,1248,1560,6282]}],"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\@C:\\Windows\\system32\\prnfldr.dll,-8036":[{"type":"call","value":[1200,1248,1560,6258]}],"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{7007ACC7-3202-11D1-AAD2-00805FC1270E}":[{"type":"call","value":[1200,1248,1560,6267]},{"type":"call","value":[1200,1248,1560,6273]}],"HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\7\\52C64B7E\\@C:\\Windows\\system32\\netshell.dll,-1200":[{"type":"call","value":[1200,1248,1560,6283]}]}}],"locations":[],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"optional"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"match","match":"create or open registry key"}},"children":[{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenCurrentUser"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegOpenUserClassesRoot"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwOpenKeyTransactedEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwCreateKeyTransacted"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtOpenKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6279]},{"type":"call","value":[1200,1248,1560,6276]},{"type":"call","value":[1200,1248,1560,6255]},{"type":"call","value":[1200,1248,1560,6251]},{"type":"call","value":[1200,1248,1560,6280]},{"type":"call","value":[1200,1248,1560,6254]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtCreateKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegOpenUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegCreateUSKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlCreateRegistryKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenSubKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::OpenRemoteBaseKey"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::CreateSubKey"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[{"type":"thread","value":[1200,1248,1560]}],"captures":{}}],"locations":[],"captures":{}},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegSetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegSetValueEx"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"advapi32.RegSetKeyValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetValueKey"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"NtSetValueKey"}},"children":[],"locations":[{"type":"call","value":[1200,1248,1560,6257]},{"type":"call","value":[1200,1248,1560,6282]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"RtlWriteRegistryValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHSetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegSetPath"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegSetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegSetUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"SHRegWriteUSValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.RegistryKey::SetValue"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"Microsoft.Win32.Registry::SetValue"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"interact with driver via control codes":{"meta":{"name":"interact with driver via control codes","namespace":"host-interaction/driver","authors":["moritz.raabe@mandiant.com"],"scopes":{"static":"function","dynamic":"process"},"attack":[{"parts":["Execution","System Services","Service Execution"],"tactic":"Execution","technique":"System Services","subtechnique":"Service Execution","id":"T1569.002"}],"mbc":[],"references":[],"examples":["Practical Malware Analysis Lab 10-03.exe_:0x401000","9412A66BC81F51A1FA916AC47C77E02AC1A7C9DFF543233ED70AA265EF6A1E76:0x10002DE0"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: interact with driver via control codes\n namespace: host-interaction/driver\n authors:\n - moritz.raabe@mandiant.com\n scopes:\n static: function\n dynamic: process\n att&ck:\n - Execution::System Services::Service Execution [T1569.002]\n examples:\n - Practical Malware Analysis Lab 10-03.exe_:0x401000\n - 9412A66BC81F51A1FA916AC47C77E02AC1A7C9DFF543233ED70AA265EF6A1E76:0x10002DE0\n features:\n - or:\n - api: DeviceIoControl\n - api: NtUnloadDriver\n - api: ZwUnloadDriver\n - and:\n - number: 38 = SystemLoadAndCallImage\n - api: ZwSetSystemInformation\n","matches":[[{"type":"process","value":[1852,2724]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"call","value":[1852,2724,1816,66]},{"type":"call","value":[1852,2724,1816,55]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtUnloadDriver"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwUnloadDriver"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"SystemLoadAndCallImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetSystemInformation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}],[{"type":"process","value":[1852,2800]},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":true,"node":{"type":"feature","feature":{"type":"api","api":"DeviceIoControl"}},"children":[],"locations":[{"type":"call","value":[1852,2800,640,47]},{"type":"call","value":[1852,2800,640,58]}],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"NtUnloadDriver"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwUnloadDriver"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"statement","statement":{"type":"and"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"number","number":38,"description":"SystemLoadAndCallImage"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"api","api":"ZwSetSystemInformation"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]},"reference analysis tools strings":{"meta":{"name":"reference analysis tools strings","namespace":"anti-analysis","authors":["michael.hunhoff@mandiant.com"],"scopes":{"static":"file","dynamic":"file"},"attack":[],"mbc":[{"parts":["Discovery","Analysis Tool Discovery","Process detection"],"objective":"Discovery","behavior":"Analysis Tool Discovery","method":"Process detection","id":"B0013.001"}],"references":["https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp"],"examples":["al-khaser_x86.exe_"],"description":"","lib":false,"is_subscope_rule":false,"maec":{}},"source":"rule:\n meta:\n name: reference analysis tools strings\n namespace: anti-analysis\n authors:\n - michael.hunhoff@mandiant.com\n scopes:\n static: file\n dynamic: file\n mbc:\n - Discovery::Analysis Tool Discovery::Process detection [B0013.001]\n references:\n - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiAnalysis/process.cpp\n examples:\n - al-khaser_x86.exe_\n features:\n - or:\n - string: /ollydbg(\\.exe)?/i\n - string: /ProcessHacker(\\.exe)?/i\n - string: /tcpview(\\.exe)?/i\n - string: /autoruns(\\.exe)?/i\n - string: /autorunsc(\\.exe)?/i\n - string: /filemon(\\.exe)?/i\n - string: /procmon(\\.exe)?/i\n - string: /regmon(\\.exe)?/i\n - string: /procexp(\\.exe)?/i\n - string: /ida[gqtuw]?(\\.exe)?$/i\n - string: /ida[gqtuw]64(\\.exe)?$/i\n - string: /ImmunityDebugger(\\.exe)?/i\n - string: /Wireshark(\\.exe)?/i\n - string: /dumpcap(\\.exe)?/i\n - string: /HookExplorer(\\.exe)?/i\n - string: /ImportREC(\\.exe)?/i\n - string: /PETools(\\.exe)?/i\n - string: /LordPE(\\.exe)?/i\n - string: /SysInspector(\\.exe)?/i\n - string: /proc_analyzer(\\.exe)?/i\n - string: /sysAnalyzer(\\.exe)?/i\n - string: /sniff_hit(\\.exe)?/i\n - string: /windbg(\\.exe)?/i\n - string: /joeboxcontrol(\\.exe)?/i\n - string: /joeboxserver(\\.exe)?/i\n - string: /ResourceHacker(\\.exe)?/i\n - string: /x32dbg(\\.exe)?/i\n - string: /x64dbg(\\.exe)?/i\n - string: /Fiddler(\\.exe)?/i\n - string: /httpdebugger(\\.exe)?/i\n - string: /fakenet(\\.exe)?/i\n - string: /netmon(\\.exe)?/i\n - string: /WPE PRO(\\.exe)?/i\n - string: /decompile(\\.exe)?/i\n - string: /scylla/i\n - string: /megadumper/i\n","matches":[[{"type":"no address"},{"success":true,"node":{"type":"statement","statement":{"type":"or"}},"children":[{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ollydbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ProcessHacker(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/tcpview(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/autoruns(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/autorunsc(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/filemon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/procmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/regmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/procexp(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":true,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]?(\\.exe)?$/i"}},"children":[],"locations":[{"type":"no address"}],"captures":{"LookupAccountSidA":[{"type":"no address"}],"advapi32.dll.ConvertSidToStringSidA":[{"type":"no address"}],"advapi32.dll.LookupAccountSidA":[{"type":"no address"}]}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ida[gqtuw]64(\\.exe)?$/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImmunityDebugger(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Wireshark(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/dumpcap(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/HookExplorer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ImportREC(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/PETools(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/LordPE(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/SysInspector(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/proc_analyzer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/sysAnalyzer(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/sniff_hit(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/windbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxcontrol(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/joeboxserver(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/ResourceHacker(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/x32dbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/x64dbg(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/Fiddler(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/httpdebugger(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/fakenet(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/netmon(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/WPE PRO(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/decompile(\\.exe)?/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/scylla/i"}},"children":[],"locations":[],"captures":{}},{"success":false,"node":{"type":"feature","feature":{"type":"regex","regex":"/megadumper/i"}},"children":[],"locations":[],"captures":{}}],"locations":[],"captures":{}}]]}}} diff --git a/rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz b/rd/0000a65749f5902c4d82ffa701198038f0b4870b00a27cfca109f8f933476d82.json.gz new file mode 100644 index 0000000000000000000000000000000000000000..16de1c52d60fd2cf078122bc0a312f142a345667 GIT binary patch literal 1036822 zcmV)jK%u`MiwFqsRikDA128Z!Fkv<|H#9kBH90UcV>DzqGG=CBH!v|VIXEygIA$IBoQIFEUZ*P4i+>eJ+bi$mT_(OD$CM!qfkVzz=zx`LRb+ zE+d*{BJ>D}BacOym+&a`5`7g7(<~Lli?b+;8RKD~uYLYUqwl-B^Q_kYtCzY+^UJgD z)8BV@`r88eAjI%hBKJil-3lV$19W=R>ghpV6nUf4s+7$y-W5^*^W@pz zo_JTDu0r^&Sm5qn#P{ypY*Z9gDq8hEuiK?44%ED=ub&?G75P?_vQYY_+3KI&C$B`K zM*ThY=Zr92nY&NksdN3Pv;05iV$yx2i)dA92!1&py_tS|HyuqryxTjO?mn5dBK>rn zU+N3wFK0Vtb++?`>G#c4->P#$0(_n8LUx&(dgyM&2i^<*erOO<^!qV|?D|gLPj@Ts zIeR}O3OK&~=t6cwH|@vVic@Frhj|b1eoP^|@!B)LQSI!yY1MqM%&MnD-$hp}Ss$zS zWvz?u1~9p-Z^o*p2bI+J>`-5$N1RWpE>*$kb6FH;JG)Q%FK)6vKzuy zf2Rw3uZ#&*a(b1jh54%gtJ)NERLfl3YF)zGpMDuE!%&8taDroHj#%GmOK_=>xGeKL z9B%M{){4j8*VZcaQ08g~Q~14^m~*7)`}Az;Icn{?;PJAqRoSjyd{rMV=ZSs4mK4{o zDRoDBDBAo|eW@cGMnCb0m-#rx^|9+sQ6)F6T{p*esrkBJ_VvWd*erkd$w}3U;`l;O zessYHuk@!$maQIv40{A0_?pXBzu#@|IF#PTcYN6XW2rRO?He|eHvP3-VqUo{f(8o=^7oH(>^e+=$sheyHkCd3ioltqq(miuh5Af@9F3 z?;+r(SGIUOL*m`_Uyl~5{8e2))&Jc-w9X%=qzjanjKVtHSHf^J} zt@C8rsxNlZ`}(^T>e-pGkxg4)pPe0u^dc|S*;(I3&(2nZ|F|mKx++XHpRImAJ3A~I zb3xNq^L=fp3)Q`&dpFTHcxxVS|7bkg|9CJOzuh~W4lW<}YVZ0NT@}AKmu`B&-50Aj zq{?TfGXwW}Srn_!HbVV2JDDEb5@;IFBi{r%TNT}L9liSdbbRvhaC9*JczAU3@%7Q^ z;baggXFpdXnqIZ4luCZTW_14!sD{M(kI<0rA$_l=6#QIG>H9UIhiN+DU%pNm{dlkQ zY*e(`uhz4%C$p+9N}oNu1i-}T$2*yy-(o)N+m91%1C`9MVRHli#@ z1&)Y2BGPSnqB5~8boqIyNB<8tvn`FN=UcehmJbbk3`Kl17%>vK;F2G>LtL><>ikmG z$0GfthoWQAUf99<9#@LvV4(q?p|InsR(ELk%BIzirld8iOpvURyNdk^x3R`dDH0PJ z%o>V$x-h9Lo0_mKt4}zNHGsyphO(|&>mAtFbu|Y9^Ta~}Lsuvt#%N~ARw7DpvDd(r zW1|aORiAbN%YHqJ+EyHs$X*$^@^;LGZN+Ix$FnrT_Cr^m&qNify%|~c?7@;y$t1?D zgaob}pF4yT(TeGnHKa(8kgi;xX}O#asKf}loE5n8cGmcSRTy&QaO%*>8AeD$B%v$+ zW;T>i`nYBqy7Fqi8f&Z(V~MN8(3Kx^uP0gq21t7!x^in~i>fNL=iM_-FI8!^vaGGX zAH+yTS3ZsDiB;X&x-%XNaeJ-bkTD6w@VTr;aoW}BY7!GUG6=f zEmxMIeXf*GV;rk1UuHY2t=$(PLyoGh{F=e_sfQdNIi|YuZF&cMEEXckiyXu#1+srW zf|H}_y|JzJ=g1Y**p+{CT!`y8GM}Y&zG#n1I4H8Q#;)9)ajnFFiexOq@i~jwsP^ww zVrw)KMsO3T*p+AV2EvsQPLW)$yc!ci)L_;_Ch-$oa5Q%3(nw%-4GDcDn=2RQOZ48l zr};=%G$s&n_e4Kn5n7NE8&V~@rmAA8j(!O8P2p~2Tu}H4mm)WA|&G~63 z6gsYqOlYfY)7TU;osKr%!NIvAMb#*fNz78AkZWhml}n=w(>-%; zonIIrQ+x<>o8$|E3nS!+${cz!AhHNe=Fo)!k;T}lA9Llqm$Io5Ff>^RC33At08b4 zxz&nrSB}XWXdp=?0(*c1ck7#=bd5ZQt;xq(1yWn({wR-d`)~=rd+5)0AxQ782Jj?r zL{cbozLGI*@;HZ3nP-_bU4|c4rGCv?xBY)tj_Z2 zj`px=e7?v?gxq;U_(Ps6!h#;`&bcB%ib037V>~3O@Tu9BRvggo_?<(Dc(ygQjq9=fIMfr?ct1 z>EZjW6?Stl*w@2}akF&USzf5y}Teg(GKg_dl4EZMJ|0BG?>87wyHk znkRW_CwdZyC?O1)6abcs90>RMvTPP+rjyySDVZV16tGz2K(<+1>wotw!2(HLGEq5UHi+fN7d(igd=n0+G0;X%$Zh zM92e$OmYB=CTcsp-H7V}d`nF4w9L!A%|)T@pAB5-M^QkL4HK-FI1p|Rh~_7Lh_nM> zoy37?{hs?y<+@C5Yc5WG+z}82tdfYXIlF`DG@KWQ$mDdeJmNsOF0ZJ%x_(uN@{`@U zg1T+`QX&I-V3kC4<;_&Otn>ET4lxKxh#WS-;(@cb)BXK#%zk9J*&bY|qUcZEwsSK5 zEQvy-q%{Fc2M(os+pUNf(gf1m3p+p+=?NZkF$*lPH=CZE9)H80`|;*Rs=MHFG07*Y zY3u5`SKBdX{_N+C-CRB9LSe@nu+koqwmYK5klq~MbtCX;SHZCe(-1ia1WWJXk;jE- z8qICzmFn`65P47%0ZZ>8Db1Stmo{wMe!~>mTfs7QLt{-QizP4Aab=x0W@3e*!1hm9 zvBLh$v6FnRPAUUxezK(Wg@^Q5!5VdgDGQ|*cJ5pk$R>@Ty0W7s?^ zuo4}j?^$b<8?r!PO$5{j7)oX~4|QnPYez9hHc7Dd9AfQgbxP(c9KI)QE0AQ!EPt@> z9BM$Z#qu(o+8hDP%^~V;Uo`Est}AO>M^fZ?0v4ScN>^ydvrwgNpYvm+WJ5?yr zsDovztX)ikrgP=1^x@vlTd`V$=yD|p?obs9mYf?(H@(Vl{1i*LP*9wgLcv0Fh1|hq34Bd|^%IML2s-!IE+)vV~=EEFm=Yu>H-Ir_#$NK>C|D z!#F!f!TNE7hstVkZGtGa_2vs77bl`%(KyVkuA0yFb^Er-Eyjp@$SFAmtHlik{E$mE zz7X|Eb+9bj{MEIca84I@K(4q`uw2|w$Xm3N>W0_47ovw4R}M=zcnZtViWxi=k_;>j zhnb#N`e8tBG{rfZ6f6aYpqrMLd0my}h>iE6&dvS|+o6VWWNHWn3&deSwc9zaq=J~j z#3Lb6N|k~Yx3ovWI&v5v4ZvnR zYY!J{ppan&&@y+xFnUNvu)5q}U%QtPn&strp^lP2?02aUY_>cFYs?LWe5=Hw zw-eTDd=zQj!Rm59)9yD4R+q!nob}eQP*UY7Y@>ALxEM6Elw#Z6xIj*A!Gdx>)0RF8 zR+U4p5ZSM$CnUk1sz|}Iau1d=V4Y{Bkg;m8rW_s-G$$fqiuB6B5^}?BLJI7D0aC4! zf~Dgy_D;`et7UDs;la3LST$SP9C}h~onCBQ%@i5Y1xv{x@ZPJs(H~fz8r99zu?x^(H92%% zl4+ghGwaMG9%Dxrm(EKyU+AfNZ9cKhk&u!jqn%)3xd$S&9YT{3d7uOZ3(R3MjfXEi zD2CjdLcvONh^qXctzq@K0je;Vb+QmSs)8lw5R@l*`e|G(?UTm|QpcErHRmvN-5g?E zm94t6BTPt`U}KI*Q{CjSzG7jx#jYTo)9Xe2od#% zs4abC6MX1z&hb$<8va&jVVGo6AYD-(YT1XOnS7!SZ7yTh}> zK>OG+wi==KZzybcy3`u!BySc*f(ZZ{Q7kOf9u9_8H>euBU0Q|iby;cXVaFV(Q5;IR zUsa!$i&2`I>4fzZUzetc#4wn@Cn7DZ-Pj0eCc$cxLs89YR4!-BWVCEADno1?W7MFYM0ZeEKF`;n){H(f z2p72Wc}yJD*hsUoSkJ8w_Up_gM+S?*8k-o0ppP@c`~e>c2o|F}oSu9W(BGo@ci3x7 z8yzYeI35T;PLbUZEJcZcGkbW)=2t5^p7<(3rhS36C=qm{MQ&m_stP_-_cg9~E-bw?~KjzkN&PoeZS)ADEU~ zvGz1uQ2$cVekf~zXC>>bN$RP;fL%Y=#656`2bSx=zFvY*XT#B;XAsd!)SweomTljY-@HV68Ko^P}G^8-s1=;QD>TZ zt9*f~DlSy9V02cBMRQSEr+)AR>G3)f)?0OPMqlT(r54qxnpdFQq$K2VhFpktCbjpW z&TrSb`cu0s^FO5E$bhUfxxII~<^~~p*i|5Bl6#LKBjrqSZ+$DHrD(NjpU5-jnKRA3 zwG=u49&*zIbEdlYIL9wCXR>>bxO<;DQ{bBoQ9?#;mS)aW_`d8$1#bgLvKZS?otV-IK$eaoDJ>DKN=1iCGaZVXw&LsJ|{Z;ZPGmw@&FjX(NqVEJG@xFlP#UT?7VzMred|Rh%jCJ;G^B?Ekas z9&@I;_ZWg^%$eTaeeogt6PY+eHcw}Adk57epm8RF%u?iR-J#lE3fgc=Gh})qb0)Rd z+wcKF2yC>>nc|*Nc&UozT&<;<+F}M7$E|BJXYzZGv7?c{sMYi;y%6QOz2YbGAZ-Sgtt(p% zxizm{dK*Fi`S~A9RbQ_Ss`mXelq5?TvVVf*-G*lHkK`ZArr)V>T<4eC#W`1&yKEEg zB}h977J5T$2{WVYuj<-T3C-X|$PMreEcAxJ>rEsGkgyo(q=Kd15P-Km(tcN;9>xT= z3SI4q(u8K0$$Rr0ws@(+#tOkIZ%8~~`$Xfp+6blbX4(}uj{)IRNCzCO?1t@sKtdiN zkIi9VRX5BKY65J!g<5Z-O_3{PU{N;&TpwVA3@@qRNc|-S)^r=}#+Ym-ZU084T-zQE z(7GYWbqTPz8)857wA6Db)$Em{w6Ltpj6@mI)`JD!5QOF@d9&@?*nE4;1Q}8UOT7)n zG$A)g3q>AZ#lSLe529#eFQ1{Phdd04aj3bUy`Apwe`6jj!_6)9LKVgIO1IC}G9sKM zQ5YjzrVq6ijY==7rrkyt$juvP@7G^1y>EjVNZ;crawNT@8g|&OhyJElPx~KkAxIc? zd#<)@-0HNl?##`3=12c!?@GAaHj?yT;f(iX^=2dw?jvuU3{653GrU4l);d9!i=!cP zLlRt&vg8-%zi%HPiHl?d4MK+*zqCLcjsB_&)z#HqRpNOqT-}{ocj!Dkv0l1>zck=% z>cl5(z{r=ea9Q2eAdpcW?^;aodQtq* zFDUNvw03d~(f>-K->+Z)8|tFWrW9;QobR_Y2&iPA!T&cLBuM8qd?9QXWG02j0dV2)iCS=Fbd5o)fjxb{UbfoA z=XYEmjRvjvHzQ;Cb@;K{xE}PntzQfXV6vf6<9pK#gQ=V5)zr7ql!kdp`9=O1> z?x(A_^C_0F>ow2i!e36%?eFkwdwrt|2bND3>=M#6e0q3YAFN{w#1jLO>zjtcPhilg zx6fwa zUVyvxocGoeY?)rtdGh&$we&o139ure0ZoDD(YrzqcER!Rt&r73AzZqmj~P-FeSBPK zf~oa|sM830XEL2mpzi9=U4({F8Hk0ji227R#zHa_CPzStZ3K+PS2!}#SagGZNSCwa z@-27-NvwbotR_?lR-^>$EQ4&c{AP`=C|tQhxC$lQhshlNTV(>?MBOS1SgR1Q&fLEW zBRlJSb#P-50uJ==)W7rRnTT~(#8QQbWm;)P;y-8ivCTL`iFr*Q8?i=-c)GN9u(ZP_ zvLueH46YROh}{o&mI>Bn>su-2&3SCFnN#j8ZvIScav6XHkri-tYL&#%s#W^{t8DU0 z;;PfGB%WHk+5^~T{C@fBG%Sgy)v)#e7I{{{)#+FgPpf0?1I+pj^VR8C5>KmRS@-V5 zckeO*Ym9(}>a;9Lpw+VW^{~UHMN2|;N|q#0D_Oe%^8zd2>U1ngpw+RK3*VnEKW75w z8HXjYLM=+H^9T ztZD(UoKL`Iw4X^Lt@4Fv0Opy3TVmBkMB35AeaO`BCDzG|M9cc%aWVA+5M;IjFpghR z32KsTu{MHM&R_Zd-4xs`Tx$igTB2yIokGi+i!TqE4bWLhLCcnV`a@;3gi3N5QrTr~ z1TAM0rf3A#@>7^LEweo`W6#L>m^9iRMapWC#<5bUgh{L>u#$zAVQ0$;e7}>~2#b*t z3N6D9ffYEPT5}h+B9l#Ykx^Y#s0Hd`0sAGZ4YtPG23l6VolW||=b@3URns?7^ zL72_^#dL!9uhR!SMEC$>z!^!+yK{%78}ngfjmRl!@mY8zrfVwFKd*Di?IYpNym9lU zKfbPan{6W^O2K?J@g^WBVKb(r#qD3&41bn7)0kSAR^isBR`;?uZX4aJ(e=2~8g}ZV z#&yB=#7)d=$BNLonMC~ElPV#x6U7cUa-j^p{yf}s!iQ|qFOm+SD4E5h!;*yRQAuSm zPtn)QN$Y%Eik%Jp`@jL29~-%}IVZtWBP+NI#ZP7zkn8asQN0C%vyALiErvv?Y=`F4 z&QW(htC0;NP!#lNO>RvuRgK?g>CKh-iR?gI9n@ELy)~RdH>L z6<=OAz+(8wwr0|IIp7H*>(`feVpCAEeDWW1F(wCiHivOV%{!78Lq<&Kxv+^YV>kmP z_jIkWT*)Ug71eebyG^S`K^XyqI4O!& zjj94C>8rs1lIOcqbW3K7UaM%;=qfk!AUfPpj|Ps%7KcL7s?k@Pz#|=pXFzm@AklGo z#<`DHjjDn)&7bclt9+70x0t`Y_*Mj>QJ|#NyRBW$+TS_TzbI}9;~oVrwAYYlc3uu2 zkNB`58jyz~Ct5Q|oxZjDv{r$>H%-*srD;0;Y+;)9#iD7gEYrk}=cYLV=_kAUnkTaH61Bcavd~ybxi47=QraC4%+y?k6;+5PO7{H*i=6Cmy7ul^xG4Bo9=7J6J(nHQ7v6W+?vTRT6Pbqt|UoCxkjPyqIKJn6e90m zcaowPY>9ffi>O)vf61Oxj2>!bIgOsi2CL@I_w%q?T8qgZd{TCJn%mJ3uLPh$0!Q|w zf+(rHr?E{?)!Zq67$Bl>f*`<7;Y%FKfi4n{q)HrPP&zet?jHu2C`?q2Je#l=ZG~;R zqsCJIL?fr35p!Jd`a`%U;5r^6U(619hqjBE+CA- zfpBg01&ccz=_7CbjN}mFPiCVsC<0(f>q4T^b$ci9epp63wX`z)aEm)ey*a?(^MoS4A)ZWd!I+wgTI!(-U^BAclmPREs zYtFDhymI=`NmZx5V9_y#4a$@G<|#YCd_H zr}^aVr=7#gLf%i_eqnQXS$mmt_#;S*r<=payg73Tnr~?iuW+SN>6@Ix$0D2$ukl9U zsS5&B_Zc~S*BG{%?Qy-|Z`Mck^BTIecelmBw`M4)Fl*ED?jOlt{E<}wSM$VQl3h0M7FA^xeI(HKy34ou8Y0OW+QT{| z9ajBecYdC@h@x>pCLLzF!Y^VZ5T#g3B)#ZZ!OAioS75%LQ8Q+|XfLfaHZ%DeMy!;= zwl20a3X(i^bQ-Z~WHiiKfvuMg|iJG_F)XayQ#Op0C=GT;sBmZc+8^ zI>SkX+Ido(8P*II2hF=wPZ`CtqP*R?KFhNM)g6MQb2*aQ*v7?h6t%-;r+ zorF#qpIC|Y{@(N8%+UO67b^FUj;_O!hw}2#brp2NMg=gmU*TU*zWg8bmjm~+50~)3 zmS6$2zo1fwgXW`-PH4_==pkgt(ov;4s>4G^w*3>jl@noUDfk4s-$gg+7wETz-i)s3 z8v5-CBUIXJ6PadxM5Q=G7kOn}SQf4py%kl>qaz@r`s7FSJbHnvp(jycyY0WBV;(>B z-(S#G3;nQBp}Y7E2#6z0P;IL8w}pf572l##LS$=$`5l}*qd0wxeIGRrHT=aF)aP)V z#Hf! zk!~CSDPulcrYm;NEGz9*CSxBd$(6=u#BbTZC;_q-C77wVb43Fpp1W4yQmkqqIjrFY z4K204kt}HL;}6!tY(UZy0c;qxImOM;<}|%>WsXm#8@1fZIBBC|bbdkO>$b1NjQ*3- z=R9v+Y|q(;8H(fnMZ+%7t8lU|Ak~TY*6I=dNr)hsEA))}mkmYuHaRi+G+EXbfqxfR zvzlYg=l-f@gIaJuuTAE)W^Y)V`7U^C2JqkfKb{)(H&FDA?Qt9T6e3{8iCV4KZNNXAtiflqo$jZsN*X)w!0c@ z8iwtz{ZK1mDxV5-EwF{f)rE96_rqfATcC2b3^i`Yjb3-yYa3s~Q#ajKqt`UXM)yMt z&iFeM_9u!>aA#^kbv z<+6q3M8@=t`m-!sVC%6QPgrmfn+-Ddp|3aGj1%Dv2m;;>nG2!MaBCe_Y}Yg{>| z#P~Zc&J>bdqS+7_jAXHgJY?)+8299 za5H-@-b=j1XNU0+IbN{YqLk=~z;LXio$?&|Nf*l!0RpFG2`QOX2=E+VS{ucq3|_E> za%nBp?Bg_1NN+XzH~4Y}|KGGpc9Lt5$i_ex^+*PS?Xq4}pG;m`f0^dmn1XhQIiKJx zt-xOBtAR0Y%_pmgHHEamUwh(pW$n67zKNCKVtOeO@7T*Cdvq&bbF#GTDd>Qeg{C&k zW9$Y_U^Ub4#OQnPe=-`Qakt(*4U`Xp90( zQ~H9X$3i2_W(@E4@8_$&KbfzV0=%!^FwGDC^nMm!hY_;;YojgMuX_}103$&Uha(Gt zZHV}X>~W4LsrrS-E8GRo1M5QfIB=nH3Q#=wzpjXX5(n-$>r_n}lfJ2pRHTZOg=r8| z=#X`I>yeSUaR35*^w6<|cF>ZoDj6HLvNi=I3cMA}cGp$8_NG3DEf`t#v7CDjn@Une z^v{pcA1z!qaY=TfyuoDymo6>`xb$&3!{tA5d5gsU^?7XMk-Q;K}!jy5={@(UT6o3Jc`iPZwcVppJ=9hnQ*}?iF0UfY{}ZD*%^*e znFW=PTuDXrPt4pvruxK8KuiY2xKPLC6)vM@2x1f)HCjSNhS!iT|g7Q zCv$o!5lAA-&Tz6leABiEB|@M5cb;qyr{YwcidSAdrS0L69#w|zAsOlWd8zm>aHUZ_ zoUduuN@G41|4COGkFDZsRH=lX{}zZtbSlsGpykbkwzVO|;zjNa9BNpHLWag%_C_E3 z#<|=%)w5g!=si3s@hE3zf-QJ*6 zZ&wkfHYBb3Iypu=amtQG5G`CXe3)CQ=A)E$GH{@Zh8e)#K45; zdg%w`$Cj>V$rG6Nkou__(Q3Ijf5@UIDe2c5~$2^=W=Cj=B2`;P`r|JwP2fRL{8#We5s+Y z1xGA97+3+`5lA9dHr|1ioF~LF2@j8S#IvF_$JNFr4m7dKeh0xE?2D6Yfy`KCu(A(0 zu{v;#M+e}2s^qDFF3_u^U8 zu9pN=X2kz&P{$8~oW!IZ=i3(YCNeL|@37)Ni84g?2~Hv^HtzaQ8%06v1xXvcq7$v<w2yTCmj8ztYs#z+}! zlhrd)0@ATqNqbqWbUYR+hjsLWMEa&*#YFH#ezHu0 zYtM<`*8J|?x&yVVz`tJ{htSDauo0LqBn;t1Mc3g>2EO9mz_=O@e>ty3*F`gTcoz|q zYqr9=y2RV6@yy|*hJTwJS$xBI0g(!%BjWQwz|W9uh)Lt9DK-9O=udzjps4y?>c0OU*uodlcL@=+9Q z!w*0VZEL<_-9@p6+!_OW8ThlDfF+w_1e|x>uAD*Bvv(pAcsARsT$N%2D+{|1s(^E{o+Z$B zoanNCl~rjw|Igjkb+?Tp*}u|fpYkxzI>QOc9?wgt~VZczKxy8Ae2qrl`+&xnA^`M4xz^<(OhSJNS@O=n0xRbq$i7 zeh9foL}-fN%=#is9NIEeVpGex{!w6#JjS=NuUJ1J{W*@J@V*@;bq zX^zwATUq;oWG*e88LXNkhPC=y^qsMc!YA@4#y#Ak}r?Bg2%4XH0fnltoF z5gHvIDkB5;^Jze=%<)VynH@i`KHyuH6yS8Kuwo)eQ)Ffv-y;#q)MZG4;6sF_xXk`E zw#B9Jd1N$a@0lVrEy}ZEnbmN3cIpt9sVOd_9)`sxsdmQLxl|pNwc<3R{1&_}nM(v` zio^_(Z{bos_kgoy5}4W-QaU`KVKv2Nj$?)T{m`?CR@D@*={=vyYL&=Edd{f zt1!y)423ZXY5UWE1Ck@l$q?%O1@Q#cH^px*^6>FvlFi~WTh-@FJW%RlHAQn;F$6R| z+fHftjAd+O{r4h*I*rI?v;fLC#cV!eaHULeA}&*`MyC)JFtEvFPDD$N`sOH2f~>A# zoL)aeZ&OKwbCdxmdJj`HrvoH>Pja8gcmh+5XD7Lj%X{;H z7~gLck4)~#Cy?NfgNMW{4YN$qoh`F_0*R+~5iuXmEK}^~$0^lCD0+}!dmE)GbpgLk z&2XF^g_J}z7s9MJ>V{%RAxWP)OK;Q;WglO7L?6g3Q*7n{k~n$*!viWLQ{-i~%3E)K zwbWe}!(y@0jviXRCW&RF%rZq_4(84|I(HVaZj@Q3$jSjE_b4Pr?8alv6gS!FDgXxx zJ~7~9XhFUgKnD)>MB)f#F@ayam$BG~&coY=+k3>}@-nT zD>`o=n_@E?sAuYd;jMgMzzdpPi|7*3;-kH5MDn7ND3_SVp`@LeF>Z>|sE4VYxd7J{ zy2R2R#?2P@qQH4R(W0WIS_w=Bh0G@-Ge}`j$O3BUhZdftWN0-scoA;V*kbaEG}&RjsiTL(OC-_1p|y00%}7vA?NYltm~D!k42xx&-KwXe@NwcnC9@6p zRAayiVv7~CO%aoi*hG?yLh98GwpngM(lfGb>P)`PDUduW^T&lx>%V1o$K}VJ0+80e z_U|aG!YG$ll?r8wL=M%bL~1%dWch~k@901N$$J|Blj*0y>11?sGMJ7|$33xN-CN(w z6*iZ6G4ZlXL3I#0IB- zt$l|LP>JX^`wzN0?U>FA7!;FvwpL`yw8&2srvz6Z0MB5;F*cy}FIGIDlu`dQy;a|Eaxy4{KN zu)Z4>izr*d7M z3brw{IwWC5p6UBDXDb;4;RVXw(R891S{IT4?`rw4wK9pbRTu-+2K3U5VrvM)iPUVbr$Bz|3Sccj_R5i9NwhkkFjS z@rZr^t&rFgTH9^k=vyyi=*$JNL%aNeq4g2TGY7kpPJy!mk650L7Dns|uBj|49vrf3)Hp z$)G@CSt(6tj-iF-2y=HDR`s|n3$U+aG1Z=!I@Zh;@yz8Cy62pLsFu&rf^&p<+kGn( zA>(ALVv48eL%+>|I}jWf)bn<<^4wqSydAARN5J=;XM))!Bc2_hrRVy>yOg;MD|xoA zC75C|GCEUSrA_xXYz1@%(G*KC+I1=ntv1&e-S{Ef@)RIAFXTj)f)<%0?7OBab*_d5 z^9hlaGU9Ex3@t53@#pbk1x9B1M1PJJlp`Tq0h419E?^E1ZDYZ)$8rKZn+j z>uoBF)uT?LKWalez3&uS+@hVhMGeW(dU1ULe$Em(ybH^DakkFu z?ENE5I;Y7y5Kr7WS}?9J$R}v?Vv85N3yCI%qxIrQ#xn$_RMaTK76b`Fa~Vq9TlF^{OE%F&u} z{bQnPy^!-e6+A%Ge?mCarD}@Bv@uZ=@PRY9kxM(;<7g#03P(d=)6CkUrCK;zJdPMM zWMH!*Jz9evM~le4NS0+#Ay4zT!)ReGM@!4~1-g-h026KH1tn1zo}-oJ2(#EAtLrk0 z)FuSh4rq)P6{9I0vk?-SWy{-Ko=5+Lx2Z5{wLC|w%=HC%BEwbdC%|WXoao)r`f`7z z_BW2!m!r%axHrs8xU?j7QJNwy8k#;zfo?Yu5<^?Gq}*Srr;np`<%lOl@YD2&Mb!Hg zIa*lm#YzUibykv=tLA7`IXXmCOvJpH$jZ(8wcRDZ$YabCgQs{znheCibRqwALJ9DnBc4 zSlm}g6$X7y<`JzbT6B(pa-PLshs7FRJkE$p#vH9WM?u%b5W`|w%Lf?3hx*zM%Y}kdr~)SUrK8|mS zTNQs0G|!9DBqUN%f%WYDpy_(0tJO-D@7F0zgvj&UR64Zw8;;i98;m{;E+)_5YqY*P z*66>KWtn9lm*BaPuxw(E04)M>=}zrJ9b z`=xe}ju>@b z;;W}gmJl&ISnt>uV@pUkr!Rv_tMx(GD)*_Cp$<08C#=)MEKfD)X8p^P;72>PO&ACd^N$YZV*i6FjCqb^1+$ zm#OX9M5lpPk|cn;TB6}mc^q0yvM;Mtn0f%BL?Rf6;LZ7Z%|X5=SQGmj1Dmg=bGX?I*+P-q&`_J z7vQV?8h0s($zrs|CWR2Rc}5%`aHs&Wd|*1BKMT+~qWL#%wWYNV6$G4cLnnxd+Yl{9 zNdTvNc!&B|5IPY#G9s3Jp|vOp=mx7y=W=8T&ZjyyvlA-9T_UhAmp^`ZM#la7I2u4| zgd6R4ztwI(lMCHy-46a4A@}n<>H6#W^z_SfD(|c(TJMF?3J}&7%@L@7s%YOAt53(u zcCkjWCI1BM?!_kN0S9!z$u3|gw13*!^(-=2X77TvT}ONedp171nVcyQeKzl_VPut8U%|B!%P!Bm`e(Vr?zl|yEJ>i?eD|h@LBxWs*N$j=nL(QJ& zI@IzxV>)|Vc<{;dT-Tvao-z5F#>!mEMS-eKiaZgd#Di#KQhT4v?CG4Vy|xQj|B-}( zn2zuplG#TpTt|{xiQVXof0|(JZjT}G1a}d zxqp!xlihpE?tNnle6v1E$kb+OV=8>#yHU|?08tuH7pk$l4SJ)rnD0?tp(#eQU%CTb ztCmOghQ_lO#(T(YW4e5AbIXWrOp>qZuS(8S4HCEmV;RtVg>6ihPxlu$0WYQpSK7n^ zNZXh&pT?&nUW~M9loB;jY-4hK8eVgc3Y4meh-z2hN+zrl~8PB3Vcll1_6z6pGH+|V+wq4a2u2T@2t9K8&lnT3qdp6nBLx@_z?U? zCIE0ikH2A4m!~O`a#nmpEY8SH(wG*l+XmJ4VpPK^Pl@G;wlS%_)`#~xJAYGljx*Q$ah|w2jH{y+ud6ZA^aedlfA-f5d%Sy4p4-zW3&h(Y7%WzQckd z=<%i$wDJktm{1D%T%UihOC-EX}8!cP6tQE+kb?u4O3G^TL zzprKaxMNh|`_oHU8r#JEiI#WkTfsj_{<*H&PKApy`=%()tps-2M#74SeiAM8MraAs zR`xgf2vkDT@O)weyp0xmBfx82Bnlw210qR9OT7^QKJ7?&SD!LtA$1B(^+YLzy36E~ z9tRX&EUCFdw8|S19&&w>;hAcLQt)PqitAxu@JS*8M=QHg_a73W@QK&v*l1NZiV4*T zHnl>*O|&ubgbXd}MgZ3)*f8cL4h2zv$wq6s^`D=v!HL(sLhodrj~~?ftbrNfH1fTGxH1LSTU0W> zE2{b!IydQVoIRYsR(c--(@h*p#6(NFr-wGJx0ZdAU1>{>pXt?lA6D}FkX$EiAZmrM zV!7$sYFjXSHDmR~q-USNuy|?Uwh%5Aw zN$rW}97txr+x>#xF1Z|G>h`npq+x*1l!`aPjI=HyFJRgo{v;Fzq z&Mx!go`c!lLHli7TVt?6|39sw|MuhmS5HyrP_PEkt=3o zsef<#>-F_Cuhg50vd)&b*Vh}ZfAvzwXEmtL-~W9)oZn0bXXBgc`TXX?`PFpP?|VRN zjP$PVQ}EQoQH2j4i->t<*VO5`hKH@}i2PU(`!Vc236-r&(ns9y^gq7a?m&%UB&)2H ziJ}C01RuxK@#SRLILtpjOio+Zc{7;LFDLJ>=HuBPvoF)($>sTU@(<-qw}rLZF#Xr{ z^+q86`ubyDL^@1srE$Km;!6FH$TVE%^{>mkv9Q~7+-g-+S>v&rk3GK_PnBc23)Pgg zLu+21oeVCwdI|fN9kzde8mQU=muG|1zx^_P(DI?ldzluc9_M450)KHDu&3;@{my4C z33<2q|DA7M9Deh&`CvL4T#jxoCm&DdGllW@tI6ef^v6u?>dE=^=J%`d<(H@5&IT7- z*@&i(V&{vv{*T7`9LzKk-9B+U3s;{qd4HZh3lK`=gbM7M?X!8xd74(TArijyUG=*D ztPQ{8aZCEtQnUGn=D~GP`l8?W3nQ6_k8Oycv7cpmo+&mrnKFC9?k_y%_2-XFHjjOU7Eqgk5>`y*J}RO<{3KxbDIj- z9IX--lvX_l*rVAiVVPrB!UD6aX8=dE{VObU3`vO@ldMQ?I|2Jtz~)$%U{IFz+ziJw7A=@Lk|h|JWE}_0I1w;6$FT&5a;$1q z6nXWn6EGvXC2o#o2@Yjh&&;skL@UkBF)hKNOsfv7uSXG6nFoKCYPI+8=$z6*J?0k` zu>F!}i>&^olwo`)6Jq{M*iiDNzXQ4KG~9y9MQo_|NbWoNy&wiN!iFw=`LN21QkI>g zkVOAwzW_~gLh2x(cK%~g+~)FXm4vnI8j0%@Cq+P)=IZgja{vMHs}Rs-`OJKH#7w9V zFJYAv>L8#ivt1O!GOX@4SHX3T$Dz&)ZjtVe#}!>8@-5;wvQ7Q;y@SdqRQ0g z$DM-+sow;2!Omn@#&?rtqDIlVOahxo7ag!cU9Hr-bd4eMsbhdH)z6FUqWm@+chf53 zq`1)KsZaX`uH%W|gA-VMC`LZ-{9YvSdvT#_6*?lHYVO_R3zx>RTx<#NLM_JfXaS)U z$DJh&S#_Tm_dunoSf(CPi%GcHn%#c5ZtmkMix(>xt~d-Nt>jvG*zTNO&5oNQruM8D zdtFh&(nQh<2ZV>Mwdo0Sv|i?h1^EPIxQd7r;JDFG`b;);;8+FQw}TO{*og6{0|Bu3EKJXxJvje$ZxenQUeb zh|TjD85_1Ou^+aJqN}3IVgs9g5VeC< z&Z}%Z7PPzDbCW2f;=}eN_QTf}TDNnDfX8j(?nB3KJuS;!agSP#}&n>^nCI9hye4>zUyySIctO-GRM9oYK@jT+a+&8OgMrxF!OE zC4%fYVZ_+SGecE0)BJs%)i}!%gv6c4EHqX5JekffuV(Y32>ot^YVtnGGD{!l6k_`|ccp1fuVFev*z~H4^B_*=w|0sgDQOaK26t6tjHjq1~%BCaEz% ztKeR-TS$%K&0BcX7@$?#ui00lh5@bzdBtWIH4JF|>#KF3s4+l~_g|?kM2+Al=+#i8 zc!APfY6FED#S7HDQ@a|N6}&(l4z<-ljRIUd{Cf5OY7{>~QN9|*3v|0sE9KQFUZ9MQ zTE4DE0qz=jy_#}0iWjIer51XtQTzD0NA{`R&FU7gKg>+uru*w7RY7wJUO;tH%b>XwFVJvB zt%K%L{9J|5Tp*|xRaFViMS1~ulv)bSrGRSGBi2Iex(=p{Id(BLmj&L?cC2b>E(27v z9+rTE&WwlAfNdIJ+vV$rx{P zo~`8abFaSn!_)r1pJCaQUWm>f`RaA}Q3305}BAA{&4}?7Z z!Qklfz;tvJm-h=LD%ygnXg}~r6D9J%l=S84XgE|N4@^hbGi=lxG7F}q`5Ow(&&~$F z^~Yb1E)q;tpALuo6)8An7EDzSgWlw$k|l%b>2Q&~pDo{i&*tyrqGa!v_w)GXeXhSZ z-fK!;8%%u*2gx6OQS#zo>U&WZDSvrNB!VgMy#t4iBasc$;DJB6I9FtKZI}}8eLNYS zDDt&!m>xeH_}vRdnGqYN$ou}6vk$*35eTNnNB%^ahik($dC(p921*<_8>Y%HKL@G= zf+_7et5#K(FO@7BOlvR8+gMGu#)c{F!P&{#NYS!6Fs;46xco>W9n{*yyO&2JXeO+j zW%IDw^s+x83ef6FEmf~b*iKcqTM27i~Ii z8ZFEF>2w&zH`$ztxi@L`JuLZG!z?a~CI9weNY0zlWIFAw%972i^>C-@^knQ`ZD*X; z{Q*y>yX+k%Mg1h|3vY8?9G;vdUVHtEjit+$VU)8Wt3olcrtate(crAJkCV&p*q6mR zefpU-`j;D^r5k#C`(K8cXfzJ8`E|bGc4$#IJmMT>p%{C!rRDsVEf!=NPA*lOyLilU z7B1OvRfY4GJk*czaA$wZP_bVH{Fnb{uON%&L62q8^;T2EUw6gd-|Iqo{)aQs+sBft zsvcv=ANHSp4{mD8q7^xOSfd2dACqiO>rBuS#isVXw6iUIaXV=FF83?XZzT9 zVnv)nTTIT;F`23%xyL!y*ak%cxz5^puHSo6j#je>ey9_Jbf^u5EJCBO%5K?qg+Nq7 zk)~^@Of&Qr;;!Cm1|>FIy)pN1n{Nh1Sl8iO@7_#`D$LJs?w1*V?(l=C14~m0zke%% zO3pgP)Pq})*p71w$Q^j=a|1;gX)-h`Ta?(&>^-+$J5$4>WG~7Z<7H8PtKiRfZ+86T z<~HLcRODt;)gHQ~b%4fT4Ei2E%_#0P3=V5gN!)j|5V=^RWTddeb zhb-1!QL+};)A_RElCcB~HHm0YCD`a>m-PwSB^YIFkWkv#n<`n97mK_IlYRRa3f0yv z8dPjjTNdhitG2LyEQ=WuuN7%Dyx5z$mob)UbP$lCld`O~DtCrIY`u8g?VC4ORt9w0 z%!GI%Rrxs0AekB_5S*399`OvS@^|_yXVpfh@^}FVkR_4S9GopcRqjp;U_Y!v{|<~X zjA$5DIXwP+HIrCEk9K8ctMYMn;2{^#wP=b|p=%=t&~Qlr9aUaUAPX?DNqZDM=I6!K z3>aZ2p)H{*@8!`c1mkmPW*$ArNP3G3dO_}NHxT_>HV54tb7OBi9U4Sco{Tt!MOi_e z7|nD^NgMPuBk99e#H(3T1himfbsyX?R)K07I7-))8fCFXsm_xT+{JPjb%&I?LC-gm z4hffE!aPej)LD@LBS5}U6W1ldQ{~CD;ejS1@JD$pq!~d~Zj6WrxqgA0_q0Q+xj|1g zdI9s!Kj1b?3UJ!g(qbA$RW8gXnnwa;sUtP8V+&A~2h(1}rd$-hiaN>0qsJZ5Kn{y} zR>9GksZHCXsyrC}Ff24iR58kKo~p2{xF^%kufdyAcWBsDxh~!0Hk|Y4K62DD2F%}E zjM;|FK&~xRRUXV?s8Dksx+YDZs`6%}SCeZSsTo0Ah^joA#^>&Zi!jRa3NoUi0 z1=og^r#-0Aw`dono+_{AJP+?rk}QbJY*C%f@i=Ka)l=o%G=#Bec&3?>;3><_uXEI!7i!R?XCZyp^3>2ypD+ z#33m?*ioH<*{!Dlms8j#$x-RNLKa2}XGAj<9reXA&6xyeMN>UYNoKyIFdOp-A~eQz zBZsz%Dm@vQibJk-Qcq?|^A_UkRLI~AWXGVH4OPy~9*pqwXm~U~r=!Zx*~#GJvfD<7 z7R`55IXVx=@c|+@#xO!!LZ&?pPK7u3fD!M`MYN=Md*qzj1r^05LPoHnjnb5~dE1li z)D-~7=|MzEL^2)i0eK4hfAoWhm`7ZrSL$do5AQmf>1z+~Q;5hqc*SCLh=^2qEWsjg zZ1}}oG)we~*+Q6iXhj;MRfV?a3o2YW`{2rHv@+24ctVAUoP&sTS~p#L)S;s80B~gB z(c-)I1Vu&Qz>%GmI5cpoT#qqZVpE=}ZqQ0Sbu_Y)BPIfe!DMYh_O4okm#gd^+VH$^wbSKsx<9cLO%1`ACTqx+! z3U=DlV2_`ZMqzV3nl43CsS^Ab6flnpOrhg~0@fjhdT3r)N+MPugIDB6v>L1S$lRmn zm<4eg7+Or-jw)ND*9Gx#bO|HcHO2izP&e8k_Gq++0UwvOXP#!){HZ8-2JITMJzZGA zZ7T+wMQf634=Pp@nS<}ALgFk1Q>{lr;vUjW;yS+0Jr6rb#b;O^sdctJ0r@$GMs4q? zp^GJtU5bSD_=iM%F+OJb+RNV|X#Bz7*7Bc@zH|qt{i{#iQGejeLBU#V*>MN!nHu$o z4am;3!&LWZT{HS49$eaZ53AGQYEAcWy!vMf$9tHn264Q`f;}R7r7f5d?OU+D>*fEC z-@BL`b=}Z}q_XQK=5`FSs0_<{&;<`)H_JNuT*HaiZ@=oow&Tt1nky)#`VboS@U!|JA2 z%%W@#BPVe}FX9d^4I9=RNMiebJ6|qDXp=&ru_UFb6EusXB($I^`F~G=xSYhGk*euv z@Q5|lh} zLf3K_t$YDZXIO~&(T7lR&3zzwcQMb}Q;&Z%InDMw$Dr*>G?Squwo@cBJF;Dx0YEbt zN+N4ISHT=hJB>V- z#xSj;S^Z?eeX4J}^F(CJs~Z?T=J9}zc3XuezYF}y#rZR4-0tk(q5Sx*7X7TxmQ`8Y zH4WNITSMUMiYEP8wv+*aGIm)#+-T=H#H+;$(5vMT*UzL9v;{;wdyu9O2x7 z3Bv_2C#2a1G&!6sFwp>1BLm+Kbu8L`L=(diZim)`Dc4Ew(*(MFdP*zTN0Y*lbO{ud zmXfI8bTk(nVdVzlvhvHa0NXe{rl}G%Bb+R_oI9I2n?ui=-J!A9>u63m!m925DHNb? zP!)cw65R>{05p+aWYNoGiLA%UQT&!&Sw= zZlz8HhbDxRb}Q?wZtbIh?iuPT2%R+7L`M_C$%6CmvW<5F#O8(u%{M{wz!A<|U1B=n zQo)Qtq@_A-1g(x{f1{Z3c(woo(>$6PM{~ZBfGvP&ut+yzjd<2n`6mt60p_gf9fxM$ z&=hadO0rnoi-ZYu)$GuwrG(JLZj>mln9ca#4WLCU!gg!K031!}CX4SfOIYtFEGNZq zl~>t^dl=14on#>1rlU#SWHCMZfJO-2N!FpV-OxGX5o z*&sQW2AZ&q0M4J^W@RxKb1uGwWhUAzpjyVXXf+=On#PTSle?O|B4HR47-_moBRMtD zyl(PA&~i0nlN%l`K=XW-WfS+QD&M6Eg6aSdoT!Z)($$@TW_zPJW(a7)nbt^Y6$4H1 zMvM|Nuts4nslCoX6TQ7iMy0z%-qsnmPKsg;H2s?_&NYbx*th1^kI{(Q4K({3VGV0w zRaIsYKY+lp00B`WLR96wtT}&zY<``yv*<5)uZd2qdpFQbaIzRbv2f8C2=E=AK{M)T z4!B>aea%2~z){u>+}!0R2GbaEN2+pH1Tt}30zGP0NQz_)H0|3j)RJeQx!;I)K=7OL zNRNo43=K5-+ly5LfQzRXDI;y5ncwILQ9+RI#xz$9P4p&j3}WQbb7*vu2AbfFV&`}O zTdYc09T-q{;+n?2$p#x~@4f@_6^dl}Obw`jsQ0=h4(T=E|P$2Qe*Iqi1YKy$v4tBu6g6h8yk z8(AHqVo~X`6te{n%uDeTX!S#qShTDrn*QyD078{#qm)r^#-)pPlEvS8#R^^ruG1KX4Ky)!q=Hz!}65?}n++l@Vq>05+}Hg##8*tth6# z!=%eRDmGOf%(|8gSnM8YddDFmQ{}q&cMJYEJH|bz%4~iOyg}gsAfqt`8I}w)(lgEL zuD!o>hizE(LC9P;N|TW0ep*!i#k_0Sk-ZoF>)OZWWr z8F)1**PadfH&-e_2C@aN6Iq%`OGuzu@nnHD{o1SySSi|kdsUe?{}OD1mFsY~xIoaQc1G7!E>M7atkEn! znhQ}D;7+0Zr1-`_6N7{aF^I9CjWztz+q9V9GOk#&WKuMK8~+lxj*0Fi#EpuL=?Run z+$()%;5}-(Ce2!)xgH7FF6L--MCT1n_b7|*DPdHfE#op9e4Wf?%_p z(C);vBZwx8Bw!Q$w>|MK2%Ht!ETYwNq1hq{;JS-USuYf@3&{8!Pn=g*L69t&I^OJKu{Yn2ax`d zWnL1hONXlOLXBdL{Q&FkkP+p0Jv!cG7q1zAfHRIj~M=7c8@X)~&3J$?uhzoD5~Gcdx>BWGG|4Th{^< zMSjEbg=qxyaIw58z(pNaMDuc$(ci6)w`qLLN+4Bnq)KYvgZBV$1h2^PIw37R zsf-A(`8(9wxsFXNiBragw?PMAI@fV*;?gOjo2eDdn9T}Q$x-B5os@RXtc(!vvdkWC zvYOdhz{-v!v}lP}Wu$mxzHU+oHR45&GGaXSluw2-UcB8_L?D~A*qpSP?uIgEyq&T* z1Uh2(f--KrSDAijC?m&v#jbm0Jb8f(Ning{Ss7Q}wwDxL&>y88;x1J-Z9p2Nrh6{U z1S;dtYnS9eH>&0mt)TK$h4MBqW$bycGV{Y!Mx0moNF`^fzz95jG3$_wgsF@?PxJ=Y z@hzr-mYKAYMpGGmo`5F;TnzPSl+svCOl72b0$n}S1nQqz5lN+(%DD2>H+7qesqzFi zXv3_f(TusNj44k<>|i|^re;dxE-{tyDm9Mu^v#Zi$Qo zEiYy&qWQVxg%b!y_f7O=T2$uievZ zDx=DKTqgv*y<`@tFv3(um3JyqMR^f_V~Jqc2}|bR#W&&n8cxYc8(wXq+2!UH$9S+r zJ<;~!{PX)CD^}j`s8jgabQ3*|P1@N+)3C|b;&+q3R?DX4;JnOkxnpz9fGx6-rA0LR zh$dtsbae^+`kCDWDa!;pkJh-8ygWFa&r>Vp{dvi=mPG23n?)07|rKKGq6$59ulDC(I(iK zX!bRV@)W5wzCFPmurcil3{Ad9z}BSFFq$O}EgD&piRNCDc3wn{61RKZd9u^ljNqox zX?G835;j6Bvp?rS6I-6nyKxR&$yE1Jnu$jfu@L}@uaZr}wlMW@lo2g=h^AzdMJbYN znC(fMB4wiK*j|Kz22Odw42?FG$h5FlKKSGh2G4}OiMxM$-mpCP@A&4dfQjEU^4tz> zTUuB%v1IX0v8)b(bCUgCua8%+p~HuubP`*$Vww(Z5togsjY?l#7#HZU6&sNkTePkUvqgEbu|(qb`mOlKR%Z)) z(Pzu7WC`~Jga9Z0$RD5fYBTxI$J0S$Ft56k$@uic#l#Q(3BHbcpT=jS(?7Wh-Big6 zmGrOabWPemou1@HB%-p0$Y#5Rm;8%_rQs^Cew*jDYTaDYE*HfztL=3Cv1jN0h#Qof zkgrH1TK(hTQ+K=}IcU!sY<~YBDBu6%VR!KEjejTTJ(CYCElMHheUs;YY2)8wV%fa% zpz%E3uK$1M#aoYGd@$*b`rUE=YJ7U~X%cXVe_Wi7{r*1zKhdXWqpLqI{PEX^?}pv; z4b?;44)K5NJqdf3d0(#&LKbiIZnpTH8t`S(a9k+t5{bfZ9#=${vy2wEgXm z7=Qo|tV9yr!->BAJ}wA=0Or8VU~pyd;Qa+8Pl3>Kz~zm#V}EklN4Ia{d*Q2Uycw=e z`VKASO&reXS1j14izCqlAs#v1J$eu zYB-yUVO80jVnbl<^#SWt1opN+N`7-8xa_#EX5i)yeON8HxdRxQ(bken6gg#DOy59mG?Lrdyjpm38;$RScQEspFmos;s9bG*!0MHO z9ST8>N=2ZiL`ElHjh* zqB7K~7S(;!4W+DQLtUFeWvG=6s^#FSnk2Yuv!@KLsy#KEjK_o7Z$fZYIYp$c&7v~2 zsutBf)HO6Y$*ir-sxq{yR@K~}{jwBZNjpQk*Q_Gf-e70ZFezmx8I$b{`osQwXNvr= zhax$*n4wiQv@izHNGPlgNy|g8sxYEkp&4(;jaUr5D$}F8$zVK1Q(+^JoW{~yu!&4x zvJF*b`>XNzW`Hgxkv~VGhFFdyMXGY;%uT zVTk>yKkLzJ*M!Y6CCO5cKeNrT3{is|MG`+P3{xFV4k>0;ULDT*N%f(y4Za*6%&NS4 zj{IrZI~+wxBZMsC>T;%`Sy_xuCJ9kQO$Z#xCRF9pt6~3i`rCO&Y(z;?q$+3PNxMDE zv<>&A=_=a3ao}h|tROk8SXJ5d=ezN*w?elwUwPE9301i?97aMENYcbw&YMy;oK<(F z=rG~@>C%;kW*7=rLG)+0gYj*}v!+56+j7S-8CKmbF3rHYz71#na5$+3R_MD(YE`yj z*Il*JXbU7=^F(Ht>t06`sd0p))*2Xg-Bo@Kp*&bj27SEbwEB6H7(66*wvS=g-8&#d z#Co7fo_1>3d0$fIu-wu@UeyVU3t;G~!s~;J)9crJCkIEJj0{Dic|Y!>sr)KZqc9yV zX7=4u%>KX!OwpBDhbJ%JTpx8#UUgqzA0M6{?{)WIH)~FQ3@^71+6XB-lomp-cPX@C zyDNvv(AEu9VP!!>&S_Y?sTL-c^5Sdve7u;3NZ8Lv5{okutabhA4HY~>0+96ldagGU z49zUF!nP40R_*)PKB`+etlGDhHM?&9I4Q@!K`+J?_h#Bb9QjiFiY%+H>S_iVJ|>YY zB&`UUm9VTNWOetuHG}LNjUr07ilEuHDhpcOO>WIVI~~vFH9<3iKuVKawMQ?_Kud~! zIi8}M>3EScW>p9cQ_7;UY7bF9$AY`C|3hI zO_%F=wTEjBg-UOHTZ=0dq)P44x9qwKycu9*lAso7dL(yzgjIX+*;u616PA`8M3O{X zk6F^4`lHz(p&Ny-DtL|}r3{!!hoOH5%`MlrEV?PNjGE*_d?}8Udo-OP|pVWW@$40JhR&lqkw#ri8vf4 z$T{`rz0~me#`AD+E7`Z!2;ON4HQ+AVfg2#lj)oQ_mRwR{?{nPtr zojurS7 zdBsIIdD2(>D7R2Umm9$5cC$2R+N$7+`0@PW{Iqj&&^ahUmg7eqvtDJYx6Y4sRcOOG zlZ(-?u(P%5)JZ6J6p>Z?2E&FB=C&nQ1ul-Hro61$R~R+~uDC6^GVvTa;?=&xuqpAX z-W>yzd2-VYmMc0!VCjBuzcig!+^C-0xegOFxtPwo&i(~lZC_zKyCh`!75)!zX7>fU zcmpnPMn*zU?VO^sDWi;~zy9HS}jJ>DI1@x$?^_%BKxag6&E$#R57H}hWdrP;dT zww3$<>g>Mrqrh;u_xvbHbIVrp9lwjFi9OG4t`c??I6P#&KaQk@j;-cb9Y`K`=4xf` zbJsi_ZX0tv^M% zaTzs-cTT#VM{lN~rzd&dtFz8EKQz06JlJ3h-KM(aU4`W)>5sKw z!G%1jvrSq>Qf;R8tX!LuLY~yw9;!B;K!mDPLv2xMXh?7SjLZgfaFiB!Cn@AfovnV7 zyrYq`3FX?H6!N6b#_@ccm$Z69XkV;RbIh!6ri;@5!a*R=E(1c03tVXOAe;T0;(`@Y z==;mHnIcqX*cq7&oY8(#N04x6qGae@#u?4_Kwi3z^K$R#@PMv3t$5?i>a zWDIp*lf(6nj;{Ci%SUPk_=w4j6V8vD_+fZM*LV*)Y4ye7kw3awRGhIf1I2fOCN~~( z5VJijd-=<5YB+ue=Fa}b*;(hLdyQwK@Ten5GU0|Z1MhS^=!gBpZV?zj;A5qyuVvY^ zXj5e?$r_K<%BE=08lfR~h`~L0$eDdYL}Z#soz5wXj;A>UAOQxd*w2Der8ppWs6ycu zi``snMPlV-f4_&qUuv1ia8|Icog^aW0m!^kHF8uon}FIG;U;wM=4eDtlTBd76I^7x zy$YzyHOf)gYD8hIZBYbw(#@!IcqJq*)gwn^yBV->#OnTdKzb>qZ-p+}4CHKWa^Th_8#BjciqmTgGJcJ->((1@t2 zSDOOankLm684gP|irW^5?W&JP=EA+Ivo%25*OiUzgnM*lGq~E(j=J8WYtsss?0Q|p zd{_pgR&O*4)olRDY852GtmWE4GTUW5flu9BJ4j~916lNDOlE%c0h)=%y};T{QaY;=IZLrOFLJIee$b*zWi*~D9jPH%4jYuM*#2Veg*TOoeS zRmmY-e;DDV`-yxS!io^_KdzB}u@x<3EMlby^t zE7c}2s))&ytzaRxp}4Z(niau~jRLr90k%L|Pn89?%|V0H{;HKGAho%A(?N#dG^4eH z)atoYwz|o4r!r8rdhV1Msx_TEm08rVuG=d2$CD3uxn}3?s@j4LRgVf!!65^}Ztn;;^)rJa)F? z0D&0{l6B4VP7hCBJ?*^fl(*nd`s9L>ot>{nJJyb>*-w?^r|y)`xsVgUxxLg?j|^xR zocuWgop)V0Kj1p)iD%u5Q#cs+^sIBej>XJktip9? zE0`Zz`}jdsMKV^P)k@Me)oNtFc5SsLK1T(-E1uUyI2L!)WtRvn({PuaGicED;meOn z)2XUci43Yz^5(W=U7WM7pR_c52+a=}693M;Q_kHod<*7WGA^_wm?v*b&_|C}$)XRJ zP&(}yM<(!$B7YiX5=*(s{%l3T8?*643DVc4kH~pApY~uW$wLymT3%2lL$EdC_LQ<} zMcl3&7x@{lvqVd^gaNjV|M(wCOI_Y(T>ytsj*H{;!Q%p_0!p4&#@*IDA`x6Dd8iov zz)xQZ5)5yi{Dsjc3?u3hiRkwFvz^Iwd^7cjJE1=sjpsW7+L8V@|6!@jzrp`iDgG!e zD@3I<&x62mDdF$J__Kc4D*{vXaoXWwXp-t>+1tfuSh#lbK=x6Mf>A+2La6}>&3VqJ z_-W?8^er5+mKUCMRd$eu*60+FtT@Tf_`*RTVsot|P9#mPM{%d>LG?LLb(fHt7%7bJ zT<7!qdAW^8sIac3Jo}a>9X#W0sVCxA#Y6UX@lXp7-u-meJG1E%-f{2c8?{(whGp&w zytiuW^ywVk&C3bC`XtBO z2t<`zg*+TBL~V@n_3#lReN6M|QPEfOwMX3nBpnsoFwTFE1bm~0`8LKy`{toG;uLU8 zI4lp*pK5hDKg+|RW>Azq`~pqXppfT9ri{-DX`g1&N@b5Sjel0I7?7H#zbvM=>YdZo zZP1gClCGhoYt?4bH}9!^l-%CRBzL>KvU$hsqbABTYa>n6Do)Gl4S+`x>ZQeO)Fz~JpPmYh-+hynM{P4{Q zdw+G1Wu)Qkw{SXVuiN}+m0o{5N8n2FE$jTzosY`-^N@c{*7@VE-1*Z>!EiJ@RjfF8 zHq&utUtn7RYb+}l4h<{TA`(Jxl>*>QKc!_aYz7O9o(qetY-*GSu z_&camY(F_FeplUVmKKD!EDUC?6Y@0Ne8lVVvH9e>>^+2fHS&Hj0Vo$IGnS6*>-@J4 zZ6izs$1Dw|W>sDzJRGP)k{*r7|EIj2F*e~{oxC6XPX6ECaX1Ay z4INCB&<1QoJdA7_euZ-)79WPMNqCw9K;r$(w-LstYLIsfPKetWTDM1;Ft%s|lZ0`z zLyLVMqvtH_X3BN(rxE@Jq1%-H5vEJ5;&&y)^X;*AD}wa}l%r#d+fjHpGQTHb^%eR5 z`}Zu(M?5UTor9Ya6VqI%-C($6U0_tfP{*;};V=vW-RRx4T|bGTY+U6$3I$Ir6xuW` zjIHp8{rQAkt2EraAIp0b+Jkm!x_N(-2<8Wskl>qNfdN2160wc@b7(FW&(ip`Cx)cc z+1R5K8VisE4hyT`c?=ckxZ3}*LJ8l%!&%m8k;MoFVi^Q5k;1@8KDez7_8vPw;iq!j z1BDT{++nxCaU{l*icta!$`I*92(R8lIu3)Q4wP$zZXpY%IwBoU{f^|r=n7-@y$jC5 zfV^Xr62}~*IZ7tYcUV24nfCOgQy->WlZ1b|B{acN3J-@yDpW|hcKkgFV?!a1NE`8r zM(}3ix@da4G~K*E3Pa_;BCs9X44<$x7S@0g{Dj~H4$1q!^SFaKo|H!Kc^QtSvv6Q! zzQ;l3hNU4)Dwn36dUSawR*i-{FD%5T z;KP&_Mbo86#WKY+`kLfX|A)juhvjHf()hPtx@(636{bL8ZOPiJ3eDkv;fip2MED{A z&7OScus9g`!dz|yNQ4opYNzSB7lL8OB8A{2oEcOBc@F@CBrm9V7`!EEhX*Vkru;yJ zC-J}2co;4?Brd=@Jt9a5X?SqJ8tB_!lDPl!xJbKU;W(!8|2d^~w(B%;w?R)l_WpLY zzqxr=nD?ibX6;gR^G>fnwRCQmn49;0Rn<1bONL9>VG`&BZ^kznT!x$ucEt0u6;(<8 z|HgT`hBP0ne9=fA+}G`x(gk`M$phO6lmAb;x*wl`1KcFSvyM8X)8Qhq4}P` z*87Fi$xNjU;awOX#WCv}kuxD_=C9-*qsNIz`eiE2lK7{Ya`3A$ea;R>rW;X7NJ{wPuN?is3-*B%UhqDIKUS&W zc6mHFRuJWxg+k(wzvTVf*jq)P+q_c>+Y2t0Td-VIVTc7i6FBT0?9#Mf;jB^GVW^G* zl|=jHmsDSU@sj{=vQ7)p%^_Rtw0LN@qNLNpwAbOZh$60uz{rSs7mQG!^)|4YVCa$L zon$5PdoDoZPcu@OS~>0)tPJojBhHC#@GX=6!g(GY*AYZeHVmP35E{3r%i@L84rH;b zvbQ81tT&Z322W@pFyS2X{x+2)Bu(@^4BuifB`k2aIy8(wHLh9M_eUiB&ZAZbiHCi< z(8I{Po*LnC3bBh3AcbXJMGeBYt7)wzpvM#CkW$`zIb9evlww+$xuNEkZ3Yw`AgW=+D+V;-lbB7?juR-d;|?Ptn*Pr}cB=6Q>_{ijD4t;Z(D z0%Gd|l6SnVGvsNCd4aH*5`_t0fX0$6r2ZCtw!4Rb4Yl|D*_f@EmdM%cX5>Q61{+N7nm6|SmB$=xbV zH}9(oRr__Q+voDT26envpFOVrIfz9uQcC}T4xSOV)e1tAD{<$@I)gD%HA znI{T)x;tW>%Ed*xjsSZdf9!&X&8$EIKGyBG|y_{Zv-stl#>6!-13%)$xWN9$|A~M}swuIJQ_8?Y9e31s} zGJ6QU^YSZAeKq0-D3DVianNx=p1_9z97E`wUtYo6cPYoKd_ycOPK8DIChI0T6G$;D zMOAw2oBY8$nXjF~*Wl(4Qlvm0GS3k3Jg1P~>ZOt|i>jCBY5B0EjtKTb>v*cNBsDOf zFa7RdY0B%RDM#fLGI3&`ra>6Vf=^xLJM`5Q2js8=C=o2`=$|>PCX@%SeV8Gym(FJL zG6@ZPlOK4l9&p{;e1xy#p&8w=-Xn9QQLa%4Rwt|cgki-^GpXTOt`Vfw0ECfg^?4o# z&{P;TlA0L10aFJ;PQyjOTnCh{7KtfxLom{-S;lD98Dwq6F4RZacCTz})%Mv6@86@W zUX`qFl~*?JMNA=k)IBn~r&X@7H}8*ZO_$O~rmUjazBx{2%V zedMZTSw0e3RwUU@QZ~+>79B}cD9V=8G@tzi277ZUV+qVk^M958x~9lIFazx1!C+<{ z@OV{)<7+b|?$>9g#ILtj8i9|Of5}8am(E~$(|Taw-d=HG8g(wLEF{DW6^hueZ}ipj zjq0}xe4gdorFHCF3%_Smp?7-vsG1;xZr|>{sb2lCe$Q*=cHh$ga)%qkFkX4<3AZM9 zHd_{l+8&K%@Nz!do0h9T$>-`o@o6mb$D*i0S`c_ub)Qr~0FQ zpVM7&nND|{@6d6_O_qxO>-Na`?kFC)_7n_jP8bM9?~9l0(aZXc-|f76yX9B{UwUD6 zC;f{Hc!nAOyJZ<*uSHmro=f1o$Oe1Vz`Kj`O@=BP(WR*69V%axd?y9Cl$^x@>iznDWz| z$$&1hsxER`T{M?bKE(I8l;1ih?p+AiGET|~sPSt(5i}}L?Y6E7yV#-uJNkYu4+2^S z<)=p9f&;{?^MU@j#Pa~R`+K9Ow0iLT zYmvu%V+$vmY@uFUb@lGu8{4kQw(A`jSMLVCnX548Dy@U%TKIwW%)OJ+4JP#2^~SeH zPtez=V)6<9)qB55kMDnX|8SJObwF3aw)YLv-60*)QX-%DE}L=Q&hcr{1z($Ax&vWFLy^a;~e z({{Edj-B!25goox+}aX3eZi|<7akZ42zlrz%=hcN4g~XeJsUjWT%3gt$PsOT|EAbn zoH6;EZY`U~zSUDzkl+>dyZYGhlgN{$uTP!}e$bKWtvWa&zS2%)ZPE+J+QCR4u0DOW zRkrp7Q$oeJ_}0#sr0r|o6dLJt&ZhujKj$>1*4FzSXw%c4ECT0kW}X&g?UY6iWji(D zaPgf5O6(#2PL}S?Pj}N*X=mPJ#F_A0KeE~tJRP9GHDhbF*CRtpK}MpKEA_q@8myQr z>Ccz>XkTB55id$p8|O8pEod;ORF!P>b?ovfI}Xd^4xMVBx+xBqGr)s)`Z@b>v#vhM;a46+#hBV38+VPsMOvO}5#mS`L;*3SjhIS%F zx#*0Gw~f;i;fD7W#hU3daubRdG#yp>eA3@O4ok-9o6V4R`4+rmKwjwkLwP#g{IyI( zmulQs8PzLKj>9uZYeh@=JnYK{r)K7*t0%(xeomcIl&te6drv*f-=rk8XN+=gUoNh@ zo7_4z%u!SCW*r|KeI%~(t9N(m6HIxIb8$e=B$c%BrCgzJ3){n0Kw4)*g8r9YZA%O1 z?eJceFT&s_1s(HBq6D?e8%esUIk{G`!M_3 z?=clQle4u_aT*9mCKk&y;RX_-yo*!_pj>vQsnXRWw<7uKO-pUdOj_dihhI5Fxp19RsEbF<(MaAH+5|0oH zTLT8Z@TO(#od^bI;>Ih+eL;u1-pwmR26X>&R5Mo&2drdX8wIn_*L7j-wa0Pwv_9xT z8NnCqLWnLi)2Q2JYA;f9_Aq2+2EC&A+B{p$Xa;#W1(nq_wtk;*G96di8IryE^HcFT z|FUSK&+db6j-1Vnz1J_JW=`M@QOUk2ieo%q%M#dZXFn+wfgYYxlmGIipD#srJ>L~5iAI8R_NHvP+FaV5^P5<~s zDT;c0Z*_@Aa^;miIwLi0v94Om67Tanhm%S>6MQTadGuVK?M2JA=CyU~xk#I@hus(3 zQv4+RmEF7doa!A0*DN97k9}n5cI>dFa5^>g)N3nhe@dOd%PmSS8%|Ui`Z~cQN|Q4^ zk&K65Xm_x&n3MV-V0hYEf0jU0goT(kc5<#}`)y;~cN+Rd)z|JNysZl(Bb}`yDEjPM!(-{O(qmPhqBZaXF|U%lw8CTe@7TvUVrqqIs^p{Z_uKcdm#S zwQfUgZkX;>W4s)X1o?tTOWu`^%Vvk}O{{!d%frz+Ryd+B8Ho!9jd%u^$PrO2zjDe8 zM3vB=(?3Cb){E-Yp5ef|RqV|0Hj5e8*Tb0=BA&={o*t>YRZD) zh#JbPW67%@O_Nb76OUYAX(*>D9!A>vk9PlUg|>XF&jp1J>-F1r6{ zok?ooWDsk8Y=ifsz3L1v8vT^wG222!Yxw2o>m^+s9~J^ov++emYq9 z58l%Vhcz*a2XDJ4E*B0B`bWb9-|1>wfJq&|~d{?3j zesitfe{ozUq5$WkXp(^Sk0I%uDU)|s!Aq3#wO_>Nia6?Je^7qxPqo#aKl;%;K!c_`yY{ZnXG&sv^r>TZ08?H zpVc9%o@(_Wxgh-X*6DQ8Y2nJV;fc6WMa;oGgzb8>UxbssvhLdo`rG1O7#K@o7;pe?nvr1dg(H>2E~@r68T5U zv~3}=gUJH1TTX!#e$&*v*Ei`@(he?R{!(r|##JkCzONsrJ|&gAZCV=BrpX%}x?fAv zVE*9W8KU7V2uETGmn#jyqxgLIv0O^!rsHEh8yvyYrTykQLswser@hgwrDwPFyQ9~tn(uyjn%z zq=i$EJh=E!l-SBGb}lkpj3$TPh)3-pT)*l>#rNpAT&kToYB>LOA@KrU6lI0Fx78`K z%4QSaz||Kn0Z!-BXb+6FfvdUAFX&yDj;1JQdQv;*JCny#oIKXz+jC^*knR`B08l7!ynw*x{oobdCe^2P@xy#1#25sk5h81YbXrv%C95N7ycn4(+=TBOgkknCa(LEmK zkjYeWEwmCTaY0rd+U8IQR=%P_%CP3rr(F-*G9h?WR32|c`#}Ej`g%e|-c7{_$t#>n za)bHe;YOu~fnugtHBJP$4^0zqL%$VFRCj)R|y=V!omxE=H7(QgKgH(b#LQfs)3vlk>&wgc*%!z{T>;W9vw0Vkq?hGhJ}%cI=73M4vNnF&u*=$U?Y5w&DXFt$UseTf6tVmp0W_j zL41lmRjg1}khNB)k>|O8i%M{sfU#uK0+q_ueEFD3OJ!nA^miVB0zR8sFdW)JE?b6}7ToiA|(Ez)`v9i zn+*Q~KE}Q4f8gkU`7aqfcOTfLwA2ua^OUR`p;X?v@7F3H)rh*irN62}@>D*syO zA+i~3^a&0TKVh4jrd;2d?l*rhvqF7Wxc5q3pB>?_LT6wI zt;70I&-=yB0ny6$bZ#77ex<$eZ^@VD9ekQC`{@=j%D$^sW$8RNciq4iqcg0C&8;xK zJS?BBOucY&W0RU`#vcEsS7_2a#7g36nk*fnUKM5&Yih(cW$Vz11z+_1n!nVL-t7_F zk`)_r5xhn|Vkk1M-6u8^+-r2r9$_0J0zQ>jYZFO6!d)A!$+|@~VcN?CgS#~pH^MB* zxO6iTCxiZd;ry?0*!XRYHFSZ`5y)}*_|s(QjdP2eqVm+cW+@5Pf=>_ zg}jp%=chj`q#(v>IukQa^tMqdfJpG!ZJ!EnAG5?L!?qO@yE|p+$M38&sy@a53h7?@SG^;db(27 zwf2@{XuQT(M~65=!h#MLcra04ftIFx5UOY#M6;|O|(Y}WS&e< zWhTur?Ul;z_xhKV(-7RL5A~xY5ZWfZHy#z16XJdljvm|gn&JdCHaxOEzV)8hy^mCd z^^CgDe$^v%!b?3aN6HEAFrN7}&UE%fVTw#yE>gTZLp7 zV{YlYIWox{$)?^N*3hC z0yvs@MK$QZkogS=Ir(ipD;f|gJDU-G|gG9(M)B@|R)fZNgV3%lT zwL^w>fol3YvH~PLX_VR~g6ySq0ZFCk5$)?rrjXV=bIJIXeKlhmI_7P?D)%8QGB->G`emKA?nO*u>w9zs)<;jk|epC(7#kfGh zW_KSxZswt3pjybG_UY)eNwIT{G<7BirEwdQcRlKa(#!U4(n7nNuKbbt`6K2?!ve!1 zht++~+sL^@TXu-X2+TWZ>zujix2i#voP%HRSS_ZW%v~6sI>v9QUb{pwi+BuSIXQ5# zY7ccBXU_K9CDK}Bu=-F~mClI}DQzLc^_&u0t}!~u$7{EkXslu=x`&RlMd)<(2UQ;KVtfE)g%#77P9 z&lG#za&_3(X&EcbruOG0Q?_F>`GxMIPCxkmD6ON&tBl9bB0ada{ia2Dr&hFIS0!SF z*=AoCDrb|m5D+hZG4QAVsEW|FaxSj$@sKD#wR*GgG9QkCYoBycg8q!O{;AJsRgXa| zs$$^F0x5Vx*8wtPcwQmuqz?Kh8*w-9;X|UX^@hu=Xoo6cjL3zQh1%%__L_%#3Kqhb zY3n{OA{jO&>?e5fZd45(2x~`uQaq@s**t)6LN!NgTx79zs{9 zwZzi%swfucK_>s}iXalK;)0`YMa5mJJ*B?KEKYZ~a^62)-^ud3f2+^PBU)&rrdYDB zUU8|W+o6G@AQ$P=_&My}k-vnMyT5=t7aGf5+1;S>QT6i~Mo?2kew!t`2r;*EJI=0% z&-6am8EZv`<{_r|%Eybm)B4lPFvZWFqnqjk`C2F*A32=Pu;&{Iv-l*steo3#%I!%M z9L&?)3>V}ivp>9=`)I1-cjoc(%$(wYDLN;%k2uZn+0YMZk;Y5c2= z(gO46hY#)kUCu8*R@_RajD7X~Q5fX-@zBrHQz|e;z~Atoi2BB#_Mj?Ls26EB9co$B)&Ixr}BO%TVEumc96*$R_Z%I-@cs_-i=&qC%U)lxK zoyp|dx}Ldt>1ZI%Ow0`%S0OBg6L>x6FQn3ws@rSEQ{O>OcgNUm@mTFSI2eoFM(5TR z%YGBVX3Z8Tp7Cc}qClt9ORIpPX3N%Mb@HUTP~|m8#m$!k;XiPuoqK23X61D2N6+Ew zh`Bzw_wQ>akMy^@pLRLoUaa(QSN640xsZf7UK(s3xzPucMv)X#vj+;%hTH? z({=PuF39WK(4i*a2>GBaj_o}_R4(h=hx<=cA*#vbD4rDS^YZPmF8%tn zf$wy3OCK>4p85>OdpgoH zB@hRmhm*6m4{+G!8B{1*R1nmZ*1U>+mt=)#s4-H~t{O4Y!R^|Q*N}%C%q3ON7oIOz zY0-vbiyMg;)+a+fMT>@|rb6&aV<%|Crdc=E2~JRY4i5Di?YgWO`2U!X-z%v~-gu~9 z3d0+?-)8T%v4#zN$&GmOokYFhy4v`oTdgoWVX?^zvn%IU7`2O|ITOs6VpScZ=q@_& z;>5Ry?6SHuvC}Ajt+-D)G?HPSnE-l!E+s zkxS&}O)8P4LKbq|4Rn~VRWA*d`UTmW5L4NO(u#%`8xOn1C)(dW3$!|Y<&QaFf$KNu zTlU9CrJ3P58s>VYTu~?|D@JqhgsmRK-1`}<>gmanrEAs=olFT!X^V#3-chTZMlrXT z1rW{jbiL_6 z{Gy4$l6m-F^Q4C-{@71oSEykV@`jt0*n4P5S)?KNx0ttmmc!ee{q)9z&A41)(XzVE z#f`aTt1)pQIDdeW>3MmIDecb!rXgg%@Z_%!yM%#7>y`-PWdg;#RXcC}=u^IU@i(kF zXja2p5A544GjP|wa$Z5QTs%D9PTs?qF-u{ct#DDgG(g+>Rju^qN~t(vXl<{=u8IAd zx)SHt>t`7!zM;*Gp^*x6d9JUBSYpeb7zrf2emKDqBtXoxC%~>=P{vOuPgYmiPDvdS zw~D%xlua7E^|JY88Xs2yYVzf4)emPm(sfSX#zk~4vkO~S=eo!KJbWJ)Et_8dOn`YN z>^nd?W%1j#*y}f9~%08+F3HPlQCFfERUBdni;wkG7>67*x zM>YPKOiM-gq8~{^`scE!w5*;L)jK%~g06h^$;y)NfS*=1;@BfRF{qpy_1p={@orQ4 zd@QLFbS-R=BDaQ_>y0c_S@J~INqo50sD*+lKsa~H zq79#@Dt(gHiP%jG$@q-H+-(1$o!~%%WImMIk(583mZF=p>+^-Z_SEeRmPf&!RpsI^ zPQ=In-|u@J{>o%AuLn8g#YLb+z8 znOAB>K{NGDU%o1Zbla;msGEPtL7y>==H#*99?S7{Sj5u4x@m4x<<=9t&gy3u&zN%T z9rrYgv{X=p^1AJF8G(-s_L%6krr6%`k_Qgr<$DeCKZl&9Fvp3qzSrIy9Zb4cMJ-uk zqu2bhHCxo(!!GLfPK^D*AS#8;OPzhiu#O=iuC8LS{H*o$lnJ~3$eT`h!!f>+pU(tYuW0CZsVhtBj?dAku4!hW)4mT z)@X!f`-42C=79pC!oIZD`Gl?`Sv=X;x$kN#YO?tew@R#eIXtN}`IvP_G9P+0+`L*9 zE_|ZP@oP$BHxg@<`?1%FBED zeLb(IKmIY3yDPAy+u^@%Jk;1ZA^#%mu$lSuxBVlxFC}k6Vm&@0ztMa6F#x#)q41)D z^`df}e}%ceuKv!{(<9O94r}7nQw-72r-z&V^}68?DZRvtouTbVZ+CKaFA0B8X?@%4 zM-oZT@l|^JCdzwB+jE~!*l{hDwIFj1ovrx#YIMg-&$7#vJXs%w>g>-BW7nR%gMY-Y zt#X@==K19MhKr1}<-F`*w>hQ_N)OsTgFk4ZR_Q2PyDcJHBSnLraQ=5y%fTdzHhC*J z*au#pQnS2g$ve7Ap5M*Ad-8}xKflagV}<$@DS2VqYQA<;M0?ctplcmx@U|O?4*!d9 z66$3E#gE8K`EnX--3_@{pV~;T8xrJ9dH8p?iHmXkb{m?lMSc()xvou;*D9%;yeDGI z3UVD@cPJjR?->@SQG6lA%ExF|(fw92yr(pUb+471)!mCfndr<+ko;YHEu;F1p~}9nLr>(zC)>(FHteoRCr|U>uqF8LJ`UF)F3 z5)^lay^|Z=5TNwi*!_bI-=)i$8MV7Wwf76&%g?*tt5Ym49HaY1KRU>&XT1DmFm-Gh zgUEH~3-{S>(pZe)cNU?0^yyteWATH@P%ZZsuOxMz2U89>jf8*v7TWKT-q!lqYY+IV z{$w|gXC6IWA3Lj>Y)aouS)JW;F3h3VA|h>3Yid*!9m_jQRn%ISkpb~{faojLn$G)a~ z4S!X_p63p@LS^xLQ>d7E&mQN;U7J+yY3w)k_7E@awaJuOT$aCPb7y_Zhi`^&fcnrj zxsmzB{u1?6O%XXwjMuGh#Y0C|ok%BdTl<0-M_yk(PCKz$e|+bsq{E+`{K9eAU~0XYdpKefLYP z)rB|qJ0`mKzO)j*AW5A3TvS^=Xi;QQWlfCjwMTpNp>6~#v4}sJOuZ$FWk3F4u+a`{ zd^LvEt;&|7HO6Fn+$Q?hZiqeSd6b5(&jR|glDwfD5tG603}c%UqmM+UmQaT~P-PUszKI zF9cFWHwzS0vho(a<^5A028t7Gpx~_x4WBe^8}kl0`QrgUkdm>Hrn%`rEb?ufo!g1VL_;&K${KRE+8&2B*HyLFoP!a9 zn*Iyaa38xA8+Qs@A@{R((F@ePYI658td}af#bkJ=ze-JZ(y?EnNQSn*@i$TD@aQ0Z zyDyaT98s&WrpmXAG^B-l=R}|K=S+%hy*Nq&K0VRC)H*!6Dt38iwbN6At*T|0GcNa} z_g^Q1-X=bq6|+icH)r(yQR+$3R{ZcZi=By$yUw%)@-V<^Tvs;r@O!(uOoKI z-h7tU$R;~9`n`MI*8G<`E-w`Zbfg8!Zq4UioKZjP5KkXxiS;nE|-;WlZ$)j>u9A2 z@ZzYHSKH;}#Ct{upo8E$^S~}|F%5eboL<^Ti6j}O#f{E$ODUg z)GN;>C&UL!_YjD728OaEKOMi~om>$qJ)R&)(amAD^>lV&(iS725-6{?2vt(?|I$6+US{eW9l0k zyQk>eCXXhRZ0t;EOE}85i=M9p!FTLT>9?>B>+5lZwI06?;VY1Mw!-^D^K*tECz|a5 zW18{9BxW+pO8GiXbkfez7Sp{yHyXQb`#DUXC|RWR50M~=>I@!7{Zb>uuvF8wY@c{TWN1O+ zeb?2`YMFcTo7}F7-{O7W3S+HovQp7w3eo)Tj_{=WoNUI%k0KkIM1JW$QVX56ExtBekK4zdM(4^3;vt?B+8tU?=)Wkf8a-&N0_z z`*-yxoXoi5z>$@SBK;@rY{M*7?;`tt{W1HcZf`Jt(8^lH>avzMdWP)Vn2-JZ$}g@H^4|{{Ub^e=6v-j_b`N^1~L|4lcJiGuV_Dw(thF z_UVdV2Fh5xJ;_afGx>zbYlSm_Kh|LEU{PuCPo7fVOXsnr}B?=FyQ zIrh@&bcP@hPxOJ(g!o?m9~N`AJ)d1kLjwu99E071gq_?MBDS z&x$K7KaaSlAHqNFr2F>TJ;Eh<&tNqwXutGLUD|^Bx%jn)y4hQUYXytXFC7zU$hMryxxK3|qy7{{>773m zD`+z%%fP7VT9fOirMqx5?yS)q*a_@B>Ti$t#L+Wo|B1~(M~j~K_}*BE_&3~C4+1Yn zCMPM~PAgA@H4Z!=%kA-I=eKHn&{jrgY{Z(h|&~ z14!~s2G5u9pDHgY=#26@^Ax1%avyk|M;0gsX6k%@KN#oDwcjQpt)qTfB!%~bRzHJ= zI-k*YGh)FuVv2Y$WftkUEq34HORb}3iwab}5U z%5*;(RC1R6DW&|ho7rD|k@h>$#lde6CW`d-xffX0GM~ELwMo*M#*+B~No#$w`dB+e z5%`@fSLm$%E~e?I@|4~B349+CE5Ef{{85x~vFzhlXNyWxNr4MJ_ios~_s7}U8%1Oi zsggBysMJ0D_5QUy*|2=gNGxUF?OF4KTGyn*}<>_ob>ifz?g6MEh&S%w_-4T+YP9w-qzmRURzaPxhv( z_x^Z4l}skZ?&FuEx%c^ar+=IB-tojWAn+%cjCmSX1{OxEh69=p*6(S*b~e@+Ie$KW zG{J6zi39&mpSa#0V|#4O9+TR|+fFH}ow1+f-tNxmeDtf2rTqe9k&F8QN6z;hR6ZylHVEcNKbEdL-k41eE~+^NSV@g6AailfM?Ogtw4)#K>o#2iu~BEY(%D zL=bOU{4f%V<@nmO*;Dhzyu{GrSJBf7Ig6VVit?6}z{aX4pVAllK7^`P`H7^l4^X+W zq#Xx1yc>~xQ-~%o$1FUOqQh&PFw#kGra0`>Lr&5z4%F+bR zfKOYKBaRmjh{GXCRZ>KB;o3kdXWTOSu@uiMj$-;J5SWehSQ!}Dmg1xCA4ykf8H_#n zb9M_ua_SqFfR?lBo(`>bF!ti7L}S8;+05XlObHX*3H6oYDDJQABx`3;e;Fwk$1c{Y z#Lil-4c*!v-j#7|(F}jj;V+Ra;M>X^mTS=CkK&W19a(%JmNrWhD(US^;c6XBi2r-; z>r_6Ls_bLQZUb7D2V^FuoPg2UMP4nA9(l&SW;KCKsl1hg3H$<2WR{0yE2~&@G@-!n zeQ7i%&ndMGiRPcq$f*pB=C=(dB#w1F46}=C&-O)nSP9Hc99wz_#?Y@}B>+bJVVE3x zba$^u$AeHQQ?o|ncfiP3=T*?if9FKwTLhLOux%7ak7fkI=l}x(Q$&wGbK0<;0Ji>Lz0h-{8n0midmJ?l9Y0?leCMwmmO41u0oy@kQa%?CkwAaKyC~4F+Q56>1-XS z3dH0SQWYDQL?+Lf_UHV8stpZ{;YZ~TS3wxquwyS~M8zZ3hqix13Czp2K@IKi zPI3~FGUhvWU|=DZz>@?U1b(rJEGaF*W#n%Hm8jA8=Ec;*iH%hP$P2fJ=^mmx^4L)7 zgh;{Ln-@KcE@f^VD0H>NBM$BL2nGg4#PI)51|(2iNT9Tj7Bhhb04)L&;r)jOM2RUx z2>=(kSPZmS*Z*b&LBklPJpfb{VG^f-RtE3_wvqU+hJ1)rLNox+@ajYP_(Np&!R)^V zOxY$79so|2Poh=L8pWe4m|?~vm;rzTct9hfBEkmYzQc=Ec9U7LZt{@4=vuyiK`g{F zW||h@CnPVXmM`uQnO1F96Cuwd7=B>`eQ<*fU>~1T8VLt&(gVGoP{4yWWwnBDBG>M!RU4x9&M}P$ zaQ!!85DMgainu0n_5c47g9x1Om_VfE%lY?+0f{F8co|y(KQh3SWcDWrSdoSYe2lmc zV0iBjCtmT0jV)XN5U~v~-@$*70UzR#Q$?_zM5S~t#LOntl0fYev}~goNYSMrK-mb% z?LTI^U0l*$AeZsf@x>wVSd9=P^|pPew2Z#@6HZa5QVRZc93%T|HXQ%w@h?)kgv;iM z^`LV;Mm3q(4&rG92G{>$2vka4&#c~=>c>fB)AF6sg-X(!?Mg*gGD~zDRLVxv{XYyq z!{9J-V3-MvFNhT&lOeN@W|Q7`aM|K3K1CCRgFh)%Bf>U&i#)D8f3)N zm~zUSkt>k*PDc|jNrUVi+C2af{cqzRL8Jpf^dSclR%TaC{J$C!KID4jKq&qu@)#&S z$%eM7K;W!baVUKj1|27u5Ciu)77tKI93AbJSFzsW5}`~XLmf_kI~e|}{<2r!8u zSy5&4$r`JOe+q|ET-+v5!Qc`Li)$bOtUaimrRn_DhI79h%4Hx|XUnr<$mAgx!T`~2 z$SiN(Vh{k`*_W{HJds*HIx{d0G6Dx4qT~ng#GriWg`r6hVkz1w8u3432gq;O69teh z+@?M#+mF427!r-ty>Fma32L#Sb`TxtH-seubSM$Hz%k4qo^HQMb>tLk9K~rG>YqzC{!e&Q^3Y z((r)caUY<5AutQYT_S_t4LtBbQTVw_BjG}kTboKF*~KjbtptON7@GEfEG_>t;GTX? z1ON;8q#_?(%`7&^4AKWGuu=+2Pr8J#gTAvHEC9j0_U}0ifjm;6!tGT4*?=U93P}_X zP$Yo96d=1?V4by9tPEgyOfJVH7gldGC;XgCJz;J`*F7Ww& zNI|&iCH~I_n3#V^-3O`EON5n!9nfnCi{WQ3BjL6KQl9?Vrhy%+`T1a#8_h2`Iz2V_=SFuyr~2`01< zP2$N3y_xzjd=@0}=cC~1jv(RyD)Qh46V&1+B?!|ecTn}Vbb_3yWe;ctIiQvuY9B%^ z8_@c~PJK3rfd5~0A|Ub3m`boBC3Pl&#Qp!O6aVid22`erGTb0EKM281n}dZP&GG-8 z#NsQ0QAfzqpp5kie9CUUOlvwC$yX=;F;k8RJP2UkvUfBW1ITH`8pZ_Fh*T?{3J=R; zk27I;3>lWkMgsuJ{?GhG{A*qKUlc-hp)OP;R>F$Je{VpdqW?d2A%GRc2UHjS@5cXC z7gkC^b)ha)7yf$#AVt&)p%woZti)VN0XOtEDPX1Ha<)}4?hKx&79jpmsjlZi5KOor zOhCo>zzWD;AyUe5>OhT0h6W`l`e#suXcCMCT(UZWOBQeo0|}yo0ao}IFdqCV>5xKj zj3iLHlD>o0rb#)vy{R-I&qO6OkSKAlKsmwmp zt&HWzLAcNH%h#ZG3~D=|wgPBJVFgx;#Dt_QP*Q@`SX;_Dbe&p+^1&r6=YZFswv@L} zV)BcIC?ba_0*g?iANpWDDLMNL%pjhy+ZHT$P(xGw34tOW0T~-eKs*pdhM>o+8$1mj zy#&Iu1^U3*&8VOn(FY`z<`@-3jnUrig=_@yIc3m-6i|B)YGHRk5-@!kp9n%b5rr)n z2`-pGc@IIG+{KY`3fbPsToyuU5EHBqYvEIAA(Ui!a$qQh{Y5DbKq=s(3fX8jJ33gM z&1T~Q_muyq0Ui8gCeWn?tnn;?QV=Nks-c4KKQOwXgFgn+6;KKSi$%d!{+|ut>lMH- zdEhz&Y!DIB;@_`vz*ZKAwt@eT26&N*td6h(PUc|~4(Qso0bRQQ1D3jAPXOMuQefAv zI%e>ul>*(gqW{r|sDoX*OgLfJE>z%Z1!Kz?dJEuntM~79OXBZ+Y8-amqT_>Iw|f6x zw}Sq;F+U^9}l2wAV1fPacvX9r`eMvP0MQ0CBli^LK@jep?eDmlGPgCwVD zJ1-u=5m|sh?vA^vP#;=^E)j7;Z>v8X_?gjb6em`;pA*}=86D*s*f%I*MoyOxp^-)QXtoG?DUXVk6E)KGhrG((w-UfRkG^H@ z?53>Tf*E&^ff@&S;8{QqGt5AM4B0q3mw9pY_tIOn!Gx@_rA{d9R5_^R?!$BvQJ}#H z8QCy{1Lk=aRR(zYa!7$;+0UXzoKRTQ$Ud)OtL8oK2IeP?HvzYS&jK1xUe% zRsV)2=06L_1FuEa6I&r|91waPoELm%l zU~CDW=X#XWnZdZ5_?jquTQr>wofCmTx^m)lay0_nH-P&uUzF~+K{*PPz&phy8DqCq z$Cb#THr@%srnn^qWShAK3J>9#1DL`PZ!v+cGd;BM9R_+ zATQHDK;&$xpuhWoNzn)>35h~16XFO8Y$Xz5obf`O@q(PK&H8}nh~+UXmF+_tzJo!> z1U`eJ8!D!m>u|OtdK|sBolc@G{OiXBia&>_p*#&yK-GIRY9$#^xs^XN zgnb{hYXJMcdo2gME6p1A6a&&IkJy{qOn){g8~~nFEOF`JiRA70lyC0<$kPk~@;PLUvCN-xyNaV)e#&GGBJAYCSJRI>^16Q?aMd*` z=sAj`yQkJJ2N7;PR%t^j`fW)-q&GYp%?BE>mOK&@NG!uv*{c{5Cx?0@c^5&r{x|Gu z!np09sIypuu$OO0)p1-}H*)j5G7%m-m~IE+n%-D|2G@S(b|7|bV{|@>Kr8;lQ}GA} zstIoK2s)|>7V!vbstH>02nwo+`{EJz|6r&I54R;4(r&lWccR^4=W*_# zmz?p7f);!OwSi!J#18EWLqQmK)%1=MT96uA@JRy$#lL$XBmERJNcm;e|`88sqjl;zwB&tWG@SS_m z9QUC)oWVZCh@E>xhPZV1R_n#ONJ4r8pb%OKnqnw~@UI*BuR9Rt4x({-B0dg0kCj$l zJ@8_&P*g}nXv=B*4nVHl$>8%jP*(;C)TH9>rAY??#AS~4f*zODl;w7&PMS{FKr{{? ziH8z;Brvp`+8~UAFeGAtK0JWEKqUfTUnaz`g{MR90o~$m+@PxC0bhOxHIBe13Tiyl zlN`{L*v4O|jDS%M!}_3Nlkx`9Bz7h8-axGq)M7*JAS%#r2=bSHgAOT@AD9rJ$ry_E z1)|#$a9#i!R~CUpdI?f|@UsRQRRfA&c@GMohhY{DDIM-5P6%m;0c>7)C_)*EU;^F* zK#(X1Yvv6S;DLJ;1B3)T0>i~VK>b3U;|R3Yncz+knBRhnzsNSt{d7Qs_r@`mbzDT@t;3ku>oagc;a{VHdi#$JR7g^I93Wr-Q=pVORthP=PcyJhjAtErf zs)7&Ri|lLT`c|+TzzOUo^#{8_thf)Q!~lr8{yL%OfZ@dhZvBwyKOzdG=WYd}2Q>hw zA^$&`&H<{j?{DMTHMz;QJ=wNhlPBAnY)qVN+qP}oY}aF?x-?h%F^*x)_-R;lw zoPG8l#44~ikBMZI+?m4rOauS#6Abgep`-l2k@fX|BMbU}$pK{|Q6CIBGhb7)C*>YKul(aE~^(8kSiWgiKHyKF!Gr(D(w>-Tao_*N9O;)Q3>%s zaEubs#XrsoL?>e>wRVXMD4_V5c11-#@N)vb>vN1~2hsS6! z`=8S3{PUIPLn>r41hc2|>4i-SPXU4PVhdl=P>0AUwYlFujz1W`;{g_E3GQv_ZrFR2nnfhyQ>t zI=1NlPhKHoy9G5oM+uv(qs-;8!ToZOkc?cU5*@-PrZ>v}m)H{hUm|Bj+-Ks>hllu) z7@z+?VaEN5eWafxc|rAwl`ygYu=4I-@FVu0wE?91v^GZm3*P?)RB=ZC3A2A9EBX_R z82)FFNPp-Wdhr5?f57=K(Ek^F_#2-omj568Cy8?Y`6z=QCPm4AYU< zFL0K`MXCed+>>dWwBKpG(J=AzOv-nSZ*G~rR}&mV zy4muLOcmYHZAiMSbiLW04QqJm;C{JW_r&ZTjUOB`V$L2qimX^1yR;MAlB4hfoSguS z-h5d+aL7aF(Kxg&rf&z^e@yZ7Wm4P$uwUv=cXW856Gjh#-dUM+`X+a*O9Ba_`JI&- z3i6r~;u7;)x&7_2#<89gxNU!}os3@==c6Zw6rSikNcNk|M%ch>QHxnDaP+ga&pQI1bToMdmjyIS3CFHQ~3S8DJ~BkA*b zKYAbaru{ii+yZW2Pe;D1cS63O*bVL4XNjFegoIg2o-ZmO)!$>-F}L4uffpM7HC?TY z=w3T{RcZnOoxAgBBEEEeIicgLrUP8Q4P7R*e`#v=aEmaYQSxDwM-0U64n3lTZI&4n zJFnVZ2pJ8~_@2eGfgiqH-BILj?I18;i!K`yH;YTP_qKPDqC0kfT%s{Ha+c)i$GpYM zzX6Dgr-MUXR!}8}7f(75FZiKvnKqUeycgDlOOM29KFnNy%6L$4hsL9tRHa6Nq15JP zr!XadG@l^Gz(Z5dHmw?54+ZyR#UU^nV{Mh>Y@7HX{d9f&dLFk1d^z%%DuTd9*`RXU zqf*D1C6F3OxjP}*Bat36)Alc-BCe7u%WS}v&J2c2w7+qdy zsrxqAZ9j0IO!S=gZ@2|+Ephod(QrMC6H`1kS%4$L}3l|5JIrj@j5b0~$uS|XzJ zu{IJ)1K&mIRKEGbADt$sdM=HCt5FXJure0i4SG1=+h<9EU-pEn7UIIsqR-jj;ZLGk z+*qr%;70}jfV=tbChCggjH=dy`4JMB&z|U0YM;tDm3ALixy~13(tiU#wGAEM3sqi&+oGe%WPl2(?Rq< zU5CP$|5nf8E)O*}#In^1kv)mIrQyeeuQ@k0KN<%7%-VCxD(9x_S8_|q%E+KUJi2}` zOT-&<&ENZ4Hbag#i#;#CTqm+Pt*RHi^Fv2YLd%tgHsx2jEnToNaSElkLI7xrLA~=C z30IW7{x~jlHXbUll+mim~YM@-ES7$f36^)mqlSbBpQLGPz~Tap$ql~;W-vCGDF ztv>p%E|_p%{<~xf_0iq;x5;Gwp2TV zNS8}8`j?eKyND)@6|-z7a#M@n8JxmVEwqHydDE|}yRliDcgyXi8QL7zeAJmHiD*Y6 z*RZS#Av5>xucu?}nr}*HtobZ&5(9tVn^U5(0lxWhPYqB@nGzB&Dy2#BSA#KzFukzzU~6v0ebF9Q+8DJD75?c`Sb^3k zsA&PKX9^n{0Ez({N%z~3q>N&o#|pi4eRZ=7qPWPn`4;|r$i2FxsCiE*az7r1liL8`1DSyAT379iTW3~ zUAq;>G0AM6!NjeKYuw`FUZhC6}dJgR_z(F}9-G;+R?>-TLgD*q}*Qh=DL5l*26RI1(@mbXbB( z`IR(3jz1W!@L8Ic`f>mBhl6xU-ZrHVw5r{-A0w(Tkl-2~Tk_hRl(pt)F~f?4}ps33OXf_}HdT zZELo-H0(_L%%;F@YFc!gyt-qoXX;GWQUg68*mx1>XfM6n=6GpZ4WH#TnkdR(kb`q{ zi6k$j8mAze6iBvT=%YrC$E`*qso9w%D=CGNO0Qx{;|hI5N)y)N;^_Mtz$vQUMW*6P zj3h6vnrOF;td?R|aSl(h#ovF>fiD6vp*s7#y)UxpW}g!#pQG(Jg`W{rVkFtR7LBNU z@|q*+0zQdNI~pKGxo#_BEsM%kX6nA)%av>ejzjP?aM&B2(D3Vpov3+Ib))`khHGiu zd812TvMKLZmj^tLsB6VSi($9lSEqqqboX)-<-$4Yblm;@6 zN89$~(faWWcp@Huz0OOKXL4nloU5Jn(HECiTmBhCSLX(o-jHMAIkk*of5I}Psoqo% zb1lbjJUSJq(=zy_1n7gICj0lw%l4|_>g(#Zn^U{Jz?0cT9d{HicQ3*+Nc3EpBsPzm ztxTQWr^_#ZOdaUiSC=MDpWNrpKfMj86gSjZzu=48!jC=ZOUEqAuSvsK&eqCt-2}MD zE#Wa41IbGV+T4m(gu1KXKrT<~&X|oucK?5GG{3X<5rp}=HU#0srzv(V2x11J| zzCT&lV%F4c8GV>7n_B1WU)MazX-c4ou~Plqq`cnx-kR2;j+ra&d217IsPuJ#+)H?E%$rcP=8%@TjpsZw$eS~Sch*E( z!)*F;^KqxK@UZbnc^o0q|621|2%EO_AW+*{9$EU^R`pdf<-Wz#>e#_If#;E`6C@UH z*?R%!6jtmuJN~SAqTZC9Vf)?5Oedgy}d4qSm|>Kd|nq+xK;2DYm*P+s4+q+q10}_&kb42!6!O6Ire7yDqTe$(@RB z$dg{5FzD?%fVq+|>dWEBW4dS0!X+tRT%0g!%Vs`p=owI% z{1FLvMJ!)#yxXegJyrL&@Zz9C*{Vw;4vR4$PV1O9DMqr=ru9peinYiK_n>s(R9g>z zi~Nc7{%Eyw3ooH&VM&wt)%uY^ATjHTzmNChrFHUa+g$4Y{@tH3-XeG9q%qREi6z;kQv>AC2jr`6?kao=}utE*uRYdD{-2k3V%t0UliWoL9? zrN+zjRkzXBdH?cZfJ02!{_<1eNfL= zbS54r!!^c`4U^5s>)u-1OwRaJ003dfcPAAjTC#rItb!2AF~FxPc@nbxb7N{hGY7); zTY}QOxE{DG3ypk=W;N#>lorNqjyZfHLh8@_xW0ROPtR2aAVu$DZJ|v-r+Dwt^hTy9 zVYQpbBoSVKl ziRCqTUp)Z-*PO7;26-Mo%MarIGN@?((yd-FWHAD0&(aPi*UN6{~sH)%|? zxamNSt%`u*SL0X32$D6&WEKk@>7_28r7oQ%y*+h6o{j=R1HCy!wf%qr(HnyqUI+y9 zyFX!khj(vake^0pi2uzg^LxNMy0-SR5#iFINui0QrMe55el>CQMneF#L%0v0qy} zfwwU|AMaF*d_C~PPwr>(BiX#@1X$ll0rS=nusV5obnSb`{*uYkyQ~%!W#s~p^@LJ5 zr_|BGR{bU>ISBVsb@`MiSrc+c{q;^lD1?9fnu^DmCeVh>rQMu)g@(N8%9K-Rs;5dx zqQ@IkT}ZO|0TmQr%~LCiW|U9&Xuo13Ir{Ox=|6UCQ0AalAZO+a9w zCJnPMR{8|hbvODQThx~+2K}r3zO5z)v!oAqEa|RAQZ-eUpcboxAvM>+@|S0PUYFb` z?9f@Z!KdG)!&Z7cY)PP{urPYdD)emr)V;CF>)u#@;~W_()9v~EF$e?Moea+njk{w= z&;1}nj>1#B^0O$1J|?5neJFjkQ-P<+r=qv&U!vwKIJeROxyzM9cBL3;y`U=D3n?jf zhXTq;&xHXL_)~9N0p9CjYuXrssAfDNwV$1gq zj6U*w+!)hw%RyRJ_)%IOy0Is3Zsl$NO^R^LyQ#DB<~0X{hJ{S0{7AmvF@6mdsYq43 z*>`102ddbAU##j+9qyl<9>*yB(V;R`nD}r|Vu_{0;uwr)@Kg`(zG$^{Z6Wc;BLPoMQ&@C90XVBrCv4dQ3C5P-Z#g# zk9UIY<^0vf7m^^WHHMG?S4;Rl|9?GbNPPkM|tA%F0m`ST`#7u#8x=^cIijy=qoM!4q#Zs5Z zd-QH}Y@Ty&YsZOga&3CdvgUY1F>Pkx?EYardf6=y*hico<$4=?^l~0q8F}uCD>S(YDkx@~2*3^C+?~Zo&ZrdRxL0*+7 za5`6YZtEe8slih?nkZ?ZeS|G7jU9wKXtRrlq%*e8N7>2fVvB?rSO2RRr? zjVVAC>Rq-(w$Y=jOJI|^2~m22l?IpMM)>MN&kGUL_~Z{ecBbuC(v6wQahF0`DkQV|{QmRfg{DV^y!rb6 zRNdUDmHSN1(Rc)Tay^YHu+^2N{*zZ(^)@1hq{FN4KURL#Ir9L58|)1W_9YNPcB@^2 z(T)&Lxwf1>_KC>*PDg1^o#8zU%sMJ_SyxmoHPd-qSAx!7?n&5bT^m?Df-rsRv;<#@@I$Nw}piorH@CpGPTz0BJaYmNEZi zcgMO*fX~B6wSauA%d3d5CPz_XpjL3)w`nD23bV$8kzR+b##>6F>C-=Rs1>{Z&TZ~9 zYzEn?W?(%8oPiU@#~$uuc(EG)@!P+e;~_d&AA+BjLg2)ueTR0^w}`pTI1hm^5px!H zQ5h|&wg(=!P`70Ra4$MnKRS3v+Gv7fOb60Gu*NNweV{8on!-3LTnL+|Ckds}^5Ng1 zCpRFg(g562ZA!>tu#JhoG7uOnjL8g}hsxI84GA;pwoT>(QrBxtW+uWho zlrg7Ec}!rXs$*h{TU1Xc&p^q{-#gm=J*Aj`>+NTC6|XV<;boGp_~b1E{-%<#-R<#4 zFHA)6EL2obV#mfKi}90@-+h}8N;45j5j~S?%FZkh>z0Z*eED$6Md%Ma^Dd^QFu}!~ zb~SBK?L(`Am(Zd&9(Sy>Ic}n6Wse@)Ip4@pvM?!HMcu&X_OGT~xtnh|<&c^^SDp3R zN78$$uu%@dmYI%K8I;F`PR5(aPpBtdvJ3XE+l35S4Oqm5PQMPQ$(S;>zZ$e8u&~4X zc}v8jGhu!e+To=Cwbhc@fAbqmVbuZXe8xRn+`gr}fE`}qEz!7Gb8ozaZTpYV^EXq5r9 zn&kupV%3p#)27aNFSK=If9;#L4XQl?Da#`R`_I4Ww8k`@`=(DZ?)ol8&!6l8&NWJt z8U}l+wK+OZnrSV4TKeh}Ml{@A1B6$yP^Ufc8f18n#Qmbp^@~pdQ%!HE(}&y21ZSO^ z3R7@Cd@DY6pcvu@`jtIV3%tkvOO_T{Ya-#yu4+82Gg|b~qYENaKVqf^QIE-p?0Kip zP%N!eg*)*N9u^vL4T^Fj>+UxkoVoQ(nefcTg5KKqD9w4nDssfWDhfw!#P>Qks!eRu zEwl4MAphuwv2W^o@Rkhb>P?4_wa<}!i)~J{KEwV{gkI!Tnz0K?;0NU0 zu<70D!uHjd`mRumZOsf3^1Cxq&LD{++1~dW^V>8bwoDA?Jk3q1$49~gjht!`OTYVd zjQwhuOYO9K(-1AIyjlRi4@?tm-JmRID{jrZr2e?voYz(N58N(UOTb%BduVif0o1kHmtwMYafWwFK~?SAb%{rleXP!c|c*n ze^}P!;@Ro$%XQgdKbfpai09%+|J{#VzNU(Q6``5-y znplCn8_kvN=QO`j2!5%2kJV>~6YHfA1BwLr{+8G4gaNMC?_(LoWsgn%^yQjSxu+iw zezPV4lddcj(x@TlKO9r%7xoMWUgK;a-_70+FZ&IiyTx67Uw4ULka^DIApLfR?E~>e z-o)ZwLk$Mh&~DR1UJ1C~(TBHgRS?thNxyV$9~HkATob-tg$bm-qe8u2t#fZn_$C|P zsN@p@XZa5W()2yTNLuLqXu2Cm1xy*bv%Pw&kG@EP`;rR`oIIMp*27}`ea(8uxe+k( zg;8+_!y>CKdbRDk16cG;H(uT5_b)bOW_IY~IX?Ya?G4O3(*feAT#dGL3D_$Pjg5zq zakwv8XLqi56>8hOXitUzO`v1iGri7CWL1A(9JoM^*TBYzQRdM&I`Ox6sXTC)NhoQn%YE!9tP@dQ zaP_s$3pFS26kaF@XmYeu-&t&LA+maI!aP}Q)YC9_YR8W~v85t;_2dFx?X-9j93WGg z?pPWP;2}<|)%xhcEzPIM%3n)&d^N^oroal~c$03S9y=(M~ zUsiMH5DMu+mXL#f+j`&9IT2RSmgF(Q;EJJ4vj#n&^i64#cBhhaw;9(yH2(@n zjTv@P;P*0op**tAXCr3U%cX@7;L|*wz4s1DGTQYF)z|CJI`_;cu<;y`4at4IS(q@$ znX_*JJRc}G+8_!0Mw^u0w~<&wNkM5k zkoL=as=dDayiqOgmz#IPWpg^EFpRW$gU?g5u^SZxTisLh|_?7Ny z%Z`{AY4=(8_;>6V)Z_9>#~z^;0tnPYrjqa9zwy71+RHqM?+}#4Z%ukKSq!PbMVmOy zU_^<+AP3C|Gbo-Wk}`)fCwWa#+T$`5!}h}ualQZksjAjN>>YrD0&UQLy%xxiV5fjH z8>eP(U}&d~oA7YxNU2Gg)3u!U?4w?{bsqbjJQLH*U|ISPK5Z%LA&qO>0f~S zc&AAA2FKmkUfa;K?~nSpSe23>9VGQOR!nP3!`4nC=s|0Qck*!CUtn4kkbqdx6>x7V zy8_S8`UXdRE^%br-rlQDxzCd;Coj|{Pp>l%Ad;fKLemGuySKOe=joAowV|{jq~JxA zgY2(~8G9Il-LJd-%z z*%QU9s^Ic@MS_%n^&U|=bQm@0_I0?lr6jPOc0dYNqy{=f!HUJ{~>_YJ29NCMET0(d{&} zz=)_h?y8`qx`$S@D#a$jd}~AZOcST*rv7IkSM*LS@*|I5^~Lk~`6pV*6Y_KQOJIf-A(x zF*ADqi}Vidoxhzn0qk^=gqm^%4j(s;yl28x?-pDS{AmT3w-*GWe4LIEGaoIB$KUn@ z`QE$wcE$L5xcxA--8A|{9aA7{Q*Tm$|+@bg}3Pxd1Z1yQ*`< z1V0p=_1a9FYtH9dl}(NnFsArsf$oqrkQ#rG7d&5gf#2vS`xehO9$Rc{v@bvHP+>wn z4?oTtLn^<47J>S+LA?mq55K;=T{vAqe`WI^ryNs&@Opx@J^*R@o>ct@^~%dWq}?FN z2fkX&nvX$3DC4rH=qJ3Dt(6}b>_dKQ?J<6p8EdIVJJ!aPh*XNg zUPNp9gmi7(=J*NL-hX@Ps8v?Ezft z3cmpBztG+N`V#M+oP5=uai4}^x^W<^i;$(hCMT#uynTCyiNUzuBO9fqlK5@+hIm*J z)ZXt1!y2Ui^T zn}-pqW=aKPlB&mBH#PIX3Of(V8Bh!o)(4RUT{ePxW9ffSjzqkP#vbqw;Z^43xU@5^ zKT`O<`3^iVA;FU^{o>0u<9N?V@SZB{ZsG0sN367#Y+F0p2*x}5eXP@tm*N?|2T~y5 zYV;MK;SbL@7*c{!Z0uA7e_uKoft*QMclU25NN=Jgt1vsw)S=-HJ-DfDU*6P^N=Gu2w;{k3 zNW%<+88~{d;P}~CpN;&K2mEjtj<=v!u#+>9OzB8_0)en@L10~z8$7&boEW5JE3aEY z?L;DPY$$;UwtUAy4d>v3GTZ(^zkgf@1Zc27b?*vQ5pQq365?VVFrm-Zg47X(tpv}) zJ9N!f-gvtenO5(0oUtPK8hq_tUW+BlDw$I80Ur{zomR908g z=y`S)IEg>(HlDFnYxVU;qi4D&i`3^yQMY({mjS94ytO2F(4gH;*79RHlV9f^CmCB+IM9XCu6p*) zxAuCIQeo(MF;NQeat4u}qC>zQ1E0R__--=o>Z{ua2GY(#_%XGV^rq8Az?r;95I7W= z3k5d61yPBYsK@zD5`RaiQVL6fjLp}p0+9_hex5-+!0T9B*TBI!00qMXeSn5#1c`%@ zczA!tBC5N=7La=mSIJV&2EA_(5coZzAPQ3rX;^4jO1^?R@>dzEL<*$KIR{2MgHig% ze-+w@+L%h$Fl3z^UrezDjQ8F(+*<_v)SxHR!;2&kx;0>p@8MDiIztw&n|>X$V_y*j zjJL;PvFMwR8E6CI2u>oy824Ag$QCtzg!tzR+Xvn! z0A*uX!dz;Wzb>^XIZyWulL_f|AQ6;=LsrUkgdRg1OrWb@NUS~I&zGNH8fJXWx7wd& zJU|CB0xrR}RZ*u*YehhDNlAKKlttrpa% z|NKRL@D9eR@B@99auII!)8x*_NAh_)ciNT|*wN{tS@dG9Yu~w!Mn4zCKIuBcyw>rC z{!>+wj(U9~0j$W?lli83Ec=C zA!x(*2EoB&M4-r}e=dunpE%OcjXx|q*?cihxM#WMt#GzPb3G}P2ts|iAMu1k%SQ)g zTydk=)hJTg!eLRfe^Z-(6q!Dv3=_SWzj_s8LH?2qvm(*Q2Sj@G><}x>_f>7NL)hcG zHd)gfLd@L79Fr5Qx~XOMX;I=Er&O8KphSB6!DJgH%`z*QnG3i2y$;Eu-RPJvtuHY9 z`J2F6MUb>5-`B>j-mT1Y-*wiR-4NNQ=trN^NJR4|nP*qfl14z6=RI52f%n==Me##@ z7w76zDI-Uw9c^o+&b4MFv>>)xVLO#oSz+g6Nx!Z(P636B zML0d<5o0uMnJ}fyQc@4$;ts7Gi^CsZhi^P5Pqx%7f~g{!6jiBiwCWGGz^0;&>z;PA zOZqLPEhNTZ%RkLM$wIn>-@?I03^B>60`=_OdMXeB!}@A&Y|SlBa2mCCEmz=u z2P{VfUnT=>teJw5eNqmw+FwE6xH7;(2m_wB|I~Egw-o-2#10_ph#LY>k4ZTeE=%$REXG|?@F_{&NiF*mB^FF5i$D)H+h*xr1` z@AYfn0&IUySpSy$`>`Y;$eiv_?`qNH1{VYpMiG)wKC9!cZ~@yy#r$zN2OcGQ%t3ZH z`Nw!8wN<=P9|&oCB6{E0 zeC4KvmdB1(BwG@hYzUqV&7tb498`f!Hmz2bfScSUZ{C#`|!( zy$i=|cX@+qh>+WK;e_`lbX}S15!7vcqdG8|n}=h^iC-r$GHYkE6b0=Sq%qS)6<^{v zW5Uq4VAgU*{dM4~3Q0|z#2@Q_Wa061NogtE%j4!&iU(V{0$)pf-lmfctSLQ9+IY{Jhu<}=vmDjP6!?!_2YrpP;EG8-xbV{BB zr-Zm=28BvLxv{8-l8#uSxgZv)ntCMMndktO^(%`ARYb{`@U4%7Up+G}-<|dnq*7t} ze9Dlkk>NF{*6~iA$O!`%>|`{GB*AXR1i-J(q?8gy8^HC&;cq2!TF?e8dLH@N&^ZP!@j^oKTuDEYV~@U<(D#9LJ)4IhAtw6W zo9U-~N~Ay}D_o%KKg?FKUW6PCvV-{xm|b@gjs^OoviJKDuBn1O5FO}$HDCACoH~nf3x!3{e1{h zK&dKv{TO)=|EMnvRD&6aR)AS^iJH1eAYHfp;YrAYONFr;bu%RLSP#bWz&iLEvQF^z zNb!)+yM{yy)=1~PZeC?iiP~}>7dhTA84+2JULUPQFODF|4TT=sfC)W)+G+FK2uwgO z?d#i&^|hDAeW#E;i_u7+jRhQLv(1ZVFz-sTXNx=eg4{^||7Ik^jyUKw?NG?FFK8iv z#t4rZdIkKWWR?vGzV-jVO0-r5`HpkzBqvKk;SBT%9=1cJFdnumr~_@Hu^)OM5}X6c zhb^i#Gyzx^<94U|j98lVe^$qqF@`qV3*f7euvc*MR@!OXq)xoXwz{_g)Z1`yfmZ^I zmB~aX5E>{IKw7sDdqUGKvcgIv-D?P~4j37lh)w(IpCe(QXiyqt0-3$9&|OH)(ih=k zbA!bP1K^uD_AvhQl+0TW(8!5=vGv^@zz@;=1Tt43keO1iglb>ZyYjrul|4bE0=ur> z>c*emxm}-Dl3}Ew0K$eE;dqB;k1q!|tz?_gO^xW8@k(u3xW22!te8uVl%)}`)4uM2 z9tro&2&#Jhdt4vb9mDf*&rSTnbn6+l{5uczx~?MckZe~V#UBf5OIr+n!fRDwzc7Sy zsgsAg+-Kw#XVF4@-x$Qgi{5ewYT3(QkVZPDw1_XXcg`#*QnVJ1aFjlfW4?pMu033} z*G)EwZKJ@vt`>sV*c`z978aH%~%bK{GmH{uCA&8ljZWu zsy(X`iR8`ab_&k7DqO$i=x!OnR9hv<#2IFjl-Igmm#QIdJB@V$^qDl1CArgbQna*b ztghB5uj0LXYn3BFu2VqWzI=vfWYy@;Qz2VPn3Luni2e_e(EigR{;BUl(aYQT%A3Q`6%Lx{%d)U_~ z_KJ>P8gtmA0FwnBhAHFwhT~14??Kz^c$`8hIGVsj8yx(NwImx=v}2_PW^`BJ1w$w5 zI!VFs{Oy&|e2Y%%d&t7|zY95KVdkMB9>=qny;h0{|4x#;9B+P;VB zMrH8NnJ+Duu5|_8gqcJrV7AoeB3rcBJhXn$rk39EdZmfu$>8G3`W(|v+^a!VO>do@ zQ_8#Et${aVYPv1|aqHi^IS#dN@aD(mQ%5>=tUnw%uC5^F)hp6= zbZ*sHt5g^h1FTM<0G3HtMU>}$ojib|@(5$Pv_%@3UKi(}dm4*}m+eyRLeTL7t3|{t z{(7>^;epN2e83q%%1$9@j8CXu*z^M@vf?TgJ(4H46C!8V;BujW*;eufwH?m87CpVf0(1Okm4LV0RFx7G zoJ{}Mg{6N_8TfKL^6pHRlRB^gQjBKyi7Bk0lP-n%ABVn;RMF16bzU+^0FJ&M!`wQs zsJ)g1Do#Zw>IgY;DZy14i%O%7!A?~i6Yqy}yxzDmpiU&$eS>vS4UsyOo1V zW((yc*fRM(t84w4oenUFN%I-5_s))RVr$}HW{!C$_>;FEi%$B%7X%jJs%f>gDL#CK z7KxY9JHkO6*S=@JTMKxImuW>^g$=MZ@L!@OBY-)lAV{E+{V;1MNvy+jkbZjJcJL!7 zasRl$`*2wWMX<#xD;x0 zNf&+8u^Z_P&IN|f{3$5qnRAkmj*8bZTM+lnotrvhFI^EaAv@z`$gV?H)AEJ|$M+3= zl{GamPyf!ZFCvY(G|?n2n>Ud0o1w^lz9peSW+)2%@8)!LR0-a zD>Z!Efnq7`^R$g`?6*C&Gf{Tm{zHr<)F+u^mUo0Q)dI*1Atenu^r*y)WTG#ZvSR@r zA$Oc_7z?-4{<>&oY@$Gg4q@LkzeZpK9<(qe0UmA4996Ki*=6@TjKGlzdi2Z8=JU7qIW4_mmF^G5&~4rKX9)&}jOU5j6!;oEot6)0HYk>g(R zEACqm(fi&`K?xdGP^@p(#1>ZGbqszi1(9Z?c;V3`=N*4QBkevcOvr7CF2#bJe?$5w zGG6!gyNiPMYC|yci6gb-RVfr^eW&UkCnwoJhFt&uiwXcxhs%Rd0$IsNQWCU?OA`gf zXn6%u5!B_T)3vin;I_;y>6u0Dz@W8r;bwC~HHy~Btg0x#Hs$d9no0QZC|aWJNM?V~ z&svpQUxVtiq0y@s+T8&?dq0Ad>aFKBK;LD6kHGs zWU3dBO1gIga;ERl0L;y7KTA#oNf%;~GI1B{ILH91i+NiDnJE7!SVEsal&_fm8QFt z-Ic3m_k1I8_ZI>cS}q)~_2kd^`0izk1A@C~#$eQyr*bn)dtipDRLVMI79Kn$WUPtt zg>xUf9pZw967hw85E-fk{HE-Ba!^__&K>Gi@JiCXa=Dko1LO>3H@-!moc+u1S+1#Q z!5)&4?l(-@rlCXTSxU(`_;1vp_YJuJ=&!3`P8ds-uy6W?_~@`!32aYG6gKSWrlY>7_f zX&RC4Z6WsLF?R(hLh-v>-oUtE-7SY;9nnNf=S@MJem3CH8sJbAVyS((_2z-ystG#l zqaPIJx%xm#5crY3a8W2b;koxb?GZwB8D>Llqy}{o~K0-S&GJ+6Zs}gt&jSyLB^Ie zJ2G0cfa9%MOZ(SfNwE2`nei1Ni%>-HOCu>XqQLQk52WsXF!v&& z3s%M&g^0x&QOvS+Au}|~>8?LSMBDN4jnQkSrqDj*=>^gzD@;i+bYtSz4`MVts#uKR zD^@Lw=DUD6txof&=8Sk!tWiTss`kW~Ix%FZtW4Ci;UBa+C2DvvGVu|lX*ILqiyN9) zWNSXpxEPSl6TtJGsGuG!{ar6MUFtCXuK8F4S0xbAAw7QlPG(j(MuUXBk=+P$ZyPt? zrHct<7Os>@iO@|iVj*37bzuedc?N!}4E{3T1&STS>0xmUK{v9rnO_ZAMLo0}n#L?e zvn=JE4Kb2ZlFiXbC1UZI9qdruIO+xeJTe{-$UxXN z@mJcm(?Sft^0Wl^Fok|oh-++&$2k7G;iG|32^6w|(flFZ0z#&&r7vJI3~zcp78#Eg zodsjr?@K5)EQ|0+wV2)pq`3V|9k2<3u|`sRJbi_2B@07{V`>h_#-!SG7Bv;Wr>9u~ z;SFVEXtQe4_Ob;DNo%|={z)hua(Zi+X^tjNULBw}xuuHU9$W^iL;vE*CmSC_zQry;|p?jaLq*~2Bv!`MFYn6uaQ~9!r zhJ6w9m9F7t31||+mLsEt)hdbY6rJyf00tzbLPEr#8i+z(o=(uKBaA6+Raj_78!w)? zQxx_Uc6zmDT2gXUjTEtRNQSFUE{Sq*0Ziw8I+x(s32h46Uyu0+HhHNS)_4Zp8fN?( z!9U}o7;ZZ0MjI^{+it*PmO9_eE6%Btn9{R3dhI~p<`Zb64m1S>ApaCjmuCi8WXxE` zr^AO=;o)<7sAHgM(}gd?#Ry#`=2Pbt~DBg#;8jS=7+512)C_^b;x+r0-dg zB7>#$kng2O04Z4vX)C}sJt8R;paZ9f57NF7#wQ-%-VM;l?YqSQqZmyJnFrqF)+UyZ zt_Jj7)j)D!y#6A z1vQ*W=`M z%$Sd~>-y!xUfB(`fVEqwy_Lf1u6>n1A$2d6>T*xlX+ubttdC_}QlK@{JK^Dpo9aTt zJV*Y9E;;t(dvs3=Y`=g>Nbbsv+4NWAT3gZYZeN@>>#8XpwOt!l7nBL)d3NVGT|VEJ z59%)SZs(;0BikN*uuM;IYj!01m9TOJIUUZT(d-hzJ_bRylH8P4HqFuOV!;k_iDA$u zL8fc$=X9;gO%au~A%dJ4$){*`NnyWfMOaDZ$kh^tX?7`N2Pp+I=rbX+mGzua%@KP_ zuBFCi5L@ysrPkzdE*n%ZO#X>(O|Xz1x-vd1SehyByl9EHvBb9Mf5On^t;cb_?nz~| z3q9g#DYnka_nNRhVm6nXY_qKm6}CdrSg{)_q-l>4<@88h9bEY1XX3qDZ|PPllv03A zHhbdO1-D~er|u?`cDLrdU@Kqi*$H*tA)lNhp~}Ino0$n~cHN6&F<5B1BGy5hxj5$Uz*^CzQ#KKpS%63G{F!mi;c8%bM z+98Q5qM2yHS%8&rP~5i~n3b?#PW6>4D^1=}`7bq-Rgs<#r0ags#LRCJ66uzYOiQCE&%9EeGc^4W3}MvA z$%9r7vFyi~py*7|WEU9|4sJ=WQhYYK$vW_3r4IDhQo=%pMU-`zsbk2&eUON3dBi2c zqcvM+SyRCQ*kiM#&SBMAVS-8{6NXj$iyQoC0ftSehn?`oo&+Iqm@Yc9(^Dmjx)G)A zJBa`t3=v_6MBp}^v;rO&ELwAt2}S3y;#e!X*}P*(eNjc&dg{TRPz1KD6k57su!fIV znY_Ff|I5zshv9_2JEGSI3*ff+g?ubRf*mT2r~{kw*D^v{Kqgqab80y++qcIL?k8sPpQ2}q~L)&l(x@fb|#Lvc^Y% z0a);EBTNOsqI$sg-wF_&0ajl?v=zMl2Ncr1dRRmkOlf5WOvG?ld0=J`ccY5P!&V*F z3BKUcK&L}G&e{>{6?T=08?u$sUo8K$6^+>%Z^^` ziOY@sQS$`%;RKB*iRb0yDcJw~>ip>oQQ|HicQz3e_vAw`k#n&BQQ!Ha>WF{cpWj=# zk8?k`w{f(l*`5_IX0f}=hXt>#qfc(rUUsOi;Y=SN`3+S^_xFUi&9)C=ZZ|DAL(VJo3%w>Ichd|z6+<){*YT*rqU3oU`eUWe5eE%}N zxe@jl9k4;Mh012^=fB?gIXCf&uk=ii*7ZtO&Ka)e8S(7}T{r12@>PBc+#^!dXu=hU zT+a;NKIP~#Nkr)nfgf$RJ4gUd{8E?V;$ar~nGiK+@I0M&D)5mDbs5y{F=mg)A7Zyz z8d6M1BS_{btSorZfP_Y0x2=)^Y7Mu)L`1geWpo+y|ATrq$<#)9wKzql_-7J6yl*IE zSTSy9>EQ9b9$)!*2k&l+Tz-o3?c3z5+6S`+CqDxSnWi9;(XNP-^Lyy4r!cc~vu4BW z!;7$D7IxEaLVT9!IETVcb5s86L0BX#MhEN^{J1|RDp9D7Z_g&ZN!^W*9{+H0e|iz< zHhC0ZI`+Id9IdaF!|l?$>GxAY3GE3&>DqgO5}kaY)4OqAa=iczT)Hjc!QMdM*f&#U z-YDOD*}cAB-88LjtGtjs>#G}A-Z)+~sc}p2qHJSEmtriSs|~M?H!9DGl#^?A-7rj^ zL6oaNNl;pfS^#r=`%T-0U*Ho{|EwizZuYnnNT};u`qS;%t}&}8GzmmX9SYaKbnnZ6 zXzm_xnsdM@ER()v!=!b*vSFpVD3{~3d4pwzkP9Zj8lpF2uasKrY@mOG*8l8ymlSpt zKiM4#3c>^QP;_DW`|BT1*N=iUTZg1^4>em3L@hd_)|7>e|hE&9u#y<|VY^nyWhV4jttBwY~#YSn@PnWLh-DbO9lWJ$bQ1#f*|2b{(9&U6X z<~E%|#}qE?B(8CTxDGUi5ewiyHj(=+mkm#Fb$`zVwQHn`-`p2P-VSjP4t`V`DR#P^JMoSEvOPZ z#TX$zcJbR7PEMt``d848bK;K6rmK(xtNC@ChVKbf@ccVw$*KBu=d>7OgyH;}qiXLb zrMDE`O$cA}gmJa~=F6S#NgDa2Y|zH<3=u|i#{u)0#=T2iKlb-5*C(-Y;(6Rx89o<5 zG|hY8X{W=}^BQ-GB3Hh57CS(5zR}q)!r}WB74D|>?~i+iUW9AnD1QoDsbpFkds5)n zr5xJZ=Xb47`ow_)d)B7t?mdA+W4mzBo%Nfjp;0|4`+*H<8v+m{bRH6rNPXF?aCR_# zpZ6W%3C14XE%u8Xn6sXlQcO_PuH!!XsU z?j~Fmx2p@l0pl{ys*AsPDo z{feIqIA|& zUVC`a@67IZ{(yIT-Y<1(4IB*dim8=-LO`YNMB92Q{7!PeiP?1_BW^i%hgW~-qS9&u z?I({=a|tmxf9)SQScT*8Ma^&S^gK~@N*MdmmY;;Sfx!A+DJ>@KK%WkW7Q?0t(X~mA zi+Jw8D5C|j+6ofzuE%Jn087Ex`&cIe;F6C8V8>>>P_C@DDm73DThEA zMRVtBAim~Onq7PqRp5O2Zs3VkV^JkYZ`&#wb9A>}V`|Km9!ArRLnm!+OzG69+A%F5 z`*t&K`nz<7)^WeS!L=_erFyGrS55R(F@iKgFcy$Y`$Z_8q!N}IrRHa(t}XC>7| z9(z0&SkDbt!jNlCqF;E*6K)Q0YSSmLaQaIX&WE2+O#^J zGs^>uK%0&|SwNFP^M}rRYc3Y+-%Dd>`o7g47b58xft?VkH8%_5d>zQ*>z9gvufu(S3u45GW}S|J`^;}KY$k@M016HtF|`@w_2;D1*(%10INi+hO--iVYQIAMGqxP+%RZ zcWnEYA;;ST|F#xqAQb5jrh8Aj2{qJ!`6W==f*9*=okVDRA+v)F<7y7`=5!oD9uvh_1b%43-_IKx55@ps|t{}?F7Hs!SlvTf!_z-z} z$pYApy!Q_3z#fAI*kinQr5EL)F3HJ;r9Ynp3?D4 zGo0))V8`Jy#ST))5@om00Sot9J>;df?Y*&;3;Oc1-xy?3!>c?7@2y#{8Be{B&z|-b z*nQ|7>10wz7&A_P$Xq^&@|H#)kIk2q!E{E>j8gM`mS2q5FWjbxY@-~* z>62gpdzL1Pv$sI->s%aVYz!#I9$zy8BJLU&BDpa!mcy)wp;lLu#6Z;O9De~>CXHW z4mJ=^831@RyD}+(y^U;RLCNcM6j6GCsrpxnR|<(vc`SvICL#meml}8o5!hBCiELoAMYLK0A1~*70u( zdi+_$zKkX9Uim-J&f-64XYvF_Kr=pWUs@AUO!~*wu4s0`RRaIZ)t}CV z0cdAdSz486eP$LNuA0#1a0#FDeKOf8|50LQ`X^A1j}W_Ybc(rQn9N*`i?;mSA-*Cn zJ3d?cV1roYt<$MT>ir{iS{ z2-Pc(WPcYO2N>Itd(G5!rgvE6&^^G$eGMTugvWGz5d(l7 z_v@Z-*g4KeiFvKSUuJW)$+nhPKm5&&KeJ$k+Z3^ZqNUCi#?Pddh&E7G>gTTeBOpH6wWtC;7Vy04lMh^ zhhrDa(mrFelf4)XRr?jr1SGX=^FA#Ft7u7JAjBFA|q!7jC}ISmv&LEuEp20kYTDo zC&Lm=dIfq~r{>V^iU_OlG6Aq1uq5P(M%rYkGIZvMJN>dEU))*09I&1`J0cjXo#xg`IGf*(v#S9}Q>Ag)JS%*D!gKcqb z&x-tm7ZLEXS_BsD2sadwELcC<5zsIOfFS>s<_Tp-M%4k-LCfO=c8Rf+1VKh5Swt9D z;j!aD0$w;Bp{S4_9gt_U;D!I!o);d_M;J`K6bqJz(q@8J0op^3+j;_CQ4R*bc~AXS ze@!lcg0o;9QWsX?ZXBhH(YU>~Ka|Q=Lvl2$&TGp9oa!Kuv3StuP>u#N7686ifU6o9 zIww6Z#sXwOUfpag%{c4lbm~DJ@WRcc99=H-eInBe=n!UFyr~&%z>zqI!7I)2k47#} zs)#U-wVc*dKbFNbp^ev92T-Xx5U^Z>2Lfb!=w1y2=mcOOs+qB{Y|7CbqTiiF{@LLq z0=A=<`56KL%N8&*tr38M0d{l-B?ESlPO=200{`>#--f-~Ax~cZY8PCh8sMYl(x?;X z0KOV?bm&_?KyNsJ!T*~mEddR{&UXL^|8E@YF#xJ&;>CVv_ithuIsSbyz*-KryOr~c zVif~;C4c=I+#SGQBbfzbGa$`V!k+a81ZaaDCnEee?bzACsDS`DNx7Lbq$I$vqA z(_jfwPwA;fo&8iii#`AA!q%`h8=GxbO7&|7Fc{Bv`0BAiGOF+M$W1f;!SNtc>*)$6z`dQAs=Pn(m{7kXnSDaFdKW~a7#V;UXpa)^J%}L4C93@=7|Yw%>b-;#3hnH> z=c-O^VymCtN~k>Zz43X(_T^+KIs!kL=f1+{6Iz-d<;f_aur=&L7oeL|(Tj?{m)wIO zlg(s<di**r>AdK7>;OP(g`9`UFezi88glFvvh*1 z7_QLX+P?HB#-50;@qev4-sEX1x<^$KI7oF#XDc~at&jf|Rmaz|GmW`6_+B@ip)IER z@@X)24JAd0F>4=IrwKRXKe4mjXj9qf!x_1CbIHcA2h6%VS5e!yigNrfbf>yvOFj;w znc9xaoap+V_8(@>q6lW9jTdnGPh=iYFK>Z!EugmzzyqGsIE&_tIKgHy$N&b5r8^KV z-QEiXgYxQMnNeu2WD9JT60~6Eus1BrU4cLnsO%q;0L`9noy`(}1psD7y*ITMI(&{a z+p`h?ZYwSyMB*iHX|pd*0zSrbMnPk&6?3wnEg6g-cl0;WZlG82o#u!;3s(af0rR8q zAIdQbS2keqb$*jy_q$!aQ$VWuED#R?x|i^8bCONw__M%CEDr9;g|F7Nge3<&VmR}E zD|$UAT*K9F2*L3X&{R^?p~dNI$-xu=+yYH`>MO10Jk%#s^fiqKE4>)O@enX-x{jKD zgr(oB*68)eZTP7eBkwzMBmp=Uu;l=`lJzqH%X|KVmsVW5;Qt6W!7hU+qS+ujWfwr%MwO zD-Q~Qc}J|6fV(DE?)yjKWBw`UCsyA6M?ql%m^`ua**|I<1Hj~om9PF$1sDJ(-{q1I zGxvqlP_h_i?+a({KTrMq&r^3z50d}5xA&v75>YKk&#GF>T)*@Ma-bilNnzyySla~x zS_Xi_*`0)QeG}qzg=7H0evtkZm4A;21Y#fO17LtBxyz*o3W$*v*^PvO;EsvtYXA^= z^05ny0wJ5vQ2;U!kL6nQhXUcFA+Iqs5OBI%wkHAc=lx6q9iXL4b~d95jH$=2_JVtm zI0azk>*7K;0222pfaLq9g$QsF8->760*EGMhZsHq%|DLAfD@jEl832I;O<>yf$nR` zTx5X|mkPffoJL&~J}(4g_%Vw!ukEbC?ZiYI0UZ1O>b(vS=6;+;V*rBCE`C)sF!awZ z23EpER1lI0^bQpfUL>i^qPq+3bahDD#Q!bE z@HZ3BEO14_j=&1Ie&h7!qJyIFx&x-BT(xQnF>S!NgYzFNoN+$2D=kM=99f%gG-jIL!WhAO2*5 z`^b6e{&>Rv7u6q@J>5Usw8Ky!jMION>H1!?b6OiE#%tt!{3Ui12M+%?d^hR~-+}!2 z4-(}rRA?kIJc43UQ?2EV`;WcKHzE6xicvX?I;TM>{i zG|jmIe`EfzJZ3rVeOB;PF_t8KI(S)y;P|Y%E-e9d%G~`zrzsYn@)v0}iAkp1>DhMI z?`};(Lxv>mK(8!$gJy3d6EeI5an0}-0WZbK^8^Vxamo|cCBg26d+L22A}-9CyWi5} zMfB9?+bhvu$yfc`81^YJNacpmhU$nRo|^G9~?-Kbcdanc8+&?kCoZjo?SALoj(rP z@8t#IKo~@Ff5Ehu*nZK8t){23Ckd$e!vnuM7jzbE_=iUtiRfV#_C`?fkJ|*5i*pNsGX}xc|WSTMa+NvSVXb%bwaknSUp^U!21}cG&K-M6MZx>9!9IX0$B< z&^uk@N`C!XjcElEmyn>4qt8qT58g-dUME4yfQ8M2E;|(C=LU2DdJiIcZdv+B;QdBO73r}nJlE$3>=l z^WznTj-PVwpFqEDA;XsEeIX_62d7Ro8E~~J z9jzsBliIhNfm?FDUQTdgR?gizuy&*mr}}o@h4w~%ff)&tBcZ4mD7lqv&(*_3SfE?3 zkJ3&%M3ja;gMxg5iU>@aNI57Mbr2O${+Sm&j;g0AAY#98t4fm81p!D*n02a8hlnkN z9>G0n-_H|vH|Y@aPdoN*(m${6Byw*GK(|CgCc$@eb?09&T#^*{TutK$Mr!ogWIcyG zILV>0-aY?W=|*WSL?UGC+klB3xiFvVNA$DyvqI59SXI2oNKAW_bO>ud7vg!zfFs>| zFBsI-IeS+u^64Erp`QdOMKklZdbBY|pK-o{^&9m5ZL&hWH zayx{2VA-ZdRHt{Xj5_%=OrtRrgpGk)_ort)S9l?ug`E0P)vXhHKEXGVnpeAvDy4yU zh%WPsNqtLMnq;JJxHR7;@!LaD)9u&euOCd!1GghNiJN5=UgReADQ5O}HlZ7t_}__p z+94oEw4%LV?cvQmy|n+s(Kec0lAvv+js(Ji#n;=y^{4s$*6!OBrro@cibrBEa#rxh zVuv7&Ps)_bg(1QQM?f#X=kw-olc~6XQ9m9=BwU6w)G6DSO=KrG;k3@XSuYPzH$uLI z%Z2L|(;{bPYLWpPsv%vqlR%|5aN2Ua<9|+DZX>eWYGqmaebe&^{2S^@F&h(gJ~-eG zh&W!BYwKtRN7Xh;$>SJ?FfrX-4yZ$Y!>O@W6ZMv}*RmKMEHKzdzV;o6|2dU78Q}7? zi|_f}YI^Yu^8Cg4=F`t%*}sDCd~tQGPZzJ=uV~k0`aU#i_)EqF?u%F-hMrQ0aC}S4 z|NVt;@N?WC6#3;5!!t~)XOH1qZbZ^I0ob{dY@6Dje==OyXMA*5Gc({B{yeCARvEQA z*(Qn5gTft$gj!;Oo`ln#yPkpBtF7&n3-@6Vf_i*I7Bl|mX6J4k1XlvyB`(Wb9OxFM z_{;c4df%_;0<J zt{ZxonCn2R1n?*v+)J3f=2NU}KBJ1kr5DbHf1KCH$oF!LF7yI-7~aL-`){he$+aLR z?m$eBXqXh@bN3h67eenr72^yN{OR)kVq)pQnXlEi*Ox#9;sZBxuk@Ft+(67FNNUXI z04W6s^vk2%y%Q!3|zh6dw5or^Ng3W|AURh%=|cGsG$qOU+XE{qzbo zoDSNzkT^8rw?rgQW-r#Q0(TujwdmU*NNM4rBJ8`Mpl&`Kh8^MwToL|Wb=m@It{xHu zI>hsBBA4a6?jE67Pg3(Qy|{k~kP^BT_ZzzQtb%qdkWQOYD}4uhjvE|~=C!%K550cB z%eNzp0l#}Yz7-tyaWv*t$hgNl`pbM8zO!rW;1n@FG;oMJWo!Rq5$P(dq7;PxTSKyq z8{2k?KZ+4An>*gVYlw@1_S5%&8V^J+v!;LZMVdEw`yF~Ea8J7mr>5mbj*dQjwP%bR zB(A}YN8-!HT)a>3I1|7Rd9t*HdN?ruiyz$ z$iMQcw8^ed5k_fXqM|d_FMtNcXrlWBp=Mjh`+{deG3ON`SqG~c+UT{okM9s&vWEL+pHP@9po%38T#NC$J z{z%+Kvewn0r_frDbL6X-F(j;o_H4d0i%Vk+2^1|J)*;oELyD0~Y!YsUCHoNd!FnJ? z^=&=p4-L%kyOSp4@zn$2(!>Y&`8M-}?ECCMx@yK)s_|15%whl=kN^_x)lu)GUO+%D z4pv)A)S_d@G*T-@Fa|P3Z5k<5VL$>ZzW=L+h0(N%nbfD(MAQu_qwcbv02i!vNYz?D zd8pBND{Ma+u=^jxh`^u(W5cbNy`nm5a*792D&)Hz??1-n za_*14+z2{AY9oD%qxV>j`&WR%WAJYMV@c`idfM^0*aKC-^gU&Rodv+b#Pi zcoMCKP8;Rv94i;fJ%x%t_rua3AKE=!EcKlxM;0wZ*RFJICV|Tl-z zOF>S`seX;NrhVlE%M44KJ{#sIEBq*gta#ai;+VZzs^ z9%o8fnpIso6tVOz?c+DZrp48#%&tv7zeVoyi;5+XcvIiBF!`?ro-|McZ|Tr@ogN!b z(T&9Z-0tLK+k=sJR&d0`*ja}kOUFlkK}cnpIECic+-%`YT6)@?@!2D3mm3b#ywn5E z`CTe)V>7G1j2-y9-Q+o&-d`9KT-yd)2Ih#* z(KMpctci6i{lcAY3gz)*c;fZV+!M5pouuyb{f@OlgtPh-aVCQ~nf&WmKQOA_4RHoF z9pA${KGLBLHEaGz@{q=?7{<^GDgUQGS(*oUTShr`E81%k7ZQhFJYY-IhutOa0VQNaW*W zeZD?cRwU=P3`B5ueI=_nzj+)qE>Na}KZ7EQY}l^;O3oHkUkk;ZPN(dSOBd;k)%spb zV7fhWTMx!AT(e8Gq(I)G28!!XrIMA6WF5W(Kyd%5EG_IGpWnrU<8IuO)`&T~%><=X>Vw4fF*cw(9^e$6dqX3d&NekQf#1KN1u)^|Og zenl2lwNUs~Io=|w$Z@=ykjP^xR~`}NpsKaX9@u>uqf?mFWtDj%-n28pb-&@KTe>$_ zA8Ix8o(6ob|G1cof_gW_g}47&9}pn6g(_57k2L)&LI{+POiE$kv>o_Jz}rjv<2G6H z>LeEwQRMO|IjcF-Mf6~WquBfIcK5{Pqk#4<)1Fuq(xfV3vgm<<*|h19Y3jZeLBQFR zrL|kKzA?6}RaUG~RzomwS6}H83+i?1l|XBLns-U2g=pzl4si^cXGMhx>}lx_H2P?i zHTa#sLlrEnW$t!O+tb0-A}J`GO%^rTlGdlpYU@q^Q#ET;`tZJ_7FMD&KdGhuvo22J z&dgiirZq_W!#7B26me2TGl~Sh~=I= zF-}x2bIk~y`Kqh!1$6{bR=Bo+2qG4 z`y50hmkYKg+S%R>dGMG5+jC*6j!fF<@>FV=j)$1Fqy=S^H)2lqi7PXt$^>Q4 zQ%An~N0EPI-nJy4w)bdUJKu{Q+_{DXv#$1}*=HrX3v1+`g86l%@Q|mLrXD zIGC`U*h_-gWiy!=SU7V%x0>>-b+LD7!=f0gSgeQIIY~c1Y$W!xFKqWeMLkdCG{lm$ zDXsjE0po68dPSbu6-+ghyvw?LaS9@1JZ|>J;m$m6K^jyzD^F>=Zv9 zm%$$O$!Ii=u*qo7fu4K@LKm7mI%ZDww6~6QIQV+DkVdfwt5l{Vl%L}VR&0pe&ls-B z17{Em9J2DP;#?=vme$*1Y=<9C0kY{dDARR$2)K&c<MJngn9X}mYp-gfMmQ8 z!B6qHhr83JQsB~)T9;kfYc_;yZ)pB42XQ{JjL@0B>;u1eicg}}7}rvwq>sVdD$o}++O0A|c=F|bBE*-)IlUNvaTKE00+4E}C1pDb^5_8Sj;)&TmBrR$zJ^_^qVPdw?>~r@_ zWgKZ@d9bZ4ZC0dfF`-n4op;lB>>!69VhdK~=Ob%*g6TLb{%CrXt@Pe#xota>HATiu zY(~Z$!(ECW-LmIM*1uopcj8nRHCYI+Nf`&giTe*(*Y>7dDR>1MZ0W&>DmCAhM`P;) zYxPS~KW!l~N|%FFV5vy^Jq!N)ihy8+j7xlU0vTdPfp2v^sSee)B< zB?0+c-uB3@lHOuAb)uV@6{8Ft@ptA9=;N*w-e1H^XQbI|N`6Gk*=Do1hL*JZM~qT; z^t;Z9y#3Nk!J*D;$3!sY>b5Nz>D;F!6*@|(+X&4oU(MRW*4nq<9^~tvGrn;Sy7u7| z+;`<8HRMY|NxDF8!j11O=5ie#=DlvYJ|Ry)NxRVF$m49KEj5N+=`t05yB?KaxGzqi zm#?Y|6i=yGS32pcGeT@(H#TEBwne~dS%<^9Q2X){=`8~nt!qVq7JTeUOSR-IcsPhh zQU=XmkXorxF@>jh=zQ8~%ZZ9jtb8Q!Ry^!*vm)18a#o$lgPGuGpq**i)>Ln?P!p1x z<&j*|{OM+2p0#AXljPXb9pXYTQ>kUMC$4m1h7tqSG@c%VTAOJEw|cu#M6m{NU!C4Z z7u!;uX=k{G3cliCI5v*M(^weLZG9mjo{a@rM;H;ipXRYaW#M>J=v z#joWCv8V=(<)C&e>*8Kl)y14m0?gie-5~9})@#;Qy9%rHrYcj=Vfi>h@MsAw_U+GX zc{qlxd5`!ny~V1z=k}-iD!;z&emhY(KKVF(eDZuEGV=cX!7+!@>asnUuC#^jYHkLq-+f`tgSgx>e$(r(~9eZ3XMR8Oj zw@TJ7EROvA`|MphoT3Dsac*;mrMcflmA|-%fwGd8ktc%R9p)$lcEPFJwJ7Kz*%;5ZmcxUp-;;Y%%~+}Zq4emv5e_AT@#^qjTrYEzDr zOBp&fxU!J;2keSy=S#Ye6ZD)3sa`c&FMlnBN4{;_+GQ>D-}d~ z%&z*MmS`=sN8ps5$mz<_%QEJAVbm5=T%6smIJ1~;aezXx$7UI*pwW%tUP$0=dZFPN$t?f%5}UzkwxlLK8Y zJr?35tSTA8;T8?&sY)Bet;9+vHvd*4u>D#X2I}z0QJ9>!4%eA9?agoER~^d?S<;B1 zVE25qtU9Rp^sU!SOMRCPYCaUcES-m?_3d#xl--jXF;Shn5V{~nHg3MT*?Bre;ZLE`n>jucWrPXHcgiJ##htnDJ6by#9B)tfl`t(1t7;_k9GZkum;V|&WUB~3RU1(pK$UMXx;NItXkyB3#%3=Xt~wXB zvbi^oJ%6C_`M)Y_s><-xy>oDr9KB#-j<6K~ZjS)s>35oz2F{YQXSMw+2?x-KB25wF zL<}8le0<6xG*28@ zxZh;Qf;-T{EkTP5OGS-WV9=f=Vp!^qj|Hl18gh-+&HrKtic{Vj>f15{oxD7`TD`5L zfNU?^yIm}9SSX`>R}nKaJ@fZ&5qpLi+Rzq(kfF&?sLA+UvcWKc6}jqJI?vPgTwS>i zP>k}SmOOkB7#E3D$gFvri|6uBsd^>bL|lg6+#&nkziv{!+gn`AWvgcy9E6h#N8WLpXkc2fQDaR%D!Vz8saY1VGZqTO_|ylQ@S^r`j%Dk z<=w=mRE8vX6jJ;$RDM!%AEST5X(+tjsY<{lr7KRW4A}uD;g_MXypww);S=wi;)1#< zjFrOCH0#Z4g-v7-1G*&R5l3VUz3lvgU}5ob%i4MU1Gun;RUmpH#fjinO+lgdm38XX zNbxlPO1l(FVbbE&?_c}_I8KLR{`E$zHAvrNVhnivy)^fZF!$A-*KSnV6z4>q)_Tj& zjzhU$>uZRqES>rMO@+)_%$Uoe6ssJxy58ArbPu6+v@?VgkKhZ`p|9cNKG&x(K`9vw zRKCc^XD0gcq(E;CRHlTeP4B-5;u6(pCs%brKv4)NO)l6%nF!E~x6949UypphZDy73 z?SRtxtAk5Ph)QWk#1-zKcUGFq4bHre?gyowr6|4ZJ02^ua6NnWi$0U&pPem^iJb4^ z;7nK2t-MhS_nyB0KdNR(%KkNn0!nGJovIngaHPI-Z@lq8(<5Nz*XQsM&{=r-pE{cK zI+S_fY8m+wSet-#8~&Y5-+YJbxqd%{9sDb(340*&uU-Z%%4q&!ajhSfY~2j+d-udT|y$^NcqFZZ44 zh01T$F>p+GIfOPW-{=c=7uSw--9$#RNgIYGWj-{i1i53&Yo06&*k0yqfT;0XDkia~ zeWsn#x!VYSy4zvto=8qxKMOn*tcq`2IRyX8xd^eZT#D7GIGHeJ;^Px!B>$CS{sLss z_@whyAYK%ltp}I)Je_WxZYP{WC2Ci!;=iV_-IvLGyL8;cxnB!+}Su=`**Lk6%%oNH?3~|ERQ=s!9X`I^!}k+yzS)b z=w<6^b|vxm^0Z&XaR`y_<0|N-Rw6ECwGBoPbKDqum`(0`r>@`Tsh5YJi`wJ!pN?u0 zLtDX>)t`R9T}-Yold`LaO<#tdf~!lD;3rXXCu4E@*nYb1L@pH9Vm%^GNs8XB+|R1Z4CW_f z=t-33Vn?7rc_+!DO77wf`p`w@pG9JoMN~)0|6`)$n%?YZDA(rn!oAQnT*$SdpL zXdg{TX6WN4;;`KnV|yA?3BVWFH_(jDUi>ug(B-oc;fdCY3oq$ie2C+^70c@XZheJ* z={>K+`FxjSXS31P#?8zE%mB77eZ&ni4gY1BQ&fdND;8yUCd4@H!)OQk%0A9M`Ej`W|o5~(Hj<4R$ z4Nrx)HD<8Q$lc(Qs#=E*OSuYhu_ZRzEPT>!>@v7LY*k&_@nQFFl)@}+vW9jtQ!sEpp7|C4~_r#NqMd8`KxT*WyhH^OeLu4!UN23>hQZ~nJt zqatOa{lDj{k_Ctp>&@V<%(e%u&Z`A-l-<~oKr3n(i$wO!9r&;f)ql>~caTAvZrW(s zrL)?9+cj5(lvgiPVQWriHtW~r=cekp*0+0-^a=Go)L7C)^8F*eWKV!3&F#GhIOZuo z*mv#)Qg!gR7P%A2jK} zGBi6-?TJkhrd@G}4O}yXs0Y0yU0dgdnGnXr_o?XI>r-c8tMR27oUfas7kifZ^}2+q z62n_5nn|Kh`=k}`Td+11U{wu9Tu z2CR6ga9%IwLnQHn(DytSl_t*5-(mOm`FZ&;SFoPW%PSWc@=vDp>|zgYIH;L1f0Lbt z7_LbM7MEcz)p_}Fn#C!4t)S8T5_YRP18Sl3_&6ojOWdF&Olbs_cD;|oQ`9cK;dqaN znMGO|oi;SPcE9pe?MGTVN7i-ov5!K79VrF$ZX?-OKWV42g-p$r^udi)sKZGIb#B>c zxcSq6EB-Rj^s3tgpaksEb)}?vD5;}03bv}Ouy`LF09U)Mksl$8WaNC~%lwu^ZbH1@Y8~<5xEY|qb{UjY(SYaWP zp}x%mTdyxueb5fS`lo!UpQ`7ZHUGc5tpSK$D;Aj_PVcyNE(X@<7?C<|HiF;makcFL z<*)ZfF5WY>vHO%gLigE*!C^S+B!FK_t7FUoD!qIR$DTHYN&vFr!h_vU*W&{xE$&qA zIL4TI?__R%4S#oIPr#))ef!~04FQu2>ntIo+M$QV)x!RITnF4kN9FoEZ}Hu~?d0qy zehQ6#bfZn|3*0xQy+`JHvI1X+8MlD+Nb2DY*Lmk98cUGp8dRq7@vKe{jv6 ziJ(ciNwbRim%w3i8!cYCI1UqrGjlB-IMNpp;5U>Dw;wn!k;nbyT*x&*fDGHOq($In zW}KG|rZ&iR?ud6Ro7Ytx9EuvSOhIK@3K2G~HGFADv$qHhGR8qEm;Ui4`t4#(nm%LP+~~%(ZQFKoW1Ba&ZQHhO+jjDgZFBQH`<}DApY~Hvqo%5>`tlE3j?k&3jI{91)H0kCjWBk4Z81O zdQA_PVgx(0?sES;0Mn4p(}tTfDV^S4#nbL=Q-Qzl`biDKcjT3Sehq_18D}@YPpbu5&FIOP11$&&#s)%VDDNKuefb^HiMgdpSI%T~!o&BteoYVnJghco=^ zbd$wq>j<~lj3Fwfp3atM%ctIns@2ldtzy);qshT;qQkPjC#UNnlg<`rvV@`ovgd9> z^L-;DV>zYe>dFddbA5BW!+4A3sy*2DHR}4J<4QZj3$3}EY5Y3dgalD_T}3N37;mmn8q` zb2ZeTWn(dO+Kq9AnoiTnW30vidF^A*<*VIOo43mm*bR_=X(rR&Kz`XMc=y_!L%iHx z4t2O$aeH{BA_KSd6H@uRElsXu%+r~50xe;zWmmN;Rl2vwoh=GggNeoCv-0hpF{nAf z+1Ieed5 z_V;Pl|#SE2zke3`h@S>zLo_~ zMaMzv-rOsBE55*gxeVq^`apwzx!B;`5b;gazLd?ye3;?gedEVnUYYLE zn7GhAeHD+aJzd~{aS0cvp-<1x#FW&u@lGvHXg5?gU>sTP>8fc!s;m#)o>t71qxDR# z=roi~9SSuxUs&rD9$PW^d_UTY{MHd5H8H)F&oG6D*Qv)ST$;yBkRb&R6J#iLJzg{+ zf#KD1H$3@788M$#6>HEtxO5)K5c$dXB{!20v>O_m3{}3ex;#xiWi*t*oUJTwQAJ{| z$9$}L!N@v9wDG=lsL{r>Vz=dNL8}Fl3>4A$9FZi-ueU1n56bpt{=k(YdH2{0NGx$d z)}w!g;Sf@kYmL9EFvZ%K>ui2zM04GE7E=vOG_~nIc~lC*Q{VZ}U(;)hpi| z*cLNOK5+$s^R(uY-^jw6Xb~5MjXU8(@y#>&#%rWoBjn?l7V$|l!=A3R(XVnvH9@`* zlX>rOIEWpVUS##EL-LJSaNUjEl7*Wc7uCsW75Wps7Zfqgl)F?dk1m#|Y0fAD=4+O$3#v9IPXPROO8o75$do*!DMwF=g1x zD`#)+tga5MF04K-2RG!*rF$l;WXB76xO2hDO{>?$qjLk%1=Fgvr#*!x4_yTtB5~FoPO~ z6e_0BvAchrk^V&9=eHZR`f9m_(^s_*O|<-&7tw}yIw+;PYweG3EW4qZaj&^`a6SSsC+p2) zIY7>RCLT!Zr7j=f8_XCzBbGBjuIIKxy%WCv1csKtY#}s{2SSZ3L;q{H2U7jDAx>z3 z@Jov*82260Rt03`E~I3dX4da@pX~$hc*xX_>#N~4nQt?ghK6x($7< zv+y_dnU@`^Q-b~dgwx8#61~S-j9u|uK4)jX&Oo;$N~groK^t>eyNx1c)vdNn#&UMD ztFHk=Tezj_mzLJHJRBbXUj8teTy(+8noT47Vu=7NwaLhcbh0(C|BE5>=EE|dE^U(1 z-O7>HpR6TXdb;*85+6sMHH+0ge z6E-Wcbt@2i-34q-X2;LfsV0at(hd931SLr}`d?KNiGZseR3>`0lu=6%cd&TYTWB7RS2J;?r zMMk{EM|oV&@1`XSQw68v^vAhABPm-c&ph9j=X*uUsSbLg(PgMkeFv7Zjs-?k^`>ul z-b?;PhZJ}qy}+MmKcKYtReUcynp`tEHkbc$mcH)aYgXCbZ&);i_}pHIJOi_i)UpS7 zzw5#cG+wK`FiCzg>Q-`)yO@5*bX5RkvBv6sf=+q6GPaO5-o8#UFW~yvZ^5u2>==3e z(TR!o7lZo81>%?%f4?gyA>boCC7dY?cRf5f8vH(4u5fQD*XeqzJ6QJfj-bkKTJerV z=)mJuQH!>Icdi1IsY-w7PvATi$10dRDL8{>pu0+9fGLqQnIGpNbxjhE3zN_HS~ngx zF{!{27BJ4YqhfrRWuzK2o%q&4Bvas!RJAUqB2t!KU*26IY1)&}5}Y)Y1)P+i5oF;` zNruN+_WhCJa7;{BM@Qbq(p?-aouSDQwmE+6{%N?MGCpQr zDZ2<{;D27+LM&f@OTe20^owjCz2B2hG&0R($GcWSjYED<5;IRw!Akptk5;Y zvyP3+uQ5EB)7EQZ!95raX?&%#eE4E9{9ZFa6d|P1MD!l%>E$L}jNTL?v;8J8! z;+wxn_cU5MU!O}Ou}pTNL@ZI4ryR$)%7o@)u31ln9!Ut#W|M<`5$2ZExeKm!vxte* zFcZWua!^8+8qbh#cK!7gXkbgrGJ9`}O@w1su4`Y4@rOGDPMDNU36ywG6s38-jPUUX%%#gYKwxgurt=i_F`2%kuU6~Acxs1 zJ>2_bCYtT^UH3pYX5aSK9lW3^;N7R{qtl)~zSB;_cCo{Wcboa(g0gylBxae*0QG=f z1}NRg^0v@Lme~<_DFFx^HRqlW^~5W)LRv^WN}mQrKean&!Naq`H*cM8IPN;6PvHmm zGx5{zu*u=g)c#PW06P<7AdN|l>T)*i$3L@><&Y1?AvEV<;(|NBVX)9}Y3gL4M0GTX z+l*u?{m)JtY=s5I?YO#Q-m+6qg`oqYUdYw+e3!GlrhK<5z&6pQ4kDLaXq{aRO-f-> zCo=E-V9KNZXmp$BgISw_Dt~@SwE?>nCaB%HCuns(!1EkV$`ph?oaY2(JNEGcL}Jri-v&b`kCLX- z%64}b7l+r*vTpMA&dv^AL)3V7Yp3-^)WmV>(e5dEwhi>dLzK>e!;O{p%%}5B7YD>> z@-Hve8s1EBy$<_kw4NVSA5q~N8`XUQxiF=zMt)yj@-z#R8tu{g<1-Jpge{HhjQ_8S^Aw3f{%$`}`&tp!ZpPCRJM8KBRcUtARz;!Sh39dav$J;hFV zJ#DND?h8Gn{jSBj$#8cbp&vS!jITVOtO!C2CWpuubkaUExLe=wZ(fw=RTLuh zP!z&R&fyoeBcp07FtFXXS+IWRZfSDG!!4yz>Nr5U#$BVoSX}u&;jNn|+*86<4i|qp zD>sK&-YDrihG zX2LO+y%S(P+w>_O7UaY*99vKzZ^YHYw+c|D!^{ksA5GbYO+%r*D3)8v$k6C9YJbH;+*Nxi+yRjT%R)kNHOv*`pi9e zWnm9XsDYIjJou?{eF05zJMK9emL)^y>293s52#T@Jl1-#k@5LUe{v;)gN+GBr6oS> zWv<_3leTDMiwvl_8J!%cM0#`kDRRCa@eH;5xzMrDzC)8!_v1R`$S4hnU>eh!7}*Y3 zIj8}vL0r983*16-p=uNezd*OqwSC(?eFHhEG_7)~V8xawJ-#rCLLq zS!ai{5aYAqitM_vpYvs~cWK&)ttD2yrD^f@Y4w)#cghvc-!vw!Ew#F-ILqR9%o+6y z%T?A;Yvn1&7K08)P@0A=_>GCWsYp@>ws&BD%v$XD=lI!>nQY!J$vj=sYw|XX>Re_AU>l5vg!;ilz z!X{f^>(1RXL+t4kFd0S+&G%roI@VWWE%(bNEMCp099G9UtJ4#p-DlE;4V7qJSt*cf z@uC5lAjp~_Xiqje6WIorBgU{APnBn{w3f5=AyPB;>H#L_zxGi1?>*^EVRA#afn!bj zu5xFmsE5#rs)^N9w{VTQhTCsq34( z3cN#uBO-zq>?)SN#eMjIL-d3q*7L^`#X)t?@9#0Gq(j+0ZTx?e8{ zNyM@Y$((JyYQ)S#Js+eP!U=Wn)~A)BCv}-@D&JI>V%3n=py)XnN67jjKaSWv1*NfMfFtK3ZcIUcP0e-BNZ%?HsH$^r@co6w(1#PHeCEb#${R$b#lj45`RvSL{r-PB``~hStl0Quu8fNwVa)H zZGAKGu{1!OzA)Uw8pKgwEmc_HLUi9pO~T6_6{k<{sHsV@I}I(^YPFW1^|j2)Bk9yM zhRmc}5=M^H2(mb-7zlA^D_os>;>ea53G_n>#1)oY+plgRm?R~=KH{|h&@(^dg3#J`?) zQkQ)5ZlkRW1##34{xa^MHLrRrJg;}g)nc<`m42-}dR@k??2)Lr;QMPMFi)-NZIiu3 zeSg}a<}%vww0#K@D#A=Yv)-{*4RfGAukmS~U3AHPW3_CBT7HfSze<5B*c$~NJqt195P-^ zSGpU?gOhB%PT5UlBmoKjo#)21$4$}PK-xa-^; zPo-043zkEf!T;^Z2qn9k2BsQ`Q%khQXz`*WrNkuFC~m1Y zI!^h71%l>xQ(QrlI9qrsimZ!c7x)Dd73yi><7Ef)4>2n9{z+9X7X1*7xTxWWq#z+O zcn@s}@9(FNdQIDe<)`$jE4TZ4HA@|xWy>v{=a2mD&NEs<45Kp_tB8gUrdP*^I#y^9 z#&a97_1l4tA#=}Zbm^VB^uR;`r+LUkAO9p;{N|pVKpn}YgG-?l8q;P+QGh$uJp^V& z)~%l_EY5`WHy#t;`Z9ld>?H!{3>>UfLZe?AwQ}g|fE#t#O%2}DnC?%I2h4GSE)m)h zWAI-EHUt;XblnX6?C&(-Ny(W%285gG8ZLi^V4motswl8IYy%@n=RRDSc0%h1S?I?M zlNe)?w6;f%-Ubq4mR#{FKKuTvq5kB{4s=6W(W$5Hv-r+aS5ufm8*WdJFT;DVA>-VKi8L&n60BM~8sj)F2p?^1Zd6ZI zAQMWmUw9M_&N{lBS4I1Ke=$8~tHlW)I{I9q*7cWdNS!RXqa z3@zRFS?I?(;cX4v;f@0HbW`{Um&R}5tH)T;2;jr*lj$y!jZ^Lka>^Ftn^hO+;1x#s zC$C9HQo2`6*Mp89(J<&=c@5Hd=|<39H~(8Ff95s7P&sP;jr;z?NCRTLJ4QV?!&I6Z zLbc9ySXfVQ>2M1z)%ADhe~7^#l2L3X@M(Qes3&|eTqScwUD}f4+>S|+{ykC=P05gg zfLi{d1I_rK;pCtrvJXxb=B;SVsJP&ke_=3TB>NVbz3mb#F|NR)g2ehTm;HzR6>D8` zI?U%=TjEg-7SSxJ%mq$ex<uz5DGYw{_j|#5MfuF$~?+^mTKCGgK}s&#IVQBfm3QuM(pw1xq_>P6dy()#WfDP=)D z1~CVZ_X{HJ@WoDz*zA=ajAs6;SW)#(uP%XNkbqao24vB4La=yX|A)9@7M5)lE+>Lq zX@pX_N9W^CHwv&ga6x8LCSi0KV50z_xk`5eP>Crmt`3~p_XP(5S0jXM(enZX=3liP z8ui3ra<~e%du7?)<;}uQ=#iB~eCh#V{9py=&K1j77J@*1qwPpCAx(4gP=x48E9*Ut z?fxe4D*peRj)l7B5SSbFjj}w1W^EA0=$mX3$`5rpZV zzBbvbng@TI8&fIVA9_{%Vy@)!3biE@@J0`3E0I>Y$#0jU7ro`;R%CaJOvVZxUp`_>`~RVw1_`73#dpPTV|**bcWBee0##~G?~w@L3K|>!k1xL zPb!2$1y9<1(L$sW@p0yGIRUWZ-Jm!HPY6Q%&s`gIS^qk`Q0z?6TaHk@EII+lj4jN`l0X7JV1+CKMD3+(k%aI<~zx`65fCA!l=juP&z(_@B{ zJNU8FlsXux{Vga+0{bbG!fzXanc!;*6lejkf}8gfR_78S@nk|i;*)Ufbhfb=sNv<= zN;Yq9`ubopr+XrQlL!8V?H|*lV`V=LM~!Yvu4kItI@|co8N_QRw8R&s$8p^ib)|_H zQ7=Uv)fE~u$80cirW+^gxzZQ{(IkYXSrV*ylaTn{H{EcyxTLy@YWM| zq`Ligdo{Uwkv-Y2pJ=-)8&Tze5jOvW%SYFDvko~vGv_F|NjXFB6|q6@n)#po6P=vQ z2Nzxwpk0#9rA@KP8#FQ?MW0z5m&g4P`q6jP85We=yAL2qomXLR)Vd{%`2g+{tR)AM z|MK;PLJ<@KB!d4H6a@G0 z1uCTvKM+{NR{tS9RIFYmY%(7{zJDF7@|Q0V)bN_#&mcl{eY99Ud_8{#R`DMW5W~y= zCDmI*CHL8d1Y6Yi|6ydNC#^00LsOyrq^0mfB#Rz4@Si)57g?ml^Wo>xWK)k2`0)2? zayxa@{s?4zyLqX22MJaDQsAe zXDH$hzCh6A=fLKw2)jUK*v0Asy`YH?zRXlmcE3uQz@zZcBZOF}K74)8CJEC~z~p=L zW45b8McCvsIADUW2Jd;uQ1>kOjY@@--d6EF1>u7*vZ|lWhovt7UuUdnYq_CU?fj>L*)275bO(;p8TIGJ_u?+pv5Wzg7u*tFKh-xxAR>c7Ke-t1<+nsf)ss` zWs7AS;c(``p;Lhs9>@pjI<29W1Csm`G&|=U4g2ia9>FB-*3x7;OB@4z_0DEZCe&>LFmxr2N#PS zYBT~3nDP_qTpm8RIO=Hi_@w>AXk?myZt#EFf=5jH^R`|E)jsH6}YtCaDh zNu`Vs0d%M^YfzP-8!byPar$M_*kC0gD13BF_^T2o7i1`acy4v=va6cI-cM+__-@pb zQVUMY=dJK$Gb}kJ_ouw&5@(JD;cxIn6!(^^#i%PSAt+LGrvRycg!ul+Sina^MEL#+ zE*HYOWAlSZAkd=Q`(?3ZV5J1VKT<0t1~1lq8T(})^Oq6+;DY~x=JUA-1pzCto;UA* zisL8IN8WA|tS5BJ4X>T^-04JKwC1PC!)o()ZsteHLz5jC%R=Di{~UWYF405*ff8L7 z;I;=5U?9#7p8d&iRAuRR*SBz10w1NS`Ex=ud>$CmF(gDd>cRVS?_hE7IJy`UobaT1fOCeL}6?s7*B)q~}>b9z%umu!o6jZSAZ z0!S3umC?gf=aL0m$COUXvb(kfujG1Vn|a3Aj`z#wisxSmj)k8e43QSF+QrWj}<;|QgEd~ko0 z+AfsLpB^bMQ$L~$HM+0KH?`3*N_$8 z#(pPw#GPr@=G0n+9P^cM4Sx7@D)mGIT}Mu#EJDK;c~Hq~A;wNahNIoC`lqDoc(XSs zYC!>QPp3<(hiVP`0S7=_;g_fdTZJsEqUvDOzRE7clLhv>D3eEpDsy~Kl2wS3 zjaNkqOxE-tXsUkVK$(P_i&WloN9J3HesbnV!U@;$K@C=7XhVaKlkoY<@K=dG`b_3r z5MOp6d`+|5-gV|^4Jmw4cFFp^`F?O?w(LJg^C=xdUBrY#Ft=Chins1P|boN;^Hpyb~WATuFUP#pvM)P|5DjimtYkH4_D0JjmUZG>(11CX6@B~7HF#zM zQ6tJ3D>8h@tiS6NF{I$AyjB(1XK5vqVW%1CJ$ zs;#8k9r(rr|I?*#`u#xt#J6aP7k2X4m_=3a9qMmsw0nFlC+jL(eM7AVAg=PadC)-) zLV9o9;yB!#Nm_ffqLKEq?w3br5kjwA7^f>@*-moAs__E%5EkGQB{Flvd;BmnbaK<} z$^l+18K62h?pczB#bpCmbp`!}RM&%bUwC&m?w%M7uW4Q6W!31;4y|W9d-Z^Mx!h~k zqES4DwY!&fdB5GE=)`~vS&;&gE3u6+p1!m>C#}~}i2C5oPiMfqM8c2-*x{-Uagl8U z+-O6?ADdT#BRslPvxRT(&2X`L`^RpfYWZpV0qGiC^RU2=4v&QW<^IMDOU6`(&o9fT zj83xKLS_jH(I5h|2kz33wd+5t5;L${Fz}MtMPitzpzFc@ln#$cKSuUPe6ZUQr8(VK z)N-Znr1Mj6Rfu$78;fu2=rA0vcA3CO0x1!&c*r&1Y|{nhg_70YmcHU^wtYa<{dDl| z`BBCHwWT;KCV&b~$Dv9%b zo&ELwsbu|ivGd5bq9B28*Y+_T#Zu{J|9BpS_8WJ{PS-p1O5$DXK`i_BE&{>*|x zXZ83B{M(KDZSHgHl>_8iM)TeMpYh~R{>8cXuddt2ksvpo_bwM`vaMvhiI}O49nGAS z>716m$1%3gj=8rE(z~y&!X*IPYsbZ}fx5d(>`fUPS}=)NI-40<{-myUl$vT@@504> zkQ}J+>A%Ap^E)TO^zPJZCw0iT!~nxr!WiSSxnDJty#FAZ40B>DYu0(8JqgL5 zTc65$tBe1b5S45!39|_VYfN+9j`0?K&_4oHXdKQK!0$`HcP*>0BZ+DhRF#=kie#1yr#7b6_ zawRqU)+6+LdO41RY=OzKtbtt^iX8q*?;@dWf#TtkFA~TRA2eKmr16vCBEn-dqZmwF zN9*@%YZ@!WjvyGYJdAr2FI17;qo~Fec zY$#6&L8~yT7va(4y@(3m^D^){06>loW3n|95vW27MrJE^z>~Jlr?D)2X4b@1?3cne z6qitVx)|H+Q>`>nR$tcR5LH~|Bs$YbQn0Kawo6y7QE`$01W_ihrA`Jk?G}B{u{T6+ zrw9}*oi;}SX9uKi`6QspJ*r+_0M67mW@i+0F4Cu*XCi64sobUm*iUwp_HvWkEf$?; zVg9r&3+dj=x$263uUJ#9WAXk|`kpt-W`lfNQ-7bY%p-;MWZrt_F>Sp81i7H#QCHkVmP^JD-Y@8) zx&uWYzb<@m(oc72H!NZ8HmaOlU9I+j;$A$j=oS^yUd0noBf1>bcY>hChH%SUG6?(p zy^M!^YwsKyX zTSi&~rhSA_yF|CLi%w0-JN4zwkKM!J=A)z#xCpIGDJc?F5uq5RPcqi~8D;ulA)|kg zJ_$`~o7!%Ep&^3En-Gu2xa7r*A|l#9t)je#Fg~H6AhNce7e0=~|93X!%I{SMX&a(~ zFEE>VahMgS^&u>DB*lC_$ltk5ao~`*HCDTsT(qg&L@|q4ZHiP)C8(}co^ZUwq83Yd z-C3C18mnuH{Fjm#TR|+b4#0`o4cV<=+%8j}k+Pj^pq{gxQnjLd@N!)X=|_+hQ{Do6 zBK_kdjocgsWe%C@yYflp$MVo%;E>6tN{qMz|Iww@tc>$~tIKIEvOg2HmvZ6Q=W@eo zOQi&WFz5noLyjD=F~}Sb&&M10bY3}pWB^@Ixe+iIwa098A@k_okg4B_i%V{##ykvvB9b z$mk6cwI3I|_-pPj$^lGXCUB7>pk5xw;QhuPQIoa4Vq-olmz^{TS!Kr25cWG`PF0-M z?(?k>Km%PG4B<0z-W%ouMmkHdew&A#vjbyXa&SCccWg$7#F&D_s;Hy@ECF zZHEHk{IqxEGn9sFJaAuk4rB@Xo0khnU%$^^eK#6UiJ+HXhTvJJDoA;0gR2$oUyrw^ z5)oo!3SU9N^0~1+jb}Wq&us+1i{cedPh3TfW)%q?4m9~ zx#49$VNRyvP83qI1bd7GcEt4lr9>+x3=SttR`ZqNN=jg_`PX6+o#QF(u_zeJ6jz^& zCd|6}DToM&*;;yLiS`d#x=%b#LTY3^Hb#9((v`J;IDHYD#bO&*Ta~wS9Cs|HW zTU+7r&xOt!=~KUXo|@Nr-=HStg=Pxg1?zwDh0}nJlbG{r?;ii_w=5AIsilqlM95xw zmXKhufIRhXCS=6t4sqiaL>t-PH@gwX^?;y=3 zTILw!gj9f0T=NdusJ8vQPHpD*qtR6(5{`RlT^vr%1Uf2fvG+P3MTRJB>T8NfS*`~3 zx((4jG&tPv^yZwTbK(jeF9Ew_X)$UZ%QRqhSPYeL)UGm{`c(7SQ)T@e^tl9jJy$-E z^~+&3jz~~*>f;nOKgB0ycF;^-x>?M)&<)W1IY8cY6^3-E^)BnTs)phR?JIU>b|1!j zhFv^$h@TsP6z(V$?$#Y_^!=AC3W{8Ms?CQYdM5}pMQYGb|B(N2$JtMbi`4l`E8ior zouhtyWeZYlq+M+EIp#}gmvdA9wF-~e=t$x_ zz@1&U^GdYf2O<;-R3qi^H{oZM4Da) zADEWwVgbBdEl9=qvSK>F{T1yQL2DlM!#(fSFsMNXQY2G2YZuP-KE^~rWd!Tv;6>=dh|0)u;L$ulkYQp<{$%R})5@?cBLRKTudB{)w(Nm}x8CQ^pCNwrE;xt@f$>p` zzbPwA|DY-eEEM_r-RS`Iy8BBA^}O|b03Gur)i1uqR^5;Vp{QQod`&exE@!m0afMo+ za$>GFr{I~Nzax#5Y%!K`BMT)Rfjk2O_A$mnLvgUi9OW&mtLM(Yz3!8w}~k718cFWDIpVJskaFvYLWMH+z}vx_Pk=4?WZ`mo;S zJ)9n`i;p;rlmez_yOaQ37*f^5BWPiGq7uk)a&2|wK>>Q)b`g*g)xZisdVIIkl8u3{ zfw*EFim>{Jh3Us1zCA^Qo&t&7Ui3%Sg{pR!v|EtUzkmznqDJIaAF}Jn36; zVsTF^@I`^r$z$h;qZI^U1kUZ&T1VF{khgEzXqz^-_BnhUawW1`ITRCY;qgLDhB-DV z!E_~NiBbF}?DR*8fZjV+n?965lJ#dB^gD_!nOkyoLMd4Oensj60$fcqc0jvdO(tLT z%qss7(=nsB8?_X_{0cL9V&${@mgr-rsm8a4uI8|L%a(;F6Pu#^ki^zv!oMq3$iAES zY39npi0)O4e5wFTQ)d5#-Di9=G6Z&91f$u zQAHR~ytTosW=$P3pBLI=TKTF01(euCERnHWAtN5n+N){@_0G*skHdR<1$|268M2U(y{;PmgvogJky@^GgX3;jQX&8k~+i<_s$2)i8Z#QYA1u zIQ7TeV0?LO=c}3Y%KcVL5SMR1Im!KdbD~|nG7_=v6$xXr+`VNI{`gtJ-mYXOLdliz z|8!h<{B#sae-Dw7fB@XbHwukleB?^R-5Q1D)pQbQP|LPr)T|<)!+W~c_PjRs z9EaN2G&9HMueg(S=TVUoVLcj#LK=q%0pZV<^+StSBUH^pr{%V`%`Z^R?AkV0Q>do( zja)H@DUCy68jAXywp3cYbYgt_uY3s|f_((bky`7?YxR}Rt1A_|0Ov>eg%el} zcO+ZiM~KHKw+dBhXAWM$>Rg}8X|IoJ&v5Usbr?2+1qL&7$wDyxn0_`pgnq{878$-@ z=7J}mb{8R$lZo(hRi9R4V)&y^v<-k^HpS)=#urZ;=N=nUCi2vv0KslY5YWz7(`AUG zl;9=HMqULn280F3L1>;}^0LQ(MoX~w8L;$K7!P3tNrO>;ItN6g(>+dE?p{*e!Uq<< zeIaH#!nI@e50IM(9Ib#-*klWCU63Md&tWE%`s-+d;-Tp1sil}b5eRG*!~p6>T4bYCqW#52R4*PP6*{!{Jd_7KrYPfJ{KnH+3tJ1J z%oU6?6_AZ8ZL7d+Gc)RWDxGb$NOX!<2kNP3Y5!Nl1kUi5yz3vOXUDRni^BQ?3B?7B z6UOpFo^JzcZn9!Y-wP_QkJm+Lq*f6LwCriTnsP?ES-%APB*3;I0GN0@@64KP>~MJR z>A?G!3JX%Ulo6qbZ>%MsqhCn-aaYI9#8``KWNn4uZBz_FEPAZ*Eg1&A`CgobHm^s{v zjJH*jG~4wH61!tW){|wis5;w$HC(>`mov5L|8}Mh?QysY#(Hj-3xW$|zkN}!BJ{ua z1xA&E2$1VYGWVyn3?mp5Rm(OZ5@P={T=z?@9&51;M8%B&{v#L}4i@2&i#Xg_%}X+z zTXG~c1}k!wJgF%js|pBY(o!rSu&8yFyoA!%DUi#vuI&pAe@6VTTXj-1BNikNyre)2 zieSP||2E$mu^;rEB^dGo%YLFJ@^AQ z2Owj!b*fs+ngQL+^WeucbX)m`lKGZ=Eh2C#m*4n`$cWWQz8}n|lzjKb6W@ILvcV>-rWPek#g)Warc@jSSbO2m%IZ=RDKO{`L#(57_~J@6)60xBIZFxFmTrEL`m;_}*Z$i73%| zLE7AJ3CRcsKUCMEE;rf$f&tQ58p6x`6g47I<4&D+iybhH-%}@X51D%F2xMhYLtuz- zEfTf|Yy%RQ&ZIN}5r^YC|HyWq7LJy6+#2pEdeqDK%^q~z3R=~-u&Qv4ptJ2;M`WM8 znh;wv6hjT4IOBvzm=#4iJhG}(A*l~D>z`}%Xy1wM;KBIJoHkDw!^3q3?Zp#B{YkU_ zo}ElQRLJxiU6GeYEO9}Lzgy^R#SW`fFGtb`$kHQZ>F1|<)ff&C_)l$h0k{W6mxLdf zI8_x6sY1U=-}q#^-@cZ@P5a959#p`o-?}(bp?kXO*YlRRX6u3`+WPe9A>&>g`rZJq zvJ>EjcD)`I8xj6imQyy*ojf;auVZ!F8xF)fn66Sr!91l|bi1sw;6J1mxQF1`^bvOCFXRsA zTW#P6hOZV(XE((ZObw-Hg+lBc`Cs7TO5`uOh9J5kAFy%zd*4L6a@i{Oqd#2FuSBTh zKX&6r>-x==;QL%%Red3HR)MTU+&|<&V>R^lLyb=+M#W_djN5o-5n!V6TYqIL-_Sd2 zclGx4;lU}afx!J`cdZxN3hc4-9PHaidH~A~;lg=Q>?H#k!L)Ln^@Fs$(SzNexP^3` z&Yxm=A>@9#!Nm1{`NuB48rX5m!R@WU71VPxC!&}amd@hIpVH&*+B%f5*m|~yI}19~ zD*8NCO$=su9*4OHOEGvKaZ!R}hG?uWUiSB|W zT2d-H7Ui64yGF*b7ucROc<$%6W?rdamTw*}?vnOO#FS%sU+~GMj2Qv5_Pp@2_>7h< zu2cR7_^#uXlQO&$B{f#Ob#ZI z6Th|W8J41UIe=)|1_*Ke21t3|Mf^Uz=+mhwRU$o&>rUIcUXIGu;6au+y6M0y&=j z8Ve8sp7!Bm#ExREeyMS`%BX=NEz*qayR2rl8gS|Bx`j0<0kRRn^@VZ@N;g9aI@(Ml zNTf>CC>WE7#igKoKiBTE683~|7`(17Q@!;a%;Tt(DL*iUJqG7ndn076dU) zE!xQgq}(PP9!HA}ZZ54i6$Il)wm)K#!Y3%V5;{#u4+i6!;5AfVV6$bOAvOCh3_)Ts z5gC8B%wmS6m>O7%(y$P^wJk})x($MmZP6(j?r9_&XSvPObRjNon~3Z$VJ3D=QKFxY zTk?P??)p9+kHW{OlBfX)%v;S6<|P?JI%8;ns*mDs10o+CQFbvP3^CD;EceEi zum+GUKWiIH8ff{=9?aJK)1MQYKmj%_AAuWl4@hsb+vk~x2Vz=~$oJBxm}nHku&2*pLGzE z(g~k!dsa-CSQ|r)1Tr-nQ}HtrP;pMl6Y7G{gxl$B@d!TepWW=8#}mVa-4{c^I!Ia- zMTi51MLxRExewyIgSI?EQ^(Y)y5n|JV1=V#6g0H@H`xVn#j$=(^%P)@{OI+~K z@FwjFZbDDKAdB%SFeCFBC2>0s)C9+&2MK&_zaF%068ekbV}N33IV6B?!Yp9>7mN`M zOSDzGypE!hb0)o5hbUG&s3vIl*RmpTp>DyKu!gyj6!DJT3t5yCw)T(Pkmoig!&E-H z!JSvH3g8j|Za#z+ktH^-s~aH)YJ%(?j%tLL zv!wM)sC5?J=f;q}C(hUCYvy!|Q_0>Z6A%jVOtnOeR)6N+=e7qXTkpSa*vTJ8w%%r< z?;+cswPl(h6Q3~{iT?7GKrEmE`ZK>TfQCd+sA=v^pI3;C#LH2U&M}U?=MW1x-AB$u zkK06KuE9Vq^?P7R^2zVejWRO$KFEZF+e2f05|a(_Q{_P#rS%p42_89QGST< z40(k>ysjrqZlpffISWR0yhm;s&>%;%3j93uv|DBs0X`A^6h7HTqiB3}U|C-XjC>Nh z@1-D7^7QD3dH)XhGR#1LgL}lp2FDv;5)z?9uS*K=Z8FlmX49;hwdtw2`SAvSglRPN z>T5IV*n)+^XDPrPGv%mSBACHUBbla%E19#`SKt7r-=rrajhJlu(yWo_iYue^Dy2xa z?Np7i3Uc=P6c@G%OlU)VI2(2~!u8YH;`7_S)ff^BqrWhdz*g`F(~OH{Z!ucx^*03e zo@~)DFwr|6m{nJ#V{HFkTHwe*JmIGRy&1~SpyWAy;3ubLEt5O#J#>C< zBK>?~lp$M;Xj|!5O(ITG6l$$gh~J#>(Yt7u77Ub{K&%itW@3-ANg7w(@{Q72 zqr?3~JP^)VK6V2i8Yify0td(pK7^HbOX-B7Tf{U@IozNx^CI1kx>t zwjb2@pbHitwiXIreZ|Uw^$-@bll(A}_5$4KyUP|Y@U;;;C|W44-gEOk16Jy~{Fkm| zy#fwxea*(qp=Uz3t}VJf{P-W)!TU&Fy@|mtOYE3z({5qR^CAs7!?06c@c?cN7!!u6 zj}60vnNt|(vIqyi7dqr=(UXBnH54FJK?~EMHd%xF?iAwa51^DV%B#)8PsT;85o+O@ z%!44xq5RBL5tLalKuY9Qs`;dbrL%41BaF5*2QE}Ft0 zhaz_cQ4*Ol}VyfsttxJ(-Oj1|c4riYzO&yD* zvK5vxQIaKnh0;Rw!9))qum953A39K~uj)a)8DTCjVXFA5O2Jf(_@_!_P}xM@k9wD( zK*O$~v2aDVm+h355V|Nn*w>|g1VVvZ078^gEpby4}Wkg~t|y{ov+vo$KCMp^b9{KIEsSO93DLeCqyr zQ{P(Gd4*ej>8ZB5v3hBa9)f)U#ZZv=TX4!VVJT`(SeZ5m1VCEUA5y>+u4%f^|TtPDh=vGO!N)(#>PT*LsPT+ za?8VOFZFO8SRa=SR(iK|%z{Ay{_*^*#%sAQpZ0Nb`q@I!#lmivyyg7ufnQw7P~XR( zK!#&8^+LFPo$8kT(v&K7$q}t?Wpy=Mv;C3CSPDD#7Wg2Y)L{Hle|TG#lJdz1lh){& zzVL<&4VIft^U0>FCC*TH-~pu_W_92=GIq$kth<}R9>aAIt*j-E#iX;F#P%!mGVs%f zzsRN{>(48C)#Yicq^pN_%r+LgrG`D+5U}LVXmlHBi(@=ySK8}U1V;8M)ZYRa+@X`X zjD33X;gr*BL%N#VgRo87rRjMiU=yYcrMGeV)aD$`wTyvF`=uqJ8?LVd6Np7AK zZWi0(Y_2qqsw7=1R;Y6hG=e0n6zNf-d1;hx^K%a}-p=3pRz{YRGhw4poms0hs}7QY zX}jIbe!-`_n_L|qo3$%V(Py!8O$u(^(z`z|oaXLVhHKr|wt3mj9Xq?+EzVt6&z95D zB;94(tLXA*V`WyUZ!GklY##beqbqie23+qZ6wh~dZ4bz(uUrh6MSHYMKi9?}l-Rq>9^>!|yhGKlXGSOo3PXbaS z*kvfz!z%CLu%iPwEW_~R^&!kUwyJvyLJtAW*$CRF>>*=079|$ifcdG;Ko}x+UxCPq z^y&-^mJ$|xQsc=R+?qJOr1>BA|JSuaU8#9wEsA%3 z=%6_%TF8#e0vdpfTS=fLnCFJv(^rdwCh~Q@jAjW?v|-7HelZW=s&^ ze9PdFRWu6zHo4`)Hd%F}GW!kObmKAzc%58Y`^9Y^D=bYNYDBC{v3MJdBj#X%dD1^5 zbR>{|y~=$JJ86Ey4Kx7Tki^MzpCmF4p;)T#Nl%cX*&p%ZzFjgZ*`dksdD!l|eMP3} zkB8^TPl32 zzABqThqD}3`{yKk($ubYFRm77R{kmt8w9DhZR6P=zi=m3Jh<|%D#o(SFB|0B)|Sr7+H! z9;b$25}5L!wr~~1N}@VRC6Sfo?e?#UZAI+irVrIpr46d?@F-K=_%V2lz+U}0QcQAh z?}PLrP^fs3>^L=r#~7atW*!1R5U&>)(cpcR1FUg_;%=QO@2;tXY3M~zy?)*ck%pAF zyZukLZhfuFdk8W$sqjE9){270hnpGkI3>TJIqt*k?|cf-h}Yoh6SFmjm2z~A3>FmC zyXkA`1vR?OrfyS1M8KSr4TNmKXpV_%K3bAIze#9@w&f%3L)mKMPcPnnHJlhH=iDZB zV-!Z_w025%F}#HcyH4#%JWX5II8jhMTWAHxx(L&Ov${KzP}J)#pGX`@_JtmCkG#rMkMU`UdDRj8EKZyaT+r}DnmA$q@FY-;EVYU0@Ti;mz%rr@0s>m zhg?(IZ$$vS4Xz%b^}&JKGlAPj{p+PeD}@6-?!VprB8Eubg#a?*ev{Fu%q9l0{?OE>0;jVOb{_wo}pefH}?pHb~djhZkeq? z87!wNt;6TxfK0W8XUx2?RAc#esQ7rMsxH^bkq(<)KDum<+qkHmxRdb_pLVITuvN34 z6CrA4*VW!xRghIRHPt-z@!F}A67cq9-aWtiY}5QxyGhyW?bqp>+ii1yRa1w`Bm0Ns z@4NNgWLyK6MRaJJy3K8d^h}uL1G`Uwzyn6A@C^9Z8=o4sO<~aXjdN%1O{yIG^(%C# zJA>A`{uj7U@ay`^?W=me>Nm12y{5q&zJu;-O^>tA%83(6JD3TU!M%}B>}NeT7$ z15!;Z`6D#x#FyA7A*m%H=Y}UeA}$andFhhXGx=tyrfBypzO~_3(M}uD;ZB?O;hbn^ z$2`HaOUFDq$4d&jBCE68h{dPe@Jd9_rc)hhL>x0Df^RI5%N4lEN(kd*5(nC6m{C_6 zW{7Qc$L&0l;b%XJ&@{jVpl2E9P$TK>bonJUY;PKAo897eln*mPc+qfEC4et(kJSZ{)%Pxd zvym4l8U3`sphyA5q{2|gr)qJ z;OZKC5TFZH{>bCqXc4Jc>A}VfXOp_lDx0A)7k4;Na8fNLa2p7dzgX=%WZRY24tuPS(HRltr_ zK$lwjRk$$|tFw2N{=fPk9z%H31`AHqK*i7XROd=q+`qk3S@#%VstftV%~@KoPsE#z z$$&jOqQSziP>k2;mL+qw-LpvL>yu!Qw+-b|SthbXUov(#Hb`POAtf(s`)nYIC{$qfejMZ3b!eimv8trU)_a+7qKu|o}xi?_}={2_k}#Sf2* ztc^Xnr<3e;8z-5EW=&=E-DYc>ipMf)@adei)m4aG1xW|5v1HS*wp|+)Ez*!3Rmjr@ zGlO64u;2BhkhP?ntbCb0r(=I66o90dvg8_C1Sl#`bCO{dSLtE7qXl+-+O^jq3Hlpu ze~S^pO=gH=^}~u++o#_O1v)~rb*?Qf^j+y|ve~h3Y66VzB2Komr}Rc!EXj3O)f(!G zVp;b*6Lv59z`dbm$orIF-K){o{yLy)jz`3F?w3d1ZOQjtWuo*F_p$^-6icmz_FDF& zR8iI4H~G?Mth9)pCxH%Mer&*&CVbkO0y|c`-*$HLB~*>b*sA>_b{d~b{ZzlPl~qUK z^Q#3*g??+@S`#)xU2+_42&Q{Zw%vS{UM}2<3ItiE8a&FPN?JUvP0x%1rZNtm8z6-a&U8=TjI&rzLh#GuC`8nYQovN z4?XI(q2$wW;Rw&~M;2`jDE;1g)1CQtZ5rAK`WyCUP&mE@##uhqokL9)B0R8d(3a30EXJ`Fc*BB z#});c8D@mZTidQ2Sz&z=qm?09@I*IjkarPRS6ie#C%nD3pM|xU%h_XuKY(2ubGR8` zv!_>>W=NXUQj^J_C#l|(vt?Afqi<;(bbmJa{IYOjSEDPD{2090DGfU!0ylpiCUfeRfWhS;X`=BObWy{tC;Jsbvkv`BZ za-kroQiBo|9ZMB(>PMHD2o13{KNmchXiaV30Zt(hwJa-)gHN7TLgJ9$YNUDBs{(1V;e7XA1VzIBTmoqyW3j|ELtYOV9)a<_sYs)bF;Keji9*_s9iMm?{uzbRGr9dy&PKi2LnB2+{_zuH`9lkTNo6>AUo6yhPH)%Ux|E7yG?45Cr z+x$3jzIV89>0cU`BJ|A0sU9+bG)W2L*p~ol=UR_P&CQ#(9wtj?IpR?#&Ky14E3W#e z1$sO5h>Nes!HFn=$|irEx51&>ECij|bMmS@38WjEStAU(|Mh_NS?9HWv60z-lNY`C zr0tN0eH9(_De=+D?s;@SgcqTZ9FavE9`v;1N-Wbyk3DO|ghOJ?GP72}_LWIC-*4Zs zt9h5%M-^0>*qa*+sG!Tiwi47mc}GLGWPM(3on4)?hsb@@xaQUMNo8itadXs6Q!W;d zPq_{KR;+~^-Xmhv?>=S>(ZlMv9^RU(ri8C=@A?-mowuN~VqUL*JJzOnu5)2HN8DL@ zK3~Tq+*VxTCm79a;l_v@;m2^(txCV|xv1CO?r_J*iUe_Fc-^GBu#Y&q zOh+&QZCdJx&jSY5Pa@H z${TCWu=h5I`-pj3h{4Ml@sV&EfTuG&%L6ustsmX*^OA@Vk*9Ot6Ye0k&jzN!L&maG z@~1z=B7`vm4Ykq6H?Rn1IwC|wQvbG383Tp) zq|k1fcpVFIq5zZ#2@e@PlAJf`B4#;YGLb%qi$tTe#8+b(0&?=6ao&;zqsz0j^OO-? zXC9Q1jLVvO8VjtR?D#Bd!nw|G1BU*Th=Po3&7XN3EA%tZ4UVlP;V5-0Qa0gGtno)} zRe21kYQQA^&FVw1FcP10O~`jt8iiavNFT*B@9uJ;)fy^&N~k##54F>jPipRivit4P z&L2=huqP)RzswCdRBE44h>L6tuYqt8e>}s6%3a4UIsdl5WoPL@Pai4U>0FnJ{{B?2 z$iXs_l0IH`-MMZg6ZM8EaNgfDz=_;-I5IrwS+k&-Fp`H=NPV3^j}Sk284U(&e%4Bjb*11 z9IjLBC1xcQ<8Y=5{FR74fWw6mCE`2II zTBk@<7#?03^i>v1JtsU`E<-?CV`=ICy%nM7`3Q{sY(;Hote%MdWF@26&@!DBzj%#eScV1VY-_s^ zCd}OSTuHGdviY!Xn}p{}yjY}v4IYr-!r_d@x}N|-4ov$2Jzqm)-Lg&MGh(q+i$<@s zE281J(Pl7OsWmI)jRyuQS#L)b{57+6>J2hpcFw3ZO6~)J&;GP|fZzT@CtoAiL|ApQ zq^aSs{26PJ$-9BPCOw7zF{Mc9BhG&dOm%Weu|>*-m*~mrwEWqg$P0u1dX2l2|8s+L>t=E01h5n$Heq4RGL-2I6OZo5Xo7qXL#26j_M230a z%{ft;SQ0i|EIrp!NH?OO$d_Q^8aVVc_4-7r~nQXUnubIBJcsV&nV~eso z&X}d~atb`QWJT@vs$J}M-N;vGJs_j-n^j8TZyyY{q}saptb$w0Lbvne0TvBQz`l)W z;L%}Eg)<}4R(xw#r~~v#HZ5fLoHnI-d41M7%jBc56C2RLwPjal(htVE}xW^!< z+)g)?%rO6x!MzM~mqC!FqbYPJd+%#E)MI`BiY=$BOO-nmF0-(;a%uWf5Cpv#^{hYy z#bvI=i$pv4%%qR9{LFH7&h~GXjk6A@t=iPXQM3F|YK9Adkccto6BYGZm2A@=kDE6< zCq%M1NgFph;2A;vBF1g!F|E9z!Rzl!zhLO5T+KV8ANBVRY*~#}%LNA;>>kKl95m52 zYa(lx7ZKYPpeh^+m?dnX0JX9s2b;J?pp9)Qr-*^j$%zY1f@(Up_?@n4sQcU+x95xk z_kZ<=L?ruF#3Md6{WY7Ui0QK-i)tK^KtQN~Ny9Wz>AAzD%L!hx)QdVQW@h}en&_*; znLM_nOh}q(G;%-lgfgojtNBDS+b+M(%OXY$QC&DFjsOCu<5>i49?lmJDXY;u#~c9w zX*t9Ih6S1sEeEtMt821?wCF_q@C#{>>meO-g;k}rHwHDuW{<(qGODx+m<)%+Epnj{_7i8D5SOH%@`j&$muwCu8CVsis;ST+ko19N@PwX<;9{ki#T3_P6lS zlDbuYzIIN`q@>F=X51elX_P_p0#c3vfSf6+munLmA}b%B>I=ful2|K*LM+2dM3c$& zm84}HamL_tNGne;bmfJ^%CnoB0!R0peY$-Gj&nxs1d#X%Ph@9JD2ro0W{P+8;aU#C z#H5|+vaOItMa0acv`>H#Ea4B$-L4coX0@ngH);uNuHB~86fPEN_9+YvRt2)_ArT7$$05?6}hC z)GIA%Opasf?Pi3SXg?`oRu0uuYbTBnGbV9T_q9L|pt*2|pqV7e&OTQ7q?cf-;7x<0 z?#B*Frl@%W39_;lo`Vz)9aYBn#8=aIIO=-!>{54bfk5UIo_fwzKZ2&xT1vXC19mZU zLAA&^EM1rzOYYsi8gFOPFLhEl2Y6%W)N0lkIi~zRK2PMjq9xZsss3@AQDe-2IG({PP3ockhIjYH4o7s)uSRqplo)* z&YvH2IwUeH=o>te0DXUJ$M3Pifeq|-vkwLr>uCY@i-ez`^P+|lu%f_-Oa)2E3WP*r zWda~D4UAp0_gfxRN&6BfyDI`Ib8-Wc%VS_rHmqVYG!c(77>^03b0`TFae+g&Vi+(5{B>miao+6-p#B=(@;9qb?p2kR7`!lMIXV6zgKXe8=B5v*eL z0!=q~Bga^n0V}INWTcpg8h$FpryD7m7)y(|ud9~49hJbJP{hTh zg^@MPb%Xxi@dyh+p)*P}0m`wUFRml%)ordg(bsG!{kW_ z78fxk<92r9Fvm6%5X7>|>$nSwoQ%xApCut?1m2|9y%aMF4~^`$gbf5G!;D#3ed3g6 z5^U%{2dZZ-@b;a^h`mlrn#2bvw!&UXF^XqQRW8TAj0{;WB8I8RH0oaoom}Xk(7lN_ zke@RN5i3iQVq#^suhvS4oTzkS+1X07h%F68QZ5ilzA^-bP1>o)@CM&UkClWp0l=2! zs82fHJ$TghZl$58PEBC+g~b*njPD%=aWEkapK6-xHW5}9r5K@a?c+0+XysLRLnD5N zVDLi&vIxn7I=SU)SFyyawD7WhkR~; zq!MVKT6JydNFu@YfsLqRR{%mYo`x`FaOwozrV(IhjlvQjljzy+W~Nc0(-P84ksyVEWAc=X44^dcvb$(+ zM^I*914Q?09W|(bMz@@)u>U&5Q%?exJeaF3l+M1N^+EOE-6~-1UA2PxbZH0N)AV z@2J#NTuG}zqZ+EXSB|$<&%}2{Z2=qXU{j=Ah3S0D*ic(NylgA)TFJXN!SB$t)7~$? zpO>bG`@5C5jw!qfzD*c)wN5V5clmU_C#PF`PbBjVaOQ-^Tzh>jg})nUR%+})((Wi=e2ArwY1jg(>#feawQz}PJR8s({k+Nniw>)aK=$- zmT}i=CiG#Umme&apIx}tNTE7?!pGAAjz+=Hs<=zCep{UI?Ow0sbZSP{oa=}LHDEgt z|2zVFemR)SM|eiBx-df$6z@%G&!$4zrZCb*w@rULMP$3ZwkmE! z`tB+CZbfv2nq>sNuc+>8MH#`>#ym5d@Z9iqqEl0xf?8s4Iu4PnB0xMZM^Px1R!PKU z%XjszFESv_DUP77hK$#W6S@v};Wn;|mkWEII`YFZ;q|5Qff!fIeiF%UBh|cO@^8WuQ*c6N;(-5E5!{mc#)<>3( zGle2qjxy!bjT1=Jl8%SA(F9QR{;d$%EN}T`>hi~Q{SVvj4}0KWY!~&RHHtdYaj}1y zp8R1K{$a=eVSg#?S*y>ntRbcm8xUc{*?!#T!5U%k+;Qg17##z5lSk6s}pDg5EJ*&SlI0a%uFtc+!{8 zXY2UN{_-s61G(~Ft{?s&k*NLut=f5~w57fe8SZNWRqxkuoGj-kK_(kviVuGjO4O2! zi~Ze;ui=@i;|oLj-{skn+`#(UtKNW?4fYg70(0>8Z{|(6a2MF^IP+sUC;QC*{o__<@{i(S7 z1LXSyMEDCx_-{brKS0EPfN|gd0n*5S0rm3#PYbXARD7TPr^||efT(`~ss9bA{s)Nm z$A`lI06pdNL5H!rO6RY?1k3R@?6|sLinPzc|4C4WR=E?w`M1Vj!-4(}>MzT`hQsqu z6Lb@Q^!|(ZU*vyU@W0Le2RHkF`_8QQXE6P#^Iy(v+Q+v3+sTq$JO4rO6$%zl`TuBq z1^@qr`j@-EBH>@ezmn;%@%>Mu_dmFQ3*mqHh*abESIE2nD=C)#WQps45d0JMe{1~r zQU4F|KMliwO``w7{TCmFp?Q9Vy!XG7!sSnv{3pRbQUABbe;@V#0RH-bjumZL3{ zwV!dqiI4yFXy?=ID(mFR@x=7B{^=@+!ufQQ_sO>)`+2OZh3E6)I{Uda*dGHn?Q=Ix z|9<=R6722yc=FaiJ9ttO6EkJYS$t!By{0?nr{pv3yL&0K6p#Un==$bAuz)-~o&oAq zYZm`l{`ni&gVlap%&P*1IXE1<2WEaRB)}?qna+WKD*?17rx%2(8k}`_ zmPXfRbl+5)kr?)_`{FuBKje2|1`1C*Tz0S#bIVO84+3x09r=_Fa z{eVAYKDtrf>6cE*Z@64@n}9YL=wP^xXK0=T zMYt98eVbgtr>7^mIkMZDDnr`)E&+ z)A1(bQ&WWI1@n7lmIK-FK6Ep@U>xa~yGK{YiVXTfJf--1;H7D?#my6|E_yx~r2I7f zpiMmJbi2B{FuMFl^bOCW!1EM)f|3u5O!epMz6nc)iBWBih);acVn*+cN!Ec+=LB^Q z*B!r%NLF>t&4sRy-1B*BlNcVW)-17YZal6%)S zF;nAZkEfp-O!&`AB}b)0`wEL$hg!-)xC{&BcLImwxG5C9b}m?4x9tm-ty4?g2QJTB z*%PX(&#{0xZoPZt37=HhsHksxk3ySd?d2R@>Nd$|)8msFTrd7|4x8v4VOkpjuSn#p z>fYS1c*D2jS9U!355m`QeiyC$0$SdPZh*PE`<)c>3g*?|@96;N?ND3T=gHQNVdx-S z0JBGj>5)|3zj2Sz7l>q$K-ea?P99;}q?6*P>)iwz0XKE zt13T~67CJrF1pP{PPs%I{**d`ILTRk?BZ@dkii_lgPtsBv?QNjN2aN`vh%3rNc5bI z7$ur3M1CMTI;aUNN1^kjvM!OVGo}~bXSr24Zv<_UK7ut?l#fWrEX^Y!|6v!8%#yf2 zKrhoGt~P}|qh64l#Q2<^Ld{&JI_Zyh7ZI;RdqYBxZgNu&gc6yzwby;eL!8Np{G5)i zTI#Cd!O`qMcCZ96PQ35&L;NChGotHIrhcr9y!Hj+Ilp^^Fz4$q?{L$uG5Q$SzVO<8 zp-p>_VDe`gQfA@o4HU5$`1uvfw$X+IgAV;68a3#nu5e=ZAMaG%T{Tc=ujLyX_x8+} z2tj0bOx}u4GknFbxkd^fT8&sA@UH+Q#6?VAy(kB) z>$e9+^Mcc8j)P>gw8H%e>`=xUlii{!YDrDfLPsr{4VEnqH^{fn*ls%^q(gpuHDy!y zxl>>0<`N)DL$SNY2p)U3bv`2FSx2{b(K$$*+*YSMbhH9po|J-xJl|7zqw07dH=Of5 zwmIAK$A_Ek-Sb^@LPJBRQzy+qdQcvwgA?4~@$VS1QlRwPg+}g^si&3=%IQk=Ly!GtI zWcylYQABQK=%=+-Ae<6FB!Z@v}zwIoKTmVi^ z2M-A%AcP|PUMX+9B>VdYJZr7j4c8WHStz({)B>%e#D zqS*`bZPNEvP)+sYhG4z@#GROC1EYl>>P$jQ?3@OaTPL1d`j=;Q22e_iew2Ddx^EAb zhMM7~y=Q~YQ3SZjXc@w%KL`e2z?hoqslpETR+U3<ydO<7di^v zq+djLZS{E((xn-zrb#}e6VL=#e_MS@R+rMO_y(l!+(J@a$MpPy8=ZBl{Bpn|Nq!p= z8dXN55uzh&=;@eBwCT9?ed_TKLXbl$dF|G*d8tQ!G-S_{4m{f^yoIEy^L19z%yIxB z2_@C?o9_@P-_{|{Gn|YmzU7COkaq!BVF^1GksrYv%6)r;@?~~aQgv52_sODTUAvdQ z-ZNZ1rF&UDklU(clwHv#46TOmL0U|zfH86FLh`!T(mNomW|pKp6UiSff{vuJ(>8}f zy&xgK+E8$uoQEdPwPY!#%vqY(G+_POvPij+sx6DIDu|2Z=&%9Wb_# zScVL+1ZAf!4!yyeb^twFenA18T)5Y!kX(}GBv9bSV^)m0l=O2(JAo8)e9)1OGpB^Z zHVS=d@mIV|^HuU0AS6`-ln)K}BOu$az13CC$0}3UO`7 zae}P}8}W3?4jOP1192iRd+3@#cZF7kY#+e9B?}HbPomvy(BX8-|C5hwo>k6nqn%fC&^@-(065o8LM0!w|%c!Nx z(0KCwxtA39r-gxM{?lJT75^xZ3dHgInwdWrP4GBcF3ceXJl4R5YS z90>JSnNd2xc;05}XrDkOScG?ZcfmW)Xxt_}|DfVLa-+00KDs*{Q^Q*WG@IQq6N0AR zJpi9}=<#1v)5`0cg^`{Ke}+)IaBz1jqEi;6)wqHdbx<4fB6mDKsxJ5Hfx3F(Wi8$GXt9P#@O zU~(?=<&-u}Yd9x`Ulm>^YqDwlIg{IkRU0Bl>^x{&wRVW)(4uQI7XNM#o~lLfbs@Da zF=mck$cIcP0U)DxXcxK@DQ;kzlJswhx{+b1#p4C!fupIpK5?@=d0sqUh?1Oli#&wSKaa?=V2krp zIAl9!*_}_R*C7y67XwT7dMA&MO*}da?V)YBlXl$;FsQ1}zlBj%M;1cfT_jZj z^^kO`c~7IqJ9dqQ7#{ntBuv5qm?Rx2hX8@#9xOnB1Suf66WrZ35Iksb_uzesFW>L> zzenGf9^>}YeaPUXYM-@tZCPusIoGN3T$T`duQuFVM|~;osiJYYVV_pc+^UkekSx-g z4C6)6#JM=rf9h-tzrY7?=3?8mpygXNw6QOoSt|OjLP7iMUM^E>#{i@zU>@e3)^I%B zN0|gvHxUSb|F0aMH8&DGC&*?orlYnvqm3Ao#g9Tv`zxA^j{q=yt_TJmDIHAPI?L6+ za!u)JM>5IhFEa>`EH&&r4HaA+McUr<1Y0+`nhFu(@;FVt2FHmoh!KiMAicPnLTWJM z;>r&D&^dvypXqMFgVCm--%KH@IF;0?xu*5b4lU2x0q(V&-TDHb=gMedwCfCl>?H8# zYRZGYX>2>jwIZ=*)hsa=gJ;`BG@pOXAhkv-Aq(P@!y7ieXq)qkZ}yuy`9)cl;naNl zJ6ZU?Ka(;*Yj>YD_y=J2tSt<4~CFzO*jzaqD4aq&nXy#`Kf#VU={w zZXr{}iPNBdEPL3aOPh!B#KaLvn;(DYhRH$oqJ>KE%T#Df@jV_{KL5S}e7#~m|M{;; zFT7P(6k0d@b~fdZ)=TFi;rntu0YBQ;6v^)20`1m2yV- z9HLg8_*)KFaDK|CK~gIxZ z)_jsd^Amr@zP_GwSE&4IzS%YyatT+=UW4nVMH{ULk216*`NHRd-8Y(|Nyjz_H;PM%BOk z;1d6z%yS*Sj2z#fq~KW7o|wTN9G*8hQnwL1p1jNGu}&hKyKnsE!Prs72mWrw_$uhF z@G$u$N43N4PS=)^1U2^K8{gcVKS@;)H$JXkOO1R`-`_^_{klte;TO)QNJzbYi&Y`H z^D@ULF}LY19-KF)zkQi^Y9{K4Ao6DS(8*|4_~B~@zk%aevcSSlAl4!}quQqg?K{^- z1{HipmcBQ4SfmR;UR}fNcV023@Ib_f4dOUA?ZF*Xo?TX!$oQ~t)NJnW_9*J{lKhzH z-1y;hHn#(RpSg7o?=8D6F5M!DE$+^`u9H{nj7%?w-N}yq?@PJyJDHos&y8tEbqhbu z=3eXc^QtgXO{G*#l6;EGwn~lYQ}&^;Z%-0$L&X2&^V{no^Q+HyUzJX!R-%OxmKVaK z0b-bC=OFe!dvAx=hK@8&OndvU)-Y~943<&jASM;G&y~|xlz&Xv?Fa>>{UE|pG6ovhr~)-m_5)M<=S>0h0RX zJBPe-#_SjGF1I8cs67yh0xhxV+iyX0CacVT21FFUIVTO<$AOI>Wd= zS(c!_pJ>~EEcUzG$oBJEk`TW3_~1R^cZ>d3&|+Ca#c?3W%(h^|4EVDCmvj5-0|NcX zll&_QsW^Tw1{VnqiQ}o-j=$Aev|=s}C8IBbD%#ThoHTpnR;8>Hul#}ErPG+})lAFT z2w_3nqEA?2R%y)3-KS0c_8y@XeLv>dqkk&pkoGlRXtQ>Z4{b9C5dxMQ=I@38hEl~K znWP$^1mbNXtO!*LW!kg6L7%ts8VFS7lRcJlaEr*N0Xs=Fq_eLeeIueq$>oYXTZ!>q zecyMAj9D_jEoiDbdr`E%Ia*R4A<%H)D3h z(KL3%SmZk~c%2${bYw&09a{83!voo%`D$^!V`F7~Vk_#Zx>ZZF&6=;&n#dbx;>aS> zY_4?K_dm59Z;jq-+#luC^b?E4NY-b_bI1K?{+aLlMT!6V^ZcMI1N{y5`Kw~QOe4{2 zaO3e}(Wo}jH80VXLS)SX(~Sk!7GW0KnezRQFa}p;$F0%XOI`ad-M3vYrd!NH$VA_> zZN4MQu|?Uh)R}$zv52;+&(zt9s|e{mH+J2SC>q~vf>*u4rdmNq#&FjGcdQiVr8$*D zvKN7E1>>1h({PSzkXUNij0IH)+5UiNGy56Sl(EX@s(Y$@7Su%fUlX4HnmGDv;#Z7i zA+$l;-v)pFpAA5N`#@>@rw{q@zkLM$?E}~CpFUzM{+bB>Yl43NZyzTAn)o|R`KiAq zvi~*lcbKsSe@)2zYvS;)3Fp5i!v8g~_}9eRUlZ~Fj^f*26VLuNvGdo2;*$x6Gbit- zcfJgF?L2jB$Bmu;G;bvXqG^WzXQPba9J7?q&?(*~$;*Y#tZ=9ebiQI^OmvHYrTE{s z|G!TQuoS?rTNWY#3sCno%m3{Q|2yCRgZm6P2z$`Y4Q&7Br(ONuzVN@>|9|k<1E-+v z? zWTKA~5^d*WkG@_vC%^K~u;q#KGsVSs|F|i&@iLMzBdg#43L9(^>B4Z}msvYOr_)xU z;BX`gS!M7lzrmKMvXTzN;;S0uO~7Dr#NZkEequ}>EImi+5JwY{b=sJMM7s_WP%usc z$&Ih{bWB2!NVCG&us&HdgCMj~^xy!@K&mRK;=HTzfY1^g!4?T}>_$+@m#Hokdz>l7 z^pD63H1S#q-hzQ-&!p0)20X_xO@Dr)3fziAaaYGa*^28gQWQJQdi&<1aA5+_^Rrqz zb(IdJj`S%FpCBE+!uR65<~;=o!lc->AiQFR3k3bi*Q$&c!PB*IP(vAl<8et4%gi*9v&s)7VRm(Vd&h4Qh)KSI6-0kYWrHype{hq>$gKk5zmx z8LzZcr-o;|7zg_8n@#ZE23qHfZIiEMEAQH1-(xzLewj)q_+rs;taxwzxxCJg`r*L3 zX=JMyEdF58bZ4OVtT_kI0&9HWce!le6GgI`?4 zfdp;d(R7bsPKq+$d?`H*!VwTa*oJ^4+J`WsQnrORPCSb5U^v7OcA>A8(&k1ftPDikNAO{Vt;ezB&bpncqD!KX`@OOovA&!Ip$Mr^Y_+=Y zg#Z_tGte=AW&A{_AtS!XE%EP76=&T`f>rEP##<4CP$MO_2=Hc|oz`_+m!ivy!>%Xd zoXAZ_thGfGgu`&?W;2}kxBNTQA0N;fqSn98_}M2tWPK}-Ytn3XzIR0)j-HX=eQ+XH z7AW^C-ZbLuV^tdd;+K=5b;d!mKzQ-*b;^(bx+WPU6tWy?i#Pjuhi>U48}s(e@%Jp> zqg1?JyxHvCo-W^GAgW%x-QUXq-Tz!(zm2y7UVRHRaDKY9n*o_~QnH?6eD(8%c8&Rx9qTM%R0 zOkG32wZ_K@R-q{G-vFHEwd(MR`@7~sn>@w1!>R@E^sH+XLRYkkl zr{u$yIalcTD*qY8OjXrde>9&nP0-MpN+x?~*CRRP()L@#sX}^R{KNE~ zke}G>Df5cwyUUe+Pn&Vt^@HV>EbTRi+P&KrGpfap{TfqRhkyqA;2=B{%m3Aa|8?Pe zFcs3(WwLz3d%x$SLz$WpJ4KN@?cF{MG0Q`Hm9b4C$9_w{_ioG2ZMZLgO%OFu<0Cf?{dXqsjjY0RygCkPZaXBhICaBdA!%e0`m#T4kyU zIi(0kD_Uz1+nDJwGfZaH{_UQn0_sCgQ^FGQVh;T1*K+q(6(qKePS1fe+U}c69O@9^0S^xKv%$Nqrkcaz8cddy*x~Mx9Yy>AgA^cBn74oq$Y8WSDuQsd(S`G5imw>kBfh}Q8>T69Wnn@&ieDS zpU@Do_QD>#hS7^i3h@}?BDRa%=&{fpO(v!Ml@ssA&-_U!ByTb4^K9R&gOd4yr|Upu z9pWP|z}v_1$^02*xzQ#|d9Br`vosZWXmG6c2{wB3iF7m@wkUzUE1WbhfSJQj(+8K! zqxJ+6T9$2!*fz`$e%1#+N?vT)wic%qmwp`ndCBDRN6@gK%4dU<@-Wz@lJ5d7!{8>M zRWiDvs27J&KTI75)n?l^sbH%^*Vm#&%0L%ctj7sFGJn&qaDlwvu7*8pSypyc=<-p9Do$e_CLUtw`m%liId!9O>J< zY3K)h%?AvQ-B5R=C zKc+<5Nc{-9R61KjDJA6GpVS}Yr4&EZrQO-trRE%7n0lY*YFX;!LJPeS7_Ii0+jF>H z-2hyTIks_rQA3I>CCo1I`aTfI4v`KExNk!C8K+}u+;P}#>4~I#sd-O1VXt2JLRKju z-a~Wiif#Z_XJk!hK!B|g>oZXuNuN^H#!wr(5Z`}yJAdGS@)u5=A$+7`+`ajIFB~{V z4HAD1#0*skUI8*oJedPM)thnqD$e#%B1kw~R23p|{db_QCRE|N6Y00NCutBlt0e}! zoqFg!{m)FE;}qD`G!rw+9~JURUHQ217d@Ge$+V*vDP-%K-?{}uu!-w8h4c$kO_O}` zR(v{w9N?TgQId#p?Q?1ogVhbvOo@qW((eQYC+IGcmraZwBE}aa0-8vif*uepl*fm; z0~TZ_2m9Nr6OpNyx*H>;DuSBmunAO^US72cOVK(8rhYn=f9O&FVT!|V{w)ltNP>1_ z0AUT)W``_vBj-J#kPiii=39T%0YI?0yo?vchF=l83AQ3LR#qfkN=po2eBLIOfHy{^ znwrR+^cM9n26npo+kCjz9m`sGw+37=W8UzWRGUYI3zgTf#$kAc$@45A3MNWGKN;9jn2>|;QOKp8-rannBjV-y2A^Fc|Z}UW8Jus z(GV0x(R~d4G6DY4aCK5@D@2DD^Nsbda8>tR(Cg5v?*obD z+0bZag8i-|Ky=(f$tH0j#BdJR^}`MYL^@R9qXk`(4ZZ` zkzCpw{~m|)b(NUr-%8m4?=ps^g-64^zunC6B5fv(=%b^Vw+OOK#$03{&yfavqZ&+y zxPp9GVs<-{2->roO^Sr(=zPY08Q4(nFYNMkYX0Jg=T$NbFG~qvyVyUb40^!6yLMhf zk%h&$<(=J<4~?ZntR4}v^dg4{_Z!Pi-si2iV60lpWrK6yMEaW$V_d;&BMUhPXT!{j z|8~TDgFN7vEeCrl0CtT5Ey+C~6<}4hPyDpyABl`dm4)B5DVVX*YdDAuHZ9*WWnIA3 z7Zat)(5aTJHVXPFBZslSo#j}@Jv#n6yKXMRlg3;F;x(wTn-OGN}h8YgZEn05eS;>SD}3fId^BnEQ%Wj)hGg< zjtLU$Ws+ETGKHSX)Q&U!BYNCjfqc71#Jqj}4Vb)o&z652-7Y+3Wqw_5RreV%(>ivG zG)B=f-zNT9R6g0{4P0f6a?I{vV8WMh|QSkn!Rlgb1Ca_48UgcZ%otRL=>p zamKRno$DcNo>;zSLtN+Z@IQUg(wRPgQHr1T6DTZglIplHlx9v=RrV?<*k+jZ#qq ztn~&fv|hQ#;xx0!%rvYm+u z-H?2aSD+M4!vAtuarDjh0I3SMXUza91?G4PGD|0{q+w`s+6gC2YQ->~E5E54Dd^Wt zAh)4XXqdSHr~kr^pnQ&qHZ{`sg09SBZONGsmz0d17G)G(~c!o2pbl0 zknFpuL;E?k1qtA%z-+Pnf{je&4@UbbYsCJ>i1y&_&aVzKn>plvoN8Xn3+Q~Gz;xqw zaZA4xI4pvl384D4b-=(&-0>?;V!KR`@W9tb#xk3HIHF(eYq$ejYS?A0#v^ZcW&?3% zsDn~k$Yp`^A5PtZJQ!D;D6A&JK-6U^lNw;NT4w3l+#C*NA`%k#NU9jpBnF)IEfB(= ze~87482>GRE6wZ2qR%Na3DUvM!N$<^i`yK_ibCG`!KW1U+>CiOzPf(MCVZE5ti21SS}8$*w;<1z zQlklZpIWx!*;7U(O>j zSRqnQ@c_AFz2G;ZA7OZS zOmh5DVA?zZe=Jc9?u>>G$4$Qeu+l!?P*HmFV4!0+Q{10K(%g$BnC?sdf4%#xTF`Ky9 z1+;!+f?JyOY%SF3?S5l<^0p2($MtJWZZ-c7%IFV~2mzVK)a!+qo^P%rED|%FzDn*u z(m17HVLJG2?Nt-69vN@;%E47!0~4kf$r8p!AGEg*-mS7D?R$BGQrW+})vqwXJN^-k zFV6|H45!HeffL4Sq$@GP`&Zhm|=f-(2*y^vyxC$|LSR z-fHu;Q}Ad&*3qDc~Q5C*ltz03Q?Prl!qqr+sO0aoi%E`23IM_g8=$#3GA?jHkOH1~?&=DJK-4mOD=NTu(IEveD43fYTd96+rfTB_zR^dR72X z^4%NW2*8%ovr@@0na!9p6vLtpMb}F5UjLq40n+`pQR#^$XiP;IK=Q5f%Q%n#rc+ z)(0CSBv4@b%N~;mzT{VyUHWiCFx69CI`tBlbGS3S(4LryD1ca=3C?&nUx*EkQrrV$ zoPQ3$IsUuGqjIp7jqM~RBZZhBk7*DhZE%QejCnhG0=lJOL!-$`aAQvP;O4hcdK)Mp zN`fX`0sZa@JsPU=leOyPW(Hy1k$`ol2q!i_d7MaJGB%tT>?QepTO_a#0ubEW<&Q~U zzWj{t{%+&=kQVF{4ETwr-^U-wIjN!JK?BCqv1=T&^eZ;_P>sQSN?(gC1a-AN*S+8(`6U5Ca-#V&cATaE7iZ;srMl zrtR1=p0nmv8MIq;+Ie}iMEb@J25U8K0d#<^PQ7@zh8B^^y>Zb|GbcLd^aV9(Sgv>WyYS8^2_q$Hzedf`Ib@nk%~ie zfO@D!|Kl^I^kB(AaLel{Zd(hAg@PLZtcKA-eT#bhNZ&t@kee#d-zr%hm;|WLlb!rA z@_Wchp9+h1T&pNITGllqs^9QM<%3FW<+l(yJ&&)UIW{ zUCLWJTK$fEl`J(h`P}n*{h}J&@M3}p8mdh zvY&Sq3pi}`s3jr-yNV?7NYFM_2{BY)+&^p7#H&UBK9v`4RC25x8bVd8bCG1u?Ua7& zDVidUV{yWX!|FuDf$>Jpz6uDr z1bqEA(w|F!$Fyj)ABH4iEJMT)HJx84fP7BOm-7>$?)nwl;?+Ti$uriF1SFD6kg&Bs z%#l8&s0V~CEf1~0=8rOVK%D3K~C==l9YB5s<-K5qc-9dq#KRJph z)p!;jD#4AGs{PbTNBIRwlUdLDHBtHWhEMw($ED;SUF(hJ(DJm44&iBQ)-67tjp21+ z0;vuqTIgBs_-Y z=)4C8yT&s;CeM%(V|IO+oK}1hX_)%#yhDiJy1NWBWp?Al2`dB!(jL}Tp%V171CyV6 zbUmJ^{O7_{aS-hLyZ7I9IUWhn5H^BTjV5cA-V-47NQ!i_ETHH=_hC=eQEji(3QFo! zhxAcQFRj@DfR7+0!9RN>%kO6M*>&4a3JLDuwD@ zREd-)o6Ys*kz+e5`tI?bUzv#>dUE<#AFAhf*)44B;0A)5+;HAh?^BT!Jb3&{`6?GY z?@l_ySqgfWNf#Eo9>Vg9G7Psu@Z(6S>L(|3>I!}eIcB(*z@;+YiXetEMI}?TF}3TV zJ>w4=M%2b_lHTX2s*5sahkfwRce>b3UcckQgTHJr_>b|* zP_d!dL&@OMiy=^oK-JjCY_`vi6U~^X)i(p_ShwYcW-RmuT`a1UyS1zcFIzh~cwQR#a$jx5kaknRla3knEyQbFY zJj<{MW=LVYM2(4F7;Wb>TPkxoi0fSQd<|xQ_!`8|?H_oYWtNZt2!Lo7qHXr^1M_!m zu^fkpx)a8Ei)!W@YSmZ<%32)#LyO0J8cE0Y+#?`nM~M{J;s(iZOZ0 zZ0PEj8*O;rx8*DBdBwVKBK%E1vsM^Deg{~sh0DSKe(XA^t>n-OIxmycN~)lg8cdh?$ievdD!n|c(L$Qp=Q`NPK;Vuv6&YwI2}FWv zoBxUgOiz)3bKh(j3o{AHD~!Q<2n*AXcbV*J9eZc*R~EBAhGST$L=QXuM^}E5DBh8e ztHkBE0jnd2$3CK0lg$>sTIo z{QJsGD#RPTf>Qrplps?EWn&AyfOig;s0>6@7539B?4v;#vjI}e)#e4{MMrzV7>YKc zugj}6t*x$B6${R6ifhCo0!^5d^|eGmv4=;5ub6ac=AtBGjI1gOWF%t<$Ak83y&yMB zD%(!+rgYWlcgN4B&Z>W|XUKF^O(L|)Ba02RX|t^=1elZ~T?Mn?R?vq`Hw+45fBbnB zCiPB0y`(itE^arzxV9O*0oks6D5=a-S_`8X<>9@Sd;UQ8U7yg1MUVNMH*7 z=g{Y@J~_0?BxKR3jo2&td3j+zzw7UiKq;?LG`K7bQMGj;9&-82$sN<%g)N)fmbb-W zVYqZ`eOs{?Q5`M-T7?-B;#EDUppaO##G%z0q zEQxZ78n^rS(u9m0n*d?H zHY56!KLdsaA5lkiTpb0wI`~NCnDG(!Ag~rUh@R<>b$GL+AiTB+UiRItBUduF|Lv|c zQQ~(Z-TCrWbb0XAPkdLd;f9du5qBQUt|CukQ)v1DWIKcL74P#bfsW9QM& zZy1a|y z2sP%|$FpfTViXW0E3wtpDp<0YmHV#Mxt^&yJK1fUs7(GoV`7lAlD;reRm)lsjP`=e z^JA^MQJI^n~B|)|)jIwpae8JT1Mh_}@d0 zS5y}(E&D_t>Oth2S$O{v?i?2mxhlCUK*n2*10?MPE2}8L$%3)YN{fc0OPPmymYq&f zO#stb0OA3`i|#0TA|Sn-q|gn=q836sb_xdgGE_*2PZd65@NQcjimWUc5{69cqy*op zEcjaunom$VXA?%c=TBu2lmKQ+*5JVJ#c9wi;F;7`vO>_Yfz&rswl?{N>3}w?%7brbw1zf5rrMLm^ zKrn39BFA49bqhF$Z86g%L#a_`|mzH z!$aKGQ016(Z&QE%FXxYVcJdE*M)Rxu8y;dmz|;BXKdl{1e|QRP^J^bmQ8z&09I9TW zW5LDQ?}YmJ?Lt;4dFgLTU8A8*qUMi9ErPcF#TDa>U(!8pHSqP1$8ac72SCr#Dd;A7 zA~>wwW;vZ^iJP7atYA$4pgXvi41Ja62a^Ye5wlLfB~qhZ+J$K+dO4&(<4Dfl(ds zT*;^2aN!5Sb!X%Bq+^+fBHKD$Wr~e zX}f|`*m|GH1c2vwRr@cMfT+*#8!BW0ikS(KyBsW3Ey1z*>iY4NpURgOACa3MEu0sZ z2uivxd;$mjobGvwrm0S}%QE2rBRUj}e$LRT@U)_^gTWa1rd9e+vphcJ8IG7?@Df)Q z>q8a_TCNlmN-&QT=UwbaIH%*NL4VKVs6MH1$~zV$ldg_(Y51Rh$5F^?D3o`m`dt-4 zM*k5a;Tth()>$ZxHt0|nx`M_{_Js3ppP_Wh45AhbCo`z#EmLL51oD3>^*oi0zSesV z>w=b#Nn-NttdRb}6lvSpU5qdS>zuiuX{YlAuy`qR zbld|A{q0FPlATVXWx?KUWh*VRTm+8JI$uvm)H(c!G*!2WVgmtqg1p=Yl7rP5RUDG82U@?6otsrH3X^}~g|0jEWk&gn4)*y= zZz|$?#y8@@nW0%AYNbn4T8Az11O!X*MMi(wn_%sY{aW2KUxC}(kmmi>uoFhCYGV`Hy7K-mGl9vr2R~e8b>p)NV@xema5uZ5$Owm z^a@7EFmRZN1lJv#enmf+S%>oKz{bcTahD6w+yCKEg8AI!bKMCODj=iLh?gA(zifJU z+({c7*ZzHoavJpNjgm!^w9Q&rF$hgw@gHn3f#BK8CZRkZl7 zn|n~D;K`vA2Bud9Hc0b?gonZVTOeOt zRYmg^>KVAzRWb)^gS|StZ!1oib;#8&o-ZiLaP|W=xk~7|E@7;7X&Cg)!VnA+BTC^K zub(h6nA)-P1ny$mnQzN`NgHyL4X=QX+NI}pM1dZ>1RU=&cf{qF2*Jlg&<$=4v)O~| zg%1rJwV0IRr>9EfrT|k84@2}RI2w)-kdP7fE#_g+lTesEgaQ^28%?_YMuEjppuGpd zxB!%4^vC>~7!7w6oZT)`pS;78p#=nu4N5=@#w0fcXb6}(l^}maVW>cfSz!$1t}y5W zfO>oslHL9uXg^<3C?i=p^uFEzLJqB~fojJi;Mwt2vwsEZ*@}T#reo|Z;9o_u4Lln( zC~Z(1H+7G{e(C_a;@-_WfcKOvafC)bn4cY7VUn+WTOP8vxzzLx}69ZxfXzBB@C`trV z+$Hb{w3yI*09mOuXv;Ey1vuC zW+*Z59tRED*6`v0s|_Lu-Fqn0j@v>m~EK%3Z%1L7cZI6N^qK$ zW?q&;aR)0xlVovF^FMrs!cR~zeR^>a2=rF)wMLvxm@qz*au(OsIxgxLY!7u}X_5KV zKmNwUoC0N!u8epecm7F3fsC;u1?t^ajE8}og&)XS8cNB4&6W5u9}x*N?9F$ZH+Puw^Xb^ZXa_|iX2Zfcs-;fo<+3N{$TC(k#Y^_9 zKfl5Vo{8hjTfgkAP#IrLtd=b&l*+;eN}FzS{cSqs0vc2aQn~3^6TpR9tH0-x!cB=p#jz$t+W=>?1JLEwF@OSDqcAQliZ{sd@DWz8wBc z1kGbN_?ipEx-b?*ML~l0V1$+PL*sO!z!5XWNLW{bHu{b^X5RCnvJy8|zegbd(Qg5q`NI)k6+X+8a3y`w{k?;;D5>BGskZ7;C z@m>=6`W-;A)~cgMgPzORZ+?A%{Cg}58l&f!XsRijLmUNqZ;BkO$=&q+AW;&~ohUt> zdhFPc0zNc|BeJv!8Zdd~REQ*>`!3Q|3F@VfxsB_(O~6Z8a~oJ4?Cty~e<6d6pc+h; z^wFWQDwG~2FxLsonAr;u_(0|?!R>SrO|3=TwL4B9gbc8Mg>)_w4Cj}!+&TsUBzv_| z+Xf*rGS)bs+lcWy*cD)PR^26A@e}&9SvLgw`aJOhxRVOS<7{A8BA0U5Imq7=~8 z$R^uffkqDqArNA00E)HTlU%Ab`JimvGXlT`MpR>^#{26{?{GM5ff7%=T>le1V)+Dx zN6&+5^KiMc$a(&5=MnJm)Ar9`21tu&MqEJHNCtqkFJBLUkAk=n4aYYzM%a0vP7b)` zuag6A`Pa$iwQ}*C&N9*bz%qE!Xo{=tV=R+}X4yppBx%w51*D;Ds)JeR6ZTdLfO7IR z?eSxB0lBIKI-LM)f!5OGb`i;{GAX})VntS`Qht$eN200~xp3;NT}*q6Wzf+~>*-;1 zhEC4|NaWYsR|G>N#8T-sAMHq{-!%POv8Jp=f@q(%gwnHv>C@g=fClXGvn?c1zraE? z=)j>>k7|T~r2L%^tclpw{5rje({z?)vQl-!5~Cc$I)_CQiXJhHUP%}Jr+Ns>|8*F^ z5`ipoMK3+6@rR2xr+w&r&PeHBtYcc57MLzrmo5T z0imk7@K(hL>G^#&SRvL%-9=iz#$A(I@luJ`Pibf+UoPHbw0 z9GSmZWT1>w{|@a_R$&7@oc}aO$JMumlI_)8_(VGOn$XzSu5EwX{1Olx`*+^b zNGFJeF=95WJDyDmiIEQNywyjO4R}?Nyko|Y2*nb34#b@KVSvC4BuM!nWo**_K%3pP zjE@`VK)I5aeft&)h04N9aL}|@8|=F!5m90(aWs3N;uuJ(w%CEBihp)Xl!EFbAawxM z4=I&tRPp3L^Nvd~nTS>^*ef0CzesV^(@6!g2A$RwngH@tBh9IStqchuGk{`xH3-ZN zKOjB0++3u$FBpj;x^XdKuR^$4adC#9vcA_~yt+x}7$o{)aSU6v?Jr?VolWFmD&wCehz zN?5GuwH-YgfCog?fSn;DqDDiA4$r(e=9XRq6o2;dGB5Iv<7bQ^;9(%5@Jk7=qdL;D zb%PG+rg}&@%c9~WDjegHzit}9I6wFS4Xmy~8CrYe_QYHcnV|rFDM;zY zwQa|fBZyeQfQso!zD`4=2!)K}-=F~{F8T+-;@`c4*q6d_JnaOMB@#L6Jphv2bO%b3 zYdbh_sOvPOHajik5716mjciQ7b7y%s;}^-&ByX6t(~8Uwf|GD`CV;war-s)cpl&;8 z2z>1C8$w!ny?)(^dpr0guEp=$jTwI|f+r%^`&gEfz*_i%nhpDLqNq8P4#|Z^E1>Oa zpp?o{F*Gyf)~MV)@#W1B%@>{l{PR&*V7$DQ>h3+JBMWn@2dMNi3K zJK(OXgK%$tOroRiL*w15?={T}zaF+ga5K{TXo3DD)ntjNM;6Lxi8hXt(^%3!M^6ol;=_SaCi0fo7X!caO$i0dk`yYOc$^uBJCk=E zHRP1Rgm!g6VPKobI`%Aj=`XDJkv6OizTT8nWa64hyU**nx<1`xM9^$UL3wYjz+xH6 z6#KV8;fmgab(@>QRu3-f4$0+e?4OyGd4Rad_XsHS5P%Nv7kIeho8=A@aTZX04HA2; zJ+zQRf-*fvs5K`(UR$?C7tsy>OoVUd<_(%ZCBEB;xK`K5agsDF9(iKm|bO0^s=2!;W!y<}MKxx)$_dgxGq#2+U*#Ks>36B@n3i zh=Ya~U=i>FNCVu4@}g`O2k+VF-wAuxp7?h!2< zXeI>{YX{UMA{Ef|il`Zeri)iF z5Jx7j?(3pBHoXWUAxYSYDTq8PK<<&;$5mu9T%T1uK$xMuJI+(Bu{~#h*7+Rgy(pa2 z<^gG?V{Ct6-x~8aPgR`EHpnYOkTp8qyw$jbts(eUtS6U$e{&h{@JT{UZS~AG*^6J$Mo=1iJ24i zWNq#R{t%PIDnG1%+Fc?x3`(s{MaUZCJI0l+ykCVr!&)pVSK zw!_pOMUMwSh;_ah2@n)Hj11lUm zDT*g0s+?SAqLa2%+`qc+nKh_hUb=CpoJJLnxC`sk-}putTgo`Z7C|j*MffQmgqFRh zD!uZkj|$m?wQR;R?eP?=U@$(Sw!y>|QHz}==aIgo(!$CFa38UXLmcWn6?t_VTF-v@ zG3;J;8}R6gtUUrKOONi!ErVbEep~k>}Gsn!Y4c z+2g1Yb!n~lZ3H6g&t3+GFR|g(Pc&+dc z3#j^5bWhS!3eAJzn~uF)DPo*d9jt7XsTMCa?G>kZ9+p!bz)cC&@x(>oj?MrabVi*vn^BamzAF3wYYh zU?BX^fkik~?`_DjU*Z6eW`^?xcp?9vH9(tMckAx8!FAI)A#iJNrwSrAE#|e`d*YVF z;B#mIm;6(?gGqj4qP3tTrS8vNgKz2;t>to9()evfpzXre*e-o5Hf#44EJ)RR>L^Ok=}Tw0|BJByj;H#6{|9g!j)P;bW6x|l zA|mr33ZaCotdPC8viD3$DUk-H>^-t66_Uv6AVQImiq`LXs$Sps=k~k(ZohxJ>74U; zKAw+#UH9vLzaEm0PY`KuM8+hyp0H4Gr}OzDhT5DO;A_3G?X`r;ID4SKI#h&3`ar|T z#`~WeQkRN2M71htLM}+2Ou_;vP8WIv%oO?>LwyM1DsM`;WV?(J&V4(ml0SbH9TL=- z`@&=|luz1lKomJ-M}iyR!H9Vl8zb<*27|yFjpz#UFb2Zg&z+k zo(mWIZmQ&T1bfQjHupo()*G&>>`y12z6U++qhQ;VD*t8E_vLD|Vjh?yr|x6o4~87H z-skmB#E-vsZRlj$bO0__`x8oQl<#pUONV>X+wYf>aUELQgz32G*U#@cW`8rh8AE3= zsa(QB>c|69mnOQoB2@X;mbyV9)Vq6PFZ>A1EHRRsOC&wLWw5gP-)Wy`_H|2nbyq|g zBPnthi~x1%4Gpr5-ZCJA=U@64AR=MD*eoYt*yDU#JfffT-fi)j>+%#v$5cXytnjab z#@Q3s?ms)`6Z~$2baUioJ^f9d_w|H_rjH*-9#U00b+heOR;qt(IZW|!$NCUfva z#;5T;ZQY|rH3t7&2lL zo)F>6;WlhdweKYKwb7U)w8i>zsSO^{s5zG6oXg^NrI6BgG}7D-+p)^L{w>i`OCyCF z6;sgmq!*y?#|@sHRlRLAHzq zk`2p9%J1<6*eP77Kg%Fe6Bc2_X*2#93p^q%L9m0mhj zR|mu6G_J*`b_1gw{a=uZICVCGU(6^b>+ygAveCp29%B7zr9Wz>ErGJVqT4RS)ZL_l z@W|i!x)x4=31GAk$2`xOP#gI1Z`gwLxMF2M$sOaLK~&}RgrjtcF0K0n2beXD`C2mf z)ULjkyAkG$b_zwSkZD$Md7q;h*lO3b4&XEm{Dqc1W_?tkDZST1CGsFY1Ue=y+&XIV8X8Gm_Y5sotTM+T*O ze>Vjiq0UeH78w{z?$LE_R?r`3|LB715MdMw=|fK;umi{^ocR%5kf&p#gQU3_b%W3T zk=N`%=BQ55Vz|_ISgf1$91y)TPI^v$G9h%d_gMFAjFWeq;)dn?paHRyQ)n(f@Vw)m zSC{f{(RQDOkVt^WtX#t+$^{{>GBt2E6-hF*NyQ|VUn0noJ6rc~% zoxG;3cQTkNQN>$B#3}zYrBXybzO$KiQyW!U@|^J4jL@CQnkUA%=|k3?m)>h<5zT=u zlDXZn8gRW>K=J{7tR;)uLGgA&yfx!Fhl%einCJT9i#6SR-`H>Dp0IMh^Aoly@eMn& zPfBG+lD@|>LJg@5jJ+z>%(z;< z;j*N&RXdd%v8Oq9_bRzw&JoHnqNYQ~*GF?IH!QzugeI7*mO-&41gq>EdE;rLyxaHv zYFIIeJZzyL)61dkrpsTyU$$sz>%@+`1w{F=?EN#JJ2y?Oka|OIdKdhZ`ZxnK;UV0T)#B~W$W^HCYo5R7j=$gEIfgeYmXwkb-xDg*k{jW2ve&s=!o z&$#aJ1^v*`7xl>^tz)}Bop3=4K`2{2hrT;HdR|t9&EiC$<3?8g#_G&~T!E712KTGc zno~2p-5Rp=lJ~2k+wWZ~NET*eF#dQusESHd*qAgcmT=3P`oQx~A)Ilhc6On0Tt$9A z(6(3RWNDImHKqC-G1QB?12hPpaK6TmeB3I+{Ja3kLod42ut|e>+az)8>4_$42#Pz5 zvUuSPLT^^5}#Neh7b?L-O>mz>|!uiv&NElY5*+xJm4X# zB%?8PAGp3>FS3Bb@erMWce5frYZBTN-J(#~e^T%rYivak&C-xYts<$8${j)rRY?GC zS6I}Szn&I}ZU9eiLlrBTr+3GtH%XLdh|dcrt;#qqF`f)WF9@(~?o61GR;JtEL}xAl z*8JXmSBw#n&oU0#Gx7p|c+E+Lg=|pD)hwE;hfDR9hv6^}BT%&%e zCoTj`8EV^J0P09z&GxU$fa1qPpbbxKQwNy^0|4yk@LxbtiH%ZQk2Qf)obPrgiT*+Z z-+sBG>4Fu_!s?9{N|h}Y>KOYX8~e-Y3l)lay;g%U^Fh1ZGpFRUH~>kyG*S})B(X<85?0#f^~$cOx}$wk-my?-vCBcE z%0jGwtck;@6pCOaPdfIP9>lVEK$NNokAw}5B?f%!w~rDvhwx#nDLqG0yMs_wD7;yq zoQ-=ONOHP7h-YmI5(N0r3Y%OQu`lNyh3SEFjjj=pd~?3VF^57eL3rxNa~q`*h}J!2l}IWRzZXdaF5qr&ss#)yw{Q_ z{kZE$OFGn4ytNKuO$`ete|UXbK9XIcaa)Oj^-}zZJf*5$@^Fy#d4#O7bGvt{+{{*I z*1@$U1=IP!hr_nV@AEwkc?bpHw=$Q1q^*(E3$9B-^btoO4UK^!S$6PxiL5xlaE4DE z#7a8oyi-HVVoh;&8Uh0!kN8e3mngij|eNNgWY)GH4 z1FtQA5cfR*2>N^xR*3KQ@mUdU(flERY=XF5_FU(937RNt9~%YZGt?9-`rncQd0ZcA zx94es1Lk6kw*`rllz|Ws&`LmZ<=1vM{T`@@NX4jSv}{jj=rl|LR-rheV*<<~{4<=v zv5XED3W)UJk=TYfH8NxxTsj?iZ1am$z;fhI8z*E9FJ$FM#)v=Z(z{cUC)NFawnhwb@V($0ULPCNgqde1M31)hz!Vi^2Z~jZtD(OlxGq!IQH83NZ=YU z!LUpD0YGZfqp|HwfH*ZSuWQ=CipEx)EX97&rz?ux^ZFqNdlIjk=&MwJdQcAd9>f}+aCDEb?HyX^> z)r>r!?QzVfqG?giB9KQT9*NTQ85DNu(xE2us1icCZfo}!p3LXXEo^^q|X=u!+l`vuNlQgoO;yfXSQZW zplO_wUCOKFxphCTJx}MfCacRZ`O}LbGFirDM=DKX?*%V^^JT7&b2-vtdj-W!+{O`~ zK3%4Yiv{oI-mDxD%oKiT6yRSA9LP8PDMR+Q!?vS+!rt?xj3?})Izr0?v)!vx?nQa^ z&I_(%neA9qPR!dhyXwFrO$1e`{f&jUBy(1cPv{H-LwT z6uH+ZApi^_+>qijIKx>?_WcQ@*{KKiCZK06o4w7Yj+9b2TtRXX1Nxn}1n7d^+9l(a zL*x>wI6fOHA3-J+uF_t^X}$tb8s}XzcZ={t$WBLk1tYX$s0IGEg<#rHJvK5j2Z~4a6iRVk%fl2;-os3*)?TibMmS);u z(#=yvQ|=i#7#Pg+U|_&%A1U+9J@7_Afb|Gkw(=S#kk61fEv>?W8Z=<8IiE$%u z(jL}cs<5vnx1hw+$&k1NQ(Rt!y#~4bNo2b!h>v!~Ni9+$8%jHCZ?cLLx<`%H3@19C zbT#gt6GGZC#YHAqRW#X#3i=j?U{_oxa>Fk(;OgutPRV7wou}g7EQ&%_eY>Z2LWZeJ zS&|%bD&7bbtc*_a=RYK-fA5?`7y~oP&lEWo#kg8E=}n7^V_QBdjq2@;CU&3A<&$Mq zmQaZ2)e#hW&35^oYhv)-p{~Q{>0e~#NpQ1jRT$;`ND|*Pkrhm@>xqIBdVFW&^!aX6 zS5ye~w4JcfYqOL2w>+O17Fqde8yIR&{I5N0>Pm9swTmqJ?G?cpy_+#%#WD(>z^76K zxi*+Hci}|2b_ry;v9c@IFM;_ax=+lolgWGj4Kpmp9^5nSTO^;W!VlQm=uNP`UR{@5 zT3FZCTR-M0!UtKCVgnLc2{-H#Z1zQ+*jHA{6hb^`BGlG5FCuS_an9Q&E$HWGjXj;v zZBRnxgkI(67kbSeKOFSNWoR`}P(+1JQa;RXysuC%qGCkrbVFU7!=dIvfv+c>*fp%N z`#HBt$Vy$G-BNKT&^F1rqQp2V+g#ILA5e;|GhmXP9kwXaWCw$4dKFH>7W|jm%l2UG zv`;@$OWkB>dgV*eCO`CP;}xk&SD{UHJ=vLR-R`)V)u*XKENDFN38x=Pe$?klmWO2l z=a*0YgTY%Wi-hoc|8Fz=Mm!qw*a@!*?zVii4l5$;-rEqGZ6NT}rBU+dls1h9qr`;Q zzest9+m>Oz6qS^q`QXyv>>WR``=E(~bpb?_=@oc69`v6L!D-~WPUy3E{7rwcBNx*w zU?F9oZLe!}q-qO(Y(^H;iY8JEE4^EYA-*ESB9H~h|rObzQn;h z`mGF7icb5;#m;DwjyrWvWZWtn${LmwJ8&(DDk1A33&{ci!VH8u0{Rm3xtjPhIW5m; z2XE`gljd?&F}Vd=Mq8cZ{w1b-%YNvZQM=*`X4#H`E0+lmnBh#;PJLKmb%T2;ITVZ_ z4MrLZul{3Vs_d*ikY^p1iXB>j_`u6>7Xx ztX2s%<^Iiem(>k}cr(^$b{!QTs^djui2%OR_$+NJF71RL=B7On>9|bKrMt8pOjNt; zxnrIZ<-ktqg~NBy_GgN%bF%+qjdcx3Kw#wkPkNlY6#SVX+L*HRXmHOs5 zUZS~6%A>wHr_J}P9e*X3gn=wKwu*x$K2~;oF*N~FNb=~8R#KeIte3HN0_1k@)vWsl|<0VJ2WIXDA@%adHtaHp?h_W6%M4<@SA}qt23kZ4rc_Ftf?HOiMju2jJ{xK#G;)(9GgLTT z3eR@+q5mQmsSy`0RXr7(&J;U1J~N<83Jz?)ersO_NhPdGVO?_Zj zX`&%dV=4MwwIxRt&5r%V`oa)7+x=!$cN>$n-+DM+tlu!8EXB9aDXhi2#eZG5WTE$m zUCDBLk=M5MXnSpEc)Xm^KsZT@k?KIZzW`bC~Z_ zN3fc*aZ?YFy*eQumCWFSl7m>gxA+x;0DVwM{(z7GSROPSjlTt0(C6Ey4c=O=QeLw^ z-%g8?q4)cDTyq1|O^4b=YzSIo4(#dv{+~ug_;u!w&MKW`!+7;!>=v^JjuHsNr3`3< zFdVrq8ib3wB@G!zG?MWFL7h<+%InN(Zx8Lhc30mZd^QS6OYl=Ipb^H=FnGLjDq0r} zJ3+F~+G5^Mg;7g_7oT?dx07VF4|uts<;};cAZ*xiV9!x}O&#j1O(0GA>#|ak+4yJL z0}+5V0qeM+?#PHH>_HmRlb|iZ%As!_4=%FE0P+B0cB~txD|fZy^5ckvb1b$ zTY(S9Afk*#d3_2ff@>oGc9*&2ZN#}S#>Pv}pi5a3z8)2Cnpf zj#M(&a|#f7#N#IkfkDF2!iBYNqt4+Tb?I2W2wglCAEPSdsK=M>SFGr%Yq zknd+qphn)?Fc+f*J}a%CeO^8MSV#e@O|a*WX};PvY8mI8hw;LNB;!wD5dXGH8)pyi z5P`gds5QJp8ZD~Q7?;%H)!QY_K+9arAp%R-RxpkA?_2c#&s%_FDGU#e-g|J2a~}EL zgH13fpYQA48J1ldF+AuRdl>}j@JEo2_4WzI6~O?ajho6_FmCBA&s;%$`f#j$A3?V$ zm0|C&JDv#U5 z6(~H5hj}K(ctlkJiwR^@CdwSle7|ShmJg7A4GdNFNggs;66{8-X98t&>d;6+BYt2q zTzTK2A4hG2 zh?lCglcsf+mW!=`g_p%7Fu>&#*M#BmxpJ+~5r!@H_1Hqx_a+s3TS3#kcIWIPe3T&= z@lAIEQ+1gQ?8gP#Lj;>Rx(5B{^ObC1Abt4Y*B)t8K);_+B7o6h{N58L0i+3;NE2WV zNqM&;L)UKO#+zA->~=78YaccvLXwSP=m2vnf$1Fe=arBU_uu#@q0*H)t~o|4=&xX_%qOr>urxP)`9`7O&CV7%az?|QGebC&NHKW#2)l+ zXN7K>g&F>Lm}OeZB@?b-pac+Bost>;ybvHKU<%GeNy60YY<~4`jIBe?n3Mg_2>kzj z8S?)-z-OSX!rohEVZF6M2LXyZA`Pe00GFQ5Ee+~mBsCDrfQ0yz7;)210&ze_?0oS$ z7k<}1R}fL+EIfd#&WjF^`Mf*Wq1HPh#qj)qF0i9LaO~C`Ag`k#g{`RK0FoY%{IllX z`<%r)%c7Po#js_w0Gwq5%;}JKa0*X+$}jo{poqP!30gdSA-x-txzHFES-S)JJl1bxX>0nD)J5g>y{e3@-7Q3q<<6$W@6QD@kM<(Qt%>rDV*1jIR}dEf zQGw5i2|J@>j1_jSsrB(uc>D|%YHL9-KgrNAbC3Xgbw>EnTBA8)UJCQ+H+JnxJ5jDN znq&iBM{|m9F_9_Rb#vYm)r!ofjMk%||Kb_}>3S8sIx_m?R2k9(Qk@H|8tkLCN0Eb@ zlKeY4Ejq#Kb5@~u7{CM$8aTVm-ZNCv`yLTXB?dnOIL~V77ffNaR>+_A&!BM41cQQg z_k`fE!ZP%5TNqAnym+I!wQhdeBNwpENzQT>&BfNxJ@4!A>;e)Vo;c6W^WkWd;S;_m zVj?4uMv{rP-<$63^>;a+o$G!+E}SD*5uOjZac}a+)qO3t&m=GC8Gi9>YW>w>Yiroo z6MhC;eesLfK)>;?<2{_8_scxyy%D+mXXlHvXOLqz4zYvqbHyN5o$eds(8*v3m&I`HLFUFO7u+)&Q4 zbM2HtsqXKeEx-E~?hXFT{FyWG>+x|)_IrH48-!z{C35re=$)XG{F7ml z)@1m3o>9E*Z}F+Vn%ZQ9Ie(T~G41Xx`!KlznM$)eqluc*)M~jsr;kfbbl7CSckSP= z{}>X5he3|X85aN3PaQ?cuiSy8MpF8axAAw?t8JFtJ83{fkedF>K0|`wx{l`$GhMs5 z`>25j?jfeXN2C z=}RgJ?oPJRTvt(tj2-U`DP+RoKe=c=?zt7MR+s=w+BM(EqOkW^iDheyxz@J8K{MCw zF4mUwm_)ZSmiwcyg)u#-B$S(dn0JFCkfG{G=f#5xlG%8Tn}B}S9Y7Mc+5<6z7By2d z*Ud4U8lDHer1PuH6NsVH2jjc{L{>>hD_ z6NEa$Mm}+^(|d?%nJYw)Hr@-+6EPUu#6H(oSIegh_fHmnqyksvCCiHnBkkh}QG-0> zMUN7E%G4r#uAC={_xvGpL6E#d#>BB)4H9u^uzPm$^Tk%|V@e39+R(P7Nxc_EcQ;+y z1n9?X^fR9+ob}g17WE4nnIVl3O37*}_knRkVkKzLAeW!r-y^mcr3tjF2Z0}6X#Er` zX`TSc6!$^Uz|O!BN*J~4LLg!MJ|vGZwtaPkf8U?y7i$9;o)tp` z%iFOCk56d6S~m)Wq7?gH2zk)N?u9%c6)zj*6C^YUSUA5oO(;`>0ZuO*YFM5ZD~M@4 z-7h2pCf8VBw4hi`>z|-kZLnMXvtGiRG~)63#M4NTVPN z@2==hQ!5|@{n^eq{pxI2lpgc>J?Dz&;(cumS!{!}avVVj(dr?7$<(Yh$Q<$Q{sOk8 z^^H+Ejir5H!=_JTTYPbwafoT-S$mfFurBMpVa=>a{t$&J%gLMDN3sXZ6xRn-vd`1sc^2U!DehYgDaKSmTSd5mX1I~|lMP#PT)M6=L$E+ddmK@wd&IbGJT=6(VK-Pf zq$PelgZ#bhUC(3Oua|v-my8!QpI&6-+seF>s#D;3#r-Pr@ppaW&>B|huhdDh{(NRJ zE81(Z`q%c;NUEt4C+a$4-us`+@;C4-qsix1j55`ARN$lvY*--D-Dfzq7NXhgs;aBh z@;>Q(gqSu$FySE|UIe8Bek z@L4`>jpOeN%P^BF3>w!APn$j2HcPTHRzU|U+l)VkxYox%ajk45t_5<|q(1vs9Jr-# z*~Mfmg7)bH8$(p3A^3@ON3WIz6{=XrEc5}ebR8s2CJqzSxCQ0PQ7FJVE)6lU%}(Y-+a)1YAw?e1=IWuR;M7V z%8mQ6TBDEkdzgjdf=YvIx@%PL|D52iicOH9eVN_vkad^vGx=m(-ra{Z_9?Gr72<=_ zHngdChEz{286mzH?zVW?1;I>TaISMn@Ot8@n%Abw+Rjj|8LF$&1SmxYP@8dMPpTru zgPqDt+u^tv@`7nj?R~1$(LDGXL!-rAL6U+?RqMCohYB{y+Rok1bga~vJZT&C^^#D5 z<3^abdqx;hZ7sg@*S;xMAzs&_Agirtb6sHunJ;Uu5~;-jk9B1+lCSF_Bo`UTwb4L3 zJ9$lV4DWgFzwPsCwnfI+i4yrXa`tAy0{du1A?e|#bNW6eDlswp5zXCQFpG<&Rt!#E z8UGrtol!@T1INUnh{Fy_w)#cIM17y?kZw6C*d2mcBB<1;c{MxOfjhhxbzNUyWy;^+ zQ3B*9rzM^83`Bo&>GuVge@CBZM+&WDV}ruKpwEW~kyD&O_UgS5Q&;^`aINlc5 zl>UqZx>jeXN(^3OfEaaphsx5xysD*4&Ju`1pGK-e3)0i98f0(9n0h5e2zSCQ8{ zS`~L}&FBjS*PlgPJ{Mfc7x@3{4%&R$AVt6KE;`uQ;>t)BrH5YsbKrJ4r_Qu7y8StD6KDtSGYRpw(~sz?+$IHtA#rflWl%_L?9VH~ z&hIr|SWR~e37!G$r-#6Pgo|F~e~)ODe9}QY$jTESkE#N;K^w`QhlDWflC%Ebsjiot zMZy1*VM6>HX}Pv8*xl+wZuRQKTB}1&bBUeDNn;{eNSVd#iIls?Ne6Qg<%~FE)l_kK zkxqxI%5qxm!`ExWFKfa>uJz^!zw2sm?Y#9Ttng`=okHdO?By^kGI2)d!}fLxHWBPJ z6bm^T!6UktLYOG}^bXHSa8X+ym=emhb8W9QkG<1%jQkx#ha%SoO-P?=<*^TUOWX+U{96c(RNM((SYZs@EDFgWw=D}{KnYoXOuFyJ57~t>^$3ipzT>oJ6V#+xIV;AK z+-D2kYOZ+7vg6FoiTE+ahO(`MOqi*c9kS@1V1(VB$T)4zialIYYksFoRVYz{!RLhn*J_+^$Ds@ck$@XD zkqllo3jy(Y~Vs9cs*J{AqzWpF+ZRgUqIuNS?p$T}G6)#aY@ew#d?fLVZbh@1mC|L~?hqyu*?&^Syg_+*tGtYA!feZDSQl(2Od-q^)x9Pz&8ZUA{ zb@n#g3M$wOm9R^WDqzV+G0o=1dt(l+M}5~~;$4k$VXH}?_EFcFiy4TeetsCyxE)HG zZpvATJ&b$jsxqOuvg&e`%RM{)D$qgHdgXZ5pH=lXNha>mD4r56|0IUC;IMXl`|Q#Z z>M&BpQ(~UI7Z4~Ry(wnJsVUd>4vCmFAI5>eK~Ftbh~=7U{JQ<|Tm7o7*<%eHKNE2~ zSQxHJD0>{6(UGv0ftr6cGnu`PMHkIvh}PrFiX3lpCejzjyHO8aQgq%CIS4JNe8KHpnGaB96rNHP7^%Q70GF$43VlvuIGRfg@~_q|#>1x~tN7ti$7|_t-A=dYjVp9iUZ?PjaU1jR z$!;gPomdJr(nGTjnshUHcq;XU0hz`q}X4IKsl(!|zDwYrtF) z#ufr#CWVDeABm((v*Acg@C;lucjowue^lR5h*$kP^KPZH?-jY%=;eU8ZX~J^-XIp! z-M-VQ@xmD;IGPWt()`AzT_naex5eg#bN$T;rH`iJq7=;3q`T=4Erd#F#(INkzfzWV_gf~*JPhBgserGs`!kD@Uzho z3wnhp84QuUT3u1@@m!aU5#A;I@mYiTAwN6~z~+Z|7oxGEqM!*84d^SIr=o>fV>B0q zrRcjj#uP;A`skS6k<1^z+_mU{Va!0(SgZ7Y+#k3B#sS|5nj4(rN}8Cj5C;MWT>t`J zz_RepDo+x9xs>mTJU9Bc*}Ad)!gK}?8dqlHyYAcOFoBq#9VC{YDtkmG^& zgnZgK-ba)Ly#}E^cL8%ST=EV#*cZlY{i96&B^KX10+}aL1xB^d4SxB_+=_c-T=~O_+e16ER_r?yNQbL56RKF^t7L4AB^IAbYn^V~h``2Y z6`CnP_VJh2s+AW>loZyvQ^r;!vN{F3vKwyvVxXdjWN?qqS@k0~j-kr^ zOI=%n-6bb__&o}b@o<&|As? zPV8((^_>0ZVl;m5`hT==ly!Nw9Cz~M_KCmm{~;_LVR^%y1Aj@w)DTpiCB+3MAc+F; z#B+O`THY%H%xDp;?p#pygcIRI%!+17HEFmYo#eI&1D0l$8fKT>KHrL7 z!*_2ZXAt04AS9tN*qigAxFnIz8is`ELjH7B!DI?bmcyksHRPZB3EJ$l56IsYQ^VpPgQ&N94LKzE|XJp6WRV+a)79qVFVpLzvn zqv2L9#e%|UmjY1iP3|?v+6_6vfljX}anP)}JD>36K50z9KfkhAD&^9hJp8)^zM}o> zoxnWQEqibUF3FjVhYK6d+ZT#fhWKjR;$Y~5nNsQaLchFIVu90;(0;UxO3Uk8c1n#Y zD{PVmTqnTP?%JCz(FNUeJ%8+lHDR_ra_8POj>@sf$)ZKogNMro1a0NFAcjzugk!=_ z%oL$BS+=HsC{rPt5Qd3t)zt^)$f_({&Vo){SrV917hLvbwlS=gl|jD57f)ON-bAFa zzem^sRg2MpWFyKBHis=PW5nddaOa5Y+|*LCBl#PqO;6@PyX0yjc6;vXLbtPUgXHEo z)egtgWNcn+H;XPr)+ZT*2eTiSowZ`6Ot#67=}x4S*BIY|4|jn+c#R8>JLia?gb8*wSh zl5n9w|G`A9t#|_J+^xR}OWn=!Xrwn~+NUIDbam%pkMhO3< zM%GNtNJDn1WlaqCd>OGf`oL}hl`xJTNG9BO%5myJDno}TI2Qa=#t9Oz z0v>t=+%lxFw-J54;SUrOxb{YVJQzthjaBiK%ZBi!-2U60?ST6dzIVv2%M=gHO9D(& zC#s10)Zb`4@rRRxq)<3~)BY1_a{*w#po%RQeVG|XjUtR{hulaJH6>o9cvyzozp_MT zId!~G$x_mB+g>Al(*U#Mde0ai-&{mLGdb7Xl7aqY8vB;pKR;De731aqT>8zzg!=KH z`PM2)gwoW?O~w(0mM=@6Pcu8p29(eV_+RdNajJC4>2jxTnRnf>jcY6no&JlvBuqavp%A9k-U?h^0713SaOaa`2nQP*|2iLHXL&VKXnD{i$vi5onAfxjv2K*Qw*04%#JSTH+#%b+~#oVa%JB1W5 zPwweVTzmH3;w!4c;XWt&Si>RthGmu3rBl? zCiN}ijCZ3MO_rt^g*H7lUf5xAnEnhz`6)tR=3le#fKcUnZKLsnDejqY)(`pFL%Ww2 z*G2Xnnss(P|12Bvf%!M|C!(+2IsH7o@Ss1Q zrRT#rcZr+D_S%bfX-Sl4PmPZ>ENv6zE|T4(>|*VZd$~0ua~3_%ozteoi!lD3~)st-Fqyh%Jg5dF3A zH{iP%xXvZXs%P6n>C7i-~3nd0; zite|VkCtf&FDl{rnCW^8?lm1Ea!|+6(1NO-jT7GfLQzLCZ})&5A{uTO{}-zZ*k2*l zzHKUOQfNe~`|;cdTQQyXH|6aNEG@UQ*uf`Rp|m>Hd4OZ1prY(r;RZQbDSJ%(tf%%P zvHgfRX-w_>KC&Z=Eu?4YRyFtTnGE9r)NM*l4bon#wcSgV1U1l3R%Ap%^jFW{*%56v zhkAIrUCrRRyk-vDdKL$^++CDgIiuJ+ajo z7eXH_=XuWe-XGQ( zD7)opJtsX;Z-eHusi{-R;ysaA!3}kt$)L$X@8;z>0bI*!Z#ARSTwGVydYerI>rr+{ zhAgyUOx{9bn-X=xP>Yep(hv+H7owekwTa}+{h;6Aoz<&`I7f}w0cy=vrwZQL?>b5& zd4{)N#;=Y4{Fj7}qP<;73hgEN>SuF&z4ay$)e`5G`WpTd{F`tNx%~6k5?K6O^ebhX zUX|r#p9_;96P@ADMWHc!en<5Gu6aI{@I;$pNQt?iJArA1qO;#uCP^^{B!&1KA>lqlOOgEixOg%|_Lq_hO11Aa`_}iqUZMrJXF8`r0o3ha#&AOJ2Yr4@N5r?<5 zsb+j_O@1@E&?oNgyI8px8=uV29$U?=V{%mF%dsC$oE?^zj^cId*26wU?sQlUa_`=F zr9A!W2F=6OkwhX1cfwqdsGoE<4=!`fJ(hIpjzx!JJQoFb0ZjTw|B1j6`izSaD)qjYU8)~$rF72zM1g6jjzM1Fzbo&A^{z`R~+uh@BdZ)TK4|Hl*KC46rCBle=zmT^X*Wk*a($836BT%01GM4 zu{1Z1zkfpwHeLun5@FCg5GWB*=ZfB`|2V z2at0>e0LlZA59AY*TZoDxH1xo0lKaQ=-P$2{be$nQ7C9?;~i-!yF+Ii1L5Fjj+P@_ zZdUcrfT`|F9)I99BBgCm7PMTBAHUVc5LJ~u(5|(%DEO(1`;mv|&UbG2nS!o#G8vBN z3vWSQ3OmL%N0+1@!@K6ou8f72@034I?ytEVSD{&y&gdih`2FUlizY=pp?B}GoK9&< z-?jFTb2^GVMUiie?5RC3T-jnPX44koatHO|<*j=^<6pQQcw|4$@%)crS|are+h$tm zoF@=0Srq?+y3OEK;PqdcRccU2Azj(ptxApcv_mZqnn zb)xyDdG7ILk4T7S&3yqbK<4Bzmk;!i%*;OGrfp(k0=?3iDW^`GBC}G?_ zk3krT!Of(>(`eQ8IqzcQJ6#p@C(PN&9=XIuR(chtp0MMr5G7{rTFsx&n24A6$PPhC zFnQxsyGbtuoT(VEsJx>W0j6mxE$JXTgCvu8nl#g=f2lLP7z4X*NNJWdpGA2WV7P6} zn^ZB;Ibusu}kic z>O6~&VOZwz$eNv6>!lH9qsM!^n!0lfE+CkXZWHgvUqMYtu2gAUZT{&Jp=911>mvW? zQMeAI`jhfcBt{d@0v>HF2EhV)p%OW!EO7S8mYziFx1_7j?`K6@WTf@i-U=pKNurF# z9^MMJxRNpx{fULP@HQFTJA#R_ z_lF5*85=YU?PA`(I}<_P+)y$}Nz9L{{KQCC*tfmftb2$EZPGy}@Ndac={TSwsojKa zBtaXU_6<@^fp~5ifeDTvFhM841b$&8s!a%>MEUbhCy7?pj?$ZVsT)C!hGXW9{pZPk z(`dY>33#|zK$BqK__I@zi_y|1LQ}73DcWOTQ6l5I@VKnbB-S}Lhp>{3y}kI}G%gtO zPHt=2NOm71zoaFNi`l$RzVl6BFF_FgU~{77i_8}nzL$>--e-(WiXOM>^k?i2(?_@v zR(tn!>W6s6E@`s$9>%)wfAe5K;ILE4Q~uSZo#WkXMQOR2ntf#t1b%8_(vmN;ng%LU zoD@PFhZ;tYSJo%PWY51VJI-~uQ~nBSLkM^M<=|z#GsxZUBQ+aBfOSb#$9%n`JJc5N zXM4Q4=voYF)M$;#DTIOGT0Fz7o${`@uUhJ?Jm!C;pERx#Vg!5 z#g>HM8jS5U92-}^c|m!N9)0EakC*DA1(Cb6pJSYQ@A18jRQ~M~;Jdp#KY8Z9krEH{ z?7bZEqsPL7li4L7Utg%;(NE+#t@QCmoBV?Pg`Ym5GwRAaH*I9yaKDaw4-tRz?R?>b zo2GgYLPWXxy~z)X3w%aK{R7-Ql)C53f3J-d&osZiuzle|@DF$H9o@&gUuPPB&U|{( zT-;g5fN2OFT-sV4sUJ!lAhuE)ZAyQ=O=Jx@@l8TSylN_E z&YXDkiTk?n8Rrazp`3`TZ{8RiZJu>@^;bO#pA6?XIlG*MKNA$ja-0@jnc>eMg;DtQ z?+=D@$o7g*!zYfa;#pUV4L=LRC#FUhuNFPu7QU)9p$&iDFoZujCamGlzdtZGqCTUO zez>Nkm!~a;Gx(c?+f>oQ!L@bPR}Ed}Ci8UC<-UpKh45txXRuRf`r$B&gKJBtUNr~} zxK9mBmiX$H-|FQ#Z9AV~s|jDS9$f3+Rw4pebms@zu;s<_btRX9Kup-{y;sDc@)cmh?3mKXK%Y=3;@tE>9meaht1 z!B-8%1=9!DN?b0aA6{uq;0%6M-HiOA+*h}C3~CDt8fy^h`^6djt_8k)H*PbZ!3`y| zw>aIVvK@od5BniMec=vop8?P5uYBCg(}+~kh!h+{3br8yC!nA;Qt&%c&>bnb3I*4o zW%?W4*w4b^7xRh=gmswZ#&Vz$`q|wE+qa=bxpT=^mySY{r2pqD?6$D@wY|1&{O63Jk$NT71B70zmM|ymcqUq>YKwd z*pL}XGvQ_L&ocr%RudE)Jr;sMK;V+SS3?Kz6e|SeZ;+kk$K83HqnqvL^LX;oH#2Zj z5@Wi5P?8x98gS!HJN$ktop%NscJYn(e0bF8s!@~yoP0zLml!Sw>&WbJwI z$|~9G{HWGKH8p4JmKDQVR=UpxZAl~?w&*~MCwb`~x?ls3+A3`Ia@}>4etG{_uqHt0 ziR}5PWT@!xmBQ51Kn_a`3(KUUKh$Z4>}6_ui!5d<$N$OW$pF$akO7JFnfNo!_mW(* zRm9bBVGq_*fR*4${pe8>_fkyz)3Tw?+--x}6(P5g=A)Kz}Ip zh_z5F`S}o8~>~%8b2kuYu{49_Ee}Z|fpE`nqv3Qyb`% zDmNaFMBATuC;WZVJLm|Y=JKu34#>fyO9EMv2?g|0oFa?)r~0VkGe?@ut*w>NlWWk) z)NX_1fM|aie~QmQGXKltl%#*+s}lV|tscZ!;`G4UYnjLJI=c1VvrBukvZ2HO@vzUy zM|D_xbf*h)5a>e#et`Dfl!=$)??N5Clw)2YOnSN-g_?Il29O)>=Rp?F1HtCcJ#gESuzX{nX+5zvGkjPgjP})TORRcM5Z}qvHhUKYqZ0{Ov z@rMW>IR6G+m*Aqoad5ZB($C+ImSJ#&&0=^GJ-A7c9D#8ss9)o@upepsDH6t?vg24- z3Zg{kUD!V=&LBCqEmxO2C6EpU-J7>bS01 zeddQ>j2)l2vNLZuHS>hVymqt3bZ6!~3hC?m5!_9MiH5K$Wf7CA^-5%irTNHbTDEoh zgZ|ReQ2ec@2qHvpIPigo-oCj$=qp$_rP?U&+W~*hQpDH1-VrP9Bk=pj_HNFz^4V&B zz*UeIJoa92S&WXt#bHkPM}G!l4#c)S)%YMvd@?s(YIc6tq3h=45i0(?wsz zNKd!x`R-sZJipG3{5{p;3y8*G%fCo5VYz{b{8x?!p%AdD_X~LXBfS_pabF2W4gZWf z?xZr7or5oX+PD*Qy?`I5TBA8F>Q)buNtlS^@~WW4MZtiJe&or%xn8t<*v6v|$~-KL zCx*ief9|8Mq(x42%;fOL+rN;LA;JE)iC?hXuHb6orB1Tw7^=Q)2AwA4B`fIHT~$NqOLlL6Y?YNkc|jDy5dTZ?rN6zi`&-z3H`vYh+lF4nP~rP&F7-c zpM+$l=m_zRYQP#cBkvQ1fy@4aQp-8Osro2> zwwX=sGJhs6IW#m=Lz*V-@0y8yv{X=lo$^<69c7b*&u;z250W8h_qYC$B!m#iihK!1A zf#vt*mXilB&jx|lyF5&iYf+_%d@`K3>qx#>z%s1in+dNh)@B3Heev>d0;NYD{Yg!# z(a7S4lLtR;rr&Fvy@YXV^45kvN)dGD{g)`N)pJ5Ld*_f-lKYrpHA0$h(l%P!?)X0s z>sy`KOR@@L3pp`=V0~y5HM8b&yK>qE)0_y)Ok*V+IQgx7x2NB}`mk>tspULz=+tY98{f;j3lo z-8>fIxDtKpG{S3kNo-G_r~%qNQph+c=_$CTdF}!F zO4{~^Z|DqiDhY8nLj(PM*jnA1Dzh;wVT4879JQ9?g6%^_nLn@L z?Os*VWVgXPbq6n zdHX$fH4jMJJ%zzCW$M9`P0wa0-+lZ9x!wOjW>*}di5fQJ@S$}m59&RSzc|%Z?Ec68 zhqc>dA`G}4a#cLlnSpVh#Ev!VrayvVFv+68iU_@bNU6_rZyDIL#}E=6!`EEKnWaL8E3MwT#sEs|&t`_Fd^yloa7~hq#4VkwU1RiA z3)$5V4>is?&JNEuHYlxizy0R>@l)F}?J>z*!ZT*#XWQI;3Fj(O&^Yi*|0pVid6 z!o0|vW$fgeSY^~Y>ctlXqmd|;3-N0nz*UtGjyM@X3xZu(TV2*$f|=2&)#&Qe4^w5V ziO+(EYh+{hj|Nh?-x6Cv5)A&&gJ|k3Dmexy=u-pMzCSK_`SBx^rSzdYZDM)FnF*6rfP|<(BOo2lt8k$;=-UHXw(JiNBan?TWQQj^b#YfFhg{=gfg~H`k*ekH zF_{a}CROALLC0+xVEU9rB4MFOqFzJWo9XZ9GC3HcPw=!pzd4| z`M`^kvB2}U%EgH)^9PH2Cm*u}mb+iFO1uw_k9fKmJKH)K^BC!OwjnEA3?@x){Ao-G zFOwW=^~k0)$zp={W%ihUeoocZuX4&lM#hUKL8MDHh%vk~)~QD&k;eyfv908f%l@c` zzaM_sbF0&y>FN(J6*}CLM#pB3$GPzCqG1DvQ;m$_6@v9wHYe;jm+nGK>VI}(Vt$gM z{X<9c2QKnE*7cg#H~m9uy0pDP7P6z+5O}VUGT`^Jk=U7799@ti$-} z)g#KPz7R$*{pM*bO_1QJ{Cl+2tj941N-9D^wNq_QaQen@b*mL@5v zagK!{V=LkZKyz@qvqrn?y&Z+rVC}8B($T|v0f+}%R>UNR@M&-SRPJJ7kw0w*_E}GS zU2S#afe!CRmrgaJDewxv15f6i_$tH7*H{3QqbQD@6z3?&etq1!NYvI-* zN>{_cg`}oL4MtP!s3g0@K0=PqkU2wbjHSq)h@D(TgWf`W`Vn z2zGs;u4c4qtstL<4sDBG?5vD8d(v4a(#=?ngwh!eq&Cism5c(OTzdT9^;!%6ed#1swAK4~hgW(x6fKw8Qh2rWRX!jVoSS?>v0c*-aI z&Y;%(=dR@1P6Xzh^Vg}2cDbBtEf(h~kMz3)rfNoMf<%qy4yNk&?>Bp7jl8KH^~y$( z((d-l8ysQA3-$=d=otp?mFWcBqPsOx zNS|+`EYwFH7cd-PDr1W&lM<$#a|PDK<$I$wT9f?QwNlZfQDuq;E(Jd^Xrbd&R-=Zp zSfyaE*d}tk;Vn65Qe;yP3yH`#gg$KES|-Ssh#=zSbDZ$hCK-I>`&}U|F8DwOhFGRm z5B2`QxFsW7O-mnExEkF}y4nBOjqSZN?C&K&b{MCi=(fwp3--DL-@$`>U21$F(DlNG zKWdh2I3bkXM{h@X1y%?Y)$2Gp6g73~f=<;|$=|??c-4cl%NtGo z{8cI-qQDmj0-xeX@w?YbX=a=ieNyfvdrLdG+UlZS8fTo%?TFX2nwGg5>k@Mt4*NZmTiPhX zr-bu^9ypV#j^>Rkcn(lSvR*rCiYy2Rs7T>QWgcrm3V|k#Y?i zrxuGQa(g)+hE;i%el-<-kSKO8?A*LM?INeauuh9DV)5KwPk=W@=>Zr1R04Z9wfe&a zRYh8ae>*!*l_*!!f|IJo8L9wY zYg-+KQI&_x4;~%MWoSy8=C%u_bRErCfMKJSQ%cWS;Ddr~WxF|{RMx74t9V53-#M|r zyur$>W7yle%0#u%*&K{`9iKJf_w_M8NPh2IR0bda($wYWm4B1xqhPzw%b+iOh%LYH zg88X>UZV2*HUdfsr=cF~^!pM{Qxd&CSzXdS`5yxK3by0zPgetFz&g}7TXSW=K4>n; zVlOXm8ne}i3aXL(0#u1As(CmofRD?*Ta8{G$sG?EQvtrFy3=2MWLPgM?l87FrD*D! zlRL=b?<|`t6(ly64$jT9*=;}N8;4?(wbp186;>l1#;X$LRQqw(|MTJB@^R`D?K_!o zg@*K2^J5@32Oc$|I=hz7tnH8QF@@lp73V{%OiCN?re)hFi*_0*u8R@}JD8irhJ$Ra z2Gskf;2||+0|V%CO1S<)1$FEr{M*m;6XL42J$!^v&jxxvdiwLkLT=5r>0*nSCq9_T zgxO#Yb+#3vse$yHa1XXdGd;psg!eU>AB*5zI^a?ZWkhG+zzBB5iAe|}Nq-31JYtlW zft6Y|SRe16b^Q4&nLP;z+|2kQCPo0I>{Nt7@9rKWM!ebesGW^ zEGcH7VQw4opu09EkxVZxW>{Wv0z=GQ6V2`%NaB>H-P+b*Z+D5UmQzpjvd?@t&$ck3 z>&P0xv<2KUKeFlNt5)|{?wuM0sPwoWLe4d31H}4KhlHmPH%)fWV=DyzHCINDc45Z4 zogwVl+ifl7g=4M)Il5py=mtS!yCDZ3^$ZTy`nt7VpZA2g6(r#Fm66J9dgOaa66c1P zb*9d@I_aU;cMB}wQ+%rR;K-3btjD~P^=EPt$oS8PV!H=~uWr~Q$bt>s zBi+P!Em%<27?oVR^&Iz;Ur{}|n=lO&xVDmoL=2jR)?tfP_>uoDGW` zk9KmAH2V0on*){2z!@5N%%wpOxS@pzJwdzppIv-h+<+Uje@#gFvPtgK^H$-K*X`7< zP82=L)Bsa_(Q#x+{-o$r2$FpiX+*<4KPT-<_I&g@U=^?0QPh_Ma6oL0%=!|PLzAS68P{Q0w zr1(nO6HeySW9KJD4AuZJp+ivsMdr^J@5_?QKX|)Y0r+cF32Kp|VuA~>Fs7qi~U+?{p2nTm19 z4ID$V4YTr!A#A-ICeGNScdhAslAwPT&7y>E@h4})@KQ$KWc9d+76tqag78MNVZ>r% z`FF}V5{?*jId?{iX2I(>Hth`WJvmUY6IkVG=qpEhH+Xzqf1=+O%i*zXdSBjbJ6+!# zg9f~Lu`jC6$k@ZA*qoPnsPE%Uzg5)Cy$qF%w9SnyVoN#U^)D- zQymP?;EJ|rcYMJkqW!eNZ4?oOoo1Igct{Kznef3bGs~HonO(uqOXPhcH^nt zv~U3@NW#;*!Q`I=DBgX`d=FPl3uhF89XNd#Om5>S@;*KLeK51aJCQl;z}f*MVM{>V z42b0w-{k}1I6yoPh(8NZ`~<{efLIw24+COrK%AESz8?@91L9UdYy*f}xG8=D;$1*o z2Z+}JF{c296d+t}K0ykY+YRnv6QFPa zO5_Ggw2Q!oS-K1Ev2_&L2HM&Rl&A}cTL3XIm9`DE)d8q(2O!P{#7lsfU4Y^m5PJY( zeLy^Q7o5xUA^Ythkmp%`wm$)FhX8H&1={Whw7m;xdpFSbEuiiHBmeJ0_n|Qr*l}5b0Tt+Vs6ekn z0LUW%evJ`W&Y3y_}%$S(urEdla20C^68d@~TZbf9$LltBefng5ahx1m!8$j1TX zO9Ar30Qq@VUwt0)blw0{1`i|1NZ? zz%Y>t3=?udpO*vrJPkme1|XjRkjDndO9SM?0rG_a`F?=>ED$(jAaGVd;MlU%{zv}b zhK{!ruK+pxIF0GQE&M-6$iPv_zm8D;NkjN24fW^sUDq8!4;54uvpT!LRL+1g{@+51>e8+%Y-ZvLIm9r!EqvE!ypIO1)nn8%)K5FRCJ z_`fsw@ShCW{*!^}e=->TPX?*~$$(q*-x&n_9~q#9U;oCwDpBuhZPhs|baT5(S_+af~hL-0~9Jwt#)a^`i`$#|$_ROu9`^7;;$gyKN$32w&0G z^ogP49^S$Rz9-D} zQypnw7$TpUQbad&&%R6DRJh$IpTw1A;?u5{a<9%R5$p9t@c3HNx*p=jIC zx>UN2_H8{3Ws@kX-qA2)AV>nTNeHoukH^&t}} zrKw&20y}Np_%55sA;S9(;Rql_`NM#~8B=s@+gmt5|1M1@ktSijWdb-N`g)DPY^NRo z*9AYA=P(JHnBd2+iQ!(pkL|A~!LbZUfh`|CCF>+j(rTiF+4{3vOFVJ5RZfC_9i7-$ zN0PqSJ=b781k=&C@8I&|@ZNsm1!a@X$;*7AJKE%*V{#|r<(KF9SEx7i=V<3*rwQ^X z*!DW<*(G$93J`~od zG=y~=x5VlUlqyyV`aUCP32-T&`G)`>QIJUP zZR(TwufKw5XpIG|J><<5Zl{bV_vHq8n5-{*5M5+PhBZ6+@{Oat>MI)b*xb=?B7TBB z9e_FhmV|}|U*ph%8+|quif-nmt&)fe;VxXvXrDyvegZk}mFX}FU8sT@zdsDll_$vs z@CbqE78(;Y>HPw8N(S*4O6-o{hgkmBQZ&m8=Mq8$g4sWV=Q-|>R@B90`N?;(P&(d?jk9{zM&X?^)*lWx@HvkQp=zZ`#Dxt*!A z+bNvaO7fM$-noGVd9Nhs?GWGynk}$=Wi&*7NDQRVE~P@!9+|d<{Nv*Yf_gopB(SAW zt3-YRZ)=EGUp``$wsz&V&R4kgSBYy)Hi{xL*yWaeB9Jk^*-{Wf7xaH}c~~0(FZqUd ztPx$v@4JH@9NW1Z-M!QH{!*rj)iYXBg~y9x$@emaNaHL~Vcr}h_{49H4<9MwQ$6`( zYujRCj(DLouil!Xz?6S{&0{jo?ENLnX9zR#QKLSqvZMw4%Z|zPxw9yA}7~QnwPHcVJ?qJw%yXSs(Jx+X2IWW8$$p2N;iD8kPM5n|;wK z-t%Q)V)(u-)q?9-KZ^HT-K?s^RdU(=>_At=(0?8lnd$fUFm@{i2}Eiq60M7c8pb*b zGL5vD!XFV%LSwjJGPy##l3dOBT>fZ`&@<>I4@^JSR*xT1=~GkPn!?L#)7w1}!Pb`WX0SriFb z^Py;LkTZvTeN{rCHPPci^Tkd%tFq*s1AWw@pe<$2(l+M;)oWTN)wDbYo$+rWHwnCF zqqIN&(_hJ2(w2p%SBosdOHrALy_htYY1ajKzEX#I4Wh+0gSG96#Xo^hN3Glr_^?n5 z9kY9B`f96#L#u&>l$be3v`Dq=w3UnrMu(oa@GWyUDy^BP2@4c*!|m~DVfUSd!3EOC zt)Gz2M$OzNv^Z0Kt<40;KN#sD$Oc;!kD3edVfROrap7Vbnp7VsE;TwVk_9 z-shlgU^MD>5y^FMrDl`dTXPW>Oc`4#ZnL!VPeinXiT_g0n8L$Uaomw3LCRDv;d=08 z^kF=Z>Bqo)Y4v)sTu;oLI&b=9vC8LY)#Yb`FR}akXLBYqD_e+{xxkmXax6|DWP2y% zz_Y(KMHElryvc8x>CPRKs_>#-n{YG+wzwHS&)vzCGtwseJhkv@YMSPtut?oBQG|C1 z71foY$?wArdnx9SBx-jp)eL0VlYu1^`EO`+bTyGdYMuCgb1;SsgiA^F*IAP zpgMlXZPI_wHIsN%tQ~ znG7A3*Z^49{pap8QCkn?ax_PnDvz52{$31t!%cELX6(X6% zOY5ecljlu8FyJ($Zy-Jz+SifjC%!6fU^ud9jq$&+q3Agos*$uPp-s7p5zNlKUogEf zEwNjW#VsG>`}Lb&ER$7=RsogYYR@53Z(01KV-1eY5oz3~%LU)KpPEZiWD}|5q8w>N z7wjv*OtT(Z1%r+r7xoN_$YgPWYkL>|>MKPuXpgNnl^o3petk+rsP#!sdCEnv)M9kf z)UDIKp3y$nW#O6jG)o_WNkgVjQT+h$|2WrEEi+k&3>+CIis`=_r}G{6oQ&x3Rc5d9 z%}+S={l`rHOx8`>n3_ZUiRV~#-D7jNH=%$Q;nwo&QSK}xK}fZh=WlwZA&Ry`XHmoj$DBxW+jTw!rH8Kp$qTD=4) zA1)3P@$at+8I)0-a31@JUS@}eNfv>-)TZr0J9)%bhtyv?SRAPp)O91+Nku9s^f zLrIPs!k2`@`~e=*fi%`!h~bw8X+3N0VuakhlQdq>rH?~lTa4jY_=cEd@EJ8`CHqF4 zxgZ0wCI=q#)un$Y&MSRYpCCd)ebZ9th))p>f#4eZ?<{OG13!Mqu{n zhbhD*u+3sO<*w~O{J7!gUzFs1t8wNOQmW^y#Ew9&ii8vCu9fPPM{4~r{aa_wji1bm*g_L|HxlV&?-H9^6GCL391NCV zXH>^~qzTP19nk3Hv4bOg_+`0>KDKCS$OziwytS8bDhv<&N`F%Plz$@;qo+_em!2%0h3T_cp#R;)K6jOGWr32d)Tpmh_WJ62djTEDzwT(&E(w ztYL=jl=5q;xRsXHOk~)&lR=!{r1$RMTxEYs%#^_^?x7bUEH7ao5D-xNNz>t(_*W?< zG3(}ShU7w1s=C073zPL%3m6+v3e9N%%&$_dP9#*;BPkH*O*5Y?*V?OBCrFQ!;T)%TNtJqc>`CE}&5-UH_9=r2`d@NoT?sCANH7(z5-KVF-y%cuYBHMSzv}T`z zaQb%Ndz3w-K^C#qooZrU759oi=ir0}>d-I|qAG{Tq^H*=qkYL-kDDj(Ghe$mU?YE5 zit=s9OCx0H^oPHKgpvPO2qews2D0~8`V6*?Ne&Cr@0f-#r$!UNjyBHAw zYU5zUpjwfs<>qu+uSE3SIvrJ$u?rl3KBS^>$*y3O=FzXdw89jhw-Y9Ob0#(`#y?#C zZ@-XOhR!k7W)RCrk(Ea|j9*4HXz$F$x9-J(eNDl?8=vwB#})B7`ZouPqWZAp3`;V` zEpm6r^m|HqVB5DTwc19JAPe-Q%E8&um3UMMhA6jy@M4ZTbaFj^M?O7P{5yrHniDS> z49lOPgi~S7p;E9{&WK2MBG?=K??3U&*J(1wO5lbTlN+Vql*l;B+ zKk4aC+$t6b4aAgjPuqEFrstI~>_7ACC4qvkNpny#HuS81WXlh2=~{V^_B-`j^ySxO zJUW%CE+(}q%^Yj|IzBrrsV%Bvj2dq^k;`G67=yihAAVIFlZkmpD6UDE9=7c zCF|p#A!)3%^|wWDD;v*b8g3H35sM=v&%#-(K-@vhOL|scNh?24G!YZV{6LD}Ajjw^ z#kFHCE;C1{IBuU!izhuyjY8FMtJDzbf3?XSeyOki0mbLc4Qhr>oGJxeN|!ZOOu(g|pd(okoiblPsZewVX8_7Qr||Dx}L|95&>MN>v~ zAW4t}tu(`km(n9D3bn@e_|(^pU;KUJw?P+PfQfQlp8}zf;VEaqPl3698e;sPsadh#5rHFsuBqf6aea{c6D$~X$QZ`@u6lMXLQ zvU~)de4YY*;LpCt#Jq-yB?GoHnV-FJTc96bkgayJ%S{jJu6zWBm+mUBZ`=eJ{iV+z zD(R?r++e;GoWGPX*f@6LP@asqG~~adK{7JIXQ({)DP^*GC1=3&_NG*8r_D(c7cd-; zJ47p&@o3id>((YQBhXWL$9gkTaxnRUq2TDI1E%gH5l!5gwEmE4G~X4}uPdr45o?*jODBJgwTm70 zV*-9dyg_kNN1Xlak? zD_oS8;1P&C_Tf#0gRmYCMpeNqPy8iQ^-(X^Gwxgw1{0nvJ0}H_u(n0w7$OYdj|2A% zy$(dcARwmtlgT!794LjqJ9@T?HJx5ka?6H$CpmRZI@kS6>gZvYob2sdSD|*)o0Dh_ z)o)`XOTG8=JjMXmSNc7zLQw_pe@50Cw+vDLhKLH5NLG#g>3-t`|sFN zrY@0W4Lxt74y|+b+aK{dM0VAu_*yI$zz}=T79`%js>>RpBLo=K_Nt=3YIg2sKijqA z?Nh{La-$epbZ@MF0GxcjI9Kc82{>9!m1ts`g0yCxbf~!(&P~e4r2W`j`Z%F)=RI7T zniG`|`Eyu{yb>hha^!vx%{1j5cU6_dJnJ4b=>-BeJoAWnrr-BxicF|6y{GkZS94v^ z3=7v+Q(exLC4?=%+$(NVgY0azc#A_6MEH;M!d7ctCf2);7ZFOn-`@GzX0`_)BN2FM zwR0+M%vq_On7k>FhH;%=ErtGL;Nyl-2x$s9bJKAb^KHU^Ytgrw>WY?4QGuqtG|o(E zXS?0L>$C88E*P2qFM_!zOeUi>?9vQqU?5QQ5Y_Hdn27xQ-on4kdkD6?>0i_6n(|Id zJq83A^2^eN0tb`4rU(|iIXXDyHWD22E$kqq9vU@_?s?xmb}Z8rI*?+6cNap-7#Tic z<@4B~%Bpv)_PC&}5AH7@6o3EGezYJ__#MXba3M5*Z%1^O>ob^iUf@hdMUcs!I@1{^ znwG$(>2hJPfN@v`3sGSMsa9a7B1-b#UOvO7@ro!}NhH>>l?i@}RXOniR9ZnBgSiSc zrKSFGw;Il`8>;wKmXP5nqXX+2&d+*#hy|Ui?_GUFwq*bbj|&AX=G)%D6q?FD0{6H*M-oegaSI@ONg;=9YqAU>}w-Q`x6;oo1` zTOLjE`Ew1HmMIfX5Bg;8+Y5e3oJA6AP!7I+tr3{ZgnoqbtrnWyM95Uc$`YBLQ`c?o zE~wXL9|`Tz%5^>U{Or%Snj{prdweu$VG$H?JCgm~`g|zZXrQoBv}ob|*ou?%Wx}t8 z$Ip(s;5gB^KXor1L_T)>MbJX1x1Hi!t|8fW_Sp>$DjL1p9ni)t4tvTM*cLH1cxN^{R>l-c-HQdDB6TsYR%hjMH)?d?eR11WLlo8 zXK^FD--r~U&VsDo2iGGBNG}1omm<#_>H?9v=X-{lE#>`szqZyJ=~q*(?`sBIqViay z?CZU?!f~W2n!2|7m){!44cUi!q*dRVI&!5oUfcM#aM2s8?jA@6@Jiq5QgjRP7aBOc z4RLXlYC)PL>75t-GaOGSF(Xhbo+hL4mV?^`54HdS%udrM0?E&@ zy`RvQyBHYm4-9wt-(A_`GmRwSYm=v&>WgX!fHV|4@Xz7+@vY&eWWYb%CR;;~gb@*0O$=`oATeZsVPMk~Olh)O5B)OR95Z`oUl&|x@4WlNX zn&Ve~=qLQ7%yV^?*xhblnz-NHK%O7{ud9?aV?<-KDRqOtR-^o? zS*H?4Ne~c%tmbiYK76>IU_;^rhwY)gc(X3^T!YchfoMeDJpG$;SJI zSGR`9q+9eA{d()p93&dMh^C46L58-&0<}%+{rsGiP%ouZ9P< zHS0y%wu>Q8UX;TN@!%Wam_Y zokT{Phf?#CmAD>Q}VG!`gPq2oG`buW5nSkDSM|j;DU54+?>#dIrFiwgr$ANC)<=;4j=P^l{hx1ll~Xl4D8vFXTsW1xly_Rm8PCc$mAbxE-t?j?{@x)=JPM2oESHF>0X=P<0CD znDUpoH7BfduMI=N=Oji?@2m4v={X(>It?4UhMk!iMjw}z*gdw}hM#rIfXT8Yk@C*( znsq*E9-04G%er6oppCb0)Gkd)n{Oh~_q9S)30euqn`U!okzaw?HPV_YlYQ>pf47*cfSxnb^C*W1#JkgSc{pnv7A~$xiK;@TKv5 zYhR`RXNhc)j4j!LwBWBL^d|32yN@1^(;2#iGVNgkGASg;H?P9kjahb3nv~@DSEHC& zvm9zRe;ZZKEps3#Ivp%ZRx~!L9{%d+O0+4oPm{tsZ|Wh3bI<3uXU=4O=yj=Jj8Mrd zk)p~$mNL#E_mj?hZTQ1SHre(QA4wair-PlzoC4R!^ajeOWe%+emF@ZU3e?_+;_Tff-Jgim=VMoA02Pfcr?v|=~w zDM`SLxf?JQsiGK^<4yFEFGvHCvnDS_Jf$6Rcss z>XDBlU1tapH$8VI2qz4Vr0?9NDw9fDV$39sB*n|vm3hbE4D_L!tJm>uCPxUzZrKk$ zZZY}_Jf+uBbEc`qykGNkmz(qec_oNVbX%NxzUs#m)%Ur-kFxOAYaR+24ZS3!B-~|Q z*@D})qujYXO|zVICCM6SOCtD!7WTFFi{707X2&+0pbudbgk>dUR=i8*h%)p0zI#SX zg0#H?qT^l&lVqkY?=4g5Ox`Bi=qNF!%l@HA=0UU|Y&EU=`fo}{uF5aYqN>&LtLR%@ zp2nIb+kvm15{^&Dk1s~QM{wHhH7^wMR^^HIZfYSr=I1e8QG)mBOMQMd5Jcq%PI$-D zX9Y~F)E8FljU-*xws_x(k9sorx+ZhH?mmq0}ryHeHsx+Cv&?{odbaees$KymuMk`XiHai zhHr}svYjva9^GMH&lJurP0tgK7EdUcOLG*M=a9?9#%gwmgR|=a#!0o>G;v~Yd-tUK zRe1Xy&f31>*Y;g{)R7$EoqTC`F>dl(zoGI%lKU}yl>Qu5U|Z>$);na#=jQ1{^g0E5 z(Qdri7}qB^ylK{58nCQ;3oUIi{)u938?chKp6`XoS9)s*50dJqQ(zEz!dxqCz=QtW zU(y} zs3o=qb);5mhQF2v@s{ijagaPCUca1+zop0dgAbKyiW6x)Q8Pz)*h@v`wO1%AEmk%n zcqK~;KD@eXzadkLO}Ax06zJEV)5L@nFgLDE_;N5v>N!(xyP8lstUOYBG3W2{M6ZZK zC&la|d|$ujNMDiFArL@ea2lE|Nqc!bj8DEKOaCz&FA}R84!JOh_UmVGj;Gb|*Z2hN z{pIDFy-fZ?n+t)pz(lSzdJ_)LX5J(#&UmW3;pOJd|m-_vrRm%xCMu z3t40L2)87GTZEr;@zmkV1bVhBr zi5li-&tLRSYGJwoLSK1Q?mc>Qjlb&dM!j29r`xRK8qouaV_`K)CGMo9I~=Gwu%A`Q zssg{{i{z^F3@;{FJkau-zrQSJ7*IKSJY21#hwr2${H`ZScdE-z8^F_|TQ5Ghe@Zu1 zR=vWc_1g3(|JaegJ^Y8HEObA-x>>ndE*+GxGJyy0%3u5A^6@SU+AqnXpx{R1fbR8W z5aC-@%sZ6D$cWPn_ees|Yqx1QhOEsoE1Y&=|b93|Oq{@Mq*gEcYQ`etz zVkB>CR~TO(+_`qC!QmLU)nPoeNNcMYGR9*IebUcr%Uzyp4O$Ayn~YQ9p()R9RDJd2 z!{cY<-MKB~T#~MgJ-Q6(++_3@VH*Vl@;@uF&?Lll-qucBVpG+1y8&Xu+F?~HO4OBT zr!=$Dq#fGv$O9+EPS%veiqLo6d<2)#RjEj01iDr=-3YWTV0IXKxyNAeYH4UG_(xpm zDaEJS1H@6+cauaKwaCJF_A_ERLVxf%E{595m@*qCi7_^kmEIy3G1lnGNQ6#;3ER?PO>T}y-!#KS@_Z4adAOwyO#=orVf6mO8U#S|e5e6cmclvLXV>}jOE6EAwKGT71^K~?ExF_zqHiIa2GKSE*M z)uVwCWA64gWnWq=LPy;{bsnn%n(&y$AWEi@kV_?cQsYQmAFKC-*yi*nFv@f6e@m%9 zV@z`YNUTHl+_akmKO9vo81sn#fd$4cyUk;w?#O-P7oW}`Rh^Dp8HlK8+IoV=e`QU- zKMqy8-fK2jdl*_x3VwHqrc2wEVvrW2hfxadSjv)u&{}4gaMdR?-J@908;xHtAZ|eY z1U(IlA}9JqbrtM17xjyiiLv<5WWpB=bA|#>7u=U2S~_9LM}pr<1^w}nggQFnu#>C> z9Z6&y%5G9Hk(@2fGuQ$Mn#~HB$oMy)1kwD=5awpRMm2^r+Piw3{p&(vEJ@QSv}F#T zWD@oTdtd~F)cOR3!b>EqPztQRNlyMYPcNjZF#3+l)^ptcRT?~0KIK@!zw;)Ezd!+B zOhB`vM8YNq(GA5ChtnB6pru5@AZIN!n3O%o#QE2|`O~Uan?HiJy2+1&e1#8r_ZVOq zYuh?}ulwc?7HNdy>SS01`WIN%3mzwiX>wCa2l5F5V!D$}2ivBoP72Qgp1)it_R?7({ghM43*macsk_79N5@Crk zL<)!56Mj-G=#DqK5EZ7e4BfO_vj+;DOGb}M(I@bD>QLI~|H;%ZQ}`vy@z6EhPqrx+ zEs&a3BwQ%rO*t6hv%A3}O3yg^^%8!f7oWgvgqGA({L`bhR*^rg3)=H`jjy`B2YA z$&6}m@O?+JRssu&<@0wnGM1S@mp5$k`6)WBbiA)dgYM$h(LA);AyNsg3IwRlQ_jv1 z=zvH;_8ATse&+jc)~t$tpk-CUU*SQkqqq!2Aj&3CHliWG4$ux}?qeNBDcFP>E$j)0>wF!we!ocAEr3lT^}Wckbmdq#u4ZW@<1 zUiX@9_p_1;STN7Ud1k;Y{a{JKqI^7B{I%&vDh`ue0hTuyy=CxJ= zr4nb1R5ioXb7tCFnm+)QSART{7_IB}nxVW}gw+n}_8JfY+_-Ripj?^Nf&P}}f1 zQA~0e)m%R`*HlCvm_<&CE;JhZHQmc4b)0fy>sI9JDgVG);$QlbW*!5DOoOr>VUe$M zENE<$F@>QeYadxo41{D_Vk8pN71-56JhQ^UOqyD4u*WY!C(5zjR@*dMWMk>{8yUF` zG-{2osN_fqB9i&9MB^&RlP%DT0VS5=$ztf;ERy7>ro0yAH!tzT`_2rY1lxw)xf3zu zRLE1%@wg<@@Bu6{LVTZgIo`steDVAp2Z_=4D+E%D_mUu6#v1h1T0U#Y{m$k31fiEQ zMjVKo3=!p@!X&ojRdf?>jl((Av}9pUFMWWbBkv~I>1T_ssRDuiZ8Z5zC#>iT<*uhY zej#Ok_;UrkyY$=>Zzeqgiw4BlDId@{pTR_+r#Sq*V%^+dP0^9PUav+*9Q$ewlaT)) z;@s`p@R^LqD2MFS-8Y^6H&Y%NkFs+(0uM?r@tQAU=Bh^qk(YP?af(Ug(Li@z9@8fK z;I#%_Z!Y?$stov@5a;wxNo@MsWw#HO5PbJ_7 zMNF$rutag6K#Ay(L2ISnP5}OJ&FB*S!ZJ%i;^jUd%$y(oa>n}jV}|;&6Xs>kxCT0- zxb!w9hDAc!#V2G~92;CKry-#?`o*$}Q_ie--7SabD>$WruX{$cLVh@WBqWvaTXI`_ zuM}JjbUeoB;~!H39PZ0dbb{_csCBUf`CfUC+x{`6s8E=18H5UhP-5GR68t*K6X`!5 zFqAdMsptCyMvMRG_~<}T8v4Nz`{=WX!XvcG4MG&PPa-M|zTd<4XNzNBtkKc>^JjcA zm;IkzI1td{*k@}ecCExlw>BHMVcmP_EAsGrA)=$hTWaLNpN=R)bGFe&mp5Ut>3;eD z))-Sl?RZO^TtaF_h3bQwi z{c1Q=P>D_X{q9KE4G*XLj#7$_9QXH9@O#Z{LKtIh;fI=RX+43SY9VT?NRLla1j&*|rhGh|2gI;(}v-5$$y}_~iet z|8|LM1x??MEMye`>Jf1Dy+MPQRbm4B6A?@$lSbr=1dd_*tCaEZ8BN%> zf`wgu`?b%gu9v~`)~>_W8%@51;-7916a!@#Bh*W(UHg;w!IkeJYxs4XleYJ2+==JU zIJ$AosI6<3@e`#ZsBlPx?hlN9@VQ8u2?!P5AMU~`9qkP|lW46CST(<~ND}vSp-8QI z`hi_z>;ngPNSDAgyXw}yrz1klEF1o5E8m)~{4bPj*>Sc}Eu~2|{mN!cR6E7=GEHZo z%}8zjwZfjk2yv%bu2C-m`dZ0?s}Lam;te#ENa#2>G9T`75r}iD{w)w=~8=y5U1ZPy8KFmhQmA|PLBscB~h=ty+^NnYk$kv z({I19;Jj?meg%`7yQONR;pk^8;fD%d;6qzfiH07xe-q$erSat#LJBTTW(~e`vW7Y| zoIcm-OEDlud>r;3){Y_QgJ`W8s#9>1)j{TL8x1<*lEsvw6LaQZ4mLzo*&EAG5oueN z6>qED@6lG#0%gu-kT&1tpXODp^l2p)8e>1v+igxn zZCMlHbuXKhguJ?DRg@5YgDbhPcH(!*qVp=LxZbEGfk}Xs(N?RH;L1p~(?Qi0P2^$N zqCLT?g4#SxIWJ=7YX`HPmW$XNx7~_v9p#WYRbhYDS&_drAKg)?O-^1Or8-%q!de!X z9LGU2kqS025q+C&yDA&eNVU+fu`m&So8?ZYu06z@vE)>ywGz{2U`o3`NVnToJErcq zYhtRe;FP|wr^;~tW&E70hq^**ap`iu&pWWop`I47-EzSSo%f^3j*(|6h9XLlYaY1y zi+OZUG*@5aQO5R6*db^}9h zyz;l83ncpgg1$Pcb~ChrL2Y0#fS?~PknnZXdLUNcDeONG;s%B-2oiFE#H*wJ1A>N5 zVL3o7(13p-0nl7vb=1hy+CJT-_-#`O?-oW@WUilC7CA-b{QyumHxv8O+Yx39T z>i=;H8w|dVfec+k{SDDpRRFKQ@;67f_GdffHn5#fE|C2_r?6UwmE9np{%;Kr=n{|v z|F^~ibP33j|E>80Tn=8!6I=z5pZ@{>8$~b#X$ue1_J;{B6KGhd469*K3}J(W z?;B_P5BT3H0wPFTP*8J%v>h5}+XD%Y2NGV$1lJxU{C~jzMiJ0K+JZ5!$$@T+u%KZ- zXIN2yf*R7XF$Z+l{C^#+2|_&G7+JYACd%70e4DB~R&0^NVlwO3c)93v$f%w9V{eP% zEUU}}os@CuZg(rhfye5;@$2!x*1`1hae8R1`U5b3oO$=0F<8BD!nbEhEzcf7e0@K` zMf7BH4lCKx_RG0igQ{nQIW&wp^=3f|E3GaoUF@hqiqKnnfHBglEVG&}a!`qmNf`r2 zo!sU^slhdFVvA;}s3Rng8^E2_F>)=b{jnA!X%XcO)lr|jtWf#TDjC*UIGgKJp>^LX zN$o0KFpzAdx0=V*(Kx$PH7W`bS+SnC`XwRV0BfkM7G=HldU-8)V-K%|!+H68)~rZl zXkkDf(nZ$MyQLF}>kg+(c3kH<^>mXB*R^x8b(f5{9p}P;+5>hkf8RdPw&-FyjeIKO zPV1nzqIk_+euF>ZbxuZEdE*_$@r5aNhML;uI=5A~vc06k+Jq+(?Rj)Gt)uuniQ2{s zenU!1M-vc+weV&S#K#k2Cqi`B26p&GmFPZ%CAio^bQNaaEFi-&`1ex}4bXNG#Cl*=csGFGg^qhI(jGG?c%*t3!!rJdFBS#i(gi)MIi zoSbAGSXE3)`1Z41*xJo+`%X?|aOn5Po=Dp|&l~y%fpS#|uBO~d;XInsMcPgzcNIfP z?VVot5+X7Hqt)h!US69!J2I>-z9Z%YU$naqXPlc|5n|anBbLn3u>vi}{SeDicZ#I9 zJDLn*`A8iOAd@$9vhF_Ee%TGsq{ zFW%In@6T?E%JX@+1MEjqrA6wzo!(+_cjx+i(z{A@E}17iLoyDjqbY9g36rr;Tas@A zXIp?7A=`{i}xk@jex7r ziVI6?Fx4YI_!?5&>K@VRI%Ba5`ieO+N)5Ww?4$evZ$7owU1W15iJk9jLVR{RVkZM< zCS~e66QNZlC#9G|Ua?^XT*b`ds$*rZGiszqG^y71=5GxZ+agXs*~P)A6V@=dZ53qb za!-vFTR&j_}O$1w@L$bp^>r;)pCJI}k)QhA6J8e%)6W|_RYnvj=%81vZ>Pf_APuo2$ zp~nL}Nu5uLA0r>{(Q58m zULa!^l9IN{#Qth8pT{u^9h-w^l(ydH{%K-uLTxPWpizjYdp|zmX7d3#+WFb}+Re@g zGxvkr#{I!A7FFGa?Q5t`Z(ENo5~KD&;Pgt%`} zYu(^{zNbyTnu|Fr@X)erP|BKnx@P6aD}<8RS(*DaPe;Wco+l1`qxGJDSS*8t+OF5F z0~cW|Cg7;OYTw&Qp0}f<7nEK%k6DAxW(cVyqMoTTAGk;on(q(afGg_DOJ_4L3x>p4 zBH`y1wS-w!7Xz-&7bV_t0v+KkWvOW|zn?x@e?3PDb~HbeVLp>$vo2WdeMGrAX}$5; z-kG7j2_ALnnmmcz0?9q!DulBR_e`SZPe|X3yLKJ#C{dPlaSxilJ!gD8xQwk*MsnOA zw(T%PXHV9MX*70Kw@z8_Re02=th{gh2dj^8 zAJcq_(Eg+xgRhFp%TOo(Fh58T)2pJ`tK-#Z9KWf8(6Z%CqxA9EsYr(Klsz&o?Nzxr=xg(`DZ$oVwFZ z={!i*K2r6363|_}V!yZ!=9&3vpQ7!*;iI3-qB*LyF`l%dc!nuC+~ZtUp+9{r17Pg% z7b3JMgLW`yK^{XrcI_>_(|`AoPq-6|yL_JsMSEDu&L_AKX{>{el`6hu2bVLMJCr+d|i>vY(famjp{yz!t@ir(Jj&S?ky0r+;oX)Qfa+#GUeh~>5GQe|Z0%hwE!Q+p!^}I}F8{>2i#x6~< zoXXpC1f}<#cQz@aU*&k4Z#I2naA}imR@UA%vfB63Ai$P(cI~w+>LJJvkyo5pNxm$e z-RXw*G5QV>g%Ta#X@3>ml9@1Uu*$NvOTVRmy*v0DoY$$!SR~g{8kgo`cAv$wwkY#K z2dNT#8lmGIeG`}Wx02I-@CJBuADA4a=_Kd}SM;!=UG3WsB-VQ_tP8qSXFkPOkBJ0H z0+IO-T}S1UTK}A11eZjN!QoluQ0uGSqI=P*PmliKVEW6?I;l zn|PBAB^@aJ*HQS1WRJU%AGBiW!o8J$iBq`^%`pH={Z+hbghSvZA(@Ehm?$ z1MKIW?@%c(J1%Od>nU{O&S+&^CB^wgm+@Ge2-g^SVN|{p`K(NurgLh^G1F1qkvSj_ z_wkNrbJiA{17FNQGQg0L>obmZ}j9Cv_@c3NIxDICGpW(p-PH=5XE;^^@; zGZkrLo>Afj5(6zedu=(Opou_}Ck42mEYxXLQZ_dE`qir#{kw-g{&$HBqefn2%IhK0!~Pc}KFdudk!#l)9s>ev^=Jv1X4)RWG#M42OwnQHLL9!{=l z`6-G5-<*v~Ed2o5ks|EWM#P*oXLWI{mJ;3;RUvled5Ke`B~I_fteVDQ%3jUb1MGzX z;=u-HYT^;#^lgEwx17LPd#UJowiK3x>q(_V=9+XaVyCBs#7q}CXJDCB@5>{3swbn3 zLGanGdXmFT#etjnNc}OSj($l6-EM9}hQvbmxO5vVK?E)B_mZ)iJuI0IjVia)d^a$c zn90s$D~n)qrdou{{KcPnRt2T{sUvu8I)>a7Kg{s}D+75cm<71XK}waZiK0f!Q-f)t zB#2EIs!2IBiUx|D%sM8>q=|i*^^+qc9cDJkskAGL$HY^!!Lu4?lCCy9swW!HwX?6W zqmr<>EZk}IP*gNhK)0N_D>dso$cKR8)j*xbFW`mpnc{0~1$1!C(dv&$o8CsP=%l6a z7*z2KK;1=PVi>a(Bd<tHn*quJK=(9N|)nV~S#s|i;ejb)kn z+E$NHm8GPyCvy~BXr8LoD1T6#%@y~%1Of|r98c9IJ!@LSN7cF9DcI-8Boz7+(N4?h zigM}jCf_BnZdNKbf1}YVbj%Fazd!XmXJ#w_wL+DR3o{^&l}(N?MvrT$MZWhm+YF(O zMGu*$lj9U#E#Y|>S~BBnIytQ*bf%A*w&=JRl}|RDg4ML1j`qdwZhO=rt|%Gm;o}|G z(r8A`H9x~FDd1NDep#F2A>^O!v+E@3%46x&#os*&8I%M?NrVf#)~{ZO+Q3xUrHh2& zTHceVDe*I%Eqf`Fh(_5?H)mh!tK0HR z6JlV~(^E2UK%tD|c*vQ9#({_Y9g5)5 zT4Y`b4!(2`DVH=B)8u~P4YC_g+FE0&6CkyH3LRS}+RSKHMcu0FTgh|t&CeCi#Ny{F z|H?Z^qdw1uEkx`|+%XR62sW-u3R|tQ%s+g9YpfB4q&Fe27v1ag3QjAUEwD$`pA&I} zOxm%_OF>@QRC00qDrV@>-0N!2 z>S!hrzVT${C$u0xh`DZ!YT(wdH+K&F0206GSQR;V`wBc-$2$#mNw-W+dK+IAbC#AnKu%?ApxS1d+cBaQI{ z$H@aDSu9+xRA)y zcEKek#y?V6;`Ms@T*;%G8Z~RFaP7Z9-g_i4I&bqS1SjsS5r{4l(PFa}Qv6&f5$@h&Mqv=?m+yFp^?U5&u2s2wF zfWvH+xe}V^)~@dDncKuPc!c^+-h-z1d)}du)&Au|qfC>mL|q!)tC-$eo?XD0o6_3X8wwjn;YBJ2OZBN}jWp~V zic9AxM^=^cY5YN+u5TQr6A=KVW$dX+zWB3Z4V~DhOzLt_SE8!J%Pn2i`S78<&XUMg zEwLeT!FU(uma8gWnG4=d<=vzD>6=zzE5P_Jpki`)BB%CfyE!AA>K^!w1$?Te zvypFK{?}8}?S4(Y{dkp5;el$5SOZzD^can7%fgBvZ&&#DQrajhjb-^v?-cE(xO|W1 zNoBQ~i&~0HrM=u$@ufnfJC8}xyh)cPPfU!dFG$a#np?DW=W-kqu~Sd=uBBWFp%QOR z*}kRmB?{PIrfhgaRKAtP?dUo4;v@#$4|M!?-*^&wAH$8c4#TGTX!mM(e0oNzU8onijKQ8QpyIj{oi; z8#VO~Xxw@kx+dvE;IBQO2bw>#rtq||50e5M0}zY0M4y^Mo21EB1YS1Pl-3Sc$}7ig zMjVs1lwT?r}M zE(y>ZEv^eEv{kH$Td6!FVstdkNtoUjcag1UI#c*9T7BzWFI-Y}BOZj!O{!_Ny)&jQ zm;_$>RZUOOfXZ(jt-j~7&G#zQ$z5&^W=xsrb_eb;5t58$<@XoIFLmxSoSn3T7?=>- zZ>xn@eXDLKguCixfIud9c9hAzB zB7+&5E0#8k*e_TG2|=eGTD_7$Yc6jyz{Xg|>xue{)j{ozn90YR$ia2{9N(j>m#aL% zSQy8XJ=^Q?W^$qh+F73yO5ojn8g*4Ggw+CzS? zCatD3M7Q10spaN^+qn4)nQj#|b{HEKb%in-BdAWJg$!+*^Nyj&mFUtklw=OR;)&q*&H@X?_4?VMb-~l``9%|?rBh4flWP|^UriJ+BWjz=uAO2 zF$E}>(Kq@nUts=T9L-CVUBPeNw??7kZdf19Y@S5_iHD&=A|6? zm1h6ql>@IS7bwvFH9*(?RvWY(obSrtsX^amT|ixvOEXgEv)$*=-19lAYuGWWqu?P$3_d2rv|Z{R<-+gfJC>g=E5#I#B&9BOntN z-GNFDbQxn2*uOBQK?rjZSVSf)iv!iaGW;@O;T@#)0a8 zGf<1b9%7a|NWgZKzJXnWKL4k7UkN$4$Tyl3!~d}4o1qLOksH;Q6vZFGnXrQY3lauF z`ZACxZdAd^ia-1_VTnOdPLc1~5#UP)XlWqxw>2)T@tR!rTA=R=8~R~mj$R`IWUCcL zvXzj}|KA`okY6cQLLt_;5+Ijz*8*c#*y2Gh8#W^R2l}_v$XN>vU13uKX{g_bfYEAI z3<{e7Yg{Ujy#Imz9W_`%8iGPJ!W!2cq+#A#VCo9nJV;*SMuh)B|Bf2dpgUXO3L6VZ z!(WXE2(4D8pb+)5#>FvS`w#SQsX+^3fkHIQ8dn3PA?PlexWZNslGmsa;Xly7qXq-~ zw4KnB;EvXxQfMTo%7FfnZe=6_1TDCbI-fEE9=v8u)FNghjJ zq`y?pztpRLsDyv1pJx7xiWdBr`r|JZKKJje$bYE;f2oYZe`h87OGW-mjr)fx@|Q~U z4;AGvHR3PT?jI`2U+TAiW)1l}>(9Sbseh=bf2j%o`1%i(>@St!pIQH*O8=!={zFCk zOU?Ml*MF$rTQQjq{E#;;2gO{(MPbs z!{yr%A%)7?%_+V;KcmN2nNW2e4Vj-@Ti#4W&1vwa8KOV*w8s+BK0iG#*f~3G^Lfj6 z+uKk0#)EX)>1)dHk$3WkFjBGjO;KkG@?!_ zFgphb*xv)7-@IZ+wNLEY7J8eOc0q3f1_P*>mm3IlQ4CY*J;Hbic*V8_Ax)oIhKkD{q2(dPH zzE8+#Z(nv1Hv}?SdcR%FW59h-OIaY@*?7LKW#D+fRee>jzFIn;e?0N_8GerF;@AB6 zICy_BO{>J}y2@5}1LE4hKWBa%tUV^3y68Oq{oMGX5{zT@o3gI-RrgU1s-vX$4L&CO~PAj8I=P6!(e1*@~jd+OCu@M7& z7(2M688ABBO?=qJ4*`R}O0er4i12W|yc%#h!tuRNbgUA>vvJBgEJ4USutvc(d1Yw~ zaUl?B4}Bl#GESjBaYm3`KRoi%vNC{$Hrsbu*J{CkDJW}K-Ll^*(J?Ty*KmZV`QhdPA87OYTgZ(*oDOh4caICZMh%EG^n zYPS7qOQ(Cyd|P(-=(2LeET2O2x_AXRBsP5{;jXTVFk;`Eh&Z#$L4mfUX&RQOhlb4< zpJq<*hei&zIZo~{+f1vPcpfhfcJ*VUMy=0jKQ>P?!V7`8g(6-~dx6LDY`S6=ggbnH zv{%~m=HBjSfOhU58{0okc7ZPys|zXH?P2`!HlCJ{Q{L5DLMxA17i~s%HpY1~*9~G} z&;PZNQqir92C*#*cT9`LTXk~V^l@~mtCd+F#hvuM2rJ1(W-ANNQstI zrCws^x^ewGj2CXK@N)E`gj8%r*vDyZ_RNtPbXjE?(a+m==7Aswfi zpNyV8cQ2QDuPV)NFBsO*Dy}^5EMfdcRhu%`D|ch%hj&qz8a)=eJ34oIhvZa?ttnD~ zyXW?s``VX_rK)qX{ehJ30}iQ8OO=~)IYqgqn`!Ws6rWpOD)<&%7MBI*XnDB%H z+tU2UsG#o~b#rrhx`>nfJeYeV>O|xT{ ztB6+VVbzsOo4{bJJ{|CK`n|(7@6XADwqmrB7Y#&44haSaf#k zYdwaKtZC^3BUmmJTw!5T7-3c+G;4>~585?OQy!KYr(S#`Dy6)5vT#fFG!@g|m^=l61-lE3Be&7wWqcjFm3PaKBqP6{O`sDnbZMpP&k_*9|Bw@tE7F?^SxXDl9Egy7{A~*dm281u9ba_ccH9UQ|O*?K$6ss#p>K?yepxaxKT`>a93VaBBgj9@|0hUW8#~5&mEJ8 z6UGc+YSUP!cFd3tCES=&S5ay`>q#ilG#jfL-)EXw`W0)XVp#ktb5LB!G_idv#Dh~< zxmd=@Vp zHS54^MK#tOuuwsJ!#m01tX&%XJz$IlI!`vCX-p1)xug_qR;0UIqj|1jjBBhcdlr-u zUangqZIn`EQNeXS)CvSBSy3%nu4lzah5NS#rt++ySpo$q^37AG}xbdW94p zO=OAp6SeqbXyH=VST4sQ2<|z3$mhwXbO)-*>UW&B!=40qbc{8eYaUO$8vsK@H!JU? zOl7746f?#&X6#&Ihb><|XNlw=vk<5KL6qyHG%5rN4Q*D6$tfG2|08`UJYBi6E= zXBRU=)pJI;!XsrF zOU}$Npvh)U5ig5sjkl8<=yOy&ZoC*^KO11MOCfm)6@yKijWTNhu^(r;>QsV9TOh26 zy$6}s^JN0GqbXE{)iMlV88NHBMhi)MhC$q2Go0_eY8`drdUUJ_-<<3l-E zhq4|t&|&tQXA8QJV(KQ=W3bp`C!2^#oJ7+D~Vx}1>gGhY8nx{zhX-e_y3_q{j)iB?@7a8pen9V zq|&aKtq6$)SavcAE$~3Bdu~=+LV&;M8^|E;$VU-T(MPMsE4trIp^b&{E^pG43FVTk zQ&aybFMv1~Oakd5U6X=%tj5F8zDo#q=V81g*eYCoU+f$zuA_vvhiZmrzn*}dQ%Div znyi-M0IV0pN?8#qURl>c=8&!G8HeKVlY;Ue7b9U7|0OUCb~=Mp&K(vqEn#}h*^a`5 zA10S4vZ#O}gRL3fC>{s7sEyOX)h=A6Itazn*C1Y+zB+*Eg1m;#jg1+`(uO7rxt%xc zE}@T0R}%Q!U>KHKKaH6D`?LURh@j;G)EW)@j}dHjHfQp!eazqs<)^&yp@c0|_cqA^ zuQxFZ&F2S-vR;aVr38*qbQr==*^qumJQKjs6Z;le*i;7bBXr#10MoLZ&q-0as7aZ21L1v!mr}^O9&lyH8G+6`=;^V8~ zT)T0#;z;wIWz;l4e>n5U2ut#CPuRbwcNR4|)OI7F8lG@f$M4+UzSdcq)j=2Iw!Zn? zR(BF&-cV>3mt-{O5W=*EK|njfrT!u4q$@4pIms_wc8w)w$EXg>C2us-4*kfa1am+O zowp#-+Yt5_i8Oi{KZ+d+y#(7nw`G!tph*kpV}xc` zSb{EZD-_j&m$Lt95fweswF?Ui_c610^Nv{4&pUMe~VJc`FZT2d#YL3StYy3{$1iEK^4pS6Q#J_i|`vghJLXSb4`&uxCg$@-( z0h%9k7vRd^$2ixw_dl5jPlxi| zWeehkaiX0;^R?u9(!AP^MH3mWnZt5!o>frMFFXE0?UP_(lhR^!Cu6FwEois6C2GE9 zKzZl>vR0Z*jTHQq(*vHedBl^?aGcIvpW&v7X4pE^NoSq5DjRBxRw1Bsu-u24zo|ta zA_0AIMsAqGrphXKoX zW>jj+Y`AGg4t&(4a!+x@65s2i!!c-<3nQ2gJW50lQpMSR%;Hx|q|sHAm(_TtQE}j= znL#F+2$l01+1ZDTBgD{w(To>{NhKn&PRG+nfd#Vstj5IMxh}SdS{dk@LS29%rDU2S zq!|uel~ekqPAOv?`TK4e*};WC<*t|p&PZ2G|I|zWSc4g>pZNf8f%O1Fyv74e#Ykv; zZC_Iv1vPY2S?UTMaI~b|OzoQo@4khIY4Vb`(d1XKg8ZoCTFBH!I^0H5jh9B(PMvvE zy|b%4kw8iQBaeANdDYgYPbK~wlqnL%_oPs;o5`~EP&8^KwTQy^MljTnQtybhzty5v z!9-upoR6qh!PhcSvb)sct2e<^(&#V^;n7r&h6RP8OYbCQIy{7`y(>RK&UA8r5}erX|-Qyv9^eC*}=J!LR*v^fxV`adAJfL z*6Fu{4&Uv@r8>%>xd?1FD^|y+(hZxK*6By60x*c1zQQKT30Y<4=$ndIXX1s8>zM-E zk^Mf;n1+(1qL-%!3b1QHI@Q4=Q0nsz=TuW<9nfE8mUsB082Lw(?%X`e7jlsS58<~olLZ`> zd5&HI>s|_x;-*S-5cPDP-avz&usRgRC0i61giCpW-W98Mb_S_G(+s9gG>OqRrJ6ee zV;DkhD_xy9jo`rg=a89ReU#^y25iQ+W36xbf)F~w@AG`e9$0y<6p9FHNf zm`(ih?t2$1?>xOH*70%5r9c1-5OWBpfO3a8XQT{$0XQhQH-lN;e(zFxln45L_7Gy8 zt=xo(ExAQt6ScV2Mt|F9VhjzGQmW}AAfY&t6YGQ<8tM74dS)SmCuN1rm*wjLSi`%} zzOU*lmtydUa|JH+73hVqo*5>d^0$lUJPJZ%trqAdu%4~^SYGkCmx^he4-M~fshJ~S zg@3{iiv99at=rtLo?DSkewjKSZfTJ|&8e;)3g!I?2>36l?X98c8o2G|_8soF|VA!MzYu*>Yn_?O$ z(P@SPlSij|aWRoF3$gO1$IHX)kF1QD<9>v#sLV!FuM~LJ@ zpqtX^Su*v!TRyzdH%T#;pzCoUF0o4KQTs0Z&YzvO?Pvzt6-4@Z1FXK zUN-Z8=GU&4_AWul7gKMDN0s_i%{Sm1@GN9i?SY`&U8yRO<9=1XTvzRmI8S*@%tIea zUk3aZ3A7V@3Z~B-{OQ|&DA18dH<%dh+(hpuQF>RhN_AJ0l7o1g996v#nCv{uQ2OPk zC6PA2nyEb2wy4`%`D1T_8^%vr!5R}G=+RI0v<+$=Kz;X#SoIkNj;p*KDe`{V>PA>z zAPG-lyVG+Bby~^Uig?jym0025Z92cVe*y5+q!h3=o2Zn;+C#@I)yoo;$1sk*VUSa* z{X!l1j0n=vNU|=2h_Hf zV!GI%d_hz^dl*owr9pR>4x330esQ@U*_Und%Pu$~=C^nxDbYIB&s^>-ALJE{_47Fj zpT(@UVD$HxASC69yGL*~b6%AZGIlS&q})R;<_c%y(lBF>Z5P<{EYyT#=%HAn`dGER z&g@b%ozw4{ehNWxUOn?F+u+-GP&eN|e8(Vq2;(_=IT_e{OxqZpJscze4kDiDG*H-B;s z8A{xB@HAUEC(>Mg4hNh^!X(13V*J%%9kO=IL5*=2O|mnDSbM*g+`Gx#8RE7dN$5XZ zT)-I8aqpSEa-#*E#%CgBVuK*-dCjxrR2^p`)mgY=RQcHc2}mwN0H?4gQqNe@F=ce` zF}2WmrZD~?E*JjT>xRte)uM^pJGdto>Gg1q1$rX;T7wtI;vWYTA0v)`;r1|10X@*4f1 zLT1zGc`Gs-@(s#keQrX#GjO}ChK-EcolQqf`nYj>7RP0=VM@MAT0V?Oww=9fps!bAv7U`UH-H! zWo;T4baPruhRWjUqrOP|WnLsshQ5{zri6wGNFV~n8vi;QD`OQbwNwDYGrWkPOn~HdPQ=)+q=-nc-6s9AKn-d za(PCMUZP`TA1Iks4YD#u9_4lVbzO0?J2WQWl{UI6db}xFg-X-%u!Q9468?M6lBZhH2fF3QC(|R zK4Wm$mUip?Q>0nG5Yaz3vA_4&Mozrq!Z!fQ38i)cUDRzoCsx(%Vktumd`~foMA0uN zbq+_@^Tv|Hf2p*NYDaUjq%yr6m*U^` z7#YQE7{&H}@BF8t5!h63cQ>!v;Q+C7x1Qa)aTg%eGceFc{W*Jd_fpk_gnhWZq4yp9 zMe&4c2>rE7_xAaA=$)~+#DhK^Zn^O}1t*wd`F!9#o8?ag-r`FxamrWPMJoJ9eupV#|c-@$s9KBU`S{mblgd^EecIC2BFe0uL?}W|cNT=t_C_TyBFi9{kxpDwBQc zoP5agz;65;V#L!X@a!o}EdQSR#zB~Epf5M^#*O`cx`0(!dbk~&!?{h$>NE;F9D?48K)2WH`^Y!iFamvBQU=XOG|A(qe&85WZOa8K- zy9H5rj9o5q7)X&YpjpZgzB%W>7nSMFT;-|nuc6tauv70< z{*^n!T~qToowD_?>9rSYvadK6C{nyJ>9in&(xhejm)8vd98X7!j`BBNa*i+++J z6Y(U|j!%4paWax)wak)g+6zp-kOp9Re%5_frqu@J4VPDU{6cb0q21@h&o3i6Ng}ks zZLv~zVUAQ*PgW0`PwDtm83dhDoox88LEo|u2?altUjB_!8bmir zW9~tRwMgsZs5onDwCdP#s^QGH&e@0=GWVmtVmak?{UuhR7-txnZ(VcEh?7Hpk4`1- zj}ueYqu`}AcyAdg9+kH!2TME>OSYr_yvbT6tlJnDqZtugh z6(&VTgb$+TxiK^cx;vD}xCupbo+H4A*+1YAZ8}VA`{=Amj->eJA3vkZrFx1_0!kL& znf%spSy;QLl3H$r*D->_d?4*u{yfK|8GK;tZbAQ0T)gO5kj1=d5mqQ#dH85MMC>ZG?2NYqU&;tV zd*Rv=*YtBSrKuP?ksbl2OnZ?6vYZBF6r{;s;LB3~pn&&rramFt&T`h4Q(I?WCm)gY z%rOOrAii_=hpf{CN>A|6hkYG+5{9__vfV3I6dap3i6q>kwOJA2{&E*18*5@f^24U}HkMO-qJv zUb3o&411BAK8=ceRajM<7Ik^N&n?$Y!dw1yXq$hF^j(X70pP8i9^5=iwHTs-fAl>; zCc;j#f{II1iv^n~74PJG#+Ag(cqSFkBsIWR$pV_NuR=2PYe@@ti?K%!L+5j4n7q)P zR;Jhas7XVky!xN9o@smn-w#tk^rRJz2If1pYD`_iyx~8XMF1@sWSu;T&3G8u3epG=z~oD8L~4sl*eu`j$+CX*O)UKRB|3+b&^_Lp4J9aXyfmi5)XyK+T& z_Fr*_)k`Cp)f7oB26=aJww(l4zOx3=idKpG`FX^*a?O*BB*U@wnpu)WQ2*`vDCdGG zvY>bPef-O}blG>nF0VM(xOutC53rtrbF45phWqD_ulrX*uoi6w6;`ae+{8NjCgd}E zjiUmtV}$`+S0{O``@QJKtZdpj-{thjxbVR$bHH3V+%N|Zc3s{A`gMgEP;Beu;^NHR>W3v} zvozII2Otn53b}U6Lk4aF00>&LnVcF;R-aO9p_T51cjT~Bg1@u z&FyavlGGF4mQY4o`u@VDqUbWe$4sUqyMj^Kk-X`fxXMQqEC?zZ6R8h+bK8((2D3wc zxHPuXchaoC?wFgb@UQZ6zj88@J;Ss_wEncMe8w^8Du6wtIjtnOmg$ifI#rz&3Zcs% zN@X(?w@T!AXzw@e-NpPS-w+Y!chu!fqaoPfDzr{i9?)GV-8`E>fkQ0wtWAyFDM$ro z{#SXm8dSN@3z(nxJCWem9;dz?$W$6L;aQkH-hFQoY&&a=ra^m8%Irvwv_)^d^ka~% zuZ*U#5g%F48qdu9G*$DJ76~1Zapvs_@<}S=J*D`~>~(DqiO3tE&VlA1{99}H zlZSzP`eP-mThA82iB<7sR0LLwaL(0$NXH5U17*3|Ly)<^^4*J5B=OfNPUeP2tccXG zWgp?Y7BRqe<5)X4auNKauPd-F{9izyuFh*|G`2}+K1<4!+XY@$JwwVg9*a}8?raN#A|-tO@=Yl?ovntZ*Y@XZg1>vSP~FruDJBahIM;8mdKjGvHs zV%r}oJI|V=wkjbDjGPlAr&%O3y0)l$@dE$Yf=YKPMjRlmqHVQ?gnh~bx3^kFw6 zP76xUTwO}99QGet)F3RF>If@VHFuxzh!-6tgsX^OgKu3M0pkd>@Tv8V=~1CmDvc=*idRlky^{0kaCQmeb14Wp=GIEPh28+P%)d0*M zA{rqn5w8eg!b7ufS}l_yRy+@V3c~eiFbrG~ycJA~Z*mVY;$WoIg7B`h@t_9U>cgV& z)}g}Ww=`qZoxWi!j+M~ApnzHjqqTaa#er*6nP0SKF8as5{E%{={Z=dT!6qGOehNGs z;j;qEF0quz`@jU8vluSc7rCJ9og-g(JztH4vabcRt-sbEkgNZgB9o@PUnQc?h1!xO z0VLS{u~M#0&I9%Vfx5RGU({#C^$bAC>bwCx`s#C=7l6$@8gW+W;>Y9X)t>q8997rW z&XsO9tFhq+WJ9s<>=1w-FVT*daJdd&reSCS+UQ`so$iisRljAU9qc8= z|8siOos0KbYg}DJo)OnLm;U^V&e9o$am1`?NhOBVqhftU7Sr0ExUesMnbW%3_1!FL ztTebtk5#^UBdqA!kDxFJjZ~LLvguvjQi(I}QNg>Hn30ujA1<^EGmu8v$?Gc*J)ow0 zr~ol55yY$KdnOxL5sFot(0o*c5f9S$is}p6sQJ6=oM(QDu6_Wg&woTK+qUHsgsME` zp~9_y!pgO%Im}1FLX#3(mt^%}1D|R~LUpM*p9P$Rz4;@2s<@eMgjifJ^DAe3wA4eS z!P7k!$t!a(qqOjKR9p%S<&6xnC6*N$|0_W;QLhjq4#Ddz+7?)?a}(8+k>QSN&)LeI zqIW|g?QeTVBB*T{d3MKSiQ~)KnkwtP#WkZnVowutsZ>u&BB)l|$C3C)J4#9%6__C< zfF0?CDgdot=as~kx=Y;cyP}~?+Bi!NE=bQY#Em<#iN!L z>)X{x<}Mx71lUtlo7G;^u{$~~Oo6B^);5ZPJmt3)Ti%>7Vr(tv3OpN~L}>6(D(nxM z(-#^_W2DBHSUh*`E~}+~0Bt$%jgKim>*A3N5wacTQF$s!zXe6f0m-yCbMWq!c+82mwjZ~m z#I&@Ex3bj!n>nh^H)}`ico5R#FEot3G%7T1%=kqNN`{YKB6fHiw6Xd3$a^Ccl%>m{ zVmOk!NIGvpI;S<}G4n#!o7zV~4j}G%`N(MX#*D(t#JM~9`_1Q`vrJ2a7Y<0Qt5#N>Wz?QM-3m?5?%Vj~ zs=bvKo&0w)(ha??<1%B6Z;R?c9IlD73gvM)`Y=-s7Aa(v%ny}y(w_}X$lJYXT@_`d z!3j%DD;PJOx%1rNw&nNet!%HExPIawxz?Euhk73W_q^<1R3pa8gZ|>qq(OZ|jahVs zCOozP{eg_jLu=PduXAhoqfXWSR<-?QbMEPkZGj~#!UAQTDOzD;mY#>5WdgxHa}0}u zyfsRv`E|0z*^2a@U~#G>vtGI{*V8|OV*mlGaM!aKXU$~ z9DRo83%v$rDc>KiQZ5*lLCdi-{|vjBQ(>pp4DDOjPY?IBDIwC>(ksdR>3l!yRcW+R zL)edYf1+IQ|GpK5WTD?MhgIpMhb87B!d7WG~dy`*(X!GTqAf?+N-S zLwvlmr|2k6pAaA3ZkJ}kI)T8x;@Vub0pn{oJwE$Ui8#t^v}nx4ghBHr?xj77V>w-d z{}s)>GQDZtLlr}6{2a+QZne?za+sH4yI{*J49 z-PvCy>retbhtc64o#o@A!D2*k$)%L;KKf66^-slG4K}ESOur$yKbXb7Y+HzS?Q$yK z-gR>)T!$Hzd+eEO5@a${LJ_FpPR+4m`>=Bsa<+)=34BdY76B7b9!#(Gh=)uk1; zE?fVU#;MP1chZ`Ee6nJ)5&*{$I!f(T1X$y=91LG@N!?kHD1;wr_#TW)okg=iN)o2hVSm&d>?!co5tbeekbz~hfrRvLUT9d|_PPESYc{=f z(mg<*bA}x@vd%1&WhCKjwQDx-@hz_2LBEbu+&UhM)xIAPcFMUn2P;2GY7G`L+t+GcPn z@t=H`t!tPV{@CjIOOv-lgm9EtbD1156ECS?D=qd%d0ML%M3699G~##T{^5-wp6hCI zdfSQMjv<>FFi5Ey!t1n0nRHwqk&Nwqp*e|8W~O!;4}__f8(z)tu+%efyt;sAq(4^|(j6jE@Ap_3TpY*SvWdhKI5WrAx{C%ocD%p$!XabL)Ib6II! zb#lE|P`NJLZD!T_2bM)OCYi=XV)d8)qK(c4_@|)Ol#W>eoGOeM?OpdA7wh2P5p6pW z*~@`AIqIs*{z!)~I|%hA==D5=@UzV+LvFe3MQqpNaw_C_ zfCi3x-ANPv`NgLF-yhHp;lE3P3-rij15S=uT{k^#@s(9vuvs)EF9$Kr76R_*DRILW zSg6-g7%zHVn<>&E(y@Xaj>0m{O+o6a-=4OG$&JUk>)bkm2Rhj?rl6Tt#I*UrUFkieGrkyPiwu8trwB?AJDW-p0BoZ0j(D!~ur|`sL#Nk(VX&w1a`{HjBTZby>L-aXsB_O=v)o>egeXN9F}c@Sk@qvT zTkD57blInIYusITJBDK=4!7g1C3)|1EvU=mx5_hr%Jfy*gw;2l=A7D(056{)ePYMa zLn6k2X)UOGn~w=a!kOQ%g46>J*dW1s-D1DaBAeQ-Nb<7~ogw-wcBPSr>(%4o)eU^B zg0Rid*-I0@;vn8IV!txJrwGH-uZ1d?y<_4^H_nA<$ds^shV(mm&nM}DxXS|78SK2m zQ$6K2ZCTw+x_J}(!f4Er@Pb?uNDgP2K@icQI}&nlhUH%EPXVi`R=+A=OSe}$e$i1E zAM+1}8{@O}^nhS3n?so;!R&I9(dpjf_3s{~a#Bed9Nh+6NNx2l-!x~KltkiuXvAWZ znOyh4j9y(;T~<@4WHy2{kTU`!NXIom~ZZ*t83smH)Z4v4;c_Y;UPoEk^3AEYeSh5V7imH zK)W(##0ekUcrs@C4f!=sosnU`E0$!tB0#FIPv<>y`Zm&Yi|n>N(ja=dOz`{En7Xi> z%gRX@_v1${u%M6aJEAFySXLZz{giji$Hsgwb5pKXn4zCyh7a)34&YN!yd?6qE(*`L z2ZjYPAq~a@>1t>Hs^Z3umiI$8sqBDs+_tw3MFPwB>v*zON8{*rIN&FWnQU{6Lyx45 zH7WQkHQNM>mg26UR^h84V$B(+NV`>~$AE>T+mVvq4awX5ub$$<tBq$X;N2zXB=3T=Z<+?2`*$ZXw(b%XfpKl-+fAw zBJ=-h><<=cH-!eV>5)iKT5T=e96tf~WE5@Gz9{1(SV_xJ0Y?`6tjgr8%E*o3E0*ci zz9HAtNiXWBsk^}509r_R9tGUJXh(_+n$~0x6TKP*6SySw>y8%fl3FP@0d|PC$k4qB zeoA%HOC9=6LK*36OA?}~3wdKjfcqt+2-fk*(ZqU**>8)aiEp#RD~8Mi#1zagdu#9l9;HM`LwU+k{E0VS^%*iWyD| z(DhCvGVas3O!^sOMtxSu32oH3tU8MPEZTrIcUz0^f{~vf?r1{sX!pxEr>CzZzCX%l z*rctgMKaR$3ADfeLP}Fw#mhi1F5pe_q%8pVDv% zD!sOJj{Im$SJ<5zYv+WOeht-%@xHdSK0 z^tne~eXZ{#^M})Z{^b^iTj^;9fzu*7AMF>2`a9eN;ASLgK*yr21Dpw za_$VAZ<$H)-gQ`?)&oIBt(<3LnrNpE1n$02ALBvS4fVe zvT=ztpcs5P>Wk$7riIFdh2B0&PL;oyELr==R(*if4r!wO-F)*|^t{h-DWy|0)X@l6 zeicsS0VG*j9gZND?KK~$WH4>M50F#W$hT=Mp05xhUE!y7_|j-l|GboE;sH8#gm{O0 zBbuoN8~jaBn508CC4f9J8%oGOnQRgW6s?zr_`iHpp7HpjJzweFc${@iOp&FNm-#0f z(O$nEyfrfYy73gS{Pz#vkqDTqT|xCknue0TumAnASiQAjlGIFv;~|!TkpSGuD~XQbA8)NP-tgs^{P%zxFhhZe&4w~Iqq8Y zGh6~X_+6Xn+R>7B-4|m#5|RpZkq`&nfJT;=C#YGN45~)Ojtx@}!oN`|LMSQkIE3Fk z?*=%|1RK@s!88rym#+RWf+gzlVOp|+yS*7Y$cqe^%#6Vlzm2P>VvJJCI)tl=wYh`v z5G5EVUK58yJ46KQUY&S#$1}U6iwIxORD}Z^>$FwXqG+5ssorz{q%E)H|o9bKagE9P(?=> zqY)BLOr8^;*9~fw`P2yzw{dH%O4jmTGo&_I@mux%QhgRZ+%8tyKv-(ESVA0 zT&2!Aa$x#@m>dG0XX^I5z zTp4IM>U*IzZ{UChIev-7hB$>hm(0J&1QAR;FnLt~-jKb~QA5za(>8?JiIT;?COsj9 z**b8Wyx|E>hyJlem(BS-P#^P0%hd87^{BZWFSII^k|-s|L=iU%2ICK}>rE=bJ^Iy9 z8B9%dAHFEsmKLXYF;D``+(u4b{(@h%x;edyd()p1^f)yoPh>j(;ZyJ-KikC6zW51$ z;wY2V2<44Z3Y;q-R~HDovM#RZnwy#7cZ2w}Qi!eHE-b#|tjW9*&SNQy){6?GlO1!()um;i9rVo;ys*>zw(Kj?MoB~jtUkv=3yFlf865FO6>vLNIh4dH#HKEWIB05!O6IBf^%oYyX=HU0n~JArX`$`Hs7X3VlTg?%ZU^%Ln`)cdm4v)K8ZFSr$fd zSN`SPzEZ1l`X;Qr2}}7HF}w3 zJZ+tL>#L!f%Y|zM+9fX~ry%*?Vt)@dWd&AtTYST5TU^@zlZFsWj$fI*V$?U?D;a@l zj6jI2QxR)du*A4v*{0u9O;)?|2YNI*8*FXvO*J4>h&s{?l|?c}7ZYOD+*2kd@;0Mo zn2xm|rsQ!)sj@V{3avk30@K%8KEgHkHvMetuN%i9#wQOn?8&qsSh9$?J*G?*7^kPo zbK+-lha4Zxy{toLx`&Q;e={wZt2X+?L>;HQwl)*+#5Yjm2K*}ep={CZ?6Z6P#;+K= z_$7o+el;<1){Vk|*Zo0Ot~)v<6hmAXhz5vX)|MFa*w4c0+iF23A?3Z&zq@cOPH0Jn z{T{hwN|)z*t~QLqZ?5_HQ5kv z2e!^`4E*Yc%aP}5Fw5s~>NCi_ACifayiTj1D9hDVf5D54iNZ8+sQ;sLu`dWfkgr6s{9*LZyEg=^VXq;6U9uc5&23;n6iDFOa+lyxDjW&DoSsvQMgsG5YglT~Lou=okOYi#V_6pDwrMb6O>W}PyvL`Oij zpc%~i=-rDKSWD~`n21s@s9|EMFC4TxGvaTXajezzixTgzECm?0N=MZ(xS!QM5Wm4y zo$?JpU2t146^(}zy!I=S0~I9?#&~wchslq!hgSNY2UhvFcEnk06lGAkWD&D@9w!YLrceD-{rZbCrd)4N6E}iA%A8 zl**ue);@01G+gf#o?*kU{xV&AYa3mAl&n{JDM@I*4CWmy(%rvG?F6eNDK6sIt|w+_ zn=q>XwQK<#@(dQ}`tg?@#j}+@J?&^drPqBG6cXF#kuJ8$JU!wGFJj^yoAXrkFw#{b z)^#bXoN@94T@Tos2DkP$BxU7ZE6Bp-Qh)Jo!lq`eYxhHgg%4`E zNst?uV)wc?R!B>&rC8N9r^teh(wNV>4qa16BMTsU#^y%ph3yf0vl<5GCg~yV*>&3jgz7iavTz1zi59x= zjEn`HUyvs%qvU{AKW;x}Fy;=1`BH)K>PDBiP@D!n>L%@fK`#A5JyaQ`P;O^>V^2H( z-avafb6JU8JgWzC3m+xnj=a{%3MUd9c^oOg`x079((*Q3S6wZq3{)x!h{%a4JQCT^ zE808hTN@Q>Xyv#~)J?*+ezYKM;!vops+m2y0h=sDQ28}0FmOd>-H^x{W$LE!XxuAJ zX351*npHs=MLRhIiRrO7Nz-z_Vd~E3rXOwFGrTc7^Sa;eVqFOm9sSvQOQxMR>mvG2R!D3E z7n#S)=_(W;RfG`=E~4VcZX}Lm?DIN4YW4cFzjL^Lx~8p+`)OuIw1UDW`M`9&)Nt^c z`So(^p?YG2xA*|Ea3tR}FCxN!Qu5UPxvbnZKf|T!Q;>6|a@QSS7VRi=No+(8LeQ*% z%~vIs6q(df;Q5YLkr$~}*?dbc4THu_>FW~+u>kRn$%b3%ux!v_eLu1dADRV;|i02yON4+T9OiIqBdm;?5;t4c zBXYcn7*fjB2e7I{9a#guovk%fxuj7#2nfE)@)~5{qdga30apvuW*|dT@Y4YS3K%u<;74`=pCl$yJow3@_c=iCn6bV@3@#O98t%PZ zU02>hlm^Q<1Zx-Pr~aDg;4E{^glD(cq{6DtD3v1|AtsiWBM5AQF|imTA~5?86(n(R zggHs3_7B@Tfw36hNy(8#MB1(qFt_2>$(82be*L~jz-iU!UQ&zuhB171A*N zz^##EA^=4x&|L$*k^H|MpjRbm7j=ZX{9iQ~?V=aZp8r(?yH1V?jTjo%#|BY~&DS3E z$MFA)y?^_3*cUJ2zteN1y03ANto^BACKYK)9>YHhiN^gO0^&kL$=jz>fyNmDjkD(( zhXEQV{G?(5G|vA4{~JjdhK?aZD7SEvie^x=s8Hf__vtvG#D}Km{15owNdgI!+x&ex zXDGKZP;Q}vnjcC$!ldFZl=%Mv{~Jl5hYo6ZYyZ3tlZv=dv#>&<%Fr7lGL-nh^ql`a zLC@d+v`i1PCU*-0Qbxb}YrZ%%9FmMa@+CPj%~-uni7rfc9O>V(3Rs3Q&UKXAAH0t$ zih4ZpLau@S2R83V`RgaKZ(j2)FVFkCr-v_f;NzUk9ASdV1TEo2pPSe3aerU#9mQGp zs@(ZH2K10(0`i*M^Mv)~T&F!260R9Ll8<(tabtcxCp!=D^yS6__Z%y*I)8-)fkREv z2rLNEJ6|2A{E&ZcE{&S&R+3IM5|?woVcs};ChPAJjg=_y>4eL1?)m9x)1F(7B9NNR z26;Ixf5)BJeRXyIyVpeYQo9ETe?30h8CI$CQ|y`rK$5UFYb*79sB1ugN1r{MRLdhA zU!R)1jxj)S0ZMCwssL#ee+AebqKZQ1`;-cRBl&{{YydadVN`^_+Db`W6+cB;^|L zKPPA(uIsno+X(bKBP|)`%jk_hZX2XehBkwECW|Nbg7+f^x2=t!LXp}Nx2Ei8pZSv&)_|wo``gy{XZPO`<|n)fyI0#&V}7X; z9vq$1R+@&dIWny`^6Sq`f*y)HH^8y0;K9fntBs4cGcE&~D>?mq$q2}`eOrJ`yXX$h zw9WAVdCmaJ{=fkKPW}K5`S0Y7S;3ftG&!&|U(U&7)os({tfvrCLY}XPpQ#o7n9vdS z{z9~VsZ+~-iR)qAQ_4$j=#E6*3^{qs`|*pPi}$*H*1D@MWG8`BSlj@0UY+r%yWZQR=FWU(8(oDw#XR9#8c3BpSU9Dc)z$Ky)OY@`O+0QZXsSg6ZmPFHo0tt zeV`;-=`^}+24ou6x7OCT0ft+iadXnMR^E;bma|;MiuMRWV*GlmRk)~aCYL8am(6EK$@VwE z3ag4;pdV4AyHdOap)Bxj)RR@4*JYJkTl0EF88j;U9SpT}z)53YCSbl*eX0kU{I0TO z=5&cWoyI6N-X04XP|%Bwcj#|BLrs?4L79u%h7c-nirIUPG$a}FGCFv+L4Q7L!WBO{ zt`}@NPj5b}%_OapP&9b-!=Ixg03@Z71OdBN1{9A-x*lD-}E4=+3%gECV)_*;D6MrO>hx)Bd>l z=(&Haa`SuET0j%4tMjstWM8%*FMUtznrxm#FJ8=LX)1T*v)1wQ^FFaSTegf9jP?%r z3wbOM(Q}S>b?w{V-AJkC)s$s-M9&L(5ut5SYYipiuB05w<7!S>xm=7SvR3}L6M2%a z&p!$48fC`5Ms@lLb&3cIWlsQO!*BnvP z!!yqnBrcDBX-ay|+~^pE*6+ol3Q)srIe^38f6+UGu z%IpzuJ23M*Qd#qJU6-TRpGd!jf$eR&`^u(b2Y>twM_^cW5%} z{M1}=LJ;}9eChf$E?$Bex6|t0z~@M0HHyrnT!pJwuybw^h#UW@@hRP^kX4;a$qKanvfvPOwJqmKF80F$L1?q(UFvkyP-whz`wL_ zmn1T4RJ>TJ6Vf%}N|lf!XB_6-hwE-ItgE~*5k>2v&1d2aux$LDBoC0uAUZ-THYUmm z6`kw8T|2HO=enh%Col1Lp6e1|ipvDEi9^K(3EEp*D^IOULV+AQyT18neA0t1gz|K? z6JH6P={9=PS@ylTp6!G(Mm)Xd%UiLlS9`3#NNk9^MX1wRkejuBcBs%&xUpbpOFo*H zHY~a?1DH!@8?23}s+ZpV@T9CdPHpXMHW@Q1V~(~tdMq8I)E09&@ zO3Dc4b)cZ}k-kQVt*r)%UZN zvey4Z$fB>0%oex*{D@mA;{;Upu~kMU21<3(BHTDo%8B@B*v=t$mZW{g*$%n+SjSe80T!;P?Sd|VaZ|M-t1 zEaP0!fx@M^Mmid}H&;;$(vjwvuhj68s%APbKEg0fWJCcx5EUM`K3bk2T=?U3H7YeA z?|YG9*&e5jw*w6Cjt0pF@f>1HET`$r=hSd2h)wg!25nP^{s5PsQ*bO+~{jd{y@|dbOZ1(Y^c^=-y$%37hoxA9Ibp@c4vlZq;Oo-ks)0gp zbbgjbZK7M4I9F1Y@-QD|Ew}h~4`1&}Zu`S6NoTIB^=t-B)2O@G(+YDcmab^WcJIwQ z0yp(y+KTzCR8YRHmP7cCgu#6H($f`d?`f5A2YK1s%At|0Ka=FPawSe28*=%?;DYAE zg&#*wsj?$anbHs86Kowf>>bTW9x7j-Ah}K?DUY225pAG!;na?TEkjLNP!-dK0I8)4 z3YV(n8o;c041DJerZpE%JIdLPysT)~VM8N4-i_;Hanpc&JUM1=EI7s_n*T=H_e;mR zy!D%bCb$%}3)IM%XPWfys)1ILDva4VG?}XW?$S-do%ZR28EKr5JDhBsdfU?qWDNQc zyX`AP@!IN1QB=-`%FPr!qtnn;U0&Pn}bxbMs9D74WOO;j9Eu?r$2&Bm=ANd7X=_b#gI_cIw57#LaNiCn2ni5`^PWlm8 z&z_{|1hJL#h#UDin;e28%O;b4#XeB>>2hK>fBI6u{9E5}ogsz%V+x(q&mC9$3f4vv zinyYvNNYiqz$cOtrw1XndXnwXk%c?e$KJB!-=oK*>o%*TAQijiWp3}A%q2F=p{PDN7Jn4ubC~$7-y;N zRuWCthv)RXlPi&JMvDMedn0bMk|8Lvc4#ZOei1E8H9SOgdm`TXq}bk0Yf$>5SrJ)K zgwxDI8O2hxWAL<8izL`GXq-(1Yy_j2iwm?>llRQc*S-S!Yu(Z-7#8z16~=_-ob%2U-pwXKiFEo-+3VN9V#@jPSR9M8UZ$x z*z0mHV?OV(`_O!>c{>_U^4x!S7q<&ZASu$r<&Xb-olI#yGBV;3zz#RM0M&nl3H#&Fwxq0k4la7_ zuK3I+hRu4~di!y){Pvc8H%V-AG($$UlOHVlvVVB#9PoHDs9OEl9mA^E>o%1ab1m;- z+er@$6m(Zz9ywmF1JYsO6If2BAY{OnER&}ShS@aQ3tu_9dOuhn@CbQ&X`^=(u5RWf zJr{S8uuLjwsxQ5Db_wYSbJkzRmpyiWx!CfqgiBGgOBW>>H?MwCYupw-A;N|;Q=YMt7g#0Pv4*79PLT$^W6Y65u`Su_j^L+P6 zl_TNCiB40UQ`gt8+$bq#tNy`z6pe$`00eJJy}wSwwSt2DM% z5m5YEg8k-j%?KN)&)E8Iwwdr5BCmiOLPzrHsWIC9hMa*K{MJLVv78kdl%F4cSC%!o zGN2)`>%UPBK8lSgtQ$()zXgbFi28fhV}&mmUOzYnv}sbcHwH|jJ9NLjzWuuH8|b;-o8GIw$0tAl zlJmAcLA7E|0&6eA;0S`6PGZ?doYEZ{mYWyAxb^U{+c zPUhbrvp5-pK>$*Z?v#(bW~r+KAmC>W*AbJndcWrLYShrR)gHU;sOgQ`SA?$3n=Ao= zJC>0<*Hi(XtpWa*r?#_1Xv;m_%7LeYWlQ>NElPq=~m1BB~bk5pnN$EKC8Bu~>e z-ka^VS|X3~HC@dhuxr-fl(i^SLawFl(c_01ug0Eza2?5V^n8;pq5pN8IXkgGZ_6}R zYKHHuoV#fQM6!e-ZB5IsZG)VA`Jo58;|8gKxZHtP@+inQxYeCk9|P*msQX6tD>gs> zeGZoxo%(-Vc`A+jCVg&l$SJ=Zoz!&le8D#f?m;;J6sGg$@BZ>)cDb^W8oj~n!sp5B z;C^;!0pd32)mS;(Ke@Ev)mS@w16`kSRtsxQYZ|Y*(lb<_^mt?t`v-N;5BnOO86Wnb zY6b~*oVr6WJkBqlH+mi&*cQ$uJt2}fe3sUQH* z2LY{10M-lZq?MiAGQ>qS;u;_ZzGC${Yu8p^ShWTMhVLO2%Ay8wV}c(W_S$&eXMsvw z)>aI&mwoB(bA$*5II*hQd3@=1EKfJv zCefvs3-`CC@nyQ0HGz3gVab9LTDkh5Fms= zLI_DnayRHX$MfCaH^%$pyMMg*?ih1G_F8kzzV}*d&b5=`>|IOI9G~X$+wGT#1~i|N ziY4wsTkZTrBkMwP<7T}gtv4Icp?5g&n7SKp&)ss9N)RQ*dmopzjq^0h@RX?v(|WTm z!arz{$z345 z&{6U9G?0Ddp-3Uksox_>$%om-s9^sQmxKEeipUz-u z-;+=RdY2vWr52MSFmte8zoR}tVj0G5=Py2}(VcYi#q@LV-V_nYVs?WH7PB-zQ(v>W z@K9T-t9vrT_--~dlE3pQboWv{E7fs1)anhkMv#oJpph_q!6F;N*01b$E+-$%ddh9C zR~5xcI6OkKYLnY#wYBk2P${3 zFcyRfR$?|b0D8Kr!d}4bFC%^H5hg>l5-ADQ=7rvTDl-U7_lWgnafiu$zR6z$gx$gr zFg-N}vbb2K<3{+b;)j)yRe4SQgH~qO7!VqGK?yH_(2coA zB~A4&lII0oFhPbx;mJwC4NF8xZ}^Z`-=FUE67oWG)Z`Hv;LeH>i8;d5N)N&|sK3{- z1@DI;jQ=P)Sj#|En*%y^otwbg-uiDiC6@%yu@k zN(h}L@kcuO8FGVIe|n>+qd^skwI`V;Y5;{UTw>SO;U8#A2Ukwm1pMX%_s`;u;@M^CTGj5sFbIoT<P z{;H>?L3+2w&LYpxtlfTFboKJp+Y!DC=uagE>dm5;1%lbPTY z%^Hs!!lL5)jg*{OwO{aCLNIXN)upq^X>|FB zvguDf5xx25_Wr~8%0z;l({Nm46^8m-pn#oK55ww(^s-+-E4g&~jlxut?Pp)aJBqba zHMbn-@hh&FiM%Q+r=KTzgdZf0p3cRw4ncLbk1^mwRrGvFuaOjZhvL#KBc>|}HTIdM zf=zr>uz2t0r9T=ycRoJ)cI=go187IAb39>ie)_}nZ~UvmviNgq>^iMZsjrP5z!h<3Tfq^W11?C3uHYC@>-Vv^}-#?

CO1C=<8B+nK>>VBw82%_g`da<^n3I~S=^*HkH4HW!HIx;`Gm z15#1pDU~bwxaj8pg92Q;>YZ8T29W9zDad+$S@*!#z;!(|24>!US zSFkQex(hr38*x>cj#Q??(Y)s(9io?>VxMjdkx^JmRC}fpQ z&E1Vf_{J52yiB$WA`6JE4(2O3VC6vxv}%~_W6K^Bd^*A&a3tl3C##rXVS11>hnWEc zYSyY*L2zye(?g&D6*)=Xn(2wBCLk${bUdSHuyMyrqC;|QqCj-VAXU1__ z00Na5KLQ{l;FWZO-HJ*$X6UaP;+7e!KAT7exVqG!EU*xO-E7QsZP5=oSFsHiYK8!` zK?!^m2#_-La~$OefIq=ytTK~91Wg13p?@*5H9w| z7P6xwRz}WqqLZzE$^a;+iy(wLAYkV-FS)KQ@XUX9M>g8>8rREJygfaC1GVwyyG8}h;YdPfY1!aH?Hu{=a*}H zi}KVG07lKa-_9cbe171%die?o*=XmY;&1*)>hb-|VK2h9%2Dmj&Ev6etwgBD$EWP? zWm{^qHLJC7q*Xf@29d{wr>KIG;l zJiz{2*2|EB6|~IA2tYVB3F^+(Udx}d)ExLAVW|B!Mxz$cwprIwb9x2&_D;wOazf=d zz-YiARvmYRWbm~g$SL4eZPvL zidDYV*_o}%5iDM{+Iw;E2eMAZ%B9H>=FJr>!@wtiZq9Orf61ZCJ-$CFWc=jYM!-tW za-7Q(#eiGhniRQSk&kv(OBhTI`hk%z!@6yHh}q;U2lzNCB=?6g6q9}!Be7YxXQlfp zuW*%}$`5vRI)Wb>AbNkuxO-K`+$TR23RC}adAomAHnFZ%**x9=4gyHkm98qXCwo@fXsMsl>mA)#-@Bm6o9i7+Vcm zPK<%>vOoY~R|V-Wj|}jH^l3*SN05~H z^6t|ylke?DO<%aO+))}6#YXK4a(4xzDE$&mx}QY8?;v;Z3lYrw0kq0l5yp*ARZr!g zhv+Tbud#aJJ-lYB-=8M>@$%ID(kR4p)O7Ma|1+~Ps;`qlj*%3GpReB#i;7Zd_XaJ< zR|kHEVosgbK?ha}^3mo+{NMw49s%Dmgq7*#B}CK=9lCq`x@yyA7f1>Dk+(UJ!fvp3O<;MIu&rg=#d~o^7d{tx( zNp2Q#bjZJ&yU>GzC7FP9xU!Yp{wq^@)pTJ74+0HdSdSG3g)e2AM>J9T%GWd<+Il}> zmS-ZWR4#tTH)74HCiZq+k(LX;-}-v;eO38yx;DBY*YGf#q`?cvGcIm6)|Hs1#+|jA zFn^&Vk&^fI)>r0x^u#Xb`mye|D6RbUaeJcX+oHH!zdHT(tlHatlv>uO7?C^2M?-w# zc01XXGL8HW)oQpt5m|eDbhl5$ZYQbxM%Q2ErL7?(%ZYFN^2F`TH4&}4oMMvl$%R|K z^UKb~oC>ob;+VRbtw>iCC7+~x_GIKT{N<=YxCgh8v45-)Yj#*r=k|f53_20IOj7=K ze11tHBRCRXa8_M_^h|(WtOLY&blJn@ zAtrMyD~gY+C&>v-Vp_1ex?vdIo8dC0KQei4CIK4Z(5@vB0l7C(zZ};=ke25}Qd!c)aHR4g zwN+X)a%er2?;%Tvca^_;9ElF~A4{c&LapJ`%W)vmQYnX)y~MrU?nb1Mp;geE`UVaK zP@$7=h-YPRXn=3!GOGtq7qAZ99R>#HZzvbu2feo(z0 z4#7G@Ks^ho!`erL3pr#Yl05yI)!f|2m}Fq}?Plo)4$HzTRn?=Nf+@0_sM{f8v zbed|sLD=H*LSJ9fA+TVHWWXOE9iCavCnxigO+<+e8M+1_a4C;g=U9ECP&l8TGZhpl z^wYrf-$U_eNsXe^unCTU;YWO_qG224=nvdub&jekQgBJ#3Xf2BV+=78%cT}VZI-J% zzVuZ|oaVZe4bVBXMwlB9E0cDtIs>z41k%k&lMNCswrNFjn>(jT^fuS}Wn|w`D);{E z1t#@p343$gq1Sh@9ZpEV1HLZ7?hNi;a z!~-Wndt~!xpYZu?Br8k4TF4lapNZ$mN071TV3v`P5o!qKaUjX^0!|ceOuia+dwyDm zmqpWEo)+P;=HQq#65Uas_a(t#kqS(E!-slk%VX`~VF90Yt51dbar(GhyW1UT7AO)G zr^F4T3%*z9bmJ?TZ4s0C{?IYaZlN)|mH1e|DMXtK`pLgT_4;|^QEmiJd3swDb{X3) zsVXI0m;j?$#cl@j8R2sxj(i*+%AZQb64A_7bJ9>H4^JQwg-vW(UEva&$RDYV;*s>Y zQ!z1Y`GpL@_|DDN5yL|M{X>pt-40Cp6?VWV)CY0q`dE8?dR1H(vaa6qY1g!I^(mWx zzRny3pTo|8=yCF6P6r1C43h10s57^FwSr9axUZ}s+2)Z^Bc29!F=VUYq2yR}$f7-a zDEzp-wO-&YaFwU~t0O@|9_J8oU4YPq(1>O6L4W#$_uP&AL=hlFc@(NNBty)8V3A%V z67-4JX*)mHH@XzOGloK!tFhSQDJVkRV3-}BF0L|jafK1(mOpGgV3x_>FjHV zJyoYr@xS;e8> z1hjf}1;!1XgIf|?+iAqIPdGtN*Bd!(22rOU8ruKqyosn(21q0CQoSlWIl1<=7~1B- z#|Hg<`>$=w+qy09Y#vTCq&vF#5>k0h1@GhSO%V^yUsO1d_`>wUM*!vU({9$mYgAO- z#UEEMe|DOkPE;#n&wnfep##qW=z9zlt~Y^J2mC;Zy>hZ`g~j3X&YLP>f0MlSrr*;!7KeB3m2~y69 zAzZqk#h(j(`sYOJ8zW5Rlkg?Q!)H%DwNXh|aRAOA;GqWC{Cj?S8!t`VO9F37}=afZ+1Y;f5!}SYo8~G&xX1Br4cbD1xolz7O3}{RLG3 zJ_rtPMUy*KVJ=Efs7xW+(eDuBK>a|B6JF%eXeB0Lku;BOlQW4tAv~7in10M$0c+!o z$Oz9Q&9tMTv#{StAy%*b$4I0;v}%B&4N2x4x&ccM-Ru$EHW&H;NxdK&tKd_2kMcl5 zDzQxi(b8&QzaCSeB%)`fFY)dqQ+vm=Gq%@uJYd!+iKK<^?!~Hof1=>C6nl03p7}G9 z&GE4c&j%%4hEpklnH(J$+MsVB%&N*4OdsISPWV>!4p2j?P!Kk!q&mqy zh|eN3W|l@qOL#eg_OLLLtYd+`k8em2!wiySV^u(067SNw)0<7l*4V$3QxVUSR)u-? z1_x&`JqIR-hSJ7Z$H##$>Zn6vF#f||_YB4IyK>su87kgVm~-VOu-Aq=hIx56ET=yN`k>;bJsC=9Fw)!9jx%K#O`pBYa^T4Te(zBLv0 zkLs)^5Ze~S*THg#uR=nX#yY1)`e66XsEj!H)a<;#WA0SPvp_*tM4dzqj(}BUh*`HS z^QGmEu_Yvh%gd9;)xxw8`aW4Yz_Zo~+Q*+l?P&-Lizra>j$lusbcRV%IGBp>&;XAj z%7${Qn2b)rd?$3>EGOavLvr6}T?5^DIiheh_1(RQoQ-sNbhzG9u41#faQ&c}fz0mr zv+CqJJbHxH;rF4u6qcw3s_l1wi$7}5(%^{C8Sh|dnCZ%xMHP?5a z8kv4_k@|dotw~kUxg5XWoiYty#OTZH9+s#qjo)1I^1;ch*mp~bVP_VLWJ$F3-m&p? zBCzBM4-gKJG`sHkY2x%t@o04Y6ir@ky{3b3z5)EC(2l;8Iv_?5wGk(=j&+8M4aj&; z+>YC2I#DRWg`+bH1&DWL500TkP|Fi4bec;lxH?5_U~zhbe40LSp!(v7YR{TC?Ikvg zeQ<-{Rk$3{D|Ofi&SayG#4OnT>6tw;EfwcBUOsh*Gl>xfFFH9$av-uwn#OoG4p~PL zO?H%@ja{D^sSjHmB>3wW)O`*eBWuZCt0rO6h(+F%KANuTbaqPX^m0&_rBy1$ETX!# zL;*1o5~xGHGJ2->+*5*8@t`kc7Ujt2eyo06FqE*PmuNb@%jw)vR>Je+=d-niXAW+W z9jJK91PdNeU83X`fXZ{#Y?xj^CnDtLQN^*1EYWg7V%vBsj1MWV*<)(!FpEIu4Ik4} zzi9#8OI!L9xHP-f0TGW43-ZH2Ll%}MmnInm?~FE{)H-30R@>}1c$F8npx-7ERYMqu zZzQ)u3M<>L`wjaHXb`K1yy}OB&{;5kVACvnvxxdLJI2el^;mHvU0`)l@Y`mk4d z_xYVVg(Bh>Th{#>SceR|@h2<(YcqgVw&p_$5%WRz!^-$y;i9j;nu6jgWJ&MQtC<}Q zj~fl&tkF7{lDRAP7x0LURvrrB9X34Ct?uU;?W7dl53(+aI`kokhuJ*%=dm9E8*EIK3T47Ta5k4#$2_ zQqIfE9kkrxvqowK%zn4eUeP0a5Oab0`v<|y6SbX2#?I$gKzLOx<-4V&P3jY;+`AJ! zo9nOs3Q6kSS4gVut8E&uGs|lZwFx82sL~PTZOAV%$fg*W+T2K0|8kv~gO^|g@A0Y14zhAbY@jd9%wSN}jkN48iV4-wt(GL39OJ zyw+?6=H$!?=bK~BLdLKSJ4t}efHG!gMj4BpQ)H(~=;zpB$M$45I6^?J-Lrv!*3!8Q zt@582;OcALt&LRk>Abl(h(uWVDSe0f5l*!z_@(i)H|sIJ=V$GoY3nhJ?ILxn!WUcn zx{zH{zb*wQ1BAgfokQ?_b+h4pGkyX^A53R;xHi~T>%^?iqU>a0(B)g=w`ZQz;Nv%* zcV=Gat#A06)A1$->kv@c;>M0&%t#N~-Pu`N?`CZ_{h}YocL|scoe&lGG+pcE`@9tZ@s5Qpii)i*g4543NKESr?%b_wUxXgzCf)blQ!s zmnO|X&)sngyCDPaD>vzcI`DFzMB$>uP~D%9A@br-h~9M6KaRm za1e#yn|yjiNV)FDbkn(Hd4U z8f6}b;iFR_z9G9$d8I;Wx*a$GBl#Z4_|Gk;c0AaQ?$v$F8Ln#vLunI-Z04_Az?v^E zI_PyFQEXZyWF$jnaWV7~jRvxkp623k2^Lw>H<&gd}U&Q(03{1wy^je!RXZ|uLzB&je+{e0U8B~A2pN4`K9 ziMc7@vZj)dSD6HMv*3@}41EI|1MyuP+60Rvu7!zU4PXr(%Pp~-78@|&`E}T|`;dfo z?zDWW&|5GKp&yHvN`|?Q$BtUL4w6TK1zTD0UkkR@!&=~>iu*lfT?%X7INqL%=^|4d zw=O;88lvivhmutnlZhFTVQT}y2vR-F4%nX3Zm`((j1RcW>_q{mmY;!{H4Q0+hA%j# zl2QnFYwdQ2hVNpeJ>vGYHy)BV`vlQh&;HNH%{*IZxHFQ-5Ebj>2S*P+Z@HIV5To|B z)t{vHeD8YwJxvlK&0hGLBza7j9Pw)C(vX;tT4%z>^6woXO1dFu45f(!cJGD+Be&n% zamMbEF1uE-ys?#ibMe-7knrl#r9GObPaTo#iN1YdzDIN!k7>Ulv~KI~kPYvMCJm0D z(Oyh5iJEe26ZYi7)XBM&aJ}%KehfM4likaWoXI8N*Pf?|ENy~K>AJr=aUMH9;BwKxlQYny2R%XFZKYX9TYB(+T zBQGL_^OYwasC8XLLWB1adbPHF>LbP0y=>bA{P+IW@qLDFUh~S;Iwj)btDUc0u|?|z zhRLoOj5`khOjxfzXU0nB?a-_OZP}E$#p46;mRx6-^P_W0KVj3hd?TetDXt!IS2sNV z1vHG#y#gA#E*EYE#{B}>rn!*mwF*1VnJJbT|3&2oxfF%Wp~GoUuWrzY>)rz}+m%^f zbs$<|hmY;_`yz50?*L`^>Y$T4SN{ayAq(X5e?E3hwsTEXTaTB$9!7j#aWU z&(WP5|DNXz{=0cjZ`ZH$T)ICn&lQS0;x_a&pXn*+dYBKD9uRMQgW@(En?4VnJc9wX zb5@g?EYG8C0^<8JHAJY^f?a%^jtBz>y%7c+8sjI!qB>PzcWXwMN09aN^UC7wB)#A) zb*Hbob8(7(6sPWeOIrPmu}(4)+?Jl6b|vR@LR+N6<&UQwGm1!S8CQ1mQl%|w_9RcY zCAX?j4AxRoiMX5){Ge&xr(*h9aM_);iugMwH)lJ-)p-w?p zm&ze+?TV$D{0kt5uuAN+wyWZ3yXKX&hVwPG!*9FKpUks8cpxd|{Q2zXHBBE^8(&_Y z?)OW+w=GW$ne601GA)ie9IzfhetG#KfcoM>Gk``&y+F27{CV+rU%zrv%S6b&|E>98 zk}`G1IM(!X=E>))!+(x=<#EuZp3{h|0@ySy_4cy&{)>rP9<}{ri*|J)+wxh2#1F=Q z^QsbDR)+W6uLytcU&1Rt4!jm(MKWDfd)#(rRp3vF7w&~=dFn6Brm}kw0}EXd=r^s{ z>W$%5&{?-GbGE0Q2rWK>9pf;>bl|NY$rgoqhhp>_-!9fLv+;Ay(mX%r)(CDJC1ZZYi= zDp>tz>e-yJhJvInlIBWI$S)*l*{8E?bb2KLqFaMRLEIvC2iOV8lb<~=y*E#f*t zo$KU-p#zqvzP_Vj5jZIx-76$e8rb};&a`o|FFW#TFs6dsJ{>GSV&+?)Pc=x14(0Rt zT`OC;Nusk9YB-8=y<#132=|w?s69cpf(la1yI}D+boOe0l6S+_5}OVga4^Hw4&>CYh5p){um_xdJ#xW_}&PxaV6KA*!ySd8P1kx4AoEkb|logI2goxJ1 z3=b&$&;YE@kc-ZM9iX4W|v>bPr;u_eO;-f0CG&HC&O znlF`qBFiG95gJZ|1Z_n8kX5$c^t%!Iq3>B_!BoAVmOPp!jWg47-T55uJyF|d6L2+L z%MJJY2PRlGniNo!w{H6z`;_xC*#S3}hhE>6N!$2!q8e9>cw^nweW(03UvrKX!5W!t ztw@2%mhHouZNx6BF*^4!Yo$IS#QWdj-{c)vV3xpW3t; z*e?AWat)F{46zHej4Zmt}wexc|p0c*^+LbO75j4f3Ly?V&9! zU?Y>K^pgcQ=0)en><>MUhXKmjz#+cBWm^4UW?>QWz$^Ac?qOHLzk4jMTUrW7_x{sW zR^8?-g@EPnX*b#`<+}m|^{?bgfNbtz6!^PtX0Ac?hi^uSTX(NOr@_l-+3HeO<;?H) zJB-XuR%fpuzMS|F8-nbjcs+$xJXwWre_5$J29TreEK6J05~MF=l44$rnI zRjWGw@yDm(p=IkMm_b?((Dv;g*99^3oMgg{;;7sh7!HeoK+Xr$c+^##quF*6;~T^p zfMUi@m~T?W;nEM6>>};u_~~WO!kpzIHMp-zt|(RC2**M>UJJ&T6?YiuzB{AS<2KcM zjB^X4!JX%3_1q(t$^xZ@uk#F>WVjs0;P4xA#2){#u|;`a3%?7}uy?&|%W8?0XwDTz z3Yw8f7;eBMCmBW-)G9xL>N%ztVt5Eq>Q{lWIr2a3dDy!3Vu$Y1XDrz+H)8^6Q}*`7 zjSO#`*o88#Pha-~gi4F6p^JltPREP#!K+i&VtrfQQV}YeFBh!N59JAX%{no_n-C); zO!&fBnkbvS7)iBbFIKg&=4R@FBoY4dz)D7O_9mUC7aUmyA44;5K8n93Rl!~dhqb}@ zWT&xPG#bAjIdiv26GR|FC6d(Zb1Be5rG0Xy86r;d1P3YN~Ne35}`NcVW%M4qTP z)^$pI`;)kp%NhuyE=9~!^I-SoBP8L`*l825f8BW=UcX-j0?kr6*0$Z*@JCkXXKtr= z{e2*@lWVz!g~7M21f#~QchCR2Z#}eWsp{qcDQ`;)M0)t6Us6CT>7d;6TgznEZ9@G|}$_7JiNX_2K_Z$YjTSl+231OV%5O&TqYzE3TC)vr!6k=v;orI$^>VB^m z!cI);oI7N$QU6&_TifRR!yD-BrNdh1RWhwpQ*SgqgnU5#S%&2G78$aFeXCPQMe?L{ z8mY()C4qcEAl2+b)!My7-O<$g-t7Tu4n!Spn^Q5knh{>7mr<4~W>#qM?%t_*JhWoN z;8eA_sJ?ysTKRMnef#y^Wqr|xU~Att5z;&C_0#SeUjC~|a$Q>$NytOd3SN;`q_DAx zPN9-W17Qc=qS5$ef5=u+o3}NJITMsF6?nbXH88UJZhn62$|@o#MtwC4o7(DX05Y=% zV~D+#lG;s~+fVvEzvDKKKRdfNOqhXl@ zrv9LoE{_2BJ)YT%a>&>L>oy?KQ^^XChE;-wEm1ur@Hdda)Sa-S`CSN2v7n2xK7 z&)l+E?~OGY@42r2z;%b&{#Rf_J%TIJm>&ag+B!HF5p7M9nVQfHHyE)}SIBXHbeVkA zug4`(LM!vgfq>ZcZE*^IN0cD1Bn-j%fDd2(UXLrMU;zTV4 z(NCM+nUbRsjTKeb6y(K;9Oe@SwJ9dmbTYQ-Y~P$7!Wv{Z-mt5(**UWgWXzpC==Zx; zcnr=eRisr(QTFQAT5u=kui>LLlQq~HbI!yPQfn=(sWR8hCm91<1tmi zT8^4{8UxqIR~=AEr8DY;eFMD6kVOU|Cb?anq=z}BeUx$LN;)2!P&*iI2<(IX!1K;R z&OF(`sDIG@Qfg|E1*Bzqh-PC&M1vwvw1Y{&cMe5_MS|0JvYFLv`XE;4Xhn#It0C$S z;JmKQxqu zUmiWa z6o8W<(~L-|SE{MiB1tc~p)Xz@ldd9aI5?VzrjeRw%h}i_Fo{=k=_YR0+lL3s#vvz+ z9JCyVXaf80x`zYy=Ar0Sjgc2Z`Nr2BtFNq-jjB@nhlWPUocTV#;^nE@v=|6R7>a+x z%i$#?NIA;Msut;&g=F;@?$x>5?b*r+5{^<#lQb)R$`iVX$SxSN@LXAQeX$u(G_X*& zrN!H_XaXGmM0oImBkYWSikVvdz4n|i6Ckrm?qd*4qco>f%kN(OD3-cEG*dG?j8a`K z5d-3w6=xaWgOasUo#O@??^2IIvxZz#gT$&B2&_S+2mZCSpo~=RsFP6+wD2P%@b68f z^?e|MFXvD|@+1^eXqWt0ck0}HYp2m(NAcDJg*mSb_LKzs^J5w?u&I45uHBT!swtK zS+F$TzbCV%c=NGio9v@P+z;4{KWt_8@dyjconsf}?gZ2I=y%LR_?o8j4%c@)2`H}} z3#Z>}GNyvpiZyEmU#6qQ`rHdIzTaoGU!gkmzBt3vW8J&nVq%0OK07iG}X84-2GMwcGE-ZLd9x2S3F1?dz?fh3d?%v zG*Dp{k56)lP$jBx)Z3>QeGg8jS)TxkGiLiia@ciUrd^E*D+#QBme<@y!e+an z-?vqx>}_t1+J98)Kvb^r)Bm(RcyZQpSr!;Uw-tjt$#TvZ?EzZ^r2sFh`m4M z%XQvjWz+T_N|%<}PfFeaasKz1zXn)tvAS{cpSuMx-X79#D>A;?^dYwAUN_^X@KHU6KtdCNZxy-lFW!ZNCoqDVdgl zi;&v~V^@O?hRPl}wyNKC@6|`mmO$ha<)f6SUkv_FIs26ksCV_A`jsP)f-rnJ9sX<6 zPa!@%%(egbO-IJsFsu0_rs;zJFD z@-gbsJ&zs4V@XcIpKrq9?z~)1WH@NWJ>;b3$`BQVr++Yu1&p(RPQt z-1UefU+ZH`3V@ty2=nY3G-s;DTQRxC!9&xo9znBUQcABES+3_IA+Ge~7lG7~OXgSo6OL%62 z;RD5}r3l_+c<^OTAzejbYk|Jn)43i8P5JcuA-pDNu`D5^K|_T4(F?Vr@u5B?sD0!eTUlAndgc$#U`1w48^>x1s76WZW2A>-9B)5YG6 z2mMUE6(Hp$9*SsBY2YOlwWs_biCxpuDNoigJtQk7T(_QZHQU|%lF>xOxWi2|dSug| zcdezhrAU}-V~)M)kga^GRP{~Kd(yipal?(oL4B|S!KJ4>QBl6dysAdoFB0mEZW=H- z6wnaq%&H&g8;h}aLi@YHWYRPbHZ*Opv@j}R6;(g8PY#@X)~ev<1xbht#w^Y4X+g2o zx*a9W#;a3x6^P0&JSF9AZg7Ll86yXtf!$7SO?v6#T%(*o-V(T-6JTZZdy>hle!cEQ z+ST~w#8+uxl+HMgQRnGS(uV^sVwh%kTPXVp(_{QHxOJCkL$h7y=8F_#XGbP}EI#ye)!GfIW%TrcsNYqI5%H|n5Z$`w~ zi{VXfd__k@0^?j0wr{r358Iw zw(W}yUPl=iOWE2^F&i&>TbB8@+e`8^yhYcKod;-tsNpJhyIQl!>uhYqQN`1Kea33> zHBUKeYNOWUiI|EOCx4Tzd?|UG&%#9q$rCw74VP1&{2r@3%E^EBY&?JwJ4l0f*upvr zf_JCD+T0RPYD!ETO00GriZ)JTHlg#cgWThqV&o5p9{K||xR3E%)$sIrPNL{VlCSOl zBO6+$UI#j3GMAc?62XpQiG6J~@f8)gm*mw?>S7WzDgn^P6whH{>Fl%DUd}|2}KutXr<62q{-F*cjJhG`kq$9#pAg zrZBdMl(4=TJRr93M4RDBGnf6ThjB+08ngop?kci-Rbn=@x;zT~qWn^#&A|S*G1*Ix zdtRHAG=A9Vl2Ck_cva#};|)stio>FBfGGRo+7wTIAzH^6lNGieb<31dNU%{>Z`@^z zBe9YbgQSX&9xazt-&U(E(O35LtB$84n_ly5(7Z)k&B5yNL;$QKWvT62Vvu#B+;Puy z=H)Ll@!RhyWu+V42(WhX(zsz-ALt)zc-zYQ2Z|qLd_{Qu=Y0*}1CmK(HkeV-i10sCKi*`?UF|L|lE8iOOD$~l$ zMmj8iZ+B96CPmH3a}@TZ64&v}`K{5cmy6dUjfC8ymU9o^8r}Fa;NjEOD~~2V7#?gM zXySk#_vlR&&nI;tac1t3IkC^)?JVwV(=PpU--0FB!Fb{WOtWNDMM^});t*o5SwPSXhTWNX|CtdUX1yRztMq(4+KngdykF&OJw( z?z9`lq>sAaF}Hox^RUhEVV+`N=+01vCRmY~Tz~W$@x9K=#0_lF+U;6?irG#SPi!P5FRs#ev=O zhntpzE-8$WTy|Q3*dwOq*P@km@R`~Q$c}uf!g!k6I1bQ`lSuHWp{1D`gC6CBUS(2L zaUqj$vlD8%M`;CG&IIjJ zPkp)d#4Y!p&jsfqe7)j}pN&U_D8(q5xcNBls%-A8a{M5?zoUQP;0>Wp>1dhzIh(WN zHg)-%@NTIl_JesUmKTm_PRrQf9LqD^^ch#n(;xdi(X_;6Z`%D?EY9$o(<_d`?m&Hs z*5~9CnK5li2{l!Vv<(f@g(mS=Iv*9K-6R%v@T99gYNPm2@tseXjNDZ)VKI1`cHRF+~Oj}@u-BP z3HGSCd?5-og$v;}Iyj&o-i?Y2wB|gI(n<4=7P@`Z*nmX zPU^qGE3^H+=d?!r`WdUOx?&0GUX|BfW_HYI27D&J&Yyc-PRt4MxpWA(#>7M8vs{0# zs-dQ&?mF|BcTr}?pTXJg-q_+^;$7j){QWp1FoOas)apq{eykZ38QzVx_ir+eI@H49 z_|1mr9HS zL#nU0vmH>1ijtETYx-2O*IrJz?A+AwuyJN->V9179m4!r5^X)3%T-Pk6Kg)%Bf&ba zS{(wI z9OM@n=&dx+)(ClUb=r~3aDt3gV1JMWgt4I-6 zOa(_9#DxK6Y7oJ&BrF+%)T$Vk$P&V;67~=f5D@sEsBrJabNc^1Py3jf=H7GP^N!E^ zdEfWkl?55sx1Tu9FSZ((KYSro;b_ZA6A{_u#Az? zFjv*6v)`GU;&J(<=G>pmmSvp^r7O3X%#bi~l&qF7f9SnIc3$yJ$2XK;ye?ZB%{!}? z%X)V?f7+lgNjm45;D1Sa+Xtjf=iIJ{^|qFscRBV#wD(8Vth1Yr9?#vA{w#lGl*j2q zU8nPg7L?UL$pIa_+_>72${CoOy4LoZj<~ z|NGHtm!f^FSA{K|ue{S6{24Ou_SQJzU(C5fNf7=SyX5xA3`aYgGP9$=MoSA3p|8Yu>%k zeXON5f11+h+O47kj!!?FT)1?Oo8pPXiAnFP0t}9bW$Jja=;J?nrX{}B@L<(~hd;V* zfHELB=Ql$&F@c*P^nNeASflyiFTxu}Nh9^Z;MKP;15fc`*8K!-=Z1BS^bfP@61X|@ ztB!p9ap=s`7v4{rlAcYgJtEn$Ib2=xxBEUKTg%ew z-YTvv@b>-Znzl&I18#%i`H0fa%bmV5*TR~dTl#kEzj#+qBc4p1Fq`TCs zsX85*^yfv_62`{_0hS)uH;gB0Htq^}>B_P_&euFrPTyD&_tA(?`ZM>U#CXryr?pD6 z2Li@>PUKSqR?RM=j3!KT>SLaq#vEVtp~H5;#_c`JV^(?aFZ@1#z_j*Km~DFGirlgH z?)Yg!-mO}-mFMEVX~p`D-X;Y-1Do4M-CB0=t39=! zNPGLZucImh6W^ZgZAX090^C;$E|ZKyu2=HQ1r#s21* zZP&>QvI<=!t!9R}|`9pfXzkQ~NTISs6T?^L!eH3dir7oq)`c(A;qrUQJj>Z#v`NpmV z?#_b7=4mT9-u*#3p38neM4i#s=Kp?L(k{yH2^xzZg+=p^eE7U|@$dT784KI(#+~gl z_r?CKPgPasb6w)S{r^{c>8kkj9~Q;_Yj2-DYCX&(ZIw996$IBaTYS2~9o3CXfrcNt)|^YN^p697mIRxn zMNUimi}9fZyp}#SVSgQ6*8OSNyhUMmb|0>#H|sX#?$EEjH1mW`ALI9X%Hy>B;1RVW zy*($ksgId2GcI(nKl3U79OD_|w0iNY=c(&})hQY+OPjFlU+E%z~|Dxz&f(NfZO$cf_oXPk*^9qWI5n<9Vlbr9xIqec16gd!B}# zi+sbWT-)Qh(qpb?6;J5eNX2fqcm4gSYr?$vOl2vqcFH_i@aMsvC(-S1mF-pTcGv+I zrEEX!p7$cCVODSc09nCTWvg*c-CKR7n4>w)17}C}R+1OGr`qxj&(>Zte^p+Udrsln zfkzUms!Ok%Ddd`Vbew*=#b#k_zL#R-_VW+^T%&Gz+30Gh(stRI_Yg97RGOReM3V6+WeMZ>aMb)Q#bhd|7PQTfpxOJI} z>HHQYe#7Bkn)}Zg9hY?f`CZns>m;r48jXa@A;Y;Wa`QEj0*ln#o9miIrrU=qZXI^f zXy}|vmNYJO^xV4b4gEAv;Qn;vY6ifA*Pr)-QxsaSTMdD)cR7un$V-t5=~DKRzdN1o zqoV4S8YIiNw-(53y;pBX_Z`dNACd`GUH(D*oV|GGcCR|mN0A{j>WAF3pWM!%&xm+j z`}1A-VbRY+=PE^ABz?QeoL3JEWUB4vEfU`lajhnN{tEJ9kH#_gr%CTth_#usq$Jlm_g&yP=s*qo9FET6J%kj?qbe|u?w;yTR*|j2fcTT|2b=5x>s&Btkv)%hR=j;FcxJrIG zxQUNbRlpFq=;EaYCi8AzS?_Z#ZR22Cc!+F7`Rag?=}o)YU;fmxjkvh_(v=H=xii@L zKGV|vmEXGgvD%_vpEndV__);rNbuqFkvYm1xi`uL=b8g}@}CqtZI4f{eC!x}W$p(# z34TKA#{34~H32%8f82b;(vgw%)^^#wD+87~Ld3}Q zSl^19vNL7=lx@y66`1G!R-v}_xbvppW`~IwoHw3xc7dt#eA(&gM>^!@hsDhvvUOtq zm>J;d;8LuuBOwxKnZI(zg-p80{CDP0$x8E!tm2eXDZ6~;&oow3eye#lbMN>wR%u|{dhc5-J18=Tq>vjqCvd05A3+Ugs{~`` z)?7Vsdi^uOdw@G-X)TJ1M_caBil;qZdhqgn8*l5yvJ!G>?pYDD1}p+~E-y`N*l{V} z($|05pQpg(DuPw(H5Z+BvGJb0L^gcxQICbjuTQ57RO@+b-$pn|Ry*&@WibL@?(BM& z`|5W7`)NC=^wTvRy=O-T-B|R~XL1GS(t3dyOv|U6zA;G6EuRrMJw8Ek>yShG((CNh z+*jcnH|z{3IV2Uhv&p0SXk>5xG}b4c;*p2$0L1NBWNhZiP(IqJoxK00K;UfWE6Z=F z?#-t+w^Sds>pj_iSiSm=P4KRi+`+jf*)?O%Mupx^Gs5Rb^A8nz+ui&0Z=DhV!?WM_ zJ?q@9&!K+U2%2dZaV>M(#ERv_`ThxfVH&=Oo7mvCFWk;dBb~4R;YUXHlVu$0Bh{f1 zi9um*aH}EkWpjQ~XUtt^zHjKN9JM;n;fSCal?y+EXZ-ggfcg%Nfj%qKUN*RTo6VcK zEVbdLx7pQHFYjb#MbanQ)Ap;Jlj^=^MX7E|N5$eSd-AKUKlxd9{U?E@NXQlHhm|#E z0esB|CbZnkr@hj*F6Z8Uz&D+9C&zdW-}nPax*evcNvP?X+S;{{X3H9#-Bdre{WiGg zNRRKd)$J7Vf8O|xcK&pPwq54Q+xmFsS+O`$&%2)7bGw&vWd3*{Au>IqP3F^y4&P^; zrlp30+#ijkKR7!a@sRR6XMtu3DXc8r6UwUu5y6Hx}EWH z4TWPb?Un<&Mn-V<43}nhN5mlK$<``vf{eF9iCM^;MVB^suRbm}Q!TcHE^~Hy4Y$CG z^5fhd^Yq%|YLo@WH$R&{o&7K8q?Gsa<(@*|nLYwOD1Z+tKg!8o3hB*l1%EN>k?+6y z@h_dv1?Oave+pRZl{hL&NsBwm9mr2j`@7+3+4WB|Brec1cjvwu4&)c7Q)sVe%MFT@ zC3d8WXQt=4XKAi@DebdH-%R#W4I}@kUwPo}=|%s@A366?aPIkP%3@=O&-QsOCl?z> z_V=F6BnMJHGKKJu&HEo?v9VPao%NP8CqU99XWGe_xn#TUeE*g6AL-FP zF4Mfbf)1qkZ^ok2eR19vN9=5Zck0h*mdcnrcTs+{_rm#daz!EqYI@rhvfR@b0ji|n z+4U50%IS(@c@Mld&l@kdHGB4uf28B%r-XG9zNOFdlk!IerO&UI%5UxaV7A-n>L;z` zh24rcjU(>U8FXNl7i2m58c+kr}F@ zq53vQO-1!d%eX5zY;Bm+Wj8)*At@VJETVW!DmznC?d<9C%-x!!A3luvTuZg=n^929 z7;L>1UX)b+%ixP}TZ5ParBTPKpm*zdCQi=e3PHDW6=^>dOE=m<| zG4bs`eYT+#6rT>!Doz%Vi1C$p#I6=&Q2UWQn@f!K|hd%PWkZ&iNHUFB%mepmdH z zd5TS!WKQpvq1?A2#>c&%2VE2yxQPQ%QB-aNqM7g%ao7z^|#Md zERH^2cWU+8Q#)M3jEB7bU2*I}*UOKjO4mXwy33-WDUGZ*;V z{#JKj*AGK#Hv|Xj_e2vDf)t86gk?b8+egM_;&>8We zT;_=xG|ENS%0Cz7Gw#>7{c;*!q#}`^% z1GSy1^2_)aUi{p9P&`#uUn=j$@y*LuPS+AOiL2kUAn*8bj_>VEnH}#FZ>ZX@dvRSZ z|Bn|7GQ3=7&Z&(tKYsQ`qW3D_6K98pH$B{zy6n!L(7<~ODi|#!+nt*gZ+J%eZ);h4 zWoc-v-=B%#V<`~e62E_b+u~BTXT`16mgn6lfjcf(1nqE$NcvNfsRpWR7rHb|6c@I- za9_tBlUlsEsQS;NyjZ4R|0RpWRegOXO3Ty33sx~~On1LCDd+A_RguN9WR@?grpi4xpP5wCSx+)F#5y`nh2tv);TR)@b!g=c4{y4sf$Rnp(` zM+RDsGMr0Bo$R__MwC8Fl8^v1&Eax^zNPs&asd*%Eu-Ar2F-*MQU)~tY&8|r8ZZWJ zc+x;k$jyTe!qJ|V-YRgCNYw7j=V`~QBn38h_s_Vwd5t%9wXM6SU!h7D4Bh=D+tl`h z){;Teh30$uO__ATqtXxkmp|J+aLSpn$#Ipwsz$}LqJJu9->BK&?&)jZVjR-ld$K;= z!R6pDe3QBb^_7n`E{%+c+|%#sy?VB}E@I_M8#Ax}b!#ng5&QdD{=p3{u6MiRtX${) z`ENUmVfW>#6-6d>4g&`LSt397^ox{(MHy^TbN$syAS)Lbzfr`;{7C24OWmnmX)Cn4 z{AkhsS=s(`_6sMow5@8@ zIsDOH^Yr0e(J7f(7hUM-qn+0`z3@zVaUd;0=f!+4YMsWc6oq=h4Ndo+6R)4E*SDVR zbTb;{2f7b$eNes_Av z{D@w@$<5}`!py7D0jlbYwP()VUlbGi;-k7BpWi;F@HVN~Ma4Y>@VoO=H@T>M{5;lV z^71d``qo6V@*8}O2mRV2hk){Q{o|hgQ`qf(o50;;uiDm4-|@D_@jZC;iI?A{M^ysq zC&$-YY|No zddIwSgVrjO4LXz#)mU-r_F_O<@I$IfR*clasVe!9DDTRIbIz3w(}qF*R=jT=-&~z za;1!OkX&}cnbG7ugZ{v#?%ebUp3nH>uH1Ep2*1pqk1ad<$6aaX;iHEtc`Fy5^;mf~ zm|knQ{Yr{M+RNc?AMdU80>35?KR2;wuT#|O1@|=8UyA)}W8K+SzTcKE(gpHSip}`z zp)Nye*ZiOV)vhExNjPJ$Qf6=`u#MBDdz4R5Y|Ku6(vk!|;{4_1Bi?_g+6eAuJ*av3 z0N8`U$}2Uq^Fw9-RA(rj*kofC{bjFQxJ#nvHdP9=!vj?oZ+%o-`CI0{P4vZiq1tys zmP*b0`Mq|t2>5Z#?BSN*%Xm_kPruF^7$z$y@iV&iWshp)Yh*f{Iph3j_=9D=r$=}D z!C;rgB|@_9k8PFZN_NR-4Au##jrWZ!$Lnj4X-byqCgfkLJNe%9;_q*CyPXUBUfm5^ z?Gf24Nw1;&v|4QUu*>02F6){0vs!1lZfhW!IiY`Mb{;MA-M+o1b@P^P>zbHF;=qFq z91Qf?@wUtUexFcSf6JHgYL~Sf8!$4+dQw#}D*jJiN|vYF^Lc#blZ(K_QFK_K<4YN(&PnQ#^C>>=&h&7pHbo`iRAdFE-??m7Ei=|NQ&x7f=w&Sdjr z8m}E+1SB2k9~Lq$Fa63ir%7O8G)Ve0XV;sKA#Kawv!xUZ4J1@UFMNJa&3^q`{qU%! zs38%8MU9$S?Ujbl#N^lX-^q>9XMc zCw}ca&MtQUh3!QzC^BSts@y-^Re#hu;;V&<|2!M63*^`EK+ zE#<`XFBglyd^z6Cx9jRO>+%Y?7?hLm>&{U7N6w@FBM@ty>0mSR?0Y#|Zn*!)dbt1* z-v~4D%hx>p=B#B&t{)1GqxWn%J}w_rEA{937>!{U` zU)KiwO!o9nPY_|W?H=XK%b>-XeX{>1g}3JwRpXl7lv~cc7@HgaB?9a=^BU@ZHCFoE zaNY@b-7h+w!e{>q` z$U9r>(5yv=_Qh7y1(ybsJ8S!Tik`{soLfi#{c@~KY;UNB!9ey4liHO!KWvyi66o0d zh_&eA~`TaqK_{{qeG()gB`>o^8U)}X|O`|9a9f9Ss`{6}=6OH2|<_D?moVTrx zg(FJ_vq#MDhs!z-=k@ybtvo!Fl3052vGA!EGd!1qh(CY$+O@ps2_J2q zRg{lD5UI-{(_K1W{$t!}%gI0QR-f`?g8y?=YJQj6r;hsUF^#ge;1r&Vy;52OH;0s%^D!sTA=#QWl@EVENn{?chWe zSA(?pFDHL;l)&k{%dQ2CL`jT@1p2zz$|%*|rfiGnR*6_z2KsL`TKh|=m)oY#4;&6` zT+~xNlqT`MUdz)LOoTA&`SN}do6o;>cTpY?1E+v|vTT2rU|MUi{A%45jV13D8*>F` z>aU0xR5joB8yejduf3W)R%J~e{@nNfIVp<|3~oQxaF6@b=FNbGxm^)H||GP zKm2r8ICQQjN}&m$SBqpvb8RLk(7#;u!2hNR|70=Qz3z2~@HZ;^^!0L~lLI!+>gI(6aLpjX;MP-4BQu@ho@hTFtHYtMnP`!7FYDDwM*EnapXoc!+V2QVeV98Qwv zNY9@5&6mH&o|r|Cd83S5N!hn0z5>6Y1PV87;veicVto(pPyDU$>*$^Z-yVw-3yvee zo)?@nfbAc<2)}gciN}&>a*VotC+`A2U^ilsk=s$WdBZS%4HKf!(xsmwFUPF`dmxe> zQ3y+xf6=X!z77}TxyHNKZ7TB*es*%FZd0FmC8eIQSRe(`P-B zs!$x)5`kL~_7F6>KlTH#`4hhZI;97<17KCo+3n1q-@8cTwFi7&cycXylqyQ0q__Qw z|7zj3FXjl8G3(S`Y|DT!zda-{Am*yWD0@^)fnE-*LoJDY4YxO#4YN|{`v{Nq{_B|< zhjjH=G*T%3T#E@ExWeYVVQS!37d>mmmvcD4Z|aKdabMt<&C9|oAshFb8!XN~ytPi; zhsox|M&q`EJ*jIXCXZi(G9j|R1YV?gGnT^d?BwNy(`089PD_RUb5O^2Uc`ZB0oS6k z_)mgVz!mj+9dv1(ahXkcId*ge3IFrZA-#&SFogDtMW%J(U7la)m*Yb84l#osmh8se zM#0(nfbc)pujd368Y1M_YYyf~5vp5;R9%$)u_RQzN;^JD{fxUJxO&--L3?z)#L1NM z{eFm@))>sj?@e@K(wB2o_U_RoZwiL4P*0Rq9J82kBb>LSFl6yhJfWfAg#{isvSPIs zPHJB+_^O!9qJdLW9B^MKOq+DL-1H@c=!V%Dw`eo|wm3WM-5cqE`)c9=Gj4PkIQ?av zAbUeWHDOpAcfW~+P{>AieB~u@4~p3owIeHI5Fzd*C+Z!OO3NEXzcgeS&5SvgYw>0yN5 z;2fuTBoTFBOI#IhfY@$?#R6&+z><`l_7H@MZG>)tJWg#1 zE|`0;6)(F98#^IdJ~|&E1hNV703!?(v4-|L&BEOY=h1apa}k%LC?W%q5}jyF*b`Cp z>k#|O>oZ6Fh@xlp5icPusxV_u5r zC`83m3M~$GIU9MDEmuteK;L`@0O(dvs+nr9i>yg9J6f?1=Y(gI6uQP4pF@&>5}55OF6G*9L0KUr%>yZ~5(#tG&Y_ zI*G@r>2K4*3rzTVucs`BX93bde9Xg~mEgc(1SX+~MM6O{z~HMkAZ5&GN7*80M3o>f z9K{t{l|yFETYnUL!!3735Vq?OZLp^7oKNu@D@cQ##x5=971t< z$#UrBEt~O1_D#7!w(vJ`_g)lzJ#l;^8Hrc(VoWq=Z}GgmgW#b=70z26Dhns;GRjjC zkFF4jQZHtfEK0pLvj{op#QN5dX`N~Wh>vr3HYB`eOroK$hYR54b)!4u%}l};3ZJPg z{107nK&PwI>ZxC?$zdl%GhZ+@@QExIQ+R!$3FeYHI|*(WB*)t}uWu`6N88ukMx+e_ zMB1=}W ze>6cC-C|q#q0EUhvH^F0Jkp|30`M2ZX?cnh%GsA}foF|Z*u6VYxTK;9{u_`~XJO(5 za>Zep3Rj}o-d24Ho00dU*)}Ll-uplg3bX)K(CC0y6DAvn_4En0gG0#ycTk~KxA=)u zAa3PY=%9!psfAU+h0p*2@Q-Cu0Pbp&!4S9v?(cY4frHjO2O?86k=^cPl9(JQN(K?n z)&jQQR?Su2kC!~Ys%;*cC;e~?HG%WftC~qX> z>XL9q11^ST4)O{62w&mSD@FyLo4~{NqP_5~1k_(iGVJ*PG08%(TEf-&n&g~vMkZyv zEYz;?EShhyH`vCdna*bb$== zsVpfdRaM?#IcX2V4>%}D7oe~km)8XQ(GZ4*p!EF3aPeK!*>>L?X3L+>63WD=lxQKN}06EkbKt3&9N@T{5xDbp%0FreQikM^E zBmM>#|4yL_3ltjaMx4BTM2*L#6B%@r^2Q+R6a_qdX=>7?e~0R*!Ah#)YjDs0WuMn* zN>Fb34U+HRAQ(=NlnQ+Wg}`G|P@7qH5lS_J5K4W5t_7SDr4*8I+eyfU?U5{yWgPTo zKy%pfC?cM-Dj#LM7M;*s7_2=NwKp8jUX&i{Rzf{BC}HrNA3(h#h=Sota8`n>OEX2$ zalCyf=fmsMY(h4KllsEu^nTkjfKp7hCj`fIYi-VSZtD^9x zgRPqrL_x90j63B}MO#c(prL{nwdiNU*5Tl2Mlzz1M=9Ds%!(&63y`c)^`J`-Ba6{v zp!NZhLJo;&RM_Qcr5suOIsABN0?-ToRu~e!6NoaMJ_f3!ppg$JKY)!==qQkH*N3tl zF2citjFE>b?}xL9K?BRDX-1;>C&dE{MhwEcaZYmJQV@DK6wgjO;E%99mc$ey1luF> zW;?v5P9iiw0wN0TUJ7kL=0ZHQmt3o~!))dA< zb4H+$v66PRk+_G#>{5(IeE$N@I~D$n(&Fbf@X!G66huL7I{C&Fssw8hc`k!uo^C6k zSchKjZGySr7VbEXuMAI0dFjIIS?)!O7BHwG~8HJ z(jXW@6-ca_h>iqnHK6DV5Szzxg0~L|i57d5PoS~jO$dOu+rlEQ0c&}oAnIr!?wS~& zR@aZ>sY%6LRQ!?;rlLwGJmK45Fjs<0>=O7WK*f!QX9!o=ZPm~m{-&;8fDvp3QyOUI zlBor}s;guox&iA0O&Vf?EJX<#zNn3{7g?{6#YJ{qKPk0GRg{2=086{YpFJkSB(=q& z6p?2QFUOO01!|}^Dpp_;Gz}7FRmegshl9+=bqkQ0okcv+L1Jk`xB`AdC(#9Hf0&J; z)2RF@RP`jX=bUUuDHVq_B@4lt9GEpwH2|>s4zh0BOAWx(5Ig}cqUrUcs*j}na%khy zVlsu*ObBflz+nWlpaKFEYi9w<`LJJE5i|(H)x0buuGTw%a+)j_(rKpVA-D`u5S#Es z6HZgL*z;xiQzyq?cdDm@AQu`K(`){c=wCrx7jjHI>Tz;7-Wg#)$Z0$R1?Q#vP$BC; zO1tIx7s!s&*bOLYW|4@A5++UVgC1gY80IZ?15ntCp?}s4zonQHXNl^!H-d?>42Ycc1bP8=8Eyv3UB>#NqD9srVz~f=f4WV`oQ5Bb zNEA6dBz&PZ64yOJD1fFJIxfTkO~I0oP5JOp2AHN)I8k>(lmcFwhRY@<3vnQ92cWuX zNKJ*%$nYKANHOioFkMMpt|%EmRD}%|@XliZG4v1MK{@{UO2lUnu7znRZBrVG4`@t* zHWdho$SP<_3$%ghBe(J}+}(oSg*a#nAGi&}6cq}R9Z;zpr3&6u2CxUq4G$Znu~H{X z3BD^JUUMHhARK;g7Bcl}nlcK3HQi)|!leL$jsOl`0o?2!BhF%AYI}n+B@e@5Z#%s2 zR#--WPh$XuRzx|;UiU6k#e;p4=szZ631Fuf1eL>C8wE+K@l@d22-@mnpd0aB)lQt2 z+U|N09|nYb}x zKqr_GSfsE${CU=^DT~A!LwWm9NR(E7i}1i$sY;BFY+IAz5EOf&mJK`+C8E39`Xhyw z)XwQ9T=$zGH`y6YAqKF)l;9o2o@Xp>vkZ_V215}QoK6y}>J!Q(Mi%r&oDm<2aPdeXKzw-!DvA!t)3!o`P#j8RTh0e(S z#rSABNhpFQ52hhXX>JsvhG_&zYoT=6E5N?NGao=!)8KV5;9U}+Y|?k$B_QcRb)qx@ zegP{IP6TC1BPW7bG-ySN%a(g0=J7nMu0Lxj(Nlg2^pvyh@pzDq0W%51nWN1bsXl0TmyaED( zy%Dn5(~hjcZ(t5UlJ>aFucNsAu^$O*6>?dx)?1l_ZahHy zAX+&EG!xW56){avUDe=~h?Neyl|ZVSie1#@h-EY&d?5=>j?qF;Xp|ut1ezt;1*1^m z6x58XPf$|{+l_%)v2>vft*%Pg+pHSxs8J6eav&wNy?{p!(8OG2Q)w3@h3qw# z-=L?0e>fZ-pVG91`A3euEh_CcfOiWCX>w%LVF{4pEk?E*GBZ9x%NwA0hnTSkqeb#4 znw$pOKk>{DP6|V@_%HDD@X^gEU`)9of!gA#SVWr(M`kv`31UkSBf~rA04}ygaa_F& zJ~YV%A*=%B@OeQ6BZOzgC16Hpp*wy8gG_H3k`79iWlhGIVuV)sP418|0J z3jBx&u(gQ74Di`?1yCjdj2j_lV*u0%h0`H`c!i(opa)7cP4GnOJ6J}FaWP4_PEdHT zK+rKwO=3ivyDAtAkEi-fH``l@ci3JEiXwgGdxGGiizU$(XZd z7$FlfN@6?326^-dOM-#wR4Lg4wb!rwr&L)>{uCw?EOc$u*8_PD-$so{uq;s!o~zi0 zDi%_ZgWsfHRL27+2swPt(1*4!2zA9`N}$AgaYH0f-A&~-8hA8?g9{|NJ|ZIi=0Jho z#Ku9DUszE@Mi|p6b$zUjiW7ut*&{WlKzTwi1(1Xc{S3H*Li#(BOrT9?94??+@pUy^ zl_m{2t5FpIXKz8wWAIUC)|douCy0$vL;7nH4km^lD4ZKvEbQs$DcJq*4 zIjX=3T2c`F1!!?5M8gT@9yoh*{VDUcll358a25(m@{CYu=6UP@BEWM(3{cT^NCtjD z!&FelmF7WIVC+W+T`MBFj7x^}2~)e16fywoZP2naLzeWsnawdtuqD*1g^p1;Yg02q zJi`g&!|o7O9~*WO>qD3A3yH-F97?f59=yPQhyvvtc@&9C;_9O&Ca6`T~-4w;zvKS>$ zJq6X<;$Eo7_^uIyT;7P7`=WuPHDHknWX*+0R+^8TG^w)q&#s?dh7puz7Iv0SIlyVc z=z+RrAv3h_DGA6oyrOh-)V00q%efEF-4%(1v(Rk<$_-4i(y7Qv){~+12^N?uV(14TQgO-< zd_?TK)WTka-@n&utZy4$A3}vGC6i$$l%}kqs!^fj}+}-pjs5qq?4Qm}1V(;J=D3}s$ z1+At`c48P%`gRavDW>C9S({L)8wUl!c`^UZpT<6fjt7I8K>;HP$*TKJNSgTob#M*I z5^NHlKEZfmR?-9f&{ut&<;#c4=_=QU;JzVxr6NuzV>|(scaSn(5 z0hNlGBC{%*A}Y$0csvwE!Kg*nyvP(Nn+cr0=l$ap?RVKp~vH1fPMyXq8>4;R==#d@cn@VQT6-*&uJF zVF!g`z@PLX`_}6$91x4+apMu<=Jidf)L>f2eg&5tV5OYUJwHY@?;)%k@FKK9oah0$$~Q9(&cM@jg{S0EJ<{9U?JaVxxUyf&{znJKQ;~}gI+dj zrp~T8k0k;cy6N$^l!Lre)-y8rLWYE?ih? zL9ke$hWZNSNI7hMR4RUgg*tqTv;hgI%TXm+&dHw%?h*s;6f*p@aqvXph$Dx{tuzO*d-s4OQ8enJp%TsJCF zi9Q9C>`CY$HC{6^j+pBg!h#Q=UCk7R8ypIoQoFz~Ky)yi zo(3lv5oSkmLm(6y5^GS4;4==ww2g{No3|tp8Om=kZ3@BUXc}+hf;ea;gn~@!Xb0{g zvDpS_QYU0!*@*~O$f`u18-6EkEd%??-Ue)!X>IkKiA%CsmfHM0}&xy_v9wQrEt`Eu@XC z>s0qE;+s=)VT4Zd@~^K(5sHT^gAf8sJ(F;xEGC4Yb_=56PYQu!%OJXu_g`NjQY%f0 zyF+-Mt6$$V;{@iy(g@10Hyx9kAt4T8JI9O4A>uJi)@f}F!Zv)9b%w59wFxdTN;9p# zzQUy3m;EN&wGDq1>ck3sE4veyJofefhpx`hxKboayOSRozHL9@@<4XAX1+mDwM#tW zak8JdgsCVi%?T=zC(>53=g814OLc=j1W>;y8{z?0*lyiY zAW{_H#Aqv;($$3!R+D@%fw;poiKRCiCjn71PA@}i5ZV_y_J{zu$|g6Gm3kAg`9b+@ z4+)3OV&+t*gff~8In)F7b`h_(yYkC?hf`$qJEA6i`=bATbh<3+Vmxk!I9>>tbOelW z#Pg62a}fr>n&Jnq#((LyYTKhr(I zzAmL`AzsiE+Lm#4bXm;#%&mKBD*T(Dwd~go;KoXPe>#kl*G5ik=3<1+QUXWcRGMAY zoSM-pJh~&Qz+`KCJtB-sd^2|GL2|!~nO=2oq=5$k!-9Q}?n)rDxP|fLbi8_eGhPq} z3i-tD8_cYOj1h)t|0;}dY7eFZrXRJ}O# zV!rIQ0Ju8>TD=B(8{k8mUR@y^uQ};M+b&4MR{$Ut$`pBgHG-}LH3*?4!L}T9Zx_NJf@l8Cnj`SOBdmGZAB?DiwSQBn!HV!T7o_yO~$D% zRi1F0iQuQD+n$Qjslg6n~+22F`c-~2n+YY!C8=2;gaZo{Id5Jq@0*hI-cfp}1kj1yw7N!@%XI0F7P zv>obS!8cXTaPtLdy0#X9S_+jj@orocv&C`-6{hfI&)Wx&%&mF8=Ur-;+Hx&RCbulk z`1@(x^3jxNZq%z3X*`O-P%px$x3lg33n9OVI>SaQb&mvUku7t=E}Iea=OO2#P~5$%_id_Aq-WWCja3PSl| zLeT;GS%ZQLsn1jJvWlLBC06n2h!8?CAUZs3ubPrkshxmPgb-VKx()1`ws-w*u`|2g z{dUGkCv1MiX7Zg>kMu|1joNcYtaWMpf)1V)03V?7~uy89Kv+rYC z#;%9fi3CdlOV@K?T6Gxe)xBv$IjwT8sjE{r+WwoM;0M6zAPxdY=vDhh5ncg_X-8xi z3e^i#=rBohB*}CdA|P@Covni8VjMk!x!p+wDVHo_*arF=)i{$U2GR9m4&D$4dJ0M=0jqn!}OrcnI06{mAAtY*FLYK$qSw!YcnsXk!v-MefWgolfa>*UGj8pnY z_3s)^g?WZy0DunoXTv$kQv+Fe|B0ar&i*85W#+%KKMsu$-KB9d>}x_<*#kH+4FXr7 zIibT7x3-RUl-E#`KsjP3BRCNEW80(rFlFEg0$C{(Cn3@fy}D9Va=xC10++TU#JA^7 zdO^LSBowESAAsLDT;SuR8zT4?o?9L2H%>{=yb+WK)}aKdoB%EJ2+2h;BJRYzph7X+ zFnrm24J~oNP@0M5NlnSOp^+MpUJQFYn#Adw$|#ansYF)j_GF^=G<1Mydl+k-Oot0vnazB4)E#c#kYX0*u4*r~&~k5tRW|py)NLB41*c8Ab;^ ze2m~oSRTk^g4+dq(kaP=Lqfg)nM@QSy&7jZ^Mq2dB!wU%j4im41abM*baM%x;A*NKyBig?l#Nc{JZ%;k~Tre(6=O_&@iov6vyi>lZ}~Kh8-#v z_h#th>>MA9dACq*P+1JB*WaZVMU3o^9pAmf8IZ|kYC0Al2{luUW_T5h!p0^1k039bsH?Ox6B@2vEsW&eJ zUTz002(jFb%SYR-5O|nGry=|=shNSmoK~_Z46SG45B1Ez%br>f^QC~7DzAlhv49f7 zOREN1?O)US8;5>ZIeaTpJJ9r$4`H#ur-1y6RjG_1azSz#CrR8ftP5%*3i}A0kO*g= zA}o%Ax=rO050`8$Gws$l#YIz>D6HxirXPtY#)rTO+7{HAvrs@sz}*j(nFN`oPK7N* z4|v*0S=4W6s6um)g97SmeV(oVrK4P1)Xkp6BEBh)Lx$UZVW{wd;NvC98`nc)1gJF( zAhTs|F%sFNS|FTPnRcsS>XA+FpM^^#f3-r3ikk%oquOBDIM@95b%oYSROQ9;d_NJ zByJUkOxIJIP&sUfKQyre5^){Y#0ilA1Tx?y3Xqgfv01E>Ej=CuINJ2!HtWZ3yNPfo zB>o8~f}LW_q5|W9eZ}9OA_Clbxf5s;B@hVM?j?&6X;e%Zt?sOaio}myk%g$hu%Zf4 zRT6F))HO_&-rKWH4Zl0d`wORcQvs?1@t`qnBPnW1Mh?Pfc?f$+rno|Lh%xG!-lO&GC}eHZB+sNZA-5t0VXUzf+7g|_k9in8=k+V@5S)u>H!s77XI@X|FX#i=0+ zZhVy8aTMH4@sBzYO8`?yK{ACpD9xgozzrYNrmCS{611@wmUbbyWLCQ|R0e<|NktJm zhVU+H&@NPjRH}+X;y~K1?9u5y#P#ACL>@L zh%3iZ z)us?}XcPhz@|HD-Z`!hunTQ9mQ3YGILgf_bGpXu&wGU9uP|C>qtV#kZUyFQl7V1_2 zAvF+!fB+mLRIb50l|;z?Cmv`DI1m%ud@y^;Q2y6+lv0YQb=q&_TD3TUFTNW4}^Ff=nba=zqmuhMD3i z3Bkw&a!~MJlL)=p&@KU-ylif-ef!b5a(2^rZ%sSmKfQgi31Z@}Gxqaf6qsbww$?s39NTsak?QPVmY~Ov4BJ zG*`F6Yx)t=q|W{~F>cF|+#5anV_O|U*#VVm2ED0}=AOa~PuBabWS=7@1OB7yf~$vc z$Gs{j@WshT0-SY3V2C5SAEJt+EG~gm#dRC_B{)-226P&G;B@q_PQ?$UC#@t*r%yV=wkjtf?BO0M?N9e1Hj*dx5E1swruEgY;BhVLMb4$ zv$CUSD*CgvboJ^usIo+gHY()tRCEx!S59+=>YflI)FKeMUfj@sISG~%YHEd-uLzAE zpmK%ed{ow;YAp;?R5nwtjvBw%lgH{`65C6RE)GAjEzR6^U73@wm+pU^gk$jJ~-?g1+oj>*WDB0J6t z6^sy>JgJIE8e%*uBMjMba*NphIDyT`x(;y!r;5vT>3a#^U^tx>qV5!klRXanJ~Tv4 z<5Z$_{J?XlhXzan70MR~&nrlV5B&g)_OJ`F=t2e@p8yqqK!Yk@tuzNY0dG}>f&=!% zoE!X@v^?lndY_R_Q- zo+c|XIjGP{N`QBm0uDF}NxU3(Mr76`r+!5EvkK$F`&EHN_o3uwh@Ac51wjYlzH`0G z&HZoM#Rx_O{DZJ!+jcXqq!}L$C!#xO+|w&0pw@}V22M!`CC0poUQ|DJDvA~-jlh{w zps^d>pbi0Oc`V!~3Y+7QZ9~QmD4XdBM&(EhMB&Yky_Zn`!ZpzH@>Ni5u|pjq?i(U2 zjB4=lNC3~&^{2a>x%oJ5UGbM5_CD8EOH0CyC-!j*)#PuylfrhZH;kB_OzaluDMmKh zwrQ9Qo8CnZdS%(5I!+X(bPr+b#2`UYk4cuNx?J0r1WUeq%Cr>lx!;QHTii?ubF{el z{GcHTN6QV1S(}Zf&w30=#B#!P!*U{M!ZHL#5b98cawimn$a@HvJs?PEIUh3|k!-*z7eb4f>3^{=^@llO);zVNOfE)zBS?prn5V)wf!cxA zzuDitYGo{e9BCfufG0JuB!G0d2Rb4M@HDajp-e$J8CodZi34o3{U5x;^t{#Pu9?krW*x0`=B4fwI8nOrFOYBNX4$ce`x7p`IFhxbdgN-5NtT2cK%(4t%{Xd`I}_o70VM4s1MqLE7PDLUrI%JLO_! zd)v3G+-%mb|6o)>_glKs{%4y#)vHGaLk_h_#op*ES~jFuX1v3)GS9_QdyRc^y~By+ zHLL0`l~yTyG_pP4sS&zo)yS(K?HEqLs%y8<#!%8Z8r)-wZf3N~w8loZj8wp2Qs(dcMF_ zr1ICHuKjNJmj%9#I_z+Nt9GVMgH*v9``DmEyB7B?VdxCxnL1fD{-GY0efx%v<@}Cy z4u51gUF}GuUF-01sNLE9O8ir!j?7he7i}-UkjT_LJLRZ@*75f$LRN*-{M=pIQg;>2 zwQkHj>~Nx{`M2{=J>@SOhot4XG&=?`L-uH&|5aIOm)2i{2 zN>erR^-p>yMYl8`*?HlG2M}Glme%(6fK|Ky6s^k9q5Lvr+I4TBYW0Xqt$BpejRn!A z3=R1giR1xJM&XT7)!kR~6v!_;_A)zsqWtyp&fPc@o<)A)+WhO1%?Iv1vHI)EqoVa& z_Ui43xO?hqmXCtGYjD)-kjiDZvJSU#qTvELnZ!S*2mQr5#>i9QrFcy6wa5`g1s`9zcR4@x5}hAT6EnS!+J@WM$d6yN zle1RMJYLgE++}w`zB|7OqwJ${Cu&O@xgg3)-eG-a&qc>FlU{B6R%LpHja-^nx?yF4 zZ%ovIUiEy-KC)()7{nNB(DS2$YT|iV{84Fwyay4J`$FfK5xakTDg97H&Xs#otOG@4 zO|M(g2Mnvf4M8BjA`%Bl7^GFFe0PeCoWpRYsA6+B23a+@Wmjpbl!QUfxtMC0y_L!P})->zGl>u#`lErnG~Dyc`D6XzlpPIR~>9(=?&& z6RfBP(AED(22mz3*7CS9F82lb{IALwOtM&6<+jqx=Ka7v+2*~wlH?pR_}J_xC%;!c zRw=A-#Kh}P{r4jEV_WKDbuijK?{rnoP$vtI&xKZNUbQpugBkYEq%{0~$lfTVPD+CE z-W-^7;Pz>%eBe113@XOk^}bYUM|S){%> z8+_(}OKJn0mICZ>D@vZGM5jE2$;+WgxZg_J+Z_hF4!+9?GBh&uq5>!ai+MQ)9dyU# zA#O!wCny87)HvBjOh407jX64sk@xDj?0sHdz7rKGr9KRisM@ctc1Pz}PTV~udMycu zNj8(~W@)K~m}L;1QAguK`%~XKeHYPRqk_8-i^~f4z8w|TCxzNza(g5fB~o$I+tG&M z;}|(|Q~hO4|8_``y+fdz%RPOc`u#|p#H7*@q%M6h`Hmt69Qu<^^9F#uVqL}#m$fT3V{W^h^^ncYq- zx@3y^EmG@oW4UpqtGY`YaPEHMpT{4{1E^-!5&c3$DM^H|R_p`V+(nnM(LpG#;HCkC zP(*I;fpl)55nV2K%BA&XGJ=R^x#tdoc%l>5y1(6Ezusf=2VQ$Q70@>65RQZyzoLX| z%vQ)xG!%~hEh6XHz3mV0Tfy?Q8B&SHwy-S85sX$9pj&mdvOH7V)aDHGdE}`^Fd16M zT0i`3;@0otB17F?nyRg4pBI{A+AIdC-DHc@L@D~fuMVgTDXYmJ44ZzYpb8s(97XOt zkJ(DlQWL?zEER`#TGc=!rrV_;r$526{uA2&uwSZkgSm^WjeMRk!c7Db9i@xCwq1*q zKu$bp-P?6d?&81*1mYZ7@1LDJ$AvN8v=V>Iizm0-Qdd*d12Y+6!PHIpPQK<@yHqRr zd9xU>sEOm)s8r&8t9WuihP6wpuSj-8QE2P-c9{3J1ab-+cj2jP%t*Jl3wBV7&K?Ys z*ms9~pjJxa#z|bk?ELFA5rEe{SMC)U>*gAZ`o%5=DX%upOQ+-qpZpy*i^?ztHVbxFC+ONLHmE6MJcN^X=;cQ|(QWTZ_$JSCr@TTm& zhmQ4!rBo(>;0JoVu?=o-p%n3HTTGUUQSKTEfr$U++p5lBGLM9Fs?VO1Bg^4S3A8 zm)AT{Z3Q6#!BV`^&Sxo>k!?~!Lth(!M}mP`BLoyAXo>SilWi-h;<5q>}(aD;pdhKDoL6 z$n#vS5Zt+gtz?cX4l~oVRV)8J%1y@3kf$C|os~h%9rE$m7%g_JTAd-2R0SzXC_I2u zKL|slH{i6K6*q>qDvMI$Adto!Z^wI2MsPIguxbLrWx8wd(~nvfr*Q>lMP!%Dw?28> z7LhmmAqKF++il7YH+SR891xDY25ZNDmu%qN>MzlN`68RNlzl`ET>3sktne2_qxXVd znmWI_d(j|I*n1#QE9}`tkzi;h`O{m4{Fg&A5)*X@m%R=m(JoM&b_&e74<&=;45%#`;cngM(1 zs)_rEW;-W3z}Z6Czuc7{_v>_k-xA8EJT%Bs{eYvr4$WyvG1bOBn0=iEiw%>k%XM2~b#A37G{G}@w`|FshW;oSj^ z`%EcEVBPIuq(Zz&ZyYpmAP$cUG^4fWwZgoAZ6iw&lvTy-6Ua6tWZzdWji=jDBH5i* z27x1DR=hoGWelJGJ5n9}^QvABwbWu?1;G3O%Etb17uEg$#%92`eGEGILppW45j)k`CvqLhYKZ^#6c zq2OiMpfqWi->zwROB$#Hw|Fv#q3**A8kxPaiDF+KR*j*Nhcdk#jV^Ao>k!hd*Y=S< z7?#u0CzY5&2s2_|1z~!-b?uS-($_MH%62e@x4N|L>Vhh`UGt{XBj)7N(JNb}s zxeq~N;MKgvmhfD`M|=wCh*a-^r=}(@Ef@v5`|-dhyHC0ZN9g9i@o|fv+ga*&c~iFN z*2Hb8)8v*0UDa0Y2%}r3&SUK-3js_)AH7}n(0uwu>diN2e{XAGX=d&cBOI;NrnuJs@r4kY#CH z-O;~Yvf$4sSZ}-4E9+jpNg#e74JfHL#21niC2(5Ly^lwsqN9NRh-xbh??;5^+-*@( z?Tj@*>`H)G{puu~op;7y_&})BcWvaUe4EP%qZ$h>QC<6e5o7hDwjEhG7SS~(NYZOl z_Ijzr3Y|9cP$jOTPCcx81Fikf;{${C)&qCKl+~&+a%nqVW1`{{_%yCo8fKBXseV93 zDc`_MnBtln*1sj9KR$u)IzZiNJsyaaoAa}U4SR;R8k+*TfniC&?R`bF(Jvz`;(o?3 z19NiKrR3zDGa04>*cftC>q(a~8u@t8se#=6r&O3DHlU=?_CE_o@4yUz|{W8O= zHz3@?Jx6Yz?#-EkB+4eihNm)=CqHD1S-BsHsCH@vVpq(nA}thas~$F%a{e;BbaQst zkC6ROaER}HMJP%3@~Kxk91u-L)g2#Y0^gW8)<;1StE~FlKXnoR?3RM`5UpL#eT8&v zK)4t_4$XPiyghNfPT1JC2lC9@By&eY?V6k)+%c?N^&?gO(Ls?k;2p6B`?ZyEQRr7$J8GNGOW)COWXRZH#UJ(y*;>A4>vPq$>(Y)$mFrIC|obV2Zh zl+ts>3x8oGfw+=Co^M`VNfUn!mZ}Y73=W#oj-=7C^6@8B7WTv;5 z_5}|3zcj35cyG4d-6bzS;VMeeK4e^}?HXevyia}7z1?7#P9wT?CL8!2_<++2QOdV^ zzq1tn6JO+Gl+~(s(@$sNI#L)?keC#M@mdH(_7kip5%`w3aQ2rMM$|ZvxirwFIyS(w zC1&h0$mj0A3>)heWxWjV7j4~cwLUG}2+*X?Q2VKBb+xYva!gVtd8j2l+^M{kIMTQ6 zj)C8oFbjQKez^darX1)Z`yA7ek{&wUuC5yAsR9yAvhUMagJD=`j!BDBe(AUjgl7jJ zCR~51-Wm0-F(&SBST#>Rwysw=okIOna{}v2-^gr-g$$=b|xaDH*u_7?^C7T zj=dw3X|U04kkcPfP3ePYPa$mKOa{iJbyj~=I0WTWBLI! zA8XK)3#?&k?HH4SaPcLQePhK+>7GaJ!yA6b1?D&y#MDax*=}4xtsK;x~ll( z9twGzufcxBdqB{snHQY`>|^4nHsNC`qzvDWoqphSkVb5Sw4iD&Bh`>M7B+LZGy>c9JlrZt_M zK@R@j#8KpICyXSsC3}6c!SGbPmRhSdEN!Qj+M^01i=Q5tyEV(HzPwvV^i!mP=@bjN z+zhc&xVSmGrj=|94eBpRtZ`YY=ViSSBvot>U9d>SK;-&J? zv0f6+7wM2Smq8}J*=fZ*VqCqsUrgfuex-aa6QnMua687Xx*7QanR?e2?)(bKdvZXt zI{g9`NXnO|G4h5gxN){vl7uwhPAzaiEAN{;4;JRw4BU1k<^T+X!pM_W7(B`f=GPU` zKhp<+P&V5lpQx*e_@gN0{gxQP>Q!( zl)Q02wUw-C2xPA-lYE>l#jhx0lc)+0pS$d3T8s7Pu*+%m*$%|T2N@tPodTK zOm%lbDx#xnj2eFTc59v5DN&@~a>{M}3nC{c&_()*?sRWC&{;}8_SIrm!}4Jk_&eD= z=|p905%~a9Ie*$vBv{hS#gr{&#qqfv^{^kZuUxs1d&1>|8X$9}m*`C8mo*^oAOM%Z z%1c;ny?*)j4oo5!+vZ zgx&ENB%d}g#AY|#l%^Lb)Pzot^Q(z96FqY* zC#Y9pa{F6y!NAdD7O00bvN~QjKh_;&!Pv{p*KaMJ$3)TF?sC0FQcBv$KchvmA8xhs z)gH$^9LSZRSi4kANm&JIsil=Q;4oj>6C3$OAmQw(t=4TN;n+Vk!?1-r#R5!m`(NP@ zJa6JB?@iHX!#|`T9Ct*OhFZiu!Ce?LA86_TN)%Go`4If4btER>PSh`bK)ZMg>&hOC zppI+#tlxdaxU3rMxw9;F&ygY>pD2(RA@EK5N&2L4w%6Uws^hIH>h9{&YRg`OAIs$zCO&Y!9I7Qg6!_CVIJ?en6bcH%|@4 zeiI7_aEKns^&T;eRL?g$u{qmjXQ>^Cr;kXuvfcfFTCZ%*$&d=LvvrxgemfhnH8IBK zvNsEs#x@z?rf3yXPYras3|w`72t(Wpb+S#pLj-e=)82VG&Cq-xZ%Z~0Xz)GWfTm91 z=2ZL1>~V5XFQBeTOC#^1ZcjwYTK&rL zk7<;>S@t9|l{dxl)2rk%@c2|tS3Po0gBRV!wZP|Y zV)A;7k9-{&*g`o~7#6=zSebMNX5#)qK~*YX=o|TWFUMj+_z$1FTrdDq#YvYVpTCvS z*q(HKm!!?+(}{Js6SrN3DEA89%9!lqa*m$->idN8y7k2ASKFK{x? zbHh3fO!VC_k=L(mQn$W+_IxKy{31+LT{(9!5b<0_9;`3nPN?7{Q71(xKUEk9T*J!K zSmq+tdmq-wypn=U28RrCBB~3&TW}7{ftZ!R*GHAo+W&G-9GHD@#US}Y$HIBNcW#dsJFYhr8h>4J4|AzvGyU{ z&$T_7F}%r<)DR{sEtWUfg{&WxWOL^t&~`kRVY|R46?P2IYvOB%Gdu?`Q#t!~a`eq{ zB>Q$_42PIyEIK~9uQ|bzBolOfRuRhO&5Z|5&kW`<_0W?ev$ZWZX~?he$^iNdi^Q$H z*_1RjQa|Pd&*24eWHZt9uRH>;0iGkH$F8OM1>YF4ki9$;+ttl6&D3X)^TzdUc{NkK zi8Ml|#IL@c$Zp$)kj@WvmZ=g5s9o@w&gTR?m3L&6%Ib|nif&B}qSs|LA?F5We zHKjU?pPKR0b?3N7j`K!n1a5r|Zwj&M-@g1l_0 zt<33rSo{xnY0Qsmr!n=~erlsoS%&Nw+hn=}J@>V)j29nvShP zx%8W&ygCxvmp4`^NuwTPd~KmoN&J6B8q3)o&fkypk@U9R;SbbS4eD1$Ch0Llu;O?< zrfE*X_=y4MRBfpVy0lJQ4cC4sRwKIoVApx@#>W6VgWR0aLn#sx|$)GtSRcKCMpU6j&U!5!`z0&)= zVrueV^luXya6(ozx-5h~=>yTKm<2>uIrD8I!9K-we`*N#9gSpqi;hp_>bHqvb#p1TxBswpF!YhNeq4jj1(o;i1X6qRCtjtt>&QN3)Zwp6tc)i9rn#)L}p-)^1 zz~?Y|eUqh=uLEV1xz&N@b{V5p94-gV{anTKg@)}hhqA)CU$=AZgSh%RvX$hE8-Le- zVXG`Txj|#5OgSaPr@ETk(#`IeN*h+xh}z5%!EKwIwJIAgiKwzhm&MC!k|_ZU75b=^ zUDo=BPhYKr%CIoHn7o*1rN<@1uT|Y4>6gca%p*;Mw%^IlPB*fFvpoXL(Js6J12!rW^lza+zwmndHOjUkU5 z@tg9C^Ja2CatZ8NM$$K4ZyfO7e)bnL9;!kX;u#fPft{#`avvVNVj06_Pqn1t(G#pD zXK|D4q$Y+flEq_vnd|OqOr?_hSZ4+;;WC`T?XkScZ;?=HFf!@A*la(4 ze5$~d(Jx`nWDOfLvE|7!*TxAP&h~eO<6pRKP5s>-c75*1FCiuC{X91??ZbbA9@Su0 zC5iIL9Z$Nu{*(>wQ7M%m=~pCd=p*vW`M)BpE+TCd(8)IJ_Att zZyRD`T3$^kZc>$#=f8&xjfx<8I^ssoG13j;OAWFoXQW9dHn3UH6!d!NP< z;YBPSvst>4!q)0HymsN)Az3Vs?pzsQEr+Li_qHg6g-lEN`#v<#FAEQ;(*Z{^vmH3) zhw|em8gQ0SoZrESkUFuhSh7r6xL%6xWC#@DVsdhz1?P7yIv5H|y|Ss|rb0d?a6tM1 zuKQ*99X-T=?gg+2FFXoXl1&QR8=ZyRPxKZA^*u4`hM@_SA=5|=!sv}2v2Ks5+?(e! zvo&|r14F z?3sa~4(AA@p(OGh5>0t^{nJRgF|tu&g@;f$Y2j@~EF?8V1{$Y=yRYTK=4u zWsI(@WKN8SpvUXBji$0`40}f1u(KtJ$4kqCB10&$L7XxTXy9xMkhXZv$V8L#crbUM zV=69d14-knqP;GP&35P3(qg!&!y8E3dWMFbQ*}e=K|NHKJ|T!s&EripxXP#M`LkQ< z_foeLX`-h3gH2gL3KTO32lYAKro7fFo({*-gUih$nO34_8W`O@9eG(z`sFNT0($TXBdDHW}x%qE~|lV596^}6Fpyg7z2cg#1{4t;&9TVMZO!yKB4FP~#e zvqnIE2r@qwgT~`kxhA&yVF?r<#C?KiFUr~wf(UqC&rlt{vY2H*9^}JNNj5#g3_(r3 z)3Ai+j0b-k7>eWt&9a&T3B|LM)U(v2_w(XhwmX%ZX6jnXdp$@anOx{Mo93hzvA@6( z$~>>5x)k0w5Qgh4;^$=VU7>_n>9Z5=g_QEVA2#Xp7*?$)W!e5z5607JW)tb;R6c6( zCQvvmn~!A~R%TNNoDGS?9@-W`d4+s!TGbyXOXWI`t1*@raShI}KThw9d~6)`lQ&uWGe&5c_H-A`doeA z*%49Z7zaJh8H|jvV>2s33E&Wu4Hv~$@{ppI?VuLsX9W;Av>_B71Hene(ZvUXI?6+22O9&?APYzh7|y?x;}`Z^Uu<=HG_`3q=i ziSZ0tLWjz}4_$7=E6nI`5nd;cwONIzk_^SU7_B7Th&gmO6Bd|5=Zr z9pLi(V4;Wu7{$e}!+UR)7eVRM0gYuM)|!sDbe4Tm5sXO~3*r`4H~B;0J+3;@nG0q%^OQ`Q4=-Gg7h*c7^`>z%Jrx zQLXKnC^=&Az|x)Ab^L*Bpe*>bvtwWAue(A^KG*UdX$Und zms$UX9xb;1{8v?G+4`jkQ

qmM|h80lWM&8%UGhhf&uWH;ROGlSaB<+WFr#U-oGY zvbtCvrP2ne1pol%#LQ1Q_17XB6|_IsD24Tv!xnGL{!a+KJcakQqW=|KgdL(qq7nR) z%D7uStzX z4E?GMXyiPg4f_TJTA^GO;N$}RGDT|{`uBzB7b0z5q>ZuZ zqqYxe#`?Qz6-ub3p1;4-{N3~adj7BayX1Sx_pG#(D6DnfDd5M2SE;6wMDp0zQ%!Hq zrYrXtG3go=esMGcy za5f;dhoK}Xc|2fpDghK=v^Z%AXn)=$qJr^v6tvW==>7i{3GVESdU*2UcoxQ1J%3}5 z)CK8-r&$fqO5SM4^iZEc+Ptvw+FBNaX3ixDb#NSmiyKnov%K#2Kg}6V)l;_aV8S!A z;Iewj84-1odQ?tdQ^<5j+;CPzci^xGwIF%A$(}y>^~q#4bWeE)vRR+K2Qc^3C&7=- zdvV8)I3z33c(Ze;_fe55Z^>`Ie;=Q$NYsEHH)*i;;!f#weYLpYRk@pSt9-Bgc;OW< zHq)-8g5`y{0?%l-?OvXI=zoHa*WwU1%-7$mY zIdnBS;QvNx@Qvkl14mFJ67ItW)v2HfqJc^u->;c)5Ntb_{7 z7h$k?%yL$gs5SQ(y=N`NI9#vE8M9aG$?uTJ9Na-#SJ9L=<9_6EuJ3w}cd=yw%N%~t zFM0M6d>!)3-KisjJXrnozBRP3_05wU&#OJn^)cp|v$tvIWDl8g_~cUa6g?UI%ir9R z(dIc+M%cSqJN&7zxnxG`A}jm(_p}^Xv!K@>_?#b6?9mdza`RSClb=bj;HxE|aG0)T{lzex6 z3%KHuQ`r;qyoxmGk;t&{2!Gl&6TQVeM&p#NxqMYKzVmL8=Y!cA>IT63*9$jaqQ1@b z#B#r}qmK^1L&0eT&6Zd2N>t@g3A7Rw+R@R)X8*uppuIl7)2RE9%=tXc zN$9>aL6bgQ(W-PLwpdiJEMSs09B5CKdN>w5)jN@AiC!;hTA8q+Eym7mt}#5ML}J5b zt|iIN115Qq!$gkxds|)Gp%i<0gPB|J2`K*4UAxErR8(IMSkmq7IOP1u@hUE&jobidxK@!?OvB~`4Poi0jEa?1NQeV8YZr0WrZT2AnoZiV8JMI@yb)9Rd0=EEQgSagW z`!AERF?ur{9DOQ}!x2T#CC#DPGu#dO97>Houbxw8b#U*C$Y%8yE|lc&WgXu?4Yv!X z^;|{=7FGn5fA` zreW~hl#X;Xv~&whNazQGFbVRxrj68=~_}bUYzR zaY+4hf~7}I7cD_HSQ2~+;(f>$@x{06w$r^7VxBtJ+ip0=vEI6_ow4!D2#) z@NMC3a?^O~3n!KdOKq5{>T2x7dghi{jXf|cvaaZ5lR}p++4n$ov+VB;+Kl_@cGJ^H zre;}9$F70}!6QwONXv0B9}0u@&&aoS9ZX#G*#!y5w2Zd2MC`aaFXrsFskgk@YTg5+ z9nETVrtNA1rND}>@)os|@6kI6@13Mbn)Ao_utdNuPx+rpW=ypDG}3MqU3>fSA8m-O z4jhJzkI8dCmftIqz+pNq6(Z)8qV=o<8Um9WRNk#)N1NY`GaVEm^$t*E*v5T6}Yaa<|MK|nc(o?d(CTLu9d_E_OCBSLrNA&IA z4SZ%n?!GDLjYe99GocLM^naM|(cd~+()8`S=ji?IsPQbtnAD2dpBk@WDs|Xs zzK+_<1v={5^DhhZhUG5M+eKO8A8w4h+4%FXChpqIVZ!!UhmW9~?`sFhkDZCBNe;K` z!&SkJ@T!f{Zp~dGwzTOA->h}c*Yx$xuhtzCH$;4{yVj_BSgZFhJWUyH-*AHe%ErdE z_9idACM~dWQ6_$#8LpSMw-x7m4z|{$n{+1aN(kw@o?qx}^WxE1&|UVOSB$jONa{yx zWY?}&$HZqq!xy)_+V%UP->V4W{6?Ma_g4(af0mq4)l}31FKMp2kLlIPWJjBM@=PnP zPLDPz(o;!cetKIxxxc8#JsHYLLxzGTM`bl5WY!fkv?0_C)x$r4cC~83YtWQ*!cQ-F z;edYvoKh#95D(rMxX%6u+8*$F3@)yVjk6p6GaxU%x?~uye50Tf+wG1Tn?)$S5TOKc zH($~?jA*d4R@o5Z(W@)O_P`%4lZMEB`QCrInnFJXtKyQ@D+ak zNZe{{jIA&t7rCinumS1I?TVXjsZ)oI>xOuZ_jUTo^2V6ZHo{!(?6nkqWy`*O_2#y1 z`oUI(FUM0&EmQS^G*62rXau#h>&6%(d5Ue8qP*$ox~_Wr4Ds=Ak^~*D6X6l>TO6By z-#LF8*YkQKx=5nPW@IK_)Gr`qDir+-yE=0&ZDwWZFRw)#nG-5yM=l5%ANbp~`7U4dVnU^~)qd4!{DfKQKoxS0wAAtx zaUmxy-+T30n0yBR^2p@svJu!dE6vOQFbDFFcCM42CK|{Zez&I~ zc$A$cn#>wT@qn8e%Vsb%+IEvd9{y(*+j1v?3jAThZ zv(&Md>#t{Pr&enYdB=EQcii`&7NgJ;#|RWXT8S|cJ>wJw;}WHw*Q9eIcwKh_ndwf``#S24OOei({j&!__3DGr~IFF?zb7j3$DFAivmZ{<|qYt z7QZw6Z|w}=+me5TOn#pgSYR{XO?aPrBY*bK@sGd&-oK-WuWCs6EXvpSoyDpP-`Iyt z(w#L}<2;mfZsF`%J0V?u6yhIgnD%AYuD4#O5+LLhC3&;s(`R$h0` zPG#-UX1Ov3gch!hc*Hl)GycV@pO&X5#xIt11d1jJMJ>vOt7Z#KyX$n&;l*~+mbVj2 zf4qb%0eG7IHjfd29;4;xLAubf-Du)*>R`;v0n=f^H!XtTZ@e)enGKi$=D4RrF|LZy8k zVJqjiVxbl6dqFdoCR|t=mjG((pZed<=6lXcZ^1slwV0a;%!?)6QF_N(^LWo>jqwVf zL#++k>^R@E3&|b+*7C%UUie?SU++>9iwe z9&Um@n*2AG1sH>pmjqpF(#`B57p^KmJ%7EozP)sMStkJ_l?fFtdb;6qPrq^k8-!Z} zJC;StS@W(4CK0zB<62jQo~{KF<$?t$V2Oy`%c(~veJ!dw(|7;x)Bg(N{jNz1RuJ%Y zz^Ih|wS6uY$LBsUzX>qcyCPP*l&TUvpNJ z7WiUi0CCIvFSC-nWaNK{1av2v;;`DGf4Q%LT(fnk`<1^5M!?U9dzIFlbd>dh+lzrz zkT6b~E%AjwnDb3iTyQsY)Ut4(dEfF>-8_BWDnH`IkA6gOgiI!yWGP@4;_-6F`kCIJ zzCb!FAr*T)Z;3XS@!C_m*BYY&u`=$;8gBbDo$h9}X2_+OSS$@nz&NgdhuqG8V*QPM zQ1PXq3Yey-`2s(B@nf0L@>teqwggMTK(EXBFQntTV6l}E_sWGWOWe53A58nwl^3om z;8p;~v6MhTxAiOH&3uUSq_hr-lDeNVOeu4WuDzsSUyAoQcRE%V!%)@*DzJ12cbk4q)Q>Sq4 zfquo&Z|^Q-l0|lP*beVx?Q14K9QQdO5_H5@DCmfmv0d;iHB_&by!+a%WY~~Q``wp@ zrkcKy$=mzytwVk`TQ@g7s3V~n+bebg-_#)OzmDcAH2S;uXYGe_`bYbS8oR?P<1#C^ zRNTNo86mB!;?noV z5wX)mi&WElnC?U0rtjaav(t(C#%4laDnNG{>+{Y_X|5-nf3EbxczsB1Qc_KWeu6TF ziHsb1E?)dIy$IIxPaST{7-ep#w#PYP*Spe@mg;X;vW@N0tih?cCj9_b1T$fFOj{HW z)~V?%OAP`WZ0nqSO&a4(aL32dGhN-Ecs(^t{h7gWJuVA5*4-ku9WzmIM$b-lBMjz; zlZlFEyfYg6LqgKPa^Vmyi;CRu-V0qH zQ7}FX)zXvLJk;*uq}>yT*RThhypH}XkdPhYKqYt! z37I{sH5)2=y2znk6drW-my^72H$gg<_v@*B>QB}36%rE92FwOvO{-e&nVFwFt)!mb zeDCAVy~x6AZ`IP9qhXNo(+RZ`-E(#EUCNT0Gr{^$G>!8{^zXthD1T5Vk`9e%+U={J zi0YY7YpnjMl-z(I8yAZ&Z3d@-^lj!JMK}4!EoNiOlcT??y|XPAnh+?qAVVq}!k50^ zgZMj{dQiQ;wr6Ic5QM+=ci|`R`bm?n!&gfxp7t3+KevCk#a zQm}84xzgFA65{43{KtzGPL2&6UM!p?sMI`BbZB08yk^&wi@HmcRZl_Qx%pa_L-YH3 zP{A4cA!ev5=C=fOjYCG9_oKxlSkIbuRS9#Npa5qz0BUvOArj6}M^QiY{olt!M(&^i zV8}MZo(k$y|A2|N)82N0jFIxg_JIul#60`5WL~Edy^~S&rGJ`}SLCP1qxCboyOT_q zw909%HWHQE_ApFbi>5a-GSrxg9}h-(Hy1No;%Z2CoGBOk-Le(!(`ny*^ExbYkBG-s zd1(P@rvxuAV=P}3@;&T0!_}4z{+2g~F6Yh7$#SPPn7o+@j%dg%Sm@y< z&H4HCu^I>;(2_eWq4>w20@=OPI?u-WH6Vwy|3BqfKN_Ljoun7&6+HDV5c#Q;=4ak8 zMbT*+6phILltekq`?7)6w_j9E*f>@~eQcwqBld%`v($Qg4mS`AK+>wC--?vbAh}RWnW9?qo;kqRv`W0$=2iUTtA~C9stIQT;Iq!zz3!_RmS9 z$nwP?{`a@8VJutE33e`eCknOopN9AiR2`%0T-dx6i|3m}<`cU<`Qav(3a?vdb3;RG}{O z&*ftm7Dtt7BbKT@^Mn(QD8Cn3rm}MA?uYLJdRnX#^Sf)+lkUjczMxkZ?KmNaKd@r1 zfH}-nV;3{k1@mgy^!9ZeUv61L>NQNlvlT;Ep}#MUT;A7P<&APs=-*ScV8>!&k|I23 z$8v)Mqa9(cGTPITAC{X;kq)Ml;x0Z6B6J02{FWO6jD0%fKq@Q#4BJs{oDD_%&f|utC+yO%f zG!2RmcD?ue-sJ6AsulrP@MAmu$=}35Us?rR1Y~$*d1;_W_Hsi~T`)x@;|9y!0$E&b za^>({!8x(&9rY+9FE8y&=1hFlL9NkR!D3ih^gMoR8Y^0}={?;F7w`f}6@cVc0i(<# zIcs@m0pJhN3tN8q2W9+-=n|a}J7q3_M=(%IcEQTId;cy<5HDZkpe3UQ%l#8sPTXI& z!fF5rIxB$oMGikEv$V}*5w%vm?qjPgWY)1|dGnwUwG&m=rLxRVGADpTsVS1w{vnbD z$3C)#IlK^plXneMR5rYF^0Ya%|7x7R;>*2a8!GLXoyscj$;xt06eL%1l#=Aawvwgu ze23C#TRC@659G88cnaVW)KY0~5nNTr>?pb=7RybiB6AXN_3KF`xz;S#IXEVxZ@HN0V+W4@a)$jgaw4#dU&E1M_}T zp#O5nV&Z;p0Y;byWX`H@WhHG`O~7-jJnF2)ic10ujTH(lF*%E zN8(D(wdoxlD_u#4X4nraK&nFDTVyK`P@~0B>CaaTDxX*<5c~mb#ZkT!rw%VSE(mT& z@9tGdcn>CO`RwuChjM)-l+#O584s8DZJzemAZqphm8h|?%bQ;y>Z_|Xm`U8fBkF%g zU{_WXSi=g_78A1~{~cbO{vBTG*Kp(i884mnD~z@#UKGTa;{dP;aI&mbP6q9BT!92I z_B`4u3U*zsw(eiuBZ#45V%2{x0qh_FaBnZwKB+k~k{mu*dJSkJO(mh7+(C zmh6wT?MW}qUICOB#IEN;k5@*W+R|SHz6X^0SiI*-5=p15inmCwu9f+Mh+zq^R;s0jHRkHv8D~9a+S8+l? zVYw~l&E2;mdjfHyz<)Kfm#!A{3M(^56}p$0U{K~qNa`vL(bBO-gq&4csjc?`Rlc0e z_yMMDb%60r5s(mu)Qgy+3wpZTL{&!+^RRK_@ zz@&hx!m~Aay5)c7Y1`Y&J#oHD^l@Z`UjQ|k^zV2YD$rR7sHB;=`mTs>*Dx9-MS>|6 zNTkhI5sY2u3XFn)m$zDJR{+dbi z)7F(2*on$oUDEn@Npred(sFj0&wWpOl>NAzs3k#Vs!*UbFkiY`Dainr)UKw{mNk;* zxYgM3UY#^wT_dCV->@O_341f<7xDc?ZAW$3*NVd&W<^S~bGrv7nwq-7y=)x6O0BHJ zggJ3p-AccyZZoZ5o#@GOU#j-pk*)I{$`6|CV`{@|)w`&YueYc5;4sx9rwN0Y3#y zpLjr6;O;0;tLRf-5%^xqAxS^b1(cW(sPFDv5#<1%s;w%4L6K#DcVV6vfmHptLYe`O zNwio2i1WSKYY^qb)rGR8)rGRNYh-i(J66yBtNaV4ED&4dK#FY=xnkrh^r7ArB^glT zpsr#&4QIq|0Ymc3$7`_N8i@8quA;H`t5d$D1Ahs~9Z-65Z-p-{3(i;QLE+X+d39a2 zwSIM7b?@-%<$%@9aPQf_(P2=0-U_1uxCr!Bkq+Q;6m?Bd@PmrC-wFiT^wz(#A_~k3 z5U>4}t0I2O>gtF!#d@`Ts8}T*)~Kc_tOy#>;;6VT!F7;oP%0i5=+``2R!4&?)+?al zg3;I^znmob%R+W`(SlM0P`@|*)yfP92q4QKMC%(^srl0b`f=Ul%kse>I?F zRUA=YnLO}w($&TKm8lx2PJ=@0N^M`eLaX(xCEB6T6`2n36IX$}c-}r8t25HR)yDRI zx%1_6=>3;958suc7tre1ic~gdVy#sQl{MA^;#WJ}%OC+^2D1GkmDS{{2J)fhvksOd z>RMK)4uJMT$;BPdi`7=i>A0KU2#~1g1 zVSHelm8$@JL*HAO96`bA*z!T~SBQpJuMm|B7?qzJA+b6ue)C_h=>ks`$Sme*Q7iD- zlHx1xV)rmiHMQ8%Ma z<;Bkt7Z1n3ilhy)V;m#dAy-6$S~2#>1{%5@L22NP$|0>cm%9gkPB~s;czy1bsOgO& z<@*Yg(wo@5IvYahgP+A%cm6ZoQ2rk~9XM@V!n&8ae~zW^AHxpt775CdM;_Z;zC-JU z{m2c!ulb4*({ryP>%=MOKM8y0q8J(61M0V*BUtH=}HMf+zQ%E=ph8mA*tMg*{Mu-=-Ay^>Ds% z{6*RjD~?N)F$@PHk@<<27gTTw|>4d;iXrv0$Z6YI7j(cScVqV!J$)%1wO@%1eziql+uCFK^AgLjXd z%eb+RT$jY!oR@+pbA53>fLQcN+ymW@t*48Q?Ed@`OxMh9!&>|8AIH?9_%G#p- zEvAOE_7TU6SoJV*m1iYmg7itg3NfKBmE3-QzMdsq<$f-A>M!Ow&C%}f(50`Dy~gg5 z#yb?N8k*!o)vjP??I~bzTj1PX0Rw8e2Bxmj!|!{2b>r4?m@Kw^DVeSIHpeygv^1-s z3zyG}n;)R^mR2Nq(NpGxaMW(|NE56abMdHOY*yo_Z<5bW15c`qW4;Q!p=Z~Cp}2Tx zbLQ&amOFRM< zH|ZI^>|K2!rO;gRUe3~LimPA#Xys{n_3lyo^`)=C(7ojvHmBoGb8HD*edzYFX~$9DkF!ElYp)4iaBMJXM zeKXd^Y7$5C);i4TQcD?FQ`fT_K8}m_j=4;E1Ip{mW`p(xhcu45q+ax~yt+ZB+sE}P zjjFD<>s7GuOp~+9VINPP|F?|N+~qm7yzP0Jk8FkmZv*+j8@}skOC2}p^niaolQcY& zE>pk%N_^pRv-8X7)$z#+fd2+GdVKHiQ~&nPYqRYS`cq*iEG`=f2&nEA7?dXd`;z5R z4{r6AR0XG8`bSEeKa3uJ81s`jKeU{~#4W-~PKJpa?)+%JGo`)AwX&$6$Y2Fb5($j* zyIfrDBo9>Rc^_?mDwEA7x=H>Y>kXy;o^t0lH2Q9PmBzxIC<-`pPtEFWsR{%y?g1Q- zLXKOp-xT)>y6^w)Zc=>ba>M4J+07X)hxnZya#++DhE17=eQGZ^^8ta~P-Uye&T8erax4v!K^PYDoCH(WL zf0R}MnD~D_^M-_`$A{XBa8@w_TJEH?xSUh!6FayC_o&CT`mNn^m7Ly|r}jjooSv$Z zs-)a~-xT>$W?x<*%-QicS&Bwm*xcy2ny#|HaopTq`)qo@x6xgzj=S16ePd1KnN1Jh zRX;KOW;hYW^^t@ukZe#W!7X`QU>P@nYj?QNG3DUp;#)uelbpN5W5l>cm;XyP2SrIY zZ!%2?iIBb{*0X_Y4 z9^hXt^s^69Zb9>tT1z#%A@>QN{L6Jr3YZCBnj#LB8umI%J3LPxHPDH>{^VK@IdaJ- zF@WRACuQf*-}SvyFmm3&K|X0UEi*{Lo0G&3hY(6_M5;dIC-tgQp zpZxHVmf2Rv$IJ@pjF@mf!LdxGaI=pTuAG-O+x>Zzv5@#%UoqS{=_k%>a z&;HT0Jayv4o0q5E8dh0!+vV~pO)a$Y2{2iV=||nH%jzQH6~JA;4E`;p0i9#)Sa1mB?&6Y<%Kv$n%^G! zVXARUd_F%^*UWRKwaAO}>DchL#12#WANiq=O>P@md^?2q_Sd=8@$7$0P%U%5RiPp^ z_3i5TyzTt>xb#e~Y2W-{%QXAU2q@8;5gzZ?pNY=BSr{a1ug*ykBy^Wmm4()P!|XQ| zR`LCBcK&Gkb8w`|c`iW0WuQ2l;;D}0)bMCFFmzMQiV6tRK%K|v6Q~zTXyjb>ybd$2C3`YAQ=BquylKbZ09Um&u z)VTDn+3{>9yTtt3yKK8MYduy|6wlcmavB{C)TFpu?Kof_XmI6iUuCTgd#=JH0!>5)?M;4kPm<4Eh z@+?*^MGldgU9CYd*>{|*y}hPcAEFaS7yi0bR!|U~C8~Wy9(pYJ^->YU!gIps+qlLT z3y79RaR%>&U!EJO#}-hB)lS|LsF>5l``a5~2D|QcR+jz0kH`pfieMWMi1rweue^6@ zm`m-~or_;8_yN--$n&&Y<&0g8I7;AiI6X8W`!&W>t(9yOr%a7-UKXU#@xpW{NxTM+ zosbmtV3Bl-lg71G^&G?!6-@C6W=uq)s#Il31dzR&HMlpA`j;gNYU1(y zeDKJktD=f9J%BE8m|27R$GD;PV)QX?h*7A|;4_!1P1H%#C5~*r2Ebe=>j5;TS4K`% z(EgjDT|A35KZ}C}Z52ymX+dF9mZ$j4E1=$xmCZ?{;a^clipH-srXv%bou&Za8Xzr& zR6S~%_3~kB%Cxh!EA7mky4l-QcVhNxb(s{vDPBN^Vwlc%4S__`9 zxg9l+pX8e+?uhASX0$kBJDZo(GYIytKVYe6sW< z;O%1mzn6X^{b{uZjvyJfRFp=V8*u>{Zj$Odmt+#m|HH+DO3<3}8AJ31%q^%rq)pE8 zps|ufND#pSHpW2mglh|EU8;av6yX~IsY^wVi`)cO#vmEDxB!b!*#-z7*I2GDBrzR$ z3|=koGx$DaNuzd$EKQKa4PZ&HS&uIkLH%q#IFO8$L5=D8wzgI_ZHN}83DCH1011X( zyx0~44Sx5-pe&F%Hx>%R^Q&x)Y$hlS>50>&QtTb?K;f-71vBv3jlP?iT zDMjWk6(%hT#&=NLh|*Qre5nj_fw4^AeyG2LG?uIdO(5$-uz$c};pU=z6L}F*XPg>O zP}L{^lONaCW(3h1@IZQ@2Kg|+xJrVd~v*1xq%c4G*y+ux1B z*r6K%!e=34`2K^15ByM|-Y_!!kkXO`BK#EIU69EHq`(imF4hq*Q;ZMp5wL$E$~{TT z6~D{msk)pE+Z{elO{}#Ae3zjGO(_e=7o?+rvv3i07V;61BbXp7Zkpidi6Np#KnJ8R zR`KwiMkyxoh+JW0d1;Wcz>hxi+b@B$n%U8SS_9r+i!q|dvKbKqAU{corx%X)R^L6T%~`Z(RQ{&gB3W>M1&0n1{srEb zqddmO1AF_VL361_n52J!E>Zou{v^2p0XBZ9i?S4YlW>^}YxY<1#BJvJ8)Gb}HSx(A z=gA5fNXNM0NlSIc%aR>;i~(`A%!LqNG}@~T(I#0af0fpnlaC*OOPt0%(t)fz@EG_Z zFZO(!@mFN|KSUv2u3#*9QC;f?X(r&!*IHmz4)_Xg3z$0ey;F^jq2!|=D*Ve3R{~Rq zs>hP((~EWXKaJ~UNH3Ar4eP=Z4I(;JG1&V6g7yUR-OsmGtq_Y4P~x{=goXhO;zv}; z2r@$p@@7Z~^-)#`oLc)9(JU5ujE={28K~jZk~bUN0MQkAaJ7GZTKM}N5igTD6!Mi z(4pm{ERb_}xU zrKlhRosIQEfx7|w$L~MXe}rTX#3F*I-`;?Ten2tGEO3uN4uugWP^~=!$8Ld)(Hu)4 z8zd116su@Q)>kuOh42SeT?yJ-;7GQl81)f8p+3S8+NbbtbTPwM@Hva2NddoMh49A< zQuix_KS1A@L!PxqKq|&31dbbEJOk7wz{?9<=HFN)U=v=Wv^X|T!czJf^b+m+8H6)R zydamkJ8*xpr-^jK03?j#FSF{rE`6%cIbn`yHXXQe^AzxCmrd!QTfu|X*P3} z45RXLZ!GRN3vODduc|C(_AkesJxk+pEDe~ z_0FL9DcRIbxrQ&@Vnd_ST%SkXifTT%`6llv*=n`-U)88m)J~16g;0gEvB)@{yeMdC zc5cT=BIoJBK5=%>ezj2Ti?>W(TC!dWH+;D@CjLv58opL$?WK)d?#RBRa94YJ|4cC} z_g2FJ6&3@fmsu<_jXJXV`jlH<2%frgH@;4Kgo};%`>pfTTV8N&e!~mC4IMBEEl(~` zxGzIjFLSU)=7gY}otY=q6jkUPPv}X@I{|Z{bIh{0x;J(8GI3j6TK$ac)L*G;suFGn z%?weu3)NH`WVh&eSG^D2n|dp%foWru8g0twnj@5>=V|kcH!(YI7(IWx3SjO2qegod zJmYHj#x1IW-pgMtK-{f4?3O`ujew3%>E=R%X0?ENnbUonn0K#lyh2$OBl}~2A$Z7j zDhzZ*A9dUCIVrFB0ix7+$iF;ZphhW4Y)ttF{nV#w@QYhcKJO_RpHTXY!gh;GT$V5Q zn1nu0E7YKTzitPhz09q?t$Qs2O)G1tjE(epgkEo&itrAtv-03Qv7suKYx8cwQ<--| zUmAd~sPfPIlyN>`t~~lKfBGn$LbYBoVz+x6>AUinqAUy5!s}%M z`nE<{+8ap;3q@=WF7u9|UoU^!r}T5d#REe1Y@T@xo>6QD#hbeN!7KF9bFz;7;PoAq zH~Sm<83+;M!?Wj)=ZZPbr4IXF)fCq{mXmHf*wr4xT;IewUE7_)Zcx?|9An$@HP(^y ze9*LGpY2RbboV;bE9~7A*Y2u5bgy^CPsepO3b%h_J}5jOm~~CMiB+KMl63m_P2Zio zl6F=!aI={N>YI3Hju#zb&V0ehXOo*f-S&NVQ*QvH^MqHKZb-tbJ74tIJ8k_q_r0e%V@Jo;%;+)0(wwktmhq>D-a)RIMo#21L#meJT{5Pl_STA#(J)$8t zQLU!o7cf?)Jd4v6&UT5rNqUN6p6P>f!pZGCr@=FR0i;Lkj%sLKA-+TU{o0|kou3#Z zz*7tDCX`R>g?Hj~Ju{IuMAPKR+6d}>9_Oe|UyhT1e`j)q|#W-L{d}nuVy-n`+XA5B=yLy%P) za;eK76oFgUAK0{=_PNvGABO8E#tsg}t?98kdbfXvwacy?_2_@4Qp3_Owp+Q5UaB4H?a{&}i+}E-Ba8*wEnw5F*h_^=;JisQ8wS{ zRcNCjmjCCu_PHC6>;a_oBklH_jEo00?wqBO$A(jRTAih8k__Ko8Iq93U%x&y5?#^Z zEG|7cQ|2s+w?17uZ!Hx(?Qf@bT!p<(Vt(|9PFIH1wqu}g>UXsxE+w<<{?pNM`#&8o zBmBtFi3_;4jji&#*i*tWaZ~oT`ahmIjru!Swyt{Ow zCAI7r?brL#Id+z;C$+cD<#vxX7$|r6#LZ2P1kVqSPTI^5RXa=OGDSQ0e`t;Li7io_ zcl^{jQ*V=}7kpSWg7QA?{3b_xbs8zW`8SF#)kINu=hp;*$BFqGx1Pq2H>su?eJ;$Q zSv^EEfApWMo1Aem;~8cYL)&Q=KPjK7il!&-X}a0P#rZ#z`0!%klf^4=b4W@G><_51 zwf?>Q!HKo1wq&z?qsHH(So~<~uWNO5DC%DOvrW)=`3_T)uVgQ>wT8s*@;eUqq_$+<+9uGx5W+Z=V@?Pp|g`X`g3?V6- zf$S?j_MxEOWb8|tZeQvRxtH7Z87k+F6O$vK3wUeS)t85tNx;_HCW}ji8*VpHC41s; zBAtYA*p~?W)Z~5N3#7(pZ!NwlQMCL~anDL;hQF~I#2xzi$jvOvqTnE3vX_Y8XzOwQ zToBMn=e-q4nDtcac4@osV^B7c<{7SCU>beWXA(afzZ5x2$woh{`e1<3T^!laS5P?wB)X zudKIk)``nvLh)NqR6 z4dic0wOYY^La4bz_5@J|P|o>q;Mjdd{LfFID&8U<%U-NQT}C;WF#~E*wEdhni6^zm zNlqkay8%|-08d(1%a9SUO_snf`2Uf_q)8+X{)v^V2l+~5?Go8v5MIqVs(ky>pAt-x zv^v~Iveg01)i|a_Hl8epB13CfiX^oBmsAf?oPcuh_l7k=61f1=4khd`jm3%{4Zgc4 zTaWy^&U>21SvSb!s>D6(3cnxJm4!Rm6GX`~L@1hJX9F?QX+=nV5E2l%*TcRf)fy0b z=O<49{s3%IwQVo?h$rt=8^_%u8xI(l7@)gmQ04s0j_&zF3F8=3^B|`Hr|c9f;RUjNtJg6HSfX zi0SHzEULUR8X=R0QXT&W*0mWhNmDB+$t0R2GHkFu`C4pPNM}^UeK-;Eb6)F2r9Tmjc!ieGJz(oOR{|oG%3}auj)n#kFB1 zXPT)s8N%t=)h*w9%{CfN(KMvQi`xyFkJo4FvN;Vk;y%rM2N!i-H@8d4)Eke>shZQa zk8-w~>q_)uJkIXeH1_WPMQ4%BG?Svq+P)njMXP-OO9*eHz>tY=Bn&N8QJ}R*_Oi0Q29@EnL5v5fKR_fkDcge#G;2ocYEj=#r zI$5~79mIw}=s%KkHt-`6h4>o^JLokmWr)Hq?OubiT|i;;lJ`uMsqP;z`&D0sy)t3M z6Hz&cU0)jf@E@42I`5?l^}|a23mxQ+rk;YkLR}FnCUVvy`kGOQ|ANpDk$Kfb*sHBZ zR0m!M?kNHr6#z@mn*Eh(i6ww<2)IH4QT*J9(MFWI;V|sgqDJvIc%TdMYFT056LpT; zuef4#uTha9qUKc-VWZvs7si?a|An6l%S+VwiVZLi+$F$#@&fTAH~*RklJQsvMy%EQ zzXSnRu;Uh25BrG2

XKBU^9MHWe=pj%?6LQ6W4)Rm#JM4Q5TXsA2CD*&v9if;Sqx zX+Dtq!XSjZA^=<0QaJ8QO~G<9FhrKH_k@^s)Ynu`{iVqh=EE`yaC-#EbtK7`%ZI}P z(!F=DQvh>7F2z7?TmEw64VMfDeqY64$4B+9 z8oApFMDIFc2OD7E?gw5WqHZm8$rp-f+#|3P2Y$pp9CptS_!@9XuIbh+aQVZ}*gnhhL+~zH$QWrN zdtX)uFxJT?ZH#4t($du2KCbXx{db11Bdlr0muyCw+xk*%awTS3GqXb`-|0HcHMfo! z*_8I_I!4c?j-8qxnW?(U$oE8QDyP?-JAcm1`g-HN;l#$%)5&^e=CAK`^OeMlmo}$f zEBbn|h0x_^=FpI^FFl%8p7Mq3iGTN8xPL(T;klN|7ninstFwQ+S@3Fysd&skB$Wi1 z1)sc?Jca-c#|Je6buL`TCuQg9E(<1GQE8QKzK9-2Zzx%Oh%(y6kNtrW@SI7>mczNB*vJh>(! z2GBgRgF{+mi~(fe|B8ZLa%86siul_5nykxG?Z(#|U28+$8JA*1J!sBl9St3zooP)602&!`IXt`r{(+(c{vF(A zgMFFw>+dpk-X*@ykp50*LNVu?@7zO<#xEQ;BGre3Ba5i_tM7TfnlaAs+c297t-~H) z!kGt$4{3!7TYqOSF80mo4$U!idD_6y7(X2=_fL{s#wD7hOP-dN+MH#XOh-(?;}J@B zUT?2^zl~QgF}s}>FK_aOicaLKlFf*cO;Qo-C%SFNeVNa3n1pa{KF7KFHSuTq5c{25 z6znc}zlnGA^yGS8edYw+^-JC(IzE<)UJc(_PK<0$&*S3A6TR3d$dSjy^A`vAo}KgS z*BFKg+l2uPvUMFEmiDdd0zG=`=n7_v zELyq$3hgEiqB#zK=fHvHIHm-=N9>MZ#fj5PkBi7V)DoMV5L9$XSC|l_c6llR=5+gv zaV#A_X!eqT&%J|k!yZ)zVAOZoeOEPloFfi;eQvu4U-kOjf=#8eEq8VplQ(%QiSx$$#~Jp+3Q7EUzvhDJx2;yn9QhSK6`qkDMmbh;IS&QXzvR_Fbst`kNvW(K5tC!j41f{N)O3x zD4ipYLd}>s3N_<94d3WPwYG6+1k04X|F%er9(e8+%ghcJrGSYpm7fVhz_=Un&};s|nb_kqHD# z@ZYxw%WWi+e(VgJtC^bkyxv~F>GVsv^~T{Fyl*O|vAQ&FKI@z0_F$i@vg@}el}a_Y zHh8XIU8vMFs?=1aWOFoBa3dI!tRaJp_DR`|`j;|~awY}KM5hCJQ}}$QKyWC3gLjcT z1D%3|mTa5i`xlp5)jLCnILlep^#|qjPoLG7l+&L#aD8ZDG;g5)TEyJl@cqL}Vd7e0 z;y`{W!<9NzL)-rH?R&_{5feI@{@JAZbCJ0|otD0$+~wLT`c<7Q^|?%SeoQ=?9ABwp zWV`}+=={DCU#emNFUdyp$}pedEDE{Ad`8ynPQ!Qly0<_VRrmAPNYBa2&h?9E^Ez;V z%j?Z)Kb00sI$P|<8Yz_8ej5Cqir9WMG&}l5A*IkNoFk>5qgx{b~Tx|WDfJ>YD z(?t8XIGakp>;J0zVqD~3Q>>G8mj$ycSHOOn!okSF&S_E-KlNieg}wdMC+QHKbHc4N zMmAMWF}1=6bsh|8i^TVWtG9TCoJRK))bD;^=9(4F+y8OD&1hajX{ZN9nW8Z39a{?T zshZ<&rQQm+Ff`W%4-Y#$rC>7s)@>FiVNqb7v&MSdTXaISgn5FPc2+)j_S&nZbSF}d zm1P{CbM4#ezlo_-;WwSBL5>yofq#~hmmEXR7N30bqDVmd%)~|RGFs;^C!dt=Z+mrx zQw48gP&8Xm@Hp;CdZEu6kRQj%RV_sE=dR`SI8ytUxqX)NvL3%qB1>x1NGNX`93UHv z_iKTYr4*`!a=nD|a%{ra157ej+b0{-<&3L@a{KD#S3$pzUt4yV-d@bPBF=1_Ezgjw zs{pdD`lnhPpT3eD_&Qx}YT7X0Rg!A3HkKyq$LuKgh`p{OKIrl{#p9vTvch;gjodSp zg3o0%I*#d2BnJ{@HTmM_?&`2^s3{Q>8b~x9$p8D`R*jlr)2EW6xizz2Mx7->>TVwY z^hsALdtxfMM7u_3sP@HicIU|nJ^*SF$;akAIoYC^J3rhpKa$@f&RM7MWYeYF`8GY@ zTPVL%URV4&k?w9ooi;=0ow0}Wsn*_Y`gGO8`Q-8LYn`&e9l27kRCKC$zw7i*OuQfx zEcHgo$zgxiR9ExNNKd3r>d0VTO~LoPn!;*FhfIn#dzRL@3s19ir;bQv(s|Xh%iCJw zS5rhggN&-xIlG!m^=1a^uSU8vot|uoR;;Gm!Y$)8`em$OeE9Ec;~8RIO*!^YQ<^%? zlu18z8kWwHn(xz{n~Lkul%=I$=|~@s*xDl6u(izH*&`>Ln}WS5y@H~vkxGPhuGX@` zqk=)(>RU&#P$`FrDo+xu~}p^g8p-Z;34cInff<6)!yh-J?HxCuMXMBCOm zMtEpWM6=I3D;Uq&A8gen((s16?^xo5F;hZ37klbnmA)u;V%X4|q)ZATSi1L&N@mUI zBwq@t6G^^qKyntdeAeO%UKN*$j0*J?iCAS^?>gCGd`G>h=AMsP$kgN6XCV48iaf2n zmFo_@!eT5UG;wNvtMbDOJX{~CsVDcSJhU0P3I3S)Sc97sr(Du8u!!q_QuFWX?n^JN z_9cmaepeyG{9aaq_^IDFs2sBx=BKVbX8ip&CDBQIz+v=C@@!kmt=sl0bo=CMW=^_Z zPY*qrU9rz8m?-dlG5gb7PSf?zkL7-If4&qFEsd(SPF>QOQoSq9o4&ok&EbCZtEMls zdSEd1*8=F=}nB|yjRoI{(9Yge-P$7az-Un zgztRqnfGtneOCUB?JP%CHD9yDWcz4zgX#Kq>Xy!_gI2RlQ?lPXOEns5YY3JdaaE3q z`!Y@Xg`(a&PxsvvD6D(-&O5JZPTLOXn6#tB%v?$lo6j$O97BYzoy-{aPV@5%+sS=I z*{}S>PLN?*uxj@v;Z4osLDy0a1YWZK&{IkG@tARIvX-z=>lwYsu@WAes=tbEovU}Y zZfB!NtENt3o)Fqfae(GL%eQa3vPX`btdr($oXpq-e)7A&lj}(59zValPNH_&`aw{{ z*vxMDW<^VR>Om35OR`cQ@;YtC)|l_89((%uRpF{B1D3ZUH?IFddN;-Ie&1*|J!oD@ z8H~|#ATAUPv{(9)7HE~!c(@Ng_oIW7o<|dJP0AmN&^sy&{#c?w6Py{pL)**S-m>!X z@g~CQ(&0}aH<(5tc0A@{eQv+=`s&RhlsyK!>*l0I%^7OiwAyBAX}Vp!>|1S9*fR3o z4jT0jZzt6JH54Ka(XE|h$dl_rudMbkGdJ>NE^l=i=BgaQASLMQvt zs{F~$T0T3I95K^3N9Ub3i8JO_ z^G-U!WUUO@KqNTv=?WkOhK~YIBRfTW$kuKtys;*1g`9W_1;b=b7oj5GzX#hVc83sZ z^}w?XUWcU?*o6|no|J;~4*@i30ULFexMx*~l7-2nTq@`!L#h?c_3A-(U06b)aN7%e zf(^DgkQBwb%P^Hkzrbe+E71KD5;$XzUZh%88{tV+XJHS;*oWGiL*PAiXhCW5!w7Tz z9@)_~{x#Xr6ISGea5N7~9kAs?z;36mkiixlC5*{71PMgJM=_fSfKenwWXMln01r;- zBcff55LFZA!D`P=DE&cOp#wgZt3>j6QqI8Xj~2+TbvDAw_(AxDa;4Qlx)=D>>Hy_; z#q1cA`ib%(v_(#f&qj18l&dP$I$8@KE1_u!>PR}Fp+8L3U>MEu{ykojDJCTzv>I& zLq821DRbCj!%ploqe%LR0h(SkCPki_MohcCiBLZ1w`3QwAA*SeXoZ)jI~wjxI|`d3 z1J0zn$PFiHmzNEjJklmhK-8! zbu(gqD^Wd*^=N?ktwoh8d@hoD3KsSi413ps%Vb^*I9~}?#EuY1tt~dq3}ka+hYV~q zlv}l9NCVpnpx|z-Cj^!k$sMUcGj>?q$bC+*9bbWHp5LN7BRrn}E4rti!V&{$10;J> z5Ic2x4pSt-&JH<3KyrbEw;*02q&>mv=^>+GN4V+SV=Ob%;2rs4$+tpuLCH7R@d;Ky zvQCgZ6jLqOzTo%}?a&8#P+&la9WVKTbRPt(qF^uVxfP%XGF265b$*MR8IXwzBi|qi z2kMBQ0jVb-#@DQ|xhi6SuK1Q-iTGDy6Hs34KC&zU9f^s}&+cc4d*|d(rIr8j`5OuAVQG>P){aqjJ2V6Fz zp`=6Qg&h=s!w|bMJ-wDnis5HqW2pXE^umcd&@8HBnCwO1sb18kgKTZrjqT)`&$1}` z?vxvuYYzz4{t|Qe>{_IaJqA^A&mv%tjlnlvSUv?j=ovT$`3n|UHxYOTiLeokqeaBT z1c_jz5a;%a8O%_sP@a`kYYdVD@dPq&H29Jqu;qswGe91wPDiG-6iM2PL%uaOze4FNtPQL9Y@}4I3QmX$UiTXYW*1^$ zv|$ZTkPw6Y{NLKhfr3Dg>#=-BO^T|37&jn{s&XA>cqE%H&I(qS)sU03Qo&me;`Tsh zd}xQM0TM?W3oTpH)X5gfzdoJo%GI^5#4(O%^f_ODJT=F7T=v;EV=945LG5pk<5rhG zG^DiDp%u7<DLcI4N|zlO$Ts?08#FC#*YyZ6d9n z<#q;rX9k0QfrMht8_=AJmu2H-{ep9xKK}@QE>qtrWDwTfu4W{cVRHMug7=6*FvsyP z2g~n(BWJG9WxVCg>ONs9p9^*VoNeG_AJ39A|FB8FpqxWTSdooi(68>R$7K%Uv2%^P z(y>Rf+k}RSVnX?hcHVRQoGR`Y!;#fv*!tHUhnNTVe(XvyiDXgZrdJirV1Tz2V?3wpSF|t>Pl` zU3mK-6(o7`+E=A& zRo{dp`6;~T{cy>X4?clk6hD-6HFt2IdZ4hkRP?08n9_D$@bU(EomSaLoF{}8|9l08 zBM%OrKa{h*5-pdpt zSqNycKc2fs$pf7AQ&lyFp72l#Pj|h@2_|0TUM?dm>#LmT?m40)eH_r0NQBKklJr&< zVYWS?hXH}q^^VdT)_a zlDM_b4E%wX`kSj>Ip>K~xew*s0(F1g&Jd+nQX#P*$kosa+t(Y)AqiM6tlY>qHkjCw zLrlBUU=3$}3kx?}G^ABdue=0uUTe;$vkiNbODP)Wc|7vH(}$488;Oid&FBTc7@9?oI()K3xxc^ zfr4u?wF5Kh0D*}8ak5VTWJZY|%K%F}wd+K-UeLH_ZtCtJZJ&Q~6`#~%{G7O~3Gy5| z?=k@vEJ{fU2BqZ5bJlL^cl&IDc9~S%oA&k|a5q;`Xgqy2!G~^Va5)(}~mbt)Hnsxzs%5C{25Rnh!Vdv0L|JRPO^BJRmeYbuvk#1u%Ki4*H)KTx{AF2CTYQBE5xWjp_q&SgB zZRURk%E%vVvG`V{$=DHjHTOsQm91=*q1iNEv{C`%7oH|Boao-HXWvOY(RIh|HLLPi zy??W9;x^}*vD(g6)%zqeXkNwKIox1nZzA||q)>C-VXAa~VrnMSd9pkAi7qu`!-j)R z(iv=(ZJ%@n#`XBt1shX!JS;GinvospRTZ6>D0N|fDNMbGbuQkn!lRr)dy7*6!CAO5 z;cxcoqnlb;=N_%WQz#My2;C+sKi%YdnM2$ATV!#3aLTgnNLx)+L1k2sEh&BKzMOV}Y64KC;g>4>RtLyqalfJ>R9> zo0}Xt7193bY-P#gug7Qt5lwNc~YwXnD z;Funisez+^VsN*s@vxPZ+`a2v_G@=6&ffU>Hjrbm!<3hSle|_9_=K%nmB@I3h?8(^ z{X&xQLNy7XGk=mYoaf01Cs7NFuA?VQP9>%h!wV>E14sQU)JFq>lU$2A8w2O0669OI z#6l5}>pAwzoYw!cWFR*d$@RPpr~C@S3~d?<2Wl$-)Tm8E#WAc2)*{0WuKZR- zDl>VJ04w+^*#eS^t@$_i3;s-cUyxIH5-~_vh5%&XwiN`B!MykkC2+_6CpkreCsa<4 z9>Ngg3J6xnLqt+hbd~)tK?6#VGXUjnNL|AU&^;H)E3im_HnMQuvN(+86Eq8*oNKyi zVVema(sPFZJ8+LnG5bG638ccD$pZkS)fifUM;fs37a*)HhQm+oh%IFDM}l4GgY8Ur zR~u%?D+O*>4kATkFzf=zD96DW(nxwef|n2kqbv#g{D#zIW9$6^UIH~{n&7-dC#xDN zy?j7^v`;)iiMyY7t%w{1rSrbcn$uG#R;`%<3cIB+OCcEcy_SO9Z=>@N%SFQuO5)apb1R?bs zR97O%toDm6qYu${UC4_)fs*fY#cb&PSG=4NY>@}3EEa~f6AD9xB##jI5%8*nX=m~U zB%;`q!bKiD@6KZd5CBvC2RRl-N)%9iRS8R59J((E9oqpp7AwVyBsJJTgT+k+!9B4c zuj?dXA}}H))K|ziUrA*j;kI~QY(X4ix8kU7hGH0F1@nhXg(0~Rz4trxN+NSq0Sy3O zXd--}h1K}XLl3ab1k{yV6)eZqJ+ND7g^;ugW|VG3U2*3lE~zN2@IM^b`T;Vl#YZr{ z%H%!G;7KSKqx%?Kmn#IjGo_#4G9y&IYmq~@5HUD{v7RlFyU35WNyR`{$UQj{SG?FiBv`il&ArLw0@``Mn&m$f1C<~-V5M+o8KDmAI9-t? zlw+#}K`q=H+YYE4w6qGw9~6WqVfq-^jOE8hMZopsx3!1m3O4eD3~c5RpkNnbq-(_PNjzwNcSS%*6&ad(I2Ldv55&FL`)rq@Z6NQ zW!2mv^CAIQAgVwR%bSc45GlM1;Ag-{BPe$aufbYy8oV(-Hm;<>C*H)EeQ+KSht

6djt*ku6wc4_doDp{I*|c;Q#+9*!T$sRr7?AE`*V?Tf=B9EvWG-ShWMn z3E%bP>p_B!s$c}}P6ZqNfMX$q|FzyMuJXlPk5J!M|K>J$%852ZGu!Gc>PjO!F~Y$M*>cTY{Mb&7`}84 zV^qP}7P6&v(EW%weT=!IgWYUv^K#zLzR%e9ALF+$6=wP3qT;3uC1af=M~(5U>8 zf_DqJ;5`OG%3Glw6>QM3lAltHc-+X2YSwS;3O#_MEYoc;yM6eK_!lUivj(hnR*YFOpK3@SC?C=f+BSpjnjyFm|pkdrG=ryBCU{v&k`k$Ey~ZCBKB ziEv!_8#Z;=2(CRqv8}}{VHv?=%@I*XM#*LR#mbNds0)eJZ$xBVd)PxeJq-mmrpB;s zHZ?~;W8gp{j;aFQGOzXwB}~vqZ0HXnLnO53KZUqf=)nzg zZqyCSEN)u{V=y^lcld81b|b#bFj9hovOxj@AGs2;1uN z8y^(fq8mZ%$bb#HrW=7A5q=L}@KDr$aN2@*|C$XRBx5ZA*eS)ThlTSyA!q{wWrN>2 zzpL_E!r$%}a?ZM1@G8)LmaPXrXqkT5p~=gh@|;Af)x1~zrio&8fKYMe$!cMdbxuPP zYn_HFS2OY%f`lE)bLZR+ZekGxmF<)y3=96G! zw$3cJ&Mbz%9OVQoJmxLr1OU#4EErba;O0(muI9{i#RFS+Xj6AebEGg-IJ+7Nma|HR z%@e^i{EraD{neC9Mc$B|Yq@4VBG!zOLxe37t3IlE*zJ8wC=MVNR55p-hXC%T?k zx{dqk8hby}eb;HFsrFcF7$$B9dg3T#=+4@~QFBIzZin5=SdXJorSUFCGA|Sjcw{&%jeI`^b2wIWHpa{S5CJ$4-sjD355!W1hJIth zy8A0EN~ry1Z|obS`|oM!M{tEBRhic+;tUMxd#*Z6~)35PX>bXWJ&QT65Q z^WDt0S5~GwUdC@fop{O;&z+Mg*$L1>+!T~KnfA%L-sA0pyo-T3p;XJ3lVJO$t9rNIg z+b=BvRt%HYZn_hl`@>{6&U1RxQ0pu7nK738Hf-zk;Z9QHh#0Ana@o|$DMsTf#UG#Y zzMz2f^PPvrw_gYCmDN8h?=iAtVBHb+ZQ^Wy@(5{#4M%)dzO7{Qk?!AP0Ea}Dhl|6N zS60rJD1U2gRgAtn|DfSyF#?@4>?00^%_ww>!H#)%jhFJ45`g2WW1KuTSpy#L{B&<# zmNV#Jxgu$Tw=|^X`pjr}M~Sc?OlPQLI5!%{dmIgji9gtR?-1wP=!0JrL$>|p_}+*& zNnqcusiGwHHR0;|FAQCcER0?lzBeKc0Q}lYV>61oyi3q^q~-$XN-(8fg z3C+Ia`<}k;2h)ifmikPl3umZzNXpf0E$5_)22v?gLIV(Q6hlPw$70<)6KaB{)hHS3 zey|=%3YBE=-J+5?;bSZ8I#Tq{6E<19HO7MF?CR?~L${m*WFY>VSeo}ZHuT=zopqo4 z+=^IprY8~yUKvYEv-NapMwZQ6I}P=8-FV?|x*wO7F}d?;FZ-hj;#Eyu>$8aIQvNw( z-Z%IgyEFIAO>|}CX^Vax0QKOH9NfkI`^R)EGEG0`m9^EstsaPIY3zG;f_?h$oU@7K zmnCTzE9)#>-$S~UCuj*KVkeI=7mw;qvR`-csFGnfJbHbK3>O02m4wsv&cWP_#9XRu zQ+tP&bL~w*-vS2t9UE@c36&X z&JY`7n~Y9u9?PEUx_9ev;2NiqZXFjFJ)h8M`)|7n)nx6yDdw{AQP1>zt`eSXezuj0 zr)M&?>`91j&)knGX|`j%dAqN6@IA#j%$BzC_UxbR`4Z`q>o5~om^)p;=#x7$Gx(xu zesb7(s(J7+U1>|}YN=z^xvkD2MzfUH#SLc~-es;k=hSaKmo0){1YU8N>&Oj}$o#X= zv?DQH`c>p;(nx6Ou~S*d@|KC~ITd3Gz;M{BKc5<*1Z!O7gFclu?Q zD;|8867Dqq?mK$$l(^7FJ?3)YCNEYw^q=t+4itatPJRS>GfS2;uAv)0scn1lAY04w z=d78sNxg49!-K0@W>fEUlfGFdZamhV;k!0cSg`fdIkTx)Cp7@pmr}8J5iTQrIJLS- zdu`%Xw%GCMf2mq30dU_!`Ml}I(xOa;P(t@c?$m*zsjY5FY~`9~d0gXj=GDNWWkIIfXy z{9S;xWA!Y^E~HIr9Cm4s38A%=1^5udE`%?%AZv(3z{x+#3gUa7P|}WN+wxB9I*d-$ zJM!h&IeyP!)XiRZwO?=KZE_&R%U=7zDsDcIEXZYc{bh@cBi)a-XqWcc{(i@kMy_c; zFS$D&v8XwD(k=|?NS~9oZyb~L?Jw2HIwapet^crZH0*|SP6oizFsNU^(y)B{J!17@ zu4zLBfa@W=PY~CyER@O!ImBH$p3!{;ld&ljbiXfQ8%4-i!(opm!-(2{sqTvkS{MXB zRcEfw@D@#GW;WkvVKChmkl95EvL<__#npXQAGMJhoITk2aTy1r&)RGXCv0x~t$ra@ zG%wf9uUx?&0o4dMzVfb66`-F`L^jnfLUcs1QGjX8GOvKq5wnc@q4?-N)iHK?Fg~@| zylXcrg4si2Tc}HTX-F6yfaS-3ycB2W&W#T0cudlxg+eq3dm;a2c!FfxF z;$OSFEJ?!dG|#=xHIzIyZJfc!N@h!)8E(zbFCL|{emXzNS6x^$`@be=KDCy1`Wly$ zAtEg~jV~L$V0!>(GeE%}H~FS1LU)$sY2!n;6x}Dbj&J#be0x|=R5yL1NG5cjxT7ty zZ{m_|*^RpEhRH94U%G=h%o%9)3 zZ*J^vALNyY{eyO3`Lplv_SD`YNb)69;{wIhf|19V4&?`*gYNg>024V zHQQ}29ZF$f92W{TFSM%cB~WFKD=s{;nU6F?;u}Py9Q(nOUDT0kP7}>-1$qvahxqz? z)*j;X3`75oe(h-tIiz|ATms<+(=S8|@lx`1^&_*oAso*J)mJzoS5+XCvt;))~V+AYFS}TMAcw5|?JE`G>dWpBU=TYf{b|w$$u3{;NZy zspgK4S-^<+bY2mIk@5ViNBD&BV55Vz7Zc=(3Fl$PVPPCgiRF#?=igTyQJQ9p6YO>D zOqvhXshCrA8O<&e&eYnS(iE=gzi;}98ADo3Hmz~y!ARCq?BA2-XX>vW|HNnQY&pwL z8#(sPKXEwlIA6|O`w)Y5pu^Y?z}ZrBB`r;};BrD;r@4tQ{qr-E(vE`@#|nJA9tXaX zE>nxF?hswT$*Jij;pCX5{_i+Bhnfpr>DKj|5Az_^EPJ;~L`_m)$Y|L6!$1_)vou@6`;O8@LH^BNcA9r{Ql*li(Xj z>X6z;6pX;p94>IHLVyNTUs(KPB(Q@HdPi#BgkzA>UL3YGybYAe!l>jC?bvcwu<1*I zB}TX`K_7c=B-L7lu!a^?W=VrbZWgF!KuRBx3yenFvC!`zp$b7%sE&dUcA3$$Rtlsq zF>Jjw$as+wg%L8ku<4Wl?xr=8X}I)KxD;VSDMZ<%qYyNg z5oH6FldunIz>|XfQ$!4hERtfX+RM(yy~c;LvC!ShH%Ix?+M#u zrv+|8LFg5S)Z1Di$Q6zVz(X>+63A+)`Xd$Hyl`?i4*3R{3Rp$hAs2~sp+|;@0#DXM z*gGFlEEI?=2_qc;6v_WPg~$MePyp^4Lv9&D5U5a-jIK^FdV>(0brz?Il$eVl7zWo6 z6fJZGRs9jbgc#HzK&t(-5%u^An<@%q8xba9VOW0?Aan$WBIN2$LJ#&55Rh1_iTE(k zMPcPD++BlW?eJj50@&X(*d+$%WWlUh+#H}-uqpyvco2;!{ZUx?1g}FFj2U4t0Yq7^ zfbR&Qh(Lv9ZzBFfVHr23u+09!rEr?ueT97jUQG)Xr_n0^4qh(-#br{P$#7uJz17D} z@?TvyXsKMb+u+t2Z){l^Fayn4@DCs*teeO#9UJ$0I6hg|&+~|%K!T&1+G@T1XQu5F zUkP(@hIHc#k;&ODASSafOwF*#+FxHI=AjY?$O7(UD`9AO=5!+WrEVo3 zd!Dju*A4ZXmE&E1FJ=(b%YlMRPC0_XaSVJ3aK3Zk!&2{K6y&+mfRUw;9Hly}!v`2e zH)NRX{&M2AX)%a3ekBgWIn)`!>Z%=qJnTjsee}M}6|Uz(^)M>eu{5&e83VvoBcNP~ zO`agiH7tI=G*gtmsfbf3g#WdfV$X&H5d#Fs)Dgk0NWKUYHKGr8z70{I%L`G2!ib%q z#%6#3chee<=1QT^5Xb}+2C>7}(*g1z0E{tbVc?M$SZorYcqkAX0BHwMK!)Ps#3JfF z3cLTm|ojgh0kGC~JY0RWCiedZj<#RBrS!s5W8NHqgOct+TA;7pNeFkw+nfa>Xi zmpwQdUS#x=GYDyNC6F;K1Y}GBG0^CR#J{sR)X1!UXL0ZdSP=~5x)NAX7qaaCkF~de zimHv?#Z^MOL{dOfi2+4H1?lb%K|nx|8c`&qRZ3bEP(ivyN?=e@R763fTfiU`7?5tb z?>Xc5eKW)T|LdgGn=2Bwa83 zFTwRA z&>!_d3hB(Z?msplG!$Dz#~30(-V`Z1Rom>eJXMfH+o}+xt#QsygEQBFEE+3UA_==d78Y<~3rN~x zI!)tEAIujee@iyw;3_~j>h6H)p?>A+*UHbk7z)&zRohooNzJ)=U1H-)5&CbnX`QQ7 zNhMX*zbf#$WD6iO8dEzcJb9)kJC?8TDCWTyU;*H9pECt@A`NqF$BBKj1&ZQa)nnP@9>w7W%YPmGwp zq&DZcvQzWvibY<1$v)NNE2`)LF1>Rh_NCmM5@C~c+zS_#?7%uZe@4OW-KJDqR%S{)Lu9n#FkV}*`y4TFm)VP z1ckuKGRm8;p?@G55rlpJifXtCZ~&0Jh8&c8@0>Akzb9z^>*|rw7t2e?)BinKB;V4h ze|>vldh+P(@EAY*lMJV+{^X+DQ&f-rv+U~n{jD$=Y+NR{Kn9zm=o{vp|75U{9D*{~ zpq=0hHpBgoa5LCorBQ)1z?data`!*XUe@D-v-j(yV;(mC^P7sES>N%e(IcIak88$8 zcNYJEpMJDN%4|1HiD+xLd-l)n_O36l9pqq5OSKBn!JGwGHp}rvxR})~09E7E&^OCJ zq~B~6vHH*N9H4}{pYs2GVtFf;;Ok7}fcPIIbOgYg^KYQXlMk~iT=mU_85K4D$!PPi zOZ;IM{QMG=;bvG>eMtZ-ca56*qklBv;YafFKQ(|45BQt5$M~PzF+gcmeXRWdXZQzM z0_dOGld~2eDfhmM46)P?7Jc6#?i_VYdZh(Du7{poj^zdXmzu`q*cIlv?d8x|wQC;^ zE>4L2JOIRXA7D1X>O)h1`k$wxK$Yn13JS}PztXy^bXS?o*9MfXHEDeN!Rxj#QRBN> zw?0iVw-f00&3{2-ymG}P?;3h6s-wwZ{D*9EiRZQ1JyK%f`lRcl4Kwm-SAP9qcl>{m zxu$t-ohh=pd6J#OJb>%#7dn}>xw)~1?Nqei{&Pqo{(qmQl%5apqxyRe38Pe1;z(AY zPzk|YkciKAY5S1X4o}+1{YEr3-NowKy9y%D>z&>od~Db-7$p<1HM@MLu!h4TtjAdS z_*}JA6^r5K&%!|IoykBy|J{*>?G>x`l2G#NAy1&=3Hl~1b&hRU&EIPi551*ndmcP; z*<8&%=C?ihhPo%2IG$?Hw9Zk{F|vqE#&*6T`TAgbtUn*gBGsPez1kq|lH~=<*gx6- zz7SlCI2!~KHcup2dRRmQ*u4gd)D8zpoR?xO`4dpmWqc=1Z}E@eZb6`Yxr| z?}lpR*Gdff%3*a6-jOP=+NUU67B)bSb-j_5?-H@zjS~UjW0$}{h$}M4@zYCXj`fp# zkRnE~4);Z9pjP7~&e?mxEy+ngv3iPKT;zAH*ub-VbsOWqy9nS9u*nnA#)xei(gc$l zJ1jL-yuoY5weN9`zu;KpYsP=R#Jpc~OZ?0Lc!w8)hV5JN9|J{=VDnH9P_wf4f&jLJ zAdv*+s4tG$sk|d?@so%2H2LAYG%P)#mBoh7LUMf0^|;ih|I3zIU!%`ke(1IA&!#Oq z>XUzBUzmr}UGIEeAvcWEr+=0V=PhpnG3c47gWG`ta-H(|HUv+6wpblsrp|7W5U7A zzQ}XM0;^d)OL;(@HJrCFKy-4zFVpKJ6pMvC@O0%fID8{b=+6zuDgnJG>sls+bI=RN zqB=Shr_3UMNl7%$9RRA!2b?>g3)UnA*gTXNFN#sb-p>Nzvg_~?UM_;F^R(DGVL*DS7DKi~952xJMpmrgyu8k~Xsm)m z7qGc7$7qgoT02lyybwoypzPokykutGHb!_STO@Sy0qxk3*TtAhc zFp|V^IXVISsGqTDR<(sQ4x}trKOVr|kDUNL1>uj#g>AujAt4&~^fh$F;V?zcz z-Ag8E7PYtGa|?4Bw%!dkc_@5o_cTHGCrQneRqwuJsp;kki1hsGdNo+)q4`l>uO3Qh zzZ(2b_3wW5hH}By^l{a!9_506gA{NkPb$1)EsFM~>gi&@r8k)O#2&%3-srbdSL`Vb z7?2~%@IsB?7d^bm$@NGCmd!zoPjFhoNuwb@5uJ$B69{uNqqvb6OhxMO$91PO_#xiE ztO;i-lCo$l>4N=x*hS8gia{J(K~!$iz~L7#x;AdCS>$)UVTKzMfE`saFIR>K@61ee^ZBacL zKh%s~#-5JA2j$j^HGBqnbGFfYH4GBz?h#UV38X6BP~@{90I5Y;i0P)&te}u2P6Q=mF$K zR&in>z|d)*^N6!zxgZSK>$A9ba>4Ub0X$8Kr*OsrUPEwB98Qb}qo8;cb|vVyX@y7P z@Vtlq1Q+&n1GMw46o;$9ErnFL!)tzRCoVd{EzWHWcz6}=i@WW3t1caHWF}5eU?OOo zha(NZ%Vr;5jksL}x6I%z%z)#L+Te|?IpJ9mTSGEx@!0`z2aEOYw;|ZTw6>`i0oB z8CodLlUGj0Uy;xF-XJ%<+@MG@LKTy6yu zc`Y0l1;HpS8Y>vEPXH25m*TvY4c4|uQT(B5=}IKt)B_JxAW*R-?%JQqyKvtkkREq} z2ORQZ624>4?UN_y-6A%3LEw|XrFX_+#J(a%$@sI>A>65vu6NzAEsnW#yzy8GRwt2+ z&#;*a@N)UTaN2VGxtkyg#}JU>x1;eOrNrBI0HH_@XNC-BIfMIre*j;rqJe#rk$qD@ zL;L`1>54aT)bX|x!(AN!bXaisrIA-_iLA%Y-k|}~b6I1#1Uzg_JJjP$bHKLI_zGVB zq;pz)ID}8*2v1oq{XP}<|8%HU)yJ#SyN+{#ZL{b)Wo!;W?RRV@x(!_~{ zU{GSk9;Qa?1Sb9KSAF&EYv&(J{(s~rI_HbV+lxyu``nMc`!r!N+Ea%=_~Px_gI#X? zxq)j^N;tM>L)*&S`18tT+!Zufl^w+$Z2%|D*dlP+0b7i?<2=~e#icFqQ1K`D8$zA9 zyJKKN*z1iGc)(m;8GjDs$b#)4P%>wqJiOWHK7SZJ>-!ETSD*9*r6Ee*otg;7s{JL^IzP2btM$O{3%OpO3!? z$kD`)UnP|IYduRZ9#O0q3oY_Ht#LpF9s&Fj8$_@#adY2ZlsL;iU6hrM>z1z7*;Vi-ACsy#D zsQI-Bj^Iz9dVBHjX!XwFJck3j8;rOU4?r=z{SIh5SQUTMNDx1exK86fm;fNU;u1>R zJCY55*Cy8ycNOd2!iqNy1M_^`M~7gcYq@`(kH56^K;efPW!wckSSL~A&FZziAMKlF z^z7Rp((1*fJb1z=sPu%~cHxYjhvF3RO>sb@@WVLA&$9`bj)*g4X z0ItJ#1P5l|+xsJwBd%?9ygkZrSB>C-5dNrLLXA7*f#sgf68=P^dSBEp(Ehits`Z~z zXTJEn9-eQk|6LGk@NL@d^`^soVczI!L$$>hZ;&~lT6ySn-$$uF{*Gx;<+-v7u^W$a zgyRbHPXBq`o)PQ+jGOW|FWnvF{mW9l9}kZ;zvY4_ zU4OdA9~tA1JY-UJArZ+%>FAuj7y4%ERd98QaNM1w52~@tbX$Fd*WHA8|8x|W&D;LE z%aGA2T)}Npb)Ug^Jm|8`+W9ahnw!6lk;O4&PSCp$UsA|D4_m)TC>YT(#qQ)qDHlLdnXPo7{CyIen=^G1&($CI z-L_a>f4Y#_WZ@nrdLuaU7OCH?^K4f5%@c%ANQlgMUiLFF*owwJC{~iVO4e&@OQMgk zL92+-Qt7I~0SDunW#%~jpdQ%KW_eBx0M=jvOMF>k8qkWtUB&}1I1 zTLwv~G{*G%0UgVGbjDmEXW|-(LY{6TJ?r}vg($M<)Qsm{@&z+pLv|iPpGZS z6sxnF`PjJ54RR^u8MuUU_4p(72R~=rLn%AF-cktlPF+#k9ZALXT(9K9m_ z<}$qN^le%w-A-pmksR#rXl7?AoXaR!9r)-;iBO=RG%hK7C{*$GCY5)Mit+hA)$O8; zIYDsiZ4>+SEN9Q4m@zse@ezvVi?eD++08!;ZgcdspN|0njo*flSjbz@u@sMbpElG~ zmN<3R_w`m%h%Q}$z@(`j>vY4wH&0TnpH=sTeXlaVKPLEHzIJnV2%=r59L}FEf)TH#g6wn=Vu0$zcCYJE5KNhdes@@xU8z2Y1P{ z(Pru&cQQKB11?iEf>a8=3F@WiDJDLe-ehv}ayaF;W<(;@&DGmRSGXqsEmi&-yG^h4 z`wr*)J#`mH6V=DI*&0qf+48p@*34^t6p5qD4r8zh+w`GW@rW(;h)8&tp;V60KNpg# z4}@Vh<382IP!rM;%V0Jwsq|GWOgib?hg{P*7V~M=_jdP(Gt?a@Dka6;*jXq<$~ynB z>sydk`jQpgCK;JvGGk-h_|`u#{aJTUE2Hw67}tk^(J!YLJC`|Me#r~w`=yYzSQedb zn_uor_*LV@D0$J#6r0x1HbhnqruB-|Jg6h?5hoESq9!A_tyV&?uSDR>bHgoKm`dA*_#dxg)8Iu252e@R-d^JhuhiaHE;L zg+6zsuFK&WCT@2Z3$qu*;dgwgR;(PJNQvvPvXIBN)yBk8k)oqV{F~(!^yA!kQRh6P zQu1k^Bh?)&99_o!$c*T19WrDce))wT4J)f`&fv-b-uj-(k#x}S{!K}@M`dhvyq=oM z4S=|AF&PQ$tbF*an;J_ibQNs z8j;#YWzx2aG*D0D zj-P%bQ3RGVA&Q(GqKv*5NiTw}!^usCAb%)5tu z{_xM(=LFK?(o*1uaF`QKZe_3I{G2hxrA4H?nNvHtu8ebymGwLIgo#evs7T3IBb~3` z7y83KDV}5d<@d+Wy*uNJS4V#A&I()AiT*7fAlsFjC3do>xP;tGIJuuD1q45-|IL;Ka%?^NC(RU`3aV{>V4dr~ z?>S2Ut9mu3?P^ZzQWI8cE!InpW>}YkmmKG?(r_ibIQwr$9M_E9mjCEoO+p;&nfdjd zV>dG^?40lNpNT^Gc`>YW{L+H_t|_(GNW^++6k9G=FtJL_ zJ-R-aQ7Gb-b~s>_Wphw!xt!a?N?Yb|fcq?;f{ZU!$eLFD`IE%&$bA2&2mDQyX}spqSc?2=%h7lwskYM3vbQMSm>ne?VPjn-`Xx@4BVM%-&+r? zJHHcKlD1RT8u)APnbqaJ$=^$^Rsky*^L4kEO3>F=C%PHOE{{z2 z8tl&G)iB6h@ZVVJesrS7awB%6{rpzR$jIfL-4!%?^XGDJVfP4!*neR>5G}O1vR6O*m_x+ZZMXOL-mcGMUH08s*Nd-a zr%EhmeYPKs1P1zV1O}d?@OW)D=zVjye`#cDZ+UyuKyt6W``Xy{&UB#vOVsbq>fJR7 zDW~pvXLLj0c8xW2K!dcChp;m%JJsH$Q0tQofoEp}{>ZHE)h~}lch66$#BOFSj_s96 zZO;2Mx5{Ym4RGxI+>EU$9G)wQeK&!qeH!lxvbR{tYf@5!%ZDDouZ9narLbqku$h${riX&@*?rc8P zW52>JYInv_#aX|;zdOe@HNICD@d&^%vKF`SsDXjx0moj~=uNi`lVXm0V|!V9rM^8< z+m0$JJAWFAcmGVhdo&aB#dUkNNvF7a(|62o=g+vz7m?Joy}FnNZ~u0y?d)5lujX1$ zOa%`6Yi?~XYy^(pXuKw3wMVeGX(i&dz115yX|1}trM?=9xV#w70+^>h3* zV%nbcXsr*}t(w{MS^r~Yg=XJzJ&T@RxV^cSd~eMpu%+8XM0j^-;881iCdCWDGb=IDtWhb-NMU@d&o6FL)u+X zW?6PkXMP)PwLx9yIK9=}64o%%dae6#kpv3WIGZ&bv(hc(S6Wb!Mut2ReO~6Pcvtc% zpVAMt{6o=af2x>rypU^fUk^=kdn46xj-LJS*I0j*GT*`+2APuNQLkfr(W2kv&}eBB zv)W6~*lvU<<JRA}&?7e@ zQ0H3j9IkAOKt(embA;XnNmDq9izO#%wdL9ylot&4xHzGT=+#-BB9ah}ZL9uAO9cn# zR&x5)Q8iDlnHLAV9zB`)Pr-lc4a;U!WaQ=#KJ0Umi9bl)Vy0DreC6c3qgGV2=(85t z8~0q?DEYZoZ?2O;Wx~yo_E(`=DM6whogyI9;N$4(Yt`Cb!alYc@XTs^wyK`! z7o&_XX+<`ob$C>Lsl3qn5&`;p>oRKX^Y(TbO32lhqqBYf<=S`Yw0kYC6IF{_L5XAK zYvTF!Mq|%id#k2>BYW3`<)og>d+j9rFke7^F#LpSdx#`&wI1_3wl?u)Osnu!P3({2 z`0Lk=Jo2gyMhfN(y;xt&37_c+LKSamgT1MEza6oYO=qj0SNZs22-;f=3Z3W(Ez9&Rn3!=JP9uVY_#t zh<8B}C;us{)rrcC_YF88-0zWAhWYWJiQ>ZUHn_aGJ{CA(c*?eh=!Mjnj!GItDJ)b_px+}QI$ zCXzYy@FTC+u$Mw5+b$-{YjUDermrbz>D{+WxmHtrh+VVy?C@zr7wsp87|_LehgWk4 z>)UmyKU6-oHyA-?F+Z2=O>q=g8kUPdZ3wWMu@-;`fq{IxmIjjG}LFS*B2He}Y!aoi8`n$T~uX_KH2A!@nTufi{f_L}l_~7rQJ&BE(s`fNX z3m>=5>G2=KQzi8Qo*pLcU#wCrcgLpk9`9{g1b%Pq^$=;e;J>-kB>8M-byH{W`(~h( zXM0siz0b{?gD-Sa>t3yI_U>)8HU0kmXlW0%_34^bnsnewa-K*kT6oJ!M0@Y&%(Xq_ z&vcle{kX0wsiB{?rW10?X=zIqX+8; zZ>~>|`ERF9=`_^sO74ODa7`P7pJW=&Z>`SPq}6Vn^XzZf{UlR2+q=BIZ{noer{E|c(=J)iomZSdw)pwQHw_vUPJgVj!n zPU>f!O>bu3l-3)l7eBX`KW&^!TUl^f+iP$Ab7Q?-Jl>i~nAO{Jcky>qze!)fj>zuL z%n6y`*?y6RuVTNSm(izpbRz#oXfv=$p~Ky{;hG zu(vaFFfTwdi4x_PEr~J($i>34DWlHC74G%Zy zZQeGQt|NW2Lv`!Jk?xMP+7kzV347eXKEw z448`gpea;3A{x{yQ$n8~DdofzMax&-TOGLPd8|7BXr&56W#xS{JzsY{NpU?vr&uAU z=1*PV+C{JC&^@R=8~O43L$;AaW<~n+mCX#5S#{?!SAS)q#0zN@p>`dXqVuJy^HUD9 zvO)bI4-?Ayy2uUN-=fG|9mqt{3)aKMt}4BPrHMTH9jfkGK_=J3Zr-DPu1-N8Rsc;w z0!f7u`cS6`^h8!_>Olo!M(&9~(m2~_cCcG?B=)v2Lzm`}MiFrPXI~tJr22XFX=c6@ zD&L|MfMwnhL(mri2`yn}4s=2|MUKEidsckY=wY|&8S>|LiWPQpuH?Dg!*0w#g3gZvG@_*qcKMD(RKB)ut`=%cNM?XFD zix}Ddxeb!)0PjLRjm8Ldvl0_+67OMb{h|-X&#dGs4TO_N>EEwuF(GY0s2I~Y1duz3 zH6C!R@tlppaQ`pNl5NjVLjcy8F7QIM6$GIfz}@R!49CrXA{0d?h8bDmaB1`8zn^?T zKp5Z?H1}Ye3Stzc!bHK(eZFw?xLNtvShRmx`yvIlbdxAXw8M~7cPgRBg#gdo^_(+c zlvC_`pX5u`=X;RkW4W+4F@a~>oE+n`PlbR)zyU%q*qM^TpD2MIsc^R=m2Ng5!huuly zg0LDyX|pik(ZWu7PcgOsjsb>$Lsi9X*nVcWD4>w)IZgn{TVtAY5`w$Akra*|DEC5o zm=g}6aHK81a~%HKCJr7EihAE-Mhrd>M1TMUe*-KJ?3m`s8<%0{cu@p@`_l=cb9H_t z7d$ec21Wn+FM|Lq_vCrlXUq{LaPjWhOK`k9Y757F!&ZzMf8`!(!UPR~Fz7TZ((E}L zw{k8)Q4j$Qw6J6~n1PxtvJz$|D(0{4yD)*PI1&ugz`5@msoLa%i z3VYUH`*36Q8xjI|gIZ0wfOTMSFNVSy5WyUb(!iR@ZJ0s8sUHvpjNY>iv`|QGdIW;K zMTfB`6QN9>Ws_i(rkvUHy_gKC+iJysY`cY)e zMGN)glex0r9`n+y+fgWfIIEJ%6lW|H7gHGLszx1r`PWZ#0y#sC@r6Mys{($SG>!C6 zKWQA?*a*rlgBz#m+-%1Mjhx3nedRjM7(OX}*vD4*u80x!+1K&14w|%aLUG&D#5UJm z?ovy3eX^qrz8vkxm81NmlVIVsVm+@y`lm`l8}B3qo#KxsP9$fuVrU~(>iKMc5p$0f zm~qDrtNzjfNlw&{KkymPkRiTz{Y6|lxt~@GT?U%Q`%Cm)zF5ScxX*FT>nsO7!!Oc1 zzo(L-`K&Q6C`OocxmmZ8$@{EIJ+BzuXFC#Jv}(UnD6!9Y94#{o6So2Zuc-JbmOD7nF_vh6L|CLzl)7ysShTe;u7=Yd7_aWS^_Q=l@}*Fm<)K5oU=nYxPRJ+ zo$WbVVD8M5)Gym!bob*E?iIuEoEb6ANRcAAvJedhCrORT~!(mwSZaduJZ`Fp}%s zSp>ZFDsc<1PwT%|37t~UzR$s}*9v#Oe{ZQK}TUaFS`|Gk0zEo~CN&WY+ab?9U z;gkIO(jsxqvhSJW{!k!P??+`s$N4lUPw&tPtOMC?vqNJkA`?_8Wt5%P=|Jy2e|Qos3G-Wv;ASw%Ma4 zpwVEm-H-Q&0dme)*#jczw{0OcIxi~_1@egJ4qWuRdYSj^EI3jsBbG<>=`ohelx>yD zXK6NMxd^;%v+tF}k<|yQuYdgZm8qb`Ia@#^gGfB?`SxD>=$Lr(&C8B8zpUi`yxVxc zP+TcG6HR-3$13M@b!LkJ{|GbuCEIrWf`K2$G9HTC78 zghRx<%e3mpt#u6xMUQfZoXk$T$nPoitw7P(AmY(Ulq$cNIkf~q z1wv5blnN*zBn!S|JZ|CTS_GBggW8Y=U*4wd_NcOa0ZN#0gA!=)CBny-Swa$%ORi!)ONBbXj_Xw0f@!~1X|7fRqgBi>R0t}g}IeY|H!H~ajjL@$cPHT z=zOZVbhxYk*Kd*CONIT^=L64&@!?*v#{J3q;S zIld_3Kn3_j_M|xJ<%bMetRFtpaj1y7qHtNdM;;98&=qS%;Y*(U5Hmq16JA$c@=D{L z$(NrQoHD?$W7KpCE>_s(0T=N7YL@O1qI({nV`do=QMZv zD2KAuX&pw=EzoLYa0i-oj2+c-HAAC*N z2&#nCzIrR8FM6m~%@iY4%+(;Mdryy4PPn*S0$0zFUX29eC}=ctNIr$Dry5++vA}&~ zS2FFMdlLcVko?{Y zkzug&3^BO*MV7qcdWXF(H5Ir>l&6Fxl@f~p`XR%@4uG5XKR97|<<3L$9sxiA)sKFM z3a}N(-vQD-`T>B?@=Vu+j2fLyanNZbpH0~X>MW9hz)aG?Hk0fiq=+Hh(x5>I)Nagq z64@DIh26mgEYt@JWXaq=mjD0ceSe8@7^0 zDT4z#J^E=EGh`ND^=lBQqy{iZ&Gr$H0ZFIppqu$HO_2J*kfp!8s)UsB#N1PJg3(Wp zg|yb%WJ>Rg8PY##5Da1U@J9YhR$_z*Kn(Tc_<PS9o@O_-w2OizEQcY0ZNvqVpTVP4asmZ0PTO@&GViev&ZIe^A5? z(6cy!ImC!Wd6*HbXGLX!7pQR)01KOwdB9rgAAy{@@9sxNa5EByURgI3GTf^B*a1MG z(?5D4TBgsjnr*2t)ji)AL7cSxP!s~h z(ZHC|UI(_EsjrI?`@jO35t4^*?<0SJt2U{iEH6Jm^e9z&y(xnH} zUHJ!W%S#3N5SMU;bMJw_`&WKa*xYlFI4DBi?~p;>prE*g>^e&f0A(0*P49~}g91g& z(9>yHMv3=KKqd19YREm9K2AXfmV*tPtR~F}jEKGo$8RS7bvR7%r9d=N{)UkX!|=lx z$oMdjxntZr4&xZc0&k(Plnw|1!hsyjzGSIh2vtNhY+p4@;L3gk0m7!t1rIP8;A$to z2`0`pfqF=|Ur^|gbdsEg;n92!`%nZ-(@8~IIEvj3g2PvaJ252qr%A{ePGbPPU@#B) z(m!zW!?6cnaM-MJN^saqm}G_c=5Q72R6~~zik5una}XO8(G<`y@W>Xj1+}EMdnS3S(9xr$>R|zAq zrlO^2I3~siD}a7-vcL!dT#KC=iU|mJ*pJ`6T48#-LoDhshPd`(fv7V8*)tTdaF#si zSMF-$weLewdh0$4WL~NAuWp^7;J)S1@QN|?Sk|fWXGHh8f;q3zJ`k+Cb6NFU`=NBD zgYHbhBIl#tG9HU8-KBq$V5A>%O-k^6i2UV}fgHcU>Tjm5^xa%e~{q z|F$XP+tc#5*JuwQQVyla-_j#tBev5cRbW@P{+M;ZL13nY;ks{+6x_)mJZuoIP0uSq+ajQ5mq5?^?SX#2mUS^%R=)c2G80Q`^~+augLCLk zQ1afVQNMD$kV_+8?<6NU)$SNE|BI~PWAUZ70^h^ALQc^CF$h0T&;KJ`=#gQfnw||w zLAq5!sjZPEpZewW$8SGG^q7oqrGJ#+zg+lnE%W1=?!E9q@{jy_KXo%nl)|~P>6mnX z#1s(HM$jwj8mkEuW}lP`&U~MlY2fy;C0fCoFT&3x^IFEoHN$b=>_fMVepE&j866@} zBBcnXYtrC7l}_lT5Y9!M(D<$ls{SaKHdhY-}`{!$s;$dh~$hH z1(_W$dTs>kCuSJh1=B0*s-M><4ZlNNV$XQj%)Hp9Z%rl zw+=RZOOioIQm%g5vB{0U{uSLV5~A&Ru3Igl{OWhO62x-ibySHY^*_p~&kDx9Hsm5u zzakv}QC1-C?gOq{>Q`k2=JmJ;3KWUuNq-i3t~*e3pOjGMY&aQr*HHeJ(xnqss{&G^ z3R?rs*S&B0?Y?_iG&AddvnF6+X?-Q@#4TY5wsOIDJ^eRl^R8EK^z==Zqdn97lSCF8 zM=OzMOFGY>0>(PdpsZ_uGY@ayTaGG{LNt+p8^-sSqmV<4J|D!34oKO$YSK#CI@c(* z4@_3)UYlimB-cJ*{tjFY@pPR*Ev)}y9yZkn6%<8(G5boAfm&L`Qnswu38ZXiLbTck zLbv3>f2T9Axzri|W;RcT+GP-zvQ4%G#hjrpl}YZWmPK=R15t>6F`JjjfD*IhppDg# z)H1L*``cgW(e!IBV5xTo!LNTOS%>Z5LgX(SRlmc&{dFHc% zTxcHUXbz2JGpcR}!B>c71T-akcLy}=+3{BBv(M=o2?<76DC_rK&?56a)s?>J!6*Eh zgrFL^m?aP&xfsC>eq8?Y7;&~nSn3<*sFBpx&onVoTXgdzeHEL7eH za!B3mWvDzGu@JP9h@=R*bjCjG!F#A&7%gnNnE2a`pwH9g;fz3nWP%HqLBpPJJ0L*@ z^}Z7U028z4phi+oSDbSG;6fYG`c_|7*t~1I|!&r1lC6|yqG@t$Y5GzUnT}vw5h+Q zfDHD7?F|H;0fGR+DcubE4$Ra3TK)Dx$m+t7p_AE!Aq!|cV1TR=p#pgg-%*GN=qMF( z0E)ee7ZYgF9AY@dP`VTa5C@^=3*AdzJ`2s2aylv@I`i#VLjpI!7NU)Z`;h7tg-jD= z2zbU?p$0GqwL*A=ArZe}MAW+ttrvd)g0Yr|!`<8Gn8M;NI9T^Z4L%v9A_Z%`kV{Wi zY*6kn1I2xx(?PxJUC(VKAd~0eP->5WgmZ z%tdYubGljb4#3wo8z z#=JjtfU)g6h*!p752J_q7a-i}S;V2N-LIABo zRPRF;xaKze_~q(N2yp!lKtEu|EQqGI$HSpTwPz2k z=~JGY5bo@lh!sZ%3-n0{(v9{N+~-3xi2a8z!|dm~3}fr=@)Pn_^e>iU}Err1D-XH59|=IgGuUXLM;7a z*a~?hGp3t=BnN9wVA4m&Acrtt01-NBkVzHb$y{+k&kJfp`5OkbkKZ9dq~I1=xq-_9 zKRVMZ3U#fUNCINM{$mm#Kw`{WMW{u=WIw2Uh!adWCPxrhB^_?Uw2OPI2#rlo;2|X? z|02ZutP>o>5CQ(mIDP}dorwf=&04{hhz%V^Mtux)kKCC+=wQ7I$7}mWDafutfE0kh z*IM9VOhR863PARD^A~_vC<=_eCl4NmoKxijtOjQ23Sqec>UlDS!(=^@5Dvu+!)dq` z>klvpM{3{^VNef4Cmk_(XtIT)1O*wSoS6h*aP%M(DwVP(tugIK%|x(R^lR4SlD1<> zCFpX065FjCx0v-^>RcT}EB8cv%QrNmkVY|f? zT*8o(^06T08q@y5BNU;1SF_aT zZPG_i&ui8dodLu8gh8WKS*$6gLgoGxIb?}mPGRRlRt&;cRi3@g{6*CAk}b^Ip`qkY zTV{pKcWal1`IEBX;r8#2-8(0~qf-8Wh8XM*j?mN&a6O^@o{{s$R=b5&_mUGjwus~` zMbLrjD_RD$r06v^BIG$zhCGszzWS6`87laGe~0rz`CWor`o?R1ibAUWDh z`E6MeL@u2Z&2lDVtZ+MKqZ_c zTQ-P>mga3Cry?QYI~sY#<01F&&`?luavgt>ni;GVeCH0$Jxxwe-C)z^EIX%>KO)palAWF$ za>tCM`ohr>A(AQj;Bp#W4J8V4r}H7tk8-Lr++z{G$3n&XjQ9OR;v709Q&}b5L4F|= zmr%M~N2YwnJzd}9@t}j#IW&PnZEkr-3$u>Spy_hq&kqqD z5xt!eE8^qwg2pO>eXQMZt(pAbD@vFOmGVN7#xG)wUsM%7G!`-|8#N_1D=U5%SYhK) zVN-XBzQV>rva7-dw9z+?X$$&P66_l;QHBI?#E_uSWx2oI!|V^eh* zcZH4r%_7rbN%`3Tq={D=r)Puj^^K3kE3dDLXt$SG%6xlP9Ok!blPPSOT7T|RO+bJb z<=pK0;_oGuSl58!+^OcQ`I0Yb!ZLHe))#;MnBHDoo*j2s$aD1+^+5UGYqzZ3oS5ZA z-`!%{ZeL^Ci3zNmld1I!xaqb%+i!m=uXpe3`Zq}znH{%S{jZ5d>sx4B`xu#>nt6@$ z#fwFDra9#2ZI3z>rKfmK_ku;u+}o~0(Ckn0jS#eq(G15dbgr`vZOt^+1kKD>e=q6} zxaht3MI+CfgrkkTAR>W8`LWH(z$0s&CvX7uw^bV@a~Ia+hUxozN81 z>q^1bVw$m8I+=u5X2Ou1kq1zo1ATS|BH-v{MwH#4#39s`nGmE!-)<0MAj!JsYa4+} zV;}jjs135Qk7~Gj_6vb|sn|OdT@{hJq)TgXCG@d1ksE)79A!Dsmny_OFl23R{{oyR zZ9RP0!UlAL5F>@U`u*wQ-6A%W7|9*z!|wP9+%wNZ=wmfO^$=8VV2Iphr?lvdZ{WQm z4iwRegD&V&#F0J*@PU>zI}S-83giM!do6?3I8Z!ZjeXR^EUKcVmG4l?gm2z}5=odV z5zGgL`?)(%w`Jf|=`f@fDW>=A#}uH=qBB|-AkiAt4gf94r+!1d`l}dFL9z&@)Ic?K z_$dcAt<5D5U4cp-{{;2Wb>sj6sNhTo*V~HVfv#F*55R36!EUqlJ`B)|CTJ71^7|_U zm+!+Gs4es#04eqG8yLy0dygO>5)Y~oLk4+2bPovapEC-njvz?phcNTV)I0{@L7a#1 zL~GU|pe7w#4*u8V({LV0*-CB7}3SvK-IL!7@>Qq zXJGS+Vk9|%Duz*ybtQ+8ddi>*^)nTG3zEwd@DK3l*ilN*U*7?9_^UtqrDE?B4FGRw z%zpr0gRb*olQ}EFT(rw1qJyY);T9uAJ4i*);%8G#?R*EUhM&DA$7+~f6>1o89T-3v zv<$RCDAK`5>cP^j9tI)4dV?MuxZKTSjDP0k<5WM&3G+nDr;SNn zRYEOQLP0M*oz%~m=2V_hpK(hxHj7ghRhzHSHghy859+F(J=@Axr{?1*mMwb1KcVl- z@wyy7$DE^%JX!AZm!L8(U61CoZ-$A^SuVvBf4ZhIF@;(-HwZY(}bXPb3qt(Q&^Kr9P<7qwGi-SCS*`fBFJT^INe#~Mr#@$N~=g(+( z>Mn9Ro$x;P&_q|kM%U-o+E9&Y^1RwhBcsK)*`}r`?WcSu8^u5d+t?k(Q$HMoQ_tRrt*TBQ@idty#rl{hR$UG` zUqn0_xYnA!sQVYsWb^mVBbSaF-g0CJ=V=}n&R2{1u*fS*`^L2HdC{2e0n4DN{#4hH z2hk6vmLXbY(P01kclXyX1pfN@GD*EMS*eC$OQ`VEu(2B%yS&@i998rFh5TNUI{KP5 zlE!P@Bt8TUR;$3rr;L45i)@MGq1Skh*G}=6mVOVtb`5S#1;XVC-O}$%375u0|C%&` z9~hhG>Yg*-d;48bqI+?hG%A7<0`x~_xfr`h@IJmkxxg0 z!nA(=9{ctA>-+e4#fuwDI}~?4w}@YT`lq|}ZV%G=>50Z$P8}lFr^^Q){S|WY<cMIZZxE@JGN86Kv&IDoDRU z`+A;ZcnkUAw`j30O?mw~i6yL|Ui9tTK^Bs0qNZbk~-EZ$TKU8pT99ev8yCWp_ zyiZ-(@yY#BP1O$yGp2&~Se>G~yjafb#aUIro>RW6CwkYgDpZqQy~IV87r;zq>z z!r-;0q^*M!Ryw;@XfvdqxKKKHqxAICO&e;N68SP?u5eUfcka!nR!U;3cjqoC=5WpA!6*bUf zndeU-TuLRI4nYq=M6<=9WOj!fG!ov1&<@yVF97z(=xt4dAd>jI2=kmcgCRPDY!6g5 zhRFO~k~mN?EWN0&6zg{g>*}z<8|bx%=qi2MEIttZi4jIPgGwL+uGI#Ed@{xeX3P~g zKyC}xNeEJ~PDbzoBY;m;XH(zd&RdxvOh{@Q-hU5wB1Bfl2elx7ng*d`AE51Q4jde3 z?bY0+*RMo0n4RrKwOxHgU+LdAj3GiLODNgr#r!ke&|DkDq3kXzQ6Gm1+)D^UCRQ>g zh*n9jk<$W+z|JJzA-uLD023h+!+-|6DiHG7D#nVy*jWkG25R~tgwG4n4Q)iN4?tw> ztI$V7Cq$12?FoPunun@IZqyELZJ8Z7-a!2|Jz{!U^9$u|ReXDQNAI?Xd!h89i~O;5 zOBwAguPLW1N2$^qB0W}%Y2D#%lHcc``|gHkboSAD8v$=`53kjAdk42s;SsTOa{YVu zZp&;)E0@wui}w1<=j`+wa=ApLv=*!UUAfkRrCa8cJgTfoFIWeQdFs-YYv9pMZ@oT+ zc!_>lcY(qrpR<&09>Fe44&eoNp9=kmnxWq%#v4d9+Km>_}rUpV_?wKI9#) zESpp3mGaiP(L0gsH6nO&M(@oVssnS|TzfmBpnxQhc6k-Jh)-qfdtg zfAu*3_KQy2gOoi|mEHH8D=d58vuohwx5AR4{K=-v+uAQL95{JIXh^m}H!_Nem236- z4SIXemvcIc{rkoXe&N+r$HQ-yba$NUwnGM{jcyLzp0!)G>w}ig{LKIFnBC?o}xdtI)E%)3ImtMO{La15S3T*nAWL=EKYe^_zfNa!?cbJFW*4;xeUYG7O zR+#Au;)2LeEmdVbT1p(aTo8V@owER$Jy;DhkgehgLiVXGN(rcj?TJnJr)c;|=uW8b z2NBdX^?qJx+DG5rXoByW$FQ4xehhkH*J0!hM`BdQC7TapOjgkNJz6lUIKLv?axv=? zTGdEW@C>{`7`3X1ucaM?HHqi&K2$bgpQ?I_YgkO6A}E#8Ht`Xmx$}?Qg;DGCHzT9U zq^vobqo%vo@IyCCbf6fJI_H4|fcoREPs)oSw3u??E{3WVFcL_aiXo`9UL3)vQeTjL zfFzH<`c~y(uvxiMfg9bGO+$$OVnUMvqM#f?87Vd_?ugcFB>2$+oUj$`WiujSVzW_| zk%@$j>d<2&2rc@%_JdE*lW5kf9P%U(%f+k%|vpW>w#mTymXs01jrZzASP%xfgkprhOxUM*Hg$afum0-dW9?W2>1k_uX z$VCTjYCVt5ja?C7uS4TcjN^r5DZ~{i1SLgfFnI|gn`T2}U>Jo#_Ctj>ofudbHrj}2 zv3zsaJmy-{i$vK8KtotmiNSU1DMoe(g+D|(fK8s`&?I{u8{%broLVM@$7% zf|$>Kd3ee$Ph5FhY!l4SLQZze)3{X+&w&h7GOQcRTx3R2hnTqYXv#s6NqB);Bv!d) zf^>xghXLsx6YIvoXk^%?%o4mITnMYse@5=V)ox^fw4#!z57?|HMR0=)F`bF^Vrj=! zZ0l9|f2>nrk0!YF+VU_EW7HKMAqY)UCA5caz0Us_h9xshcvEe(dXN~2*A)mpQ%1wD zc8CXCIJ!*!wK^^@Fx6R2wN4KL(&|VSdtd2hcrI4C`P5P7CtXLMRxH)+KU{y*eK9n8 zUTL;f#%jFE^m4@vwc^gjYPN<-naLA&2H}}r^+!u42TMe$pQ_C!pO-LwBLxo$UYvY> zw{7QQXfFSPx9HAE>QtXcP3TS9q}qlL>$Ix9t_>~8qL&UTYQ5)tyCUhpt=(yray^4q0z0|hKCRtUpY+gz zMa$+<=_*uTL>za|XTwL^n69Q!J1p2Am0q0uM%q0s$~aV)KVbLWHm%a?omkZO2k*+h zN7Oq?Jt}3@nkBE=SiZaH;ZDW2qfD?9EPoTR%8^0z0e{H!`a{p;7T(!TKMH=dQjvU) zH(->n-r+#Oo)EXFO1THFnnMEv@)U;vkErRly#M3rh;zjeP6MoAeu4}_lD=K?b+;c{ z$Trl}@SL=>Jy|`yaUyby;=()q7a6uQk9G!}V*MS&HS5mzYff%qy!Krgzs^y+@MgyY z1$pmwbu?U2YzVH~y}7JBo`Kz-@3eL#w7(BM@~C<$YHtYN$sLNLXVxEjRWwQyKIr&@ z&5gUOg0ot&@|`D>((j_tGZq2QSv9URQSa;tS>z0%mFyP7&x&n-&3Yx9#cV#pT_7qg zP|?>eQs8uYWR>iNYL=flZ6;TDl&^}|R!XiLr58ySsLv6M+-I#g8k;lfs_(>PHcuYm zTbSgNk{%jZ|ADUPx_--sg-sEur6$`v?S|JxC~)05X*;VgJ-u!;cKzs=qES{c!#DCj z_r9y%lg9g%&GyB5{bwG0I;MMcVrL^(+j}?mJy2y3HF&u`bNT{9s1?1!e!ftyh$gOC zecR(s5vgDJ!lL#W+MbNPBrP9dP!`c-Z@X5la^u3P>Nnls6V>>BdBc61d*+`$Q6nzS z9-!bk-ApES+$ER$eI9)%_`xl@p}JqUR?;v2sF$c;e7Aq1##7I*!V?c1cfMA4thC5{ zKL;mS&ji(4eF~^OcN6X(h5Kc!V{6OO^WZ)^+;3Ne7pGRktx5FXFKc-8Ej;R;squ7N z$r7$qQGxvEMYXZDdt9$~%(#31c?uP{u`Iu1rkx4}Uh#usx}~6)@d$Xk$`~4;abvjw z?HcHQ9NhPt5qz!gbM#y5;+xHHYZpJFy?VP;x8{*LLgy5g68+j68*@J(@aNlulRtk9 zY`I(czO~@FsCM0tdsnhVFV@v-oWB3-ZtnZm+}K;+T3=NrurAByLxC@=Y0M4 z%c<$@gRZlhzvu4X{r>ewWAjWUsr|r{_QkO1ssX1jQV;uX^PR2_ZEKq;IQ>0TNk~Ca z;qm*5PY?Hj1F-))2}bZ=^}nJ{#?JXGJKCba`&2q!I@)395fq|fsPJ?|7u=Y?-Bv|G z7#AD}&s)J%{UJam?Rw(*o+6*!$zxo|X}A;l>Q3Gk6T-0+6ORzeD|}h_4)*uv{uu#f z7o<-hUt-O8n;ul|E3=2I!G~A!0CE`a5Kd4;Uhv>s{?p3z11tEhW=6mTJU$OGA9J~@ zw;&H?j)Q`zGJm}@sJxgBbm#$&&GE=h`;}QL@(Gsw%1{;dn)?T;@l*Ui$`cL--`k&7 zvEXIC{YVTEK+z@7H&qitjkn%^ZQxbV%3J%lU2rYxj#avQy6W9H(sRS>s}Qm=QtBz4|N&1P6#7F3K@*9if1J z2Ame~|FxC0fGtY_iY!Wrid#g8Jv|9w)#aJI@KkGj5<=xk7U*|o{I;9;X7sz4a9{An zyb_XcuEpNF_e<{i=E{{WjU|8Ce<#>;kLQWbuBQ*U2Km1XbUD{>wR6Kab4~U@+9Mq@Wsw@4LQ=Ax!{nW3lq0# zfzka{h|nJ|c6#7v_e(F)tUGJ2nB8@e8V>w?#VX_FP6hZ9QtDJ^hZj;s(Bz|DXesoy z^fd53siK5J0w`Yfa=)^|-*<8RsumV#=U)|<`T6L097)kJC6MCyps3VSzb#Xg6` z5zUKnHCzwcuc{8-^ZOK09T+j+%h~jROy1%cB7EV{wfjvYe^r;B`nKuFdy3#ur_Jq; z?|O$;>bG9Lr_buYS~E6t>7>7Z@Z0UA+VVH7=%ZEV=v?AJ72QKe#fdo=^{0AQ{CN*M z>^=AN)+D+t1e>=685v_x|oPOy7MbZ1#I-Mcoq0(CeNFb?%Sz&KW z*c7#%Duq71G=Zlzft%s8qK5C^7r^1hB8Y=kb&!P%+0J%)flUMcZ~J10zKrk;$b>lo z9G-C-nE=J{Jm9Gzp^Nuj6}8`Kk4)(A>t<%%qvpS{^ww}>u$uo!spk&jTP3UEOf}@x&%JIP`XQ3Z_pCLG0o_?-->IgK{#9kB{xl29r)VB-a{)fDnJ4wEI3rAh zKlb_4oTu)uf8UGlZ1|M+qQgg5)3kMZ>tX{34QkbXYt&Gm>O3&N3@}qt?uVj&!zYa9 zEAxk4TqI&%A68od!^DbPpR!RF%}+4Y!G!;uNW1(4@Wpr3s}z<^s0@_@zzZafS2XZ* zE9$5bRb!vpSY%(B#pf|N#|c;g+K zFSN1J*N=30u8CDw;Jd)D?>m-O`_mj)NrOK!glX;{ME`Hfa@Ez; zWSQKs;qm*cD?3x6f8H-78NhNB|9TSH{PHtEf(?}K-^x6jhfG`Iev9yoLUbWAaOIC5 z1IrkD-&(m~=7X8DOr=FCgwvSlNikO*T*yu_?{Ne;++?axcB8 zmvBYCFBj?#tHLGRD0i5lYF;NqkYO5#<9Zqu0KSA^Vczcb)a27f#1b<3D{#knzFuEhlLnUzr;AuZEc}e7+A+R~=cXSM{ZvPs38s7Y=6iKVswK8EN1#{|(4+4iynY z)~OgduSpHBpp82ewQYzVM{u*c8qH#JumE zp#p|^w1TN4(Zm6!cc@C_(m^yh(qN5*!O5m&gJ$N#=O5CZ^NvrM)W$@$g>074>=mBK z%IXiR8qhL2i$(xwtGS9W^=s#EMvPZIcXzUO@^?dPSbvCLp6}e=pYyj&)mZl^8Ys(( z7uw$YE)mk&IoD!zPDB3tm&jZEr3K1~f%YA5!u$%fGMz7t1Y6d9T-#YIF5wdOraa(l z3stb_w*NUt!S9y&Z#cnnC{dTMp1$&MzIn^lw#?0m7CA?f4Y<#q^h-FOGSR$Yzk+>x zg^A4^c}_4{t=VM@)BBAB*Jl(i)SMIxZFRhT_DWpJTZt0|oSLf-^F1dE@5{VA5O%aN z%;_43{B%jJF?~_##p^r^c3B-`5A){}4t-Myym)q2!DGgJeQ%FWMMdQ-<38_Xxnjol zjD(TkWV?!n=DD{!8*2HA>@>ZZJPj-76ZN~^9=_rs=Mel^A^*qx*&7d%gUiNrqHal& zwwPum4xe`V^pl||FW5Bevt0H%Ez@R|H@xq?tztv<61Vxc#=ie1n#z^+&#?9M{0qG) z&ST?S=Xa|OgdFi)d!#1(=B{s&+XR}Z)?H^txn7Fr80uX-FT$n0K1gr&{6BBp&(uM` z`CAtG)f>GWsB-vT^C{Idw`&ga-65Bn>mpjYoH#hm8%bh-ieG0Zt3GZErZlN1S|` z$0%NngGWVGPW<{j80utUKi#0bA+Ob_KniA#=~<;74VTs?m}?+B@U1>q)c$s zryOdSK|FqT?=&@JBNU~5o3gYQl-SW@|j^|3!Ug*Px`5blC~6CY4H_!o0Q3^C5maDm$?o960|um1 zAMeZE1x??l*^hnSVrELL(5f{~($qdhAJ2w;1u4|2{;r67966L#JMW($O?`DJta935 zRS@!s+Ex8)$kyn@U;MrO7q>iFJ&Kp^;PRp z(38CVd8+Ik&OLR@Nf$-yMh0FxGetpW&Q`!s1kBS8{=vfS@UYMeac#Ca0pMES)Mv~qg! z(1WDAZO(}}IZPfs+a8Me5ve@l6s#vwZV$2mySLu(Ixv1-0lVI~osvhr^Nv6&2Zb5w z6xH?SFKYQMN%ijx5TlZ|PZ-!<^_`-8>5W^%IrP?B`<9U4uAwnXU1uDj9#OlrYq<0{ zOH;oL^rY7e6*BFqo}<34*x0+`U2Ojfn#J>>PquyOKkB@!G5FJLoe-vJ3UsDb8Gk=< z)X~F><{={u^!1=eMndK(w#V-eEP4Ri=YQiIFPL%NGWbx$P7w7s0`J+lClFZ6W}}7T zF0{3+uo)G{pPcpOZ@aIQF{_J=$l^mAkzKUB60C_Ev@HRUp45v(R$=oA|WCRO1(Ht;EQN4o-*bWJG@0fx;Z3zz_*` zW$rH#U~J{lMDF2?1rKTACD%s6)A=3>JxSdei@cfNP3*y)q2q_z+2z0^nw^^U3`Oi{ zUdNVP0V^DMu^wAIS72i(BX|OXA=WFB9-!!W27oVpUL@{8uHHPKaGZgOnmB60%PkzJ za$9V5Wn{;$?2`S+wmKh4c%w68D=}RgGV&%YmluiqA`@AIAmEq|946zw1{=A#iJ%o5 zMr1#a@4@z*7#uvLO%T)o8=47+Lm^{U90_8Lt=LUw=E!(u>Vj-X3N|=8EWrSt(kZu307cxnZWKzQ6!ox-YN+8Af zBTM_s>;}~GEW$XvRt=5hJQ)6g64GQe40Kh4$Y|}GBLj{SrphSf#oPtkn)OBz`4lF$ zuEc}(4n3`cdq#2bKv4ywOfQj%K${EuAZ)#d+%JR=AjV-o4sjJL74XCU8*q?_1wmv9 zJzV!nH57`pT-pJmG-fCbY%akq2#M#zW81VNi5;Q(%VdB-gFp@-29)iF#&L455yU~d?hwulDMpmIFLcS3>hlz*l_e0owq6??xlyw z%3|n%hqeXcBsd(DSJwKKH=qus)N6aWx_rEy+$zic84mrNSBG$JRhAL)zWUyE{dQ?(ojxf|oneC&OG*b9nQ|zK z&y4qu&@u~7wq{eF?@=^skm=EQbjGd5b`8TViLG0b%3Ivs)bDJMUT^uT>bb7>wLVAR z6#4>pPOpe}VHaqtBNn+DPRP(Q?_c!2HN3g{B88uZ=T{`>+9;j7CDR6?48BnwcGSZ3 zzWTIxf9XlzEskK|aU883w!S02jp@96+3ul){AqvAG^@2u^FOZieY(ZsU%^uxeLy$r z^6a`|#-SMIW6@SzowSa$RSlX!KG(|D3y?m(8LT3$5!=fbk+Dwiy6!Qa*Ps-Nwqkgj6 zyH#xK4&A$Qyen^dIwk0`$?xh< za=i6LJQp%);x0WGOu2LRojvnR5vSHIOJ3u}4;B#_zNV^QXGA(5|4F!XXR`P6u>aEV zrzpt5Pu-wQlt$4cS zOah;jd`PH*z4PscZsKC;*)x_TzPfw(-mPv~^ixXl^cM2LD0uH7es9Ybe9;zhWNc^r;mQm$&HOr|sY{$2+JGTWZS@A3G8q6r(zrDVO z@sxkakJ%r&Pt~^XdG+o6%kO(W?Yb;_>SRdZ$zy(DfkFPq?<~Ah(@fXsON{bRbX+<< zf5{~3KPvBK-F@5Yx2lIhSTVoFjNGX$3hnQzOv@jeq$!>{9pl~mcMR_0wr|>6Z>!jD z?OQGMoTh~D4%gKwHh{!9)=sm*Y>Qv}1lcW1$I`B&+(Ye-C?tQ8VmC`g}2 zVp8WEN*hk*RPC%R`WpUDtJ(?GE6ka=6X}-s~O5E1t6c~(ij!0A8rOFSha@;xx zgmTY&CDB8Rn~Zu`p*iNmjwl7k8JwzQPxNJ6NQSm|Ji2Ri4vD6?bgzw2zbP{<2nUjZ zH5>foZ3$T{Kz%joM<{v8hejl%N6!Z%3|t#0AQBP}R6?5Zd7OlU?gq|j5_14&7n=Bs z85$CwhWpG?i&D#Y&r37`SsYqwVbP_g9X=5WkYp0%{ea{p?pj1v66Y>y!am{gKgQh76rz@cp8HriPk)`1Yk=Ue32PMp4)&7WU-mHN% zb>0vi_>otxq6^ScPeTQqbIRLVoeqAn(DOu1ys3xBCY=dq-O*k=jmlMV#&L3I%aJ|hPb!xl zoPwl1h7H+JgoJTQkv@Whm4+dql5o|dFT($+MQ{dXg>g`JMSNi7j?|RQY2-ihca;Z_ zOp?mB>Ftg(wj=(SR)bP95hcSu?C4JH4 zCiqS&0_A?Oz|qm}hBRpG;mGiK!vQj*^uvPr0u6wTM_G zMvUlB?$F+fdTdPa0g)jmtr=%~iNX)oEQrFURpp2@F`(|;IPn=h_5<->9`ednxRJ}f zZK*}=xqcjVsXb;rf%I=z@~;n{T{_h&=ozf@q(5xNvad`ycGG$FKE;l(L-hgHKK=TO zjg`LMGOO}lS1b)X-c_|0_`0s`m>J8_d>#R7A1zkjk+1#9?&p$)PSMUwGHB$o?958B zGHa={J3k&}C@j`?T(PHEASy7HSIWoIXP*SCbn$B|r4^Mf8d09DH?_E;Vy&ZMZnbC@ z>^8DnJ$CcK8r`&yI`?MsHq`O5P2TLkYh+*_5W?+SS#G^MFvQL7+)G)Nf(3_{%#TM? zgiIaxF}>1~QL}q+Hz(j&LIjrppZK~T(fXTc3%4f8ignB0unU|tdV7#brNAiM@eUKvRd4-bqeao^aCZxPo<678ntaAcgTg=%fzSi4yOK6X2?mtdbf`( zDKeEE_R+Qa!PaemIot0!{y!brmCgQkWG@Np_4(0?&FWdb26Jrs@}9Z6FI#>#>b-2a zB1X1*8y}IA61N3zktSpv?CA_&wyfDowo@I}<}L9mH-js6xY~Q;kQ@6peF*%uzH{5r z8h(0G1WyMK^Oh9z^Xkiwi|xL1yD2LtWo}LOA-7N^sAZ#!gZ=g+WV^1?+q7%piOXA- zZ>~Cgq`9;sF=HS`0CR|k-=a83-TsklvNur*V?<2rEvalKh6Dxem{Nf1=!Ss&(L+=f83*hON3|4)&0qMNzcu_2>!1m$|AHiY(rvE{PK)ddyp*OICh^=kt(Y!x0_iIvL=wX)Hjw{8R;E?h z0*4J&Da60ws9uKC}&jW`Jfdb3W;rYDP?;E&TuGIk2Imxcm=DWdU4`<;24#)2y$#9-X3-<_wJUA1~??B7;pQ3cRaQj97Qeok8M4iqNN`u#nUo z!cC9CsYr4=6>ze|*^j7Z9R{RfWGt5s3MF`e(_j%Cvl@x?l{qK{f;V#GTIDcrgtQn# zU93tXUo()QANbM2AH!jYB>yuq5}|^;SjkM;i{xq_4<_ZxVT_(gEc)*Nxh_6~6F8J( z$9=I;l)o%~Gaf0Oo7lC&4(SYbcW`WiIMx#dW?-=5s4K7roOa0t#>~5O7?FKhC3H98 zMRNWZ9is7zG^9USEZ|BnfrAJrZbGL~hhK8dqfW@Lz^V!(A*EMg$##Jr3*m!2NP77{ z#M)Fi&`k4Ck~wC`1QFazBk(SPWP!^3AnO#8Wl*UqR)`%b+;fNnbEU@^kX9CnWulqC zF|H7&6RcTK#DX;#lIEaXdHYdbQS(HcCy`J=&vMfvgm?`-(u130(UjrAgHE~Bir(=c z2q|fexV&k{3#`}nT;u=_ZI`gYy85!JwOL&kNKJ>+r7Cp>AYIEEr}C7-<@q<^gqp0` zSfLKOiu037g(0r}qfj)yLsT}zeE3I`{OpXiOMj#wFVm=Ei6t_a5_GuWq1mTFRpLv zlW8Ndz=Ine7zc=;YRECRStkkv)IRE5Y>^>vA{$qHYpK3PdnIWTkG@VF|BI`9A9e;V zooZ=pNfJrEXW4(l%Dxlc>AzvTx3kc!Vt7k?!+ROB+KmMr*?X!ie6`9)$tP4~PGoQ0 zkn0l38!gFKW<28~<;L0B>a;ho@^%iNoON~%|H$3T{eeT{?1_)8OKtU{HaD{HHoQ-h zIGZ29LUwhCQvVWFD8PHoc*fhH(OPE21iqWCjcz%my_XBAb)2!|U3Ku%13ot;S)az6 z{d2qP|yW(KQ%7Fpc_0kOuCOD;YwNfsZC<%d%2 z(^Mr#RwuG{%KBstm&tJ5x4bGOJ9cC1hU|b1Ca)FpZe}#-%MGzOzfHd0x1lYP+mN-H zXDr#bdRSG~s@gK7SjYZV;$WU-f{BfeKm~U@Yva=^QR$XBfnq;gGhND)g-m~^4ZE@@ zt_(C)o}Ur<`u@-6|H0fpH~)>nMgO*2`G?kgo#d7eaB7=*|>e*x|mTt z%E205*T1Cyuh_Hx@4kUgm9;jm-HDdEjdGEyAu+K(# zr*P<+ws(B;{r(C7*w!m5&N6nK! zIekm;8ae3uv=%Z;ZdhiT!;#dmR!X+(Zs! z86vypJds6`2WOGYAU1iV#2}oC@+LUKK~t!RNE8VoZ!<~@9QN9J1}(g+amOjQA7P=Z z|q3Pm=g&}$#}n)D-Mo;fTSdMAQ`V@3Hxn8 z32gB$arIX`Mi+5InvC!^y*=IA1JT6@Cm#h933f>2Ad>T%5mfqo6XOcGL>|uG-8Zm2 zBpzua9$_ZZl;+|5y$Z&Vrj%-Bia#}zo+E)Gj}^bTa15LDB>;G!c0>hj1_6{IQs9ci zb{)2o9TO?^&;bLYGP>pTxEyE~n4uDk6V4{s$Rd*bJE!ZP?5RXfS0V{1DMDEvZK?66 zztlA(%m^h=NIM22AmWfI7Z4BxW`MLNDx)KCgJ>cdYGMc4b^pN}DEWxzPq=sEWXH64 zpxSjIZ#HOY@31ziL?jQ+&!r$;EA9z!k=l_;Yn=a-aX<};I%X5d>3Y#Y4j3|?_@u^= zk!1ImQo*T2WA8H99buA_aS70LH%+B^Vu{s${=EW!sk+Jt` zA-=hszjs42#=3|M-y{uUVigm4cy%BvFV%_^p@C;$A!NY?H3nyx^+xHIK{KdQLE70Y zkpnnAfr zVLA%&;zX_XpKHT`a%ZE2k)m1`lTH)zVFPC|0*gbK8j-#i5;`NA`4bC_6+*@UXu?ZTdprg$g|rEVk0(|n zLA=drzfPc*0a*EE3qX*V_cG015}cJzaK8?bU0lTtB_3bSE{@VhLk{4Zc(pZDM&OaR zr8*tNjIPGe=%gMyQo1vQ1(9#Fs$4Hho9y3&RZu|*yaYv@#-!Z^3Oh_VaoAYzhGZ_#Y%G+ z?_`uvPWrzwvFf?o>5J@n2mcy4-g0GQR`k55N~F+JW#gWZPsdhobYyGqJ!`eo<1H@3*VQdI7@P*kngffQj*Dcp)jHiG8OqYE{fUj?0I{y zTJJSn@08FEse$wE#)A?cRLi<5*zVG9n@a9GEc#mta<1%*amdfPl5*WvrbwOd&03S! zMSG+yxEczXhAi*ylBMJoC*~MU*rX;Wrg7-2$_IY7u{nVoT1;PJ&DCJiCYS%Dgge?q zpGn^Nre&nBobJ}Vtu_ht7hM|pVlrFgWLbXX^3qzczb!1JlW%BXJhFm*Z z)52#5Bujb8Y!ui0o$PK=D6%u*5hP^h-4Uh3W^K2-oW|P5lKWAM zE+41$ux;TpYR)sN<;fE62$RA(U6aQqR+5DRJF`{z=F+W|&NUQR?=0!Dmu%jU;v!RI zC)a1GSHip7TCaq=?Ov7eyBQIU&41j?GI=}-V*BP|uRSdj)lOG275rCrso(LFssSM= zjqm&=@7d@VsWb7R`3kPWoY@Ml-Y$n*dpI5LxE06Icnf-p?;tfbea%&HJyFt`Ix{b9 z2AALA($)D@YK7zJJ8oW2+z++(lqwpD847Nx)aqK9`hW;-q0;9R-Bf(UQ$2{?Ju}Tbo)zU7xGXsg9v2pE9BccK3rcF{ zxkd1jIQ4MD8aD7OV8_`RcupfPmPv3Ts7>2HA_U)=Y5P^(AX$}$5~-pRIW&l!!mbl| z!8fj50scF&+gTyWf%Q?8Cvu~j79>URbD>;Xi4x3S4u1Ryy=!XE|LlqwX%j9%KLYs= zFe5*oiLTcBUkd1_s1L@MM&_GLr?mXXmh3vZYTj0Tq%Ovp#$A4UPkeOI?Ptm5w^e=A zMg77Or}0wZmv0px9jWzPJX?EW&xh~d9+X_BT%7CRNqM_Us=8yx;wx}bTl&uHIsU17 zaJEC?>)>exiepgh7V6XSp;r@Wb8lPSYK~q;d&&hLszJ!5YTBa=Z&@Dj^<*atn^dc9 z^_Ovr?kve(c;TcrX}RWo`?)uovyt`v3!M}%22wKjzS5IBZjO3i&itRlU`;y_@Ci z-ETLW&PnTvJ>j=!deqWWQL`=^*xK1shvF>UcAW&2%K!RagpW@4mLN;3oBU~XZ+!?B^U>TGeKW)1mRrx#A{>W zO83X{hPc-KeSB}FVz1O^ZhEKrUF<>QysA?$>(@K_p*r4HX(DFNhtjep@138`e0j=X zP%zXZy8l$FaHz*@ruuWGq4NWg;;9fsa7pkSY(6~_y^s!^9kUYpV}ATGXcXRtQ-VnI zOiUz{7#uH>K^IqtRHa$izJMnAjBydYcARDvJSjwnRdMq%jJp}##*tWhaOMge7c+p+ zwe~Clr0ocy&=JrzT|mK$qpm%Vjjn5#P#j8X-chu@iz7}AFpuAG7F32@ICBG(BSQ^e zq{kP*HY%RVbQ~K1iPFuXDrl1(@nxom^nJ+kg*OD!5QgRRx(UT(!QK`h+oP%(bQ0A( z`WXkkoLH`ts~#zJ>|j#^{5TSh-GP%maEyzp{2W#f+n(T#Ef-uMhjz=8qYsf4*?c8bY`# zoFFvkPSkZ*2}evg%n9u#gV_AcV~_V1=zyCz>cnSE98=T@0Ji-w1!jpcTY>k~?zg|= zgCxWW>U&@lIflvAciU1 z5SilR67W!G5L_k?y#}p+#t=iqNiZa6^Y;_;vK;tTUetX!H3b3=p*qx7p(=GWHgF;dHWz!( z5@%N}BM?pK>?YXyoP3AI(zse2a||(&mEi~*Lj}S8s2zzA69xtL42d8XAsAq-B{oVg zuLVY-h|h%xDhZSm#lFVzjW}A8nht%39mV3kieQbN{6!yiH*fyuws-HgP4ateXXZbZ zzchSXOSmqu%~r7KEB(}n=J$rids=0bAHyG&vfCdEBx{;_yWD_|91J|87 z77GyxAcAizmU?%UcHR->6Z7n_Mn z^mu4vo>p>Bu}`C|JlP|QMd+pcDmTlz>rl+iy%LSKrj53-#_9KMM96SwgT2HM^Xg`m zsgyz?-rd(1jFjZgpL4m!Cn_t&5Y{*uV^3~oT9q%e@tBS5K{00fM&@Lf3no3A_)d!_ zmpjWiKeqW5*C?8zDbKxYMt{#r|LPj;me;aMP03ezWW8=K2+2mVrx+bD`E4NMb8+}; zB(JMY&)&)X13m(Lv3Zf~yT2aP_?%zZZ+|S#Psx&AjqvlIDiFH}wv|Ie|8GQafq&baR zw;Yo(C;Fc>ryDojBSKxZHMjZ=ydN@9n<#%U+B(4IM!NCm#J#dQMVH6vLXW2d4(<*{ z&e!gm8t5xM>KxJnReN0oLAO-su}3!>z!e*kZW(SxU&h7gP=ftkAK>T&&@I&;aKWWH z$0MXQs{8PQ7MiI}vkLA_5^AT<(sa$@JsHuXF+Ig&hacR@&OfaZJrHpCvE8Z+!Hll5 zxfzbc_JxD*^Vv(N8Al%Y(TE;p?48vndAxfcw=N@<;#XWvQ@1Miu?RUB()aE>oBd<< zoO|$FQTBtIFTLDhK-Vj#b}8k{4gD+*WsPSL{%7>qXFa=Vt8Z=QmKmj+b2+Lvi;<{J z`i+DM9B!e8Ve%L(efF&6g;mqRN@#WmGUnyyUO_fq_8?&-bKk`50d2+ZHRBQolD09K zT@S#-{iR{&C}8KHn*<>*m;ISqt6<5}_cjDg0U6)0gf8u<2IT|lCYH0+#Cm;ULJS3N zeDUAT1VjAphsZFB#KH3#llR05IO3vurM}whsA|Gq0_iFV2Pe|VIx}B zkuCx2KbETA7nh~#hG(g@XdBp6 zDv^@5EIp+Pwxie_r5CLTZIS|FBDpq(&?^d|y(GQDk?SO&zP}_0zgxs>?3-Z`6 zS2YNOa!D$!2wAo`eGcTR>qD%T85vUcJ zFZGnDMFmeQ3jF|bc=hHb=AR~TAGqNzjim>#S#oxs6;=CWkh3(rA=CF$1^-5ip$>cZ zp^n|&^>E1oDdWgB{ zrq&~yo}1(WfE5#1jI2_kJLR1=@siYJDqqT0CXh>nQnqZBr)-RLK4@k4J+Ij3^D+L9 z%yw>B!OcE0Hx5{ug%5}34_ksY+CKeL^2j~8_*=vCdba(h&6A(=-<0&+*GboCK4yD0 zNq}!5MOr|=BBzo*@k6?NaUgLXw6RuX*9Y}Z( zQMA{pIck*8TQZQLC3YL*$BxeT9I`B8R?=WKU);wlYJ6NwzM40DRj;hy{1#=12L% z&BYe+M^`;JDRXW7D!;9B%;tr^9^aJdOoA@_`a#@yonPXw%K>(FM}dan2fr1Hch?yU!|x=+($H6n zpl{qe08ei7SyoK25`!N6qr{kxEh{^(4B=t?Dk{2RS7|6u7`!x}4kiEk|4%=0{B*Fi zWSnC>wyuA`@?WO$_5N1_T?JSBaM$3Oe(R11tZsZ&x0IKU{I%u6(mC}&H}+Yvm1YFP zt-iOt)IRL$F1!_-xWTKYALnEp*?@eQ{ohcT(L4Rx9oFc&iQO~(mbWhrGxB=H=-G=7c_+ox-&&B&FEOzpJ726V=J zL6oQ<8Vz7&` zM+>$fj-t~YVPA$UU9fCn^R;)Q4h^zwuX~J5b$YePS6V2X*k&dYe%Y85ss@Cy$ioD` zef=$xneDpxv{E4+EVD=&W7x2N9UJ!BOy< zCkG=M{C(0TJ`$D@pIqu~cLj$;5KUDO2D2!v#huSkvsNDg(H~EBM!R>>DtvJ9q>&$j z(lo8GfzsU&9P95}X+kD{FuLiuAgxCs3LhAnfxNcjsiTDSGQ(>-MLGj}TP+`!s)z0K zaSsU?!xB@P5uYXO-C=`wY=F(NNOk*TgXG0E=3_`e2pJ@W ztJHS`-GD0dG>F&6jj+CIj(7-Ygp@p=*Q?REga7$9Mub5EkAtfTc;ZuagpjcgT9}6Q z*-1TPRC9(fah#_Owq1I25QbG1Y^2Z7@h03x2w#mL;5iV%kFjQ`LJ-v&IdFiTlJJ-) z1eV@@ga-?5c4FYJ%Gw}N{TZK7I&K6S0Spf>)=a#>pzHs_Ap5@@%zT3gWFSoE%Lg-C z5N2k7)I#AZY`dMjfTzBS3=V-Y&GyA`Nml1S+c|^z^E#+M$eSI``UO`7@O+tDc37aq z6Pjt39Cjj1RK^a22*L0)RPbg)#$B^RSc9{~$3x>d4hV+%=XuN&dQ8K~P29xsvtS2> zUS|4wB2R${;waVSL1)2=to2RY;ALZXA-LmgKY|YS)r1knj{K8_*t#rEnA_ipLSp8DZ@AK}rO&fueQD6~RSGsu;E7J%TyQBoX7daAGaMKSZ%7iMq6L5kfln z6kg#=IK!$LisS)nH9p|B-2~4tVZyGQ)+@`57(nM6JDRf>=!so{EIzMWnpoO2@zO@2 zhtMTh1<;iAhcm*{k*aEnPrW520=Gd+Ww8^5X|@IGk~zU{gny2>5#ASRhvM;*Sa!@g zj)3CH9bDKY7M%qRBMi-_>SPce0Cp&FBaX^dhC`LoaljDeBnS)e?fHlsGf%iI@DQ`( z|CMeq(=R$4!Sj7o2G1CI!bK_^`^l&p;eC@m@%6_!hX_^jm^VRQrprzx;SZ57b}R|6 zT9KF<$i)IYrNL-${<(w=K>AWE}`O4ITw%gT?T4oLWX3oz}NSp0* ziV}K0*=;ver^K{RPmTFiDlI=ams$k|R6eu>`}PJ}{~vguw~krONjY@B)X5>Xh9q-C9x3*@g0$$_yJGse~e24&@1Mk4tx+jpj`OKNek950NN z9+T;1YZScXBFOUd?E2`GDK#05lh$dwBLuVcRHPW(CDWATpU7H87WtOxaajijWk+)F zM(5g^aCd&)t;=Cg?@BUk{I>gm2&3B=?~awuDQsj1o00Y8GcT`?ZkKhu6}eWISv-&1 zz>@Z2p&l2RTc1hx0y>&DhK*NN`TE1FEC%RESrxj(D~Tc8#@;fD0gapajkhzMva55H z$qtvXPP0!?V!385pc9iQ^WFANnAM#yBNwNb;ryJzo!}#}lm$)})AlJ3;VkA~HnenP znzeZgrO8=#&qf)PlZ`nfFIXmTYFKA%CmEX``OBJFU8aI!b0;j}P91HS+`EDX58DP0 z>$ym4&g>_gy4D}8XCiYtlLJ}x>!Nwnc8{^P~eOJeD>j@-#lsuWXj$!4M+{oFo z-q+>VF{f-!OP+0`@-vreEc$VwASqL)*CO8kJt@6i>16V>WCd)FV}oZ z(qau+MA5|Zx=~D!{zcPl75y51;~M!`i4=Wn-bqK^>7C7E^2SS-Bq-J^E|H(4vbg2Z zitD>XTidG0sHn;K+ZPpCX>m)wNHwu@im5-hem0g{N5-1rjKplp$34k6cUalQSUYeg z2JB&>vF4gG8QmbMT^jiq{kwSs?@SgnSHHF(v1<=)d9|u2A{>+ba)M`BkCZQ#Y8sYRloxOIn-5y{~M9`y~mt?;NHjk;Jb&?3#yq z+CLfc^k|sq^7Ne3&tvxTMn#=ZghEA>%@25vqx*r`aDP8ELJ<|*B?t9Oos}w|`w1=d zc7*#G{BU0p>Oxn2oAyCN*rAm|V%%`wiwpj9Y%1`g?R$Ig@ORIJ`-|`HEDoG#{ghm? z$~E{{P}tnh712rB|F_P=la?Wb^YCG_{{J`+e|k?i57$%9hIZGMydH4w8^0VJ^ntSB z@0>azP7TbNYW~i)11;IN*Lg-xD4$q~zl%ad-JQG6_c9;U>0<4*J_PMvew}*TvtyaRq++$VE=@B@lPtLwW;#18d-{UL|H++?%HT z;DGRdIQtTCsJ{1cB`Jv%*-0u=mKGGDvX-(Xlr4%15kl6ftc|U*XA2c&OZIg_C~HEp zXJ5x;U&fgKxpyoxefa*L=l6`q+`0EG?|Jw0o^#$SSG`>r%8W2(a`z%A$739lZw&7* zP~ceK1b&IGkC77tZ^-f~fH3$!O8@+KwNL-2LX&6Mo3-nSH`jHhtl zHgeDoG`jRt#{2ISzR-d<(zNp{3`Yu035Zey$Zb5% z!L=`-p*$Di`^w;L3ZL`Yz%RvOQSiU*8fG`>Pfm@CJYBDvMxFIZ660rYDFFA)6X8KV zTfy6Z#SM)iY=vHecQ;TplL2sRq7E@ZkGff)@-3>IQ0?Hizo2KnNRU85uevs8`+-q+ zv+XHcKtXLPfSS=VGZi?u!hiyd5ye7Lu*pJk0)nkAeUuJhh4n%vRJ`q)=MD&}R}`){ z1dS<8cAtj;P~e4Ld+BaS4qo3X;<%RzG&tr3qpSQ%GE_}bb2r$GA#Pvh`r$tkiMf_KtO0Y5ONALf;I z1Aw|(S%BpWk)v}SU~NKC&2tCX=d!;9t_!o9uOE!-tR7~F$|qDjpaR>&v?2WOg1@pV zgrR0{AA-9dsD3XGVdc;`^w#Kb_pQuO&tD=bpduw8)dnC(#efxzO=KR#v2@L3fUSL* zVW#4T(Bg1{bsDB~%eB9|L3ckj$-)2Nw|`gxDc-^VBR_~hogUMGM8Y>pOa=@hi`yDP zfCd3a7t$bh2zPgbsM&Unz#|GUk9eQjm8SPqt_Q}$jSn!7P)5KsI+6ur#Tv-Y40u1V zIv0ehmTO?tfPb1gAxi9o$mr8@X!mvilv)G)=8(7a5O*Sj;8DK$4P`Sye*?0@m>wnr zvjqoXkT1XTLqP3g1)9goFD`3fcgOczpIuFQGfa^J%rjY6LN^5Twxj3o}h++jDSRlF}=Q< z1^Nm*R16ga2!smC!R#t>H>(%oVQvCPA1ClD`8a{~V7h|v2Mm`2p~5kKNG{BN#6i2H zg8iOZK-@8$2xZFIb(IQ2+8~r^mpi`&114Cy>fR4ame_#fy2ZVyKKp+$=JAsQX zIa7o2YFplggqn!}Rs`?xvvnY^n83WmVF&XAogK8tt0t@!qN2z>RVY(Y`j4I4AtE{p zL+}jWQ-g*Wpa*3e%KD)NF&I!&Kv=}pydb@E#1EFfpx3bE#7b@ld{*PP$OJXW2SgIk z%_j^Z_bFassHI&|aCwRAFxmXnD+ovi(hZOt2>)Ur0Jntz-1Cz%P+JMJkl>|5N)Z4D z@CbmbrLTk30YL`b0XA)J2VaIbe80th!$L3i1X!BL^`Wt{ANAh?pon{w1&J09Umir` zv2U$VzxCJHA;nM|3bVE=@Z8bYUUSUlOkMnU6T2%vm=>NK$X$3}qiHOfsdv-LtY|beIi$8G zI=X&oA@j8I$d7YBBVKcwJVIX!lAh9S`%sz7oOs+Bs~eunVlo;8UU2(5Jo&(?? z$%~Yp%-AQCxlbjW^UH6ihS0V&J~ZY_(Sqt#bi$*Wgg~=w(@gsWYfyb@;avubyba_; z4EthMA=YMqZj1bM@5mdA?DH*4Ngkk+Yx&8%Xu+%^`{jz+x@h;ot^)NoOpCCq+UE|k zOz9xBO8@WWoA=}S+HMTDJ-B{a>S;{J#~ltw-9xVD=eI5|p!t$A59C~M~ksjG(#`7slTts(@e5j58#ewA5g&Vukq7RxC-{}gv@9{{eQO=aO zMF$#@xTV@UbJLOjU|Z1j`qxS#A#1cn$*E}6FKa1I-F`s( zKqh~O;sv+N3X#vcsk_m}nYyV#wuQmygI9LAW{hV3OlgjFrg;0Nxs_4zezWPj$kE)e zC#~ZtI~|fuU6RnMFT8BY+CX>rxIw4+ls^QTKW9}Ww(kCPU~8N3z5C7HM`iZ6#t5Jt z(lWfi{8Vack9vMz^!l?MV{VTxIPOvSJKCymiasb5Yo8!3ejQyY&=#bd;dw#rTUq9= z@`HzdyLriqH^0*r3bx(WmTp@wK;9N$+mf=ijr<7sA16Wm3eERPf@&|CPl$ryw*Wb? z#?4XLezs*=tqiv_Dh$-TTr*Oi{1gyKcTNkOJ^Vu;tS#N6UO=ENz@sIFzwMn(hG`Z3 zUMIBW8?)wMw85Ku&B5S)oJ3v#+J1D_%qgSlhgnEWeG!@3j;|Sl!9NA0)17sLW}AMd zl)7)bi;d4V)#iH8CGa3lw=GNF=d&(FHl=~_CCM*){LtD*&k|jpA#?E zs_$UhNwFQR^6mwa|C!F-%k6G&BVPy?y!(xv;P{A=xm4d9 z{{P8k{y_d)I%BHKSw{u#Z!VPhDG51LuYRidRe@;z2sWva?o5a{M-ai5VMt>|OB+n-t z&Ti7!3on+?G=h*5IAIP>|AXBU9Lih4X>SU&4}6S8BM>^;o!@#2I`EHd8`%)4VaEsgtAA@qQF@`qRHifAXR%vJs zf`gEmu~~*DP{^ri!Uw*+GW1#>;!bS(gh3~ana~*<5Pp<_Rxl!W5L!)wU}R+jN6Enf zO&O45Xm>00b|BGvuGgZVtml5)pp*IG5tG!QfCk~T<(Y7Jljl5`5NO^^y>@9KVlnb{sll57Hs+bb!LKrxqxn^W=mx_DuIIp)jv_-ghWW zx01c+ygxS-+ytkA7F890LuY6r|H8vP1Rvp+d$%82){pceNm@V&0W7}n12l-$bAL2& z&^8WEmr!#k1l}O1Kntx=f#gl#zxdvZ(E5@q$dUsxIeEe7+V&O0hsM+3WAo~U(9#R~ zN&+-y=#^E_3AsFQgb3^fO@bDX2w5Z^P-noDV~>Q-IvzO;?{85-LrW7hgd9Kz1h+#c zqMpI+DS&7>NLFzi3OBR5Ye9<&;xFOFu$8n7hmXN|3=YBR0SJU)#8be_KouNtpw{RV z6#G_&vEzFPPNPF3L&$mrje|WC+VD-uZvgGnu>A^W>RC4z0)>7k#?G7pGlm2qeFkBjiE=A^Z0!&$Nb&;`C=mF__+v4|wigM< zum~x>R`N1T!%dv(fTQb#35HgOGfP3EtnH#W9;VI1+}^uGMOLAve0Yk}F?%o$@c_hy>@0iFRpqYlZdx%+?p*<(g0u z;;nS!G5D`~Ly_vi(H|mw88uWFDoYg&{O%g?Aq}577_^>r|B!$zWO2Jc>TY^lT_fZ3 z`6Cn#{g>ju3>>;5t16_S_cLASf$WLbKX(=Gi<0LPoc`!@(H=Wjc`~STnd&0fxkA-q zts9(3?Grm2Gy)mDdY)C6^d?j`yl4+nN_!2G^>oR_9CWh}ccY7+R8nD!xfJ?5wm^zL z{{DXB9KKN{t50GE-S2vQ-TVBGYWY;&;bl4|@axbOD?ZG&veMV?M+GX=0}9fVCOAPx zp%iVNq+xZPY?a5Xfj2bvd-V+YB6VIqdLdL1@b|Bp{i&lVZArY3+;@Jj8Krkk+S7P! z>ixX=Wj6u(E`Iv9P7J!ug-sng8>4%)_iJ+cAS!h_+)=tZc{B5N9d{Zyqr?{39g4 z^czWz>}ml4@Wz72EWZbKgTwwtRS$q1+TMv4g%%qldmx2xAJ#*#SS)9M?E|JXlCaLm za|luu*7ER5Xe6|q0Muw0fL3F2dvnf0Dv0F+SVR&xA#DB<2TQ`Os#PZ{!4_>aw1-=s zAKqe!ZnvBlg%sOvXzMj=rZr(_Tl`CSzn3_4kN|9DC!7{&_;q{7T#)+%)_cj=?r=f# zb~nooT#Lg*drs;|Uh{{Ap7M^!<{%vUwuW(>B@f1C;TBe?RYX&pu_{A3a+(5Us1|k8 z=DFA^xc|47JFXRz^q1}DWjc{qy+c--F$@cciLbYBl1i~^P~qCs(f!hsM7dk$Cp;3%nsf*>f!GB zm1ZwwlyrtOpaUUyKlVZ9=wcxqWG&ex03yQGze9$$A!9}-5L{l?^h#?G9i)B6`LAH<#$Siplwb@VJKW;8s?| z?MEH6HXW>hlG!wSe{4n5yg57$y&hJsPKh42j>E9SqcR6v5#z?sv=qRYiXVVYmqG!w zCTB~q+vPG++W>Ulz)J#_kg5t|06IMMTD^Dflu)*Z%No#Xc;wI(C~1?c4y4iZN9f_* zD_MIJA;aznTMB;puh5aEmuB2l(7NtdIO84fS6YZaIyg8%F1P#u9RXE%i=sFZGEX;a zxwe2@H;!*%w})E~VwdpKa597yi*N`|E#yZJZ^|fs`2v_ew9NB^kb%C#1R?lxBYb3- z2F@^~K}a1$y$xO=C8VxYXoZg!KTUuQVT1$~;4MFOS16_LN~TM7*!Mc62Azyb-Ud5e zLm=A^u$Rg|pvHI8z}b8#;RHIahXOEpoS6hj4rxGZpS9ayYhPmi2wDq& zh=g1w@qKWT9)kM=wu_zd=!M#zaR?(TyH1|&j|=XVEg zg#tgws{_&p!^tjJ-B1g5#N>06P^&V5h?PQ#W+pMVpYuaA;=}qzP75mf?(D52zo( z$$unPlK3gOp#QIGAWo4doUMO#3v%${KEoM9#pz%s+C|6;5v2le=78N< z-=`c9q*>gs-!)4}60)5@(BpkDUEhGS-{6@0bC^Lu;ws2v+yVO(gd9d9D<0#bImCv~ zw~+(Z(FR$d0CA@8z%7Kq+^0<_NBxN4G5QibMh1e%I0k!++u)57FTo}iz<aTCX9 zFbIb%VQ2He_^NY=djqy(KoWWfcA!@Bfn|60JVrgeQVOL`%*&F&X4c!G8S9*}nYlg% z8G7v?v6AZ~T8(Lfw_4`7|Jw)Ax4T>W(_(74_iuk$;v7d+XZ|`cY!AnD557$>rG#y+ zM4cMASXP+IfxA4_GV}&Vju<)fHUvjL(Pnrb%UGoAQ)zhF;1camU-u78K|z{sO{b5V z@zK8J3;wjPNbh>mz=12WsZ25IogyU}?vp+23`0SbYTNjXDX7YB*_33DGPu4gcuPrf zyB~K3ct3UAft0UG*y^axBe~Q&-=$A3tN6U1el<>?9^0#4LCUeb5#EVFTKab zi7W1uCwE;_rElP0I1njR@nQbJb!PXzPi{g;z1+0E4qh#{5?LzcJ9~@tR6{ij!f%9T zQ5RD)TngngzsBPe%O|Sgl%#i~@s{%qJr-*xplA0Le~ z@A&Vx^KQuS_{X=?drU9KAdH+JAuX@%xa^M9dv%Oz3Q7>gFz_I-b0?K~cHb3F43{r1 zO;C}RJaG%z{eI}ey3|y(a$af*%11|2p%I~}t&_2WJ_DwhS1E?~~ ze|3D3|65;*XwII3i=gI?gLZ{mPUemR$12}tY6ujoNqcqz{AL2b6;#?6z;n& z%9)2Z2R*IOfbIW)F~5fDlE`jnC^C0O5LQK#|NNhm9qu}|lI(Eg=t{D~j%5df?VP$G z-XXrYJY7bWgX%K7mNrjymnWp6DtfTuZsMgJ^yiAiuA;@^`Qgb|gM#|H%WcC8{ol(b zs0Q%2?H5pmi~UW8a(MrKlzwelQ~y*5V^#4vF-Ln#hXp*YrfgzDN_n|1z3j4tgd}RI zrXl2RRaI@Oo&mM3Tt$8TWU=JgJoJZD1j^yBvY+H)dn&%HCJvR0udhe3JHL1` zbC`2W_hN}DeP`$VYfl~v-;r<>%An_az3|>RbM;-67zDYmthSJi9p2*R#|o`@QRUJjNfh6p-Cqu+YS**ELy%(&?NK#1HD*Elq~w z7e?C#7i$FpcCcLt)WV!7!VWi$n2N{Gg!jkmT>IO`DCja*)&Koi_fNol{Y&>jc7<%G z(PYgKs_f-1o>alMRI|c~nkQXnP8=J}6u{-5$YJG}*}7EmZq#~0O0)!fOH?Rt^red$ zXO@i$;HZ1t+FPt%xQcxnzL`=e&DPL;^_O(9;k6vv)<#x4!_l7@$uwmCdrWKCjm!R{ z_{XnQE5w3glu)zJMRg;Ta~V5Q4=?k(1X49}fDI!0zRTd%xr+f|&t~>4|Gm$BDcp6w zp^7~8dCi3}OM&G#QwhZzH#GO#-X_y^JW6tzlM%Z#jloO|gO{1IYd=W&RDFL&3S5}msd#3yAJl&E zk^6RH&9A3vO#?lzHO(@=YlMIGdQP{GyK}C0{N^&Ag0|AkZIVKI z;n@f3INo&Cz?Os(Mj!P(;B7*fBz_l*>dJF-CFd$4h1)UC7mT9BjiM6&Uaq=eaQj7h zQg!;Iv9BJp$3@-u4+ojXKb9aYZX8v97^snbvhI4=;Bd;~@|=Lid-LGqsL5>%B8I`8 zM=Pb70|n109Fq<6eW8IoInX}*(y+1lntqp_K5CC;M+q5!%h;f4oYSX^&leXT`1mY3 z+`rS*HVWZf|= zvY*ffcKP8sCeQ-yR$Aj-{=J_nZw;ixQE#Uu{*+g{GFK{=&hgJd z4(hc}H5WB#3FF^uo#gt#8r7gX^Y<3?nZk$2N~&h=v+`s*9x9fJ_);T)#YR z!S>Fxv4>jrsT?9wDxu_dw`h)ep1#`mf-uO{|2v9@%+;^-Dy-n~eTQpqbTYH4OZJlC zgGF<#aW(LsI^Mac@)+F62fvbJMYMb3px7}@!MZKx(XV3L9c_xPjy5&7gsI($t8s=fSVDQzq|H$ zv&BnSVV$n!Ns|dn)ItM(5xgLlM>*IBH(Tc2g|o_?kHtE)+U*|62FphXhkM-Ef$62c z?@fghTq9EO&XYG8Xrk|2@f5v5OEIc9FfhL)aSgkNr@KF~OkZ$$@OvC0GD^yEA=TeG zIvf9YslR?Ay-e6!xp1n9$v6c+1zxXdiw3qhWWHlpl+DM~?3miZH5^3_ui2_<>fJ z+`$G*R0CM0rhql1amc&~3R^<^aE1}MaGf??X%BPg+a}^Wz4no|X2HhkQ z{@Y&Y1nHeW#X#z%SGCOQx8>BW_Z%dWzMZzb#`S2#;PW-j1L>gKgT-H!{Jp-yN~&ef z6OzC&=RH805p2=%lnvHDD2XJDn!_iWvebo0M?u16%TfI`s(@7Fz&!=_b=3h~`9xA) zYpJJ!fs*@sYuwZ{IR2ZYdG?hUox*eM?{FjiN_}WeK|7oo$|1K@1KU*9alAEE&(@Es zH>I+v3aQX-a=(aY_=exl91BNRV6hhUmHnd8GuLO0$!I4PIES_iD_z9C3aY;Fvid?$ za1$?o;0vFML;Nk~@vIcfb*NdINl|<{TS+IW`E|(ElhpSe*Eo}3pqEH#`UZvTZ|doF zft|L)9m-M1xv*$&MijQ+YU1kLOb&*n(Lx_*wLJYpZnkE4q5EpHi3;UeT|BlgbEFsX z>I8e|9SQm*$FT6;sW~&WbVN)@>V8Dwd^C^$vW>&?SU*Z~*12=JbSgx?qHcflamkrl zJ1ov@M7gR?+=WZ~muF3s-?xRP7Aa+c{iwVJf1ccj_9N>1FZWEu-Q`J*(u+tbs_glR zpD)#4{@W~tTjoUIN-glXYkB!_3R*!IYn*j=QgZA)c|k$HV29-)toG7-a+kv#=c)f5 zI5>QVL9!yLggn!%_w?zZEO*nToJaW`e{>ZtytsZK@w~>{lsHWFlx)_W`-oC~e1 zca0I~X*O5)JE6izVzYj8R6i}d^*++P<^qvH8Q8O(z`1A3Z(SDMw_^AREP3`J?Z6j9 zp-k@W>!uI7lBSkRb!GO5Vj?h0wZI(ZjckF8(+R1^rf;SeDSgk@mr$Hb@ol4Y`W@?1 z#L?T?wj`B`<4d7qvCFd*b3FA)v@{>37n&`PuWR~VCRjz&7%-KX9^h>xK2r9bHa=B= z5#dNag2&XieD9x_99)=anbdY(>N=;VyEqcx8(%dVjdHSCu!tWF@m7o$pqxS!4jgs29NzjT?yeHu@}dr%t&JUzgrHbvM3ZFa%}4IB8}%(K6gHSivLc zGPN|av`~dX;b&6)!OJr@m#&~Ke9rtfQF>3SD++@o-@D!h!aosGy6uC50ZokasZDp5W@Sbm~U?K))1TipM(*SFrR#d;D)*z+i<`v_L0|vWP|2*^28KL|u%T(A`g&iD!1hWWOx znhwsmAG@E%l7e_YKc{ zL`;wLH`LFi!Xt-!`c%6Rj zQo3(iLCdvnw0<&2x7D>LJo2d4eSi2>rJ|NTTe^DNEf4olO!W=Tx72w@A4a5yM&Qrn zE@6b9a^?)t?lO~dX)-AZs#^ZL*vq)QFjCe(+_NQlxj1ny1s{z_wwRk)bhKDnrnLxe zr%YX_>hGAFuj;SBOf*+9CWaRjqsdEgvx&5|bJ_aNkAqRTk;O~6;iXAe6t=FnYLIiO z-_zW2F#YkAKYkYNxx8@F>~qdQTNTCgyV-bbe~3xJg-#dGCMGE-@6i*>kC{pxKaIKQb9@_iM$R|d$vT4HOg0_Oe?z1u zwf@)fU3-JQ|BlX4;&xIjhI5Ubc%H`e)#i{x-Kh!NJ=jR^e)0ueQ(2FzAbxhFPhx5I zOF6#ij3grSZ<^9Y;*qQiTF%$x{aq(x68`4<{qD_cFkBG*(C=(jXjP}Vf4;4dw%0*q zR{VwgPyt7|$KKy8dKRkP?j9GV zV`6@&+)I#dR5=W8uRU!X*E=jeSJvuv5$mw+6LI_Hb=IFYRxKE~WP#{)8cBML9<&d|UoM#~NBlmOO(~Sm; zzy2K@xO>4QAu>wPe`UDXpDJ@1&q0Jewet}=luL)Lvg{odqrWq@>{{@wcSyyKEWP}5 z0&(_Ve;%JJ;nfJ&&d_txt?gXSaMu=aDe@xutd-dZEd)maS&wp`b3o4U*R9W_lIV>nsKQTaaZ}mWG`W#lxbv z=OG2*$oaL1)ALU{+U4Z(EV?MZS1fd*G&_Wmr{XR)(!bwO;?vIWxY}>XCY%^{^B0GuH^xmrYI!09Pa_$Sh#1~8T zRo-zS-r3dlWi{O5ixbW*4}TkctNWnu^1QG2{*J}|5BFkYhc#}}+_FsoS0C;l_nde{ zbIW`vBwlIw7w-w1%Z*3be+UiF%$v!m8#SCDm5&7SA7rqQRm#cuiYIHyY{I%%Wzdhv z|07!jiC(OhQCB`f#OV-ckC2@vh}~y8)ga%)|41y&dGZ6Wc(c+q(XI&jnk*;aOvzv< zjkse?{t*{8@ zb&=qIEI^l~1v1$lcvv`lT!<YYORzvz;#mK5!@HguW&ZBkJ5EdRkxgB+9hH&o|13)bIDJmz}N# zsXnYl&<>ujo1_<}n!KwTqV*z@IBF9mDm{b`Vi|0!WF4*2gftyFtMmnEZ!0ZZ*`Klg z{IEkaV6xn?^;A}uOXl2Mb+$elFPyGs>m4@Vu&``sV^RJ$8qAmHB)y!aXu6&AvES$0 zvawNqrVR6d+joW8WOXfQ3H%}tf6gITpDpU#}6qd9&MyUS11_pe~ZUB~HE$}Y_H&=(IJ-i2d$M0_wHr}L`1^bKz-;uFSd-pTGq&@=K_7R26iH}({8x*n zci7CxoFh>19)Ih+$^o3N{Fvpi9kYCVk?SJOh>GvMvOhli+zj!LjvgepVkUGcIFh#Hv{Uo2|a%bk|&p^huWEMcMQnSdI_T zP0Y;NY-KJ@yn`3pMf@H_J^g!LUL)+4Mx1@Kr2X#qD>GB0hVP zU-i5OZkLwQ4?i6ookK6afz0RXsPj@i_@265yvY9E)E9hl#k^2a;5|gYmujawbT`(m z=fLhmjZgD_5#3!W)W~%?0r|hGvbr{5r`zVZGwny)8AKJxPN5no$v-14g ze|}T@)y&VFIU~}Wva=idaW5KJ28Ie_r)P9lX653j<=<({XOoxX^Zk0y9d|3qWgfSo zp;fE87*-m|H^KkP-|psV`3u`9=;&os_FRB2qD@XGGtlL;6))d^SNl|qa)gb>J~R-C z5ZKFS>u_Fz*k@Tq`bFt_bMJL`;^nn`w3yZJ1`BTwF_kVBVnHCdJYovFo8kb~JcqTR zuQlQkTp`bd7?1OS*J&EEDN7L$14u@#Uq1$Wy>g`WXY$$eB)~^xK9iwtNB6p1>sOA{P3N-p8ZmS1`&^h&gK zw6qIv*ut;z4a=@QN)p_P+--l10O14G zDCe0OQA8)!D>&WyOkCcns4P3~_S1Q(%5`%gw@g^N_5JE*hxDEAdCj>L(c)%qzSfb{ z|6O~RRc|3vTGFm#5|Lt5TpDXrfk~hEL-t3xD%E!BVj)JiZgf3L`L&Yol`~kI9P01k zw|-*nyEJ3FNUfUeLww#Lh-mGV$F?JDZZcivJ&d?bA>-Nh`$K!y zCJp*>2TgKKnXCx@IW!INJdmv*19j(luE=#i4`{WKr%5GW;w$riMFC=YNx|L1pFV6O zWyr=Y3S{sMK~|cWxjldF5uSlqe@!}+>=Rs?;~!!0HqTZhBY}TkrYr|Ew-D=_V9z*n zLE3qog;++4c#R$@*eB#QeB)Z_6s;)TQFnx9p<^;JyQMA$*V;dE3EfP^D41PpT4?;eLV-I4iV#=vZ=W&eOGyq^cj*_W>WSpcB<4cHwpr5A_We)?DxI1rz_pyM+p~i7Fw+qrmn41i9WH zg^Vu0?poNI%vBJc_^Bj5GV3(H-zwbyZ}G)@Gkdz`V;%L3fE!|0@uw|y7Q>kIXwvY= z@}nXY({T8SrNN2*sX|)AE`RBVFKnfl5m?)<2Fv6Ri1}G7uA6nU;+$1w4!8Eb!bZMi zNW@0JGSxuLP4;_BGgq0=BMKhd&o(uq@NJsfGyEyHH z*ctwwZn=Nn%zwGb)8jE_5c@+v)u_0C${p>L)g2%Y?3$L?z|_?re+{-I_s-Qne&{n6 z-!Cfe64N=CQegwX4!cLRS&H$p5d)K?gT3Xn)x@i_c{%om@=`^qEHvVM*%&s_vXk^x zP7%K33QO0HOQ%tnouuWcGC0SMHw?1_MlmSrfr$}KhR3s;%qB)0M-*raOiEC9v6_Mb zksMw=zb=}_Wd68$k3VBSf7_bXT1+~m-g5sO4QvztF_By`ynWKE6GOVnZ|N@tkM>D# zW>4R^@qt#??5T;J#j9k-NwmYM8XW4%i<=7kZ}+S1`e1Z0Goe@dLd+W)dnZc%t3{6~ zYy{a=Fk-vAap-+4g8U`A7_o(Z9GO<{yX9$oPGke-mFcC%Q}iR)P3-zb}7w_~`q) zatn>W-UI)bgZRI>nT%g3%=zDIV^6tg?JWpAfS?g^c%LN<{x0jbjZ9fq&$UBfx zraG1#@pS$NBLnBnf?XVQ)_bD4B-0VH7o0risVBn32VKDzbI+--cfIPIiYCImTt4mo z@lbA<^)T+NaM1CWPCA1IZ_?b#_p&IOzw0M6_JpopmxGANAlZNie0%r42CdJT6YP&F z${D+~tp3~|sZ)|Q8n(Mhvw_Wm+{Q6F-*ppP&vUG~>la78C<7Bt>6p+)P9;6x$dsCD z3oSSBHElvWg<+SowWI0|mchBVprLu^vt7lj6MXvVwXgFa1|N5Xy ztRPjHd(TD7m>d-y&zPJcZ^$c#`9xVoH98-8kZ~4+dcAki5ACilebqcVX+qR;S4yS2B+q3 zp`3(WEp*}}xR=qIjtFKaY}0ZV#j%#G(C1Q-7{NVr#?*Lwrv)dB>+iYVJ$lIeXdjew zK4v&4__36eW9|=?|6Ayx`_+2r;hWumLl2S*uo|?@*X-=iNn-2(a*Z;5a-=y z)uIav+xuAqEmYPoEXkTE;Tv=X-blV6Tg%{4&^4(`^?P9b1d(^%+T!gXH6{{-)2(i zaDC#J!-S1-{KBv7qf8b-x$Zbe4!%>`b4{j*w_CM$?PbkwDde(je*PudY&H+58_lxM zbt4aY&qO$1%=Fc;JL^{(wr^I+8L?w5GVkp6StTP(BhY7s*D$a5z&~JpmS#5s^qFIP z5zuFa*V1*Om!>}b-liR|#{DUoVDz5zDjju|hf@_hR zOl~@xTm4Qaw)Z;?@lWq}*j4D>DMno=3-=8BH2@&4SjjZ6R-2t|VAt0gv}>I=ZlT^s zmuZJ-Mnz!$IK)=|s0Yac)}F4$huI^%#4@g^&)$jsMjDMG4*eKC>=6@ftIxVjnN*crcE@>%c!&t^BYU=AaM%fg;*e)eqs7dwepVll z*$d3AQ{WnnN>hSuomz&5w|B1h=Jii+dsL&dVw5L{zAa&RP_PW5~F z-hWtQHTX|2p}H2IzsSt4qpWTK$lUl;tQoFQ$+z$Nk&~+bllwk+AulVha?%E-#iV1{ zIQ5_ISANdqK2M-q!|uw>wWS9g8FlsAf8}T;BnT}`s4Ji4+{~hJ$MOzJlk)OfP0%h{ zoRpP`7A+u-e9yBkvM^L@u~o370ci_-$hNiF_LabT*I3Wwl7thFm`aJocgE;W?8*O$ zJ)lgGR~obWAiYB$_^yt9*X4iVf)HyI{TzAAPV(fsHi9^bNWg?Yr)}E=6S8MH*B}M! zFWG5dGa9%D)|hg}{Z8!X7tb$R#AN@_24wzaFvJh{)5ztIdDFBLv^sNNRy`(ymXu6u z2mwJ|n|Sx#o6?up_J7gg^M8c1DAE*0LI0sx!{0Mo(l=8K)g8|hu$P{;?(X78IkuHa zGYE_$tp?L@Jv+Kq0#Sj2T7e%DOL_&;Cn>O(a0hFNp($g z@rHf-hjZrcd6(v&W$q|VIO4|3Z25w(-KNLiM5;>Xfe56c{W$(>ApNr=}XkuRBknBq{&-TrqULfcOsJ5Yo4j_B|U zXg-!bSf?o{pp0;^{A`8LL!YSnY+EuLPN|(&#>2Sl!l${krT$5wfj+?y&r>{zLZ`IX zfuh9&61TCy&C;|2Q%(d|_GLGI;~wQf?6C)rPkG?a6*(2nT^Pe!?m*hk1x#dH%t^2} zUrOgJ0uko3l5H5L1Kl4NJHY%O4+^p3L7AyH=Cn7H1iqn|+?t04o(sKz-G3rCPK<1&wv&3J6<+B- zetHq?r@JGqR8`+;M~!*@8}Dn)-fLs4!X`dqoF=B{JbX}?-&Je<<~ z-d*o{+=C6b%#KW-9~jA!K4XzW^I*I1vBY-Ad*=e?YMNMhD)aA{oeQ3;p{7#4dm(7@ zkw>l-%>YNa<(a#Z;3B!_xwQ~N*bSF26yds%2(ipVngQ|NKWxOO6(Pb?slnmRHEbtWOSN z>mpFzeZ6JT-y#FVdF+(NBihgAT3ZeF)qaoUJU_>TEE8Je7H*(~*{m8-pbltVy^-Uh42_>OxqUx1w#+wdn#b!bt_6%g{)B~Nv z%Gr-y{qL+F zuCZ^9L0Q?EOl~l(UR#ucAhID_#{rw?Gt!6d$W|0ATq>#pd>_BI|4+zn_c!ViK?UGQ zAm6h>JXu+zNBNTXZSjKiq(z`G!U&nibL66qy7~u-e>Dp+bYgX5kNimCTYKD+kf7G0 zyOp&12$>8t!-pBqD3tF%)F)!RR^{o{mAbV>gePkw=c@|+hqDqAaNY!kXcQM)9ySFN zk7#5>1ih~KKMBfrTV9rv6tu=wWeeIKxctAKS_y0l7x4b=P$sun1)qD4e77}dOyITV z&F`FHCq)rKR$2yQO{&RrdH>I+%t*YuAJtpvU6Vd~<5%C^L`jC`w18>>w+#L9(`*${fEGKKE zQvZ*|Sz|iTbLima#t<+xXR*@YKNMP1D!#~(V+_ulJ@rOb<|>i`4Hl7!G^y~ee^E}% z?uYsE6_@ZW`QcID9S%uU5^-qj!3%#r={dHN@^qEVl(B!PoS@lye2M8tIZJFTWL(c3pd{M1*3Jy z1sqZHtXIZbp>ea!C)U9sG{@KF&El_ZH$&98$=vvB=qKONkA?o$M9|2pQXW|8^&@Te zxY`>0^s?wq-D}{d`cYZklZz0@tADnbl%voHUd0aB@UPy4pSJpwLBBu7CJfC^d)!)}c`>=ruAm5F&dNysHt1Txlmnt04aWNS*D-Gq017tSye!9Xm1NI4<|5;Z2gD6|Pf zIkX3m0Jb8qmAoT*7dC0@w%8`!m+KrM5vnzstLr&k{M{wGpf6+Q7fd*KY+F$%}{zO2JkgaO&vQv6% zxQ8y*NmifgNmOIa_5o2E-cZj1CU>dZOkh(gayN#I!8BKp7=TsCm}MovR-`o=gNro_ zAnY)-31;r0Ng!SqvXMCwbw*?~jNN=BiTWo(*}y*H-ib)&EWC+*H1U&{<0JyDam$+G zwg}inVp}^lWPhL70V@)gS#Qh4R6&fG&DMq7d4^ak5M!)!c|(a|md(s2!ST8%)r<;n zA{RY{n+aLDI1kb2fqNpqDi|`>q;_TTQCQtm=toqHX|;D-Oy@q=P4x^sHi3S-n@A}T+Dnj9P%X^dklCIWNn%Z7 z>tu+8f1UTgHpl;-733vmD{xI&a0R(|jb31)9rx?>!dP~a zUe*osgqybAhJ4kSbA*Hw*NwdJJ4Irhv2K1IlTMaa{n~f*HibVA6Qh2Oij7N4+$6oM zA*V6)HgP9JY@HlW!b9uAJ2SVL^AoEW0{O|Sf9tB`f%|68$88dMAkwi_$@#>n%(nws zeZeI1lB#pkhF0+-FJC9uaKu{YvAnBd#2`D9b9Ey}1~^hJq{v@K3)9t2xMF7TACG-a zlfIUCy9vQMQ#RD3U=pjdnLx7WZqmOjsjt3Dd?0q%F=B+RnM*m(JD+1PA{auoh6 zzW=%YOkbVBw6v-p7H6yPM}$F`lp}Moi@iF5dPI${vtnA_^No!+gK{`g1=TfZWL3GN zHnEXSm`x`rrlBPIZk@3TQ6##T$VE&th~32BYCt(RjBPr9l1n0H;WZV>heVFruQE1_ zA|gLodqWTMx@u#n?k4UCl4G;k04jAecgP`sll~VaHe_$$4o(z^ZX)(R13JX?SrKzCwb`^@%{|>rJFgcs#Z1 zbUxxj3^5JBtn-hNT4Qu<0+SuFn@YsXESkhnuem?hRn>K@H#7$fvc9Gy3_~Q)Y411j z9U4Q?8=@^0<1%OR$L{!E)X4Yf(xLcRo!&NkcVc#guCEs{GT=-cR2_(v*Q!00Q*Gwn zOxNdcHfuYZw~1siOa*V^Y0G(UIMFkr7mnY|plNI-rT-X5BA*TOYQw1sGIk(z6ML@i z-%Ub|b@64XyGeq`Rg3}OuWJ*%E8IG?QI(mQfBn}7W!Me;*9ARw&QxsdMh+~4Y|X@G znmbPL(jalS>yEzE#!B-fGB3)4hi^<@g_PN2Xs&s6Z5=xrEy0@CZFNUV;C`~um{ z6t_CUcoQ+G>0}`h>ot!-9rbI&*|HIR<}XqexfT_CZM~ra1A%g!y}%}_AWdMCsW0F7 z9ElcK*HJ7dHVcU{k+Ro%%(|Rv!&z7*FW>lPOw`7&`;2Iu>&};N%Z3;O@s$zM?pM53 zFb69z?|4T<u-Ak*%qJr$`*` zSeG@Vef}nlwDL>*189x;H)B|p=c!r%5Ie* zTSyQE1gi`U0wS_kYpnt@$~GXNj9>ynksVh16G65}0x|*>glJer2nY!LFIGrCytmK) zdHPr&kbK|0=brPP_q^wP7!HLDwLWm*se)KZU?~G^*C6&d%L9Qr0!|}vGRc>NFbhIA z3Us$ke}(xQz9Syfel92Q65lLA^C|QsiK?mL5dffK6h-wN;XvIzFqmc(2h8e1Q4Muz zSVD*I@kY!MMow1DL@)}Z-3=&uBJ&W!N%Q)nP#A=;LSQikq2jO|bTvWH_aPum!v{rB zkOFMGgxZs+atOpmvm@22h_s4VKPNffL*&mWulYMx^k7DVz7 z{a!ec61kbs?gjf$P~zOX4^xs^sQ-$q@y1ah`wo^-6o|5y1+lF_l^HihfPFl;XN&xy z4-A>r?$P#7Zx$q9GVtUJ4a!&1VIS;sO7?`iG$JrDo8x4jQ>ZS}W3mFmP683zjzGqsoUogtZ1uAbIwy2m+9K z*&6{5dCGz~c#+`*F+n5*kueB6x(Y1JV!{o`sType_;JbT$q!ml=rqU%1-FkJ$0n+a ztkt$`ET-b0jwv`>3+`pdAOdOza44wFEQAv7Amhx*gV{PbYU;@Hqw-BuP_l7`ttBv- zMjPmkfg)E3G`F_e%=#Y`L@Y^OZzT@26qJ6eh56X|L(+Ad+v78aNsIUqy4x-Y9@NQW zoOa@6guvin09PM{AMm>nc>%dY7qRmJj>{3A-69{6DHCj-!YCJzv6NUq0R+gtiu045 z1XgFEzGt;rxJ6L%vsf$x@)uVjZ$UE>IK;hJFS1x(Wwm4@tf+4QRV(d8qQs4|h=nnG zh>B8^n0#CSrDp#IUCVh20ZULV-X-o7YLhRVMcvD69)c7nm!pIlQ(hJV+p_3)z*%X% z2|W@(rj>@m0>0DG7_#KBqkz|2LI zn@D9QsQ1dn0#1H;5QQ{IIdC}>kmt>GVoc_vZG1}f;Vbe-S7DYAcnZ4DVJg%kYFBIQhp|47V7tgoiy53{lX;O4t>H1@lAYNI@4-I=OUPlwHA5C-{_i z@3AGoMa3;W{|zGg65{t`PVWNw2R4id1s~D@+cHrx#u4c@OQAd_*fCkejxh(2hc_M` z76TJABw#?|({ywCVpqK+Cg_2`n@>084wWDztRq;R3SXVWd~Js?-zTFez?C!sb-o}} zL^e*ed=|NF%r{XR> zsQA_=Gi7UvAkDkT5fVBNA&NeA$U;d6yaa^{;4V2CiwRLcQIWG?q+Bp&5To+s5xCG4 zmD~|BdojRpfsB$4h(Xq;rx~cvpYXwK=t4db2<9$gE{tEF&%;U*1n7z_SXP1`qKj=2 zw#b`U1#?W`{K?$KRN+5@qfg^XPhnrQ8rCd8K0CFRH3|}6RMj84m?xP76j;5dI(j}NEb!Zfr&#j*bAR}kV;d39RANH&9_Fh}UpVS5$3D7R#sa+zS!jsxAu(u)vz{ z%7iik^VB(*q149lypNBrR;m+rGT)DI};es%1=lFl-a0WGcp23Gu>iQ z&R~LtxEXaUj9t)C0rM|qAlS>87Gw=QUmK=4|1`on<~wx#po0nEz;Jk;27~TA1Q*%I z(?X~=M>S&U+hW*DXasg~@=UL+qzUc>Uy{J`$iA&B$@t6qH!4Ck-_Zvk;}8g(#5P>o1x zo^S*Mv^Anoj|pI`?OCXkRX4~+wMbmJfjG(mOH|#9L2`&GX3NC7m-B9|If*~jZ z2cTg1cLe`y?FmJ7OQk&rs!vbA_$;r(M)zkppcP^JmUfOjD*p1A{6PvCBZ z@_~R{43t4wym~(ZmJ(7Cya}s?g?O*-AcVUh7e^zMo21<}*apkRg&~`R4qX8|6(G+Y zd=VF*ZUF^vz_hkQ%>;yl*+7If5ZVSYNe17;a>-yE|0FMoa905EMH3%2drXIj~psHZArGn0KF$)7&OfqSB zwW#+J{t&>>ov9BVdl>Y%7oq9~f!2sqlgmN{m%clwTAUI}7ZB5e>Tym~LO=^r8B!dC zmBk1g!9M3M#EKs|kD*K!nyEnhCjsF!J=S9Z)S?H*-NdpC0=Tdk+Altju2rCp7C5>z zc=Io4?<Ns0SomI{P04>3m1kAegg)C|B1JO!*iq!DV1fr*{i#G6l)#E78) z#fT!*Hvr|nEfnbiq`L#VUW<7m^YsL@-ww1SN1;%QFESs>QHI`RKw@GhN-DB;0<*>f zG*uVk!Wb7Y{K|qa2P7pA$t11DIQyKDrUW_fx-4Jj}&{s{C1z-vwyK)F~^H8#p# zrrtMUju(ITxwa?~uUsl>V}?;&Y{2vxjIZGHmts>;5g5?o7(>(HPm??4u6K_PV748= zJy7T*=k0l8CfJ|x(dIzfQH+`QAcsn1uMr!Gn1-t5;zT z0+9M24o{rjtoCF8K^KE5Stvu;4bPszp+;#waPhJzt9C-Er5aJY6=Up#SX;I2SU<#v z9u-jT_0wD+czOylPK@4lo8i%dB^wv}yaGz0;v(QKv6s29)3}4=3RG2r*9jFE{|mwM zZN{D`Sz%h;|8-U3VfB^y(^oNP5bU-Qc*cS{@a2Mq8Uc5P6$UTJ6~JW=qxcLr3q*`% zaeAO>JHQoIV>9D{rEe;c8yQ$?dXb4|4T~cXZ_qTV^C}TI zLP2_tzX0BA5m^&?465q^GV{bbXiXh-OjJrjfiYSRUn%bf$xjD0do42`V9o1 zDVzrHF#+s_A|fE+x}y-nkEwPfl)ZtlOW`zBncopUi4fq5(}-Rzdf5yj<(zuI7iIlC zLD2?(en28P{)j*>+|Yw*zu|8`!NUQ1EAus$^TSBHSqLb!HHpXBC zN}i3kuyAD&{*%fWSOLf)%|WhpMrbDLB%v~_Pnn6aiFVlym^T5700vW$ERZ808XXW_ zuymEd|7y&Lf%mxs?(Q6;d?%J50O##N&t~V-hshmwr~z5IJk)@Ov0TJ?or?KS(YstM z0<1CJ9I)=}V+sV2w(;}HtpGVlVcg(iWDc<9Vw3Pixj=3%$`DH9|BHDf*V{wA6ktD! zpnDDyC_ikLwis7XBlm};`RCVMe_qwmU3eTSj|7OVYXX`QfGf!OFTaC}M~Q`EjzFcY^CLO} zps*2i%wsvjg}|AznUI9Y0_xmR`htzvS~H*OZwtd9orMnpoy#||c!u9D^EKA^`GSlY zcW6EY;G7(ETpw_{mr>Kvf*fmLH7u}R8<$LaTMQPwiES9G{dmroYMXKn%Qoi^*JIA< zd?cN3@UBB;UaU@RR>^mdK?G>#1uitZ3`%Yq8ITmQHQ9yZ0_b#jbpjwlAvhog=CiA- zRO}MMKL9B!19f?Wk%*mVY4pR^5!}&8E!0#22Q}sbbpW7+{~~I(#hrWvV8czJYHU-; z%5)>DGR+Lc=rR`7)gVS@pmNW?b_6nN<6=DtKV57bhSI{olVo1OKp4K^)QxCi>OlNA z>j{E-IiT8BLWwz|5lEiZ0v*XTzn7EPx!-&OtN1b2JU?Ot@bOZDWP!j;Vpj8#ru>iK zX-SM;uhwcaH@>zUV_oyHrF1JHQ#?r@!m)zGQrrNI|MN34QSi%SH3EF&Dlm7jSaAi# z3sgfeAp`j-zEJHV(8ZpC7D++*v=u43X-Dl-Pa!IBBy^$5@`Hn@gnzse!6M_D(=cdG zK!SzzAX)IjcFJZJcC4^KP^mPdHl-L7UjUpSNk%okh$2D-Qv@}>lgBB<)GGLy#Q6?vu;<^T z2ojwNj?n`(*%=?iB!UL%##F(5;^z+?{p~Z+NbcX;2P7k;bKr_6DSgnpsXxS7e-417t12zu{ zLU*gehZCtATtMO0k$S}8CkMiXg~0m`A`l0d#Rt;|%s-4{&>0b=d5Gt2s2kuB!Utxt zIhJi-Jbt9WMkuZT!Dm{KgkJ1M1{a2`oX^55=KxXPK|O;OTg0)%%!m1j zJl2wiXnrUj$#a;nKul)8u$k3|nDRu(Y)3@>0OSy^#$C{Mq<=|H2Yva38CY3&eu_`a zDr`SD|MK0HP&*Ll1I?>M)k=^f1PUCW2LK#1FauZ61Q$;Rc^sQoEWUt?Ps99$K%zQ5 zGyWfsiQ-N`=Z=9Q8CvRp9-j38zty!-@UjKFK}%2pEgi}`0as665;pkk#gPO=KFB&{ ziuinQMFi3!6=PrE^DQ20P!jSsZ^TyDLG}2bwgGFzb}5Ttd1r9lpk-^g06sn{FtJSm z8j--mpUO~DbDt7~LWNndq-ki8K__q?VjMg_x9G+`O>7}iNZHIg3T2S150Ked1izTJ z(#!H;3?SI@7%>#(?}lZz`5fuI7Fy8q`B?D|vKMp!dWJtOCV95Zz=t3ETA+H@`w-<& zK<~IqU_9kwvkmDs=I0BQ<>%tu6z#E*YuNl4n8}Bc=A`1mMkwg6Lh!Ve=6qro zCf5S+8Vs=^m(*j+R*OM!TM||?%qM+#yP$X$IA@A1X2TYB$;^Q|gs@L|q6u?V{0z{e z2m@yY>Zb*5`NJpLpiPOO@19w32=DqNc^N$7QE;*O_dmAe`67$KlU@dIa02t{mT2x4 z-;C)tgt+FILDX!?iU9<5K=O>nGWd)BnAOFBstBY50-j;alMgF<+)=&Gi99G-3Bq;= zmJ;RPW$`gsQ3!bI02ycj0T5^ILD1j~)>0A?!Omk-8onfsJ^`Hr{pq>y@t%ec896fb z9N{IogD8G+2xTU?X4F&bDlVgTwmb#_NStyUQay*E{W!Ux&$;x$ho>Z59)>+|1Jpkn z553tWh!OdYw+~BC@?YqN=WamT*AGp@fvYaYvV;8hQny9juxU$vQ^^GM$xCge)6N#m z509N0cl4bOT=Fp251B)d&yvZ#{B*Gq^~?!U85LTe0FDKv^CFKS$1=Mi3SgwNc*Kd{ z<{FI{=rQGino@Q5EaG5o8y-c_WooFhyZ1vZBge0ebC?Jxk=2F?VGEc8bl!SGM=yhP zprXhg##Mn6@An2OK?1!DWe5aFE=Mu-=bxZT2o;i0)s(2(!~F=_O-&J-EG@1Js|#5o zL`Fh~256ZXVAes@IG2iIsBRZTLQXVl$124UH^a+Ay;%YLArxRQJB<;ndyE+B&0eF1 z*Rh7-GYbITe2Ajml~E^_S&V$T%@kI7B!I^_C|8QN$719~T*2iEx<~*D zHVKTkMz&a{9w1j7MFmd+inlL7HChugmy{D1^E__WHjGIuX5UO_=$IWNbptlG{>rDH z9Q6_Y28U&0_#{Qp2&(?O5o;*|>{AgUO(yAJ`4;|l^)R5*odMI09LqK90?i`9lSblE zI=S~V(frq- zhUsLE>R#r#p@s-L%3?qf-v!xWY5xW7o>oA>l744?#oH8>AWhvx#4&PUW>+YB=(QgP zmkD^`scfj4e_r;06-w|kK@oV|m`53?5w&Va4br#`6ypNNlZsuoh4lmve?vX8xdPfT z@~KOmE+~!5!2-g6w|%4*DJ5%%WAXXx#E$w}aFBrhaDw|2HG`yE(6$Gly!m%JY9kEoLgp0ODQRL)W-k?GlqRd0wEIi|mzz0)Y z6ld*r3!$wRc11lyv9S}o-yahIkeK9S$#;Hc(2RYW3BR3!)q?EZoJQ#OnQp02Drzaw zJXoVvRQ9bF#*qLYJ3pk$^BSrUwJ{o+^8zyGAquF+3}O|e{B*wiEQ%9GN$m;K5r_#* z9&k1R-1NW0+foznPGFz142~hwF+e_jE5WqD8Izau-490=no7>oohZ6-AOuCKRU!rS zCfIPi`1z#WsL{P@*uJcVx=19L2D2a2L&0|uY6;N7FJP9j&!iN5uhWQprExb3=m$eH z$xoYG^PEHABWb6=;TDWLd~@k5Mm0bjLAB=wAjPHc-XoN%bd_Ng7qH|xt9+pK#0_<2 zjywb{Nk9>~++izNXUeB5SnuQO$q2=uB7oMxsGtfbAj1@-8TobOahC}U9_5#<8Z$9T z%|ZqWtivC%P`Hd1l#Zke`lRpqTL`Q7^?W{gx&c1OB}rBkw)a|x>E?%VZ7eKB25uHK zqJt(?(MEXn5=`@RMt1gfV(YK`BWD3uW&y^f2YXKVhUro3z|^4@!olek^$Kq?p;BP_F+V2hE$Bwp#^P(i?zXnAW=NwUex2&=_>Gk5WrK}X(IY@ zM@>@c)n-$am8ldeC{O=)zALK139a>r~OSQVrcG>025@#MLeo^TipR=MFmLh#6?6U zn^cy80LX+sq(^dwOGecUoI0Q;33zZfEZs$QIBFu{u(8}Y1k_R3o5AymDsh+!%G~$t1PZUsNltGQVk|%CCZI&@b++Eq)K;Ww{D}zEApo~Cjmpkiix3GN%M_JR6`&?Tk{!Yk_F|oY za(nsrF`k-lNEPt0xJ%Qv%~ock@F#Myru$1VxNm{RP&06ZQ^Sy6n<@lFQD#NGE0A-{_*(DcbKb#V3I0j_dj@0=>4v_4S_~r1VtZGoMTrobNTWjy{ArrHiFK zvMvf``tC-!Lvk=`Qr!7YsN5awU@c0B&T~aAx*YKBXx$bm1odS1ARFvs6&C7D>IQZw z##;`XHt@a7NChSv<(GW8M^LhzMhob&Eh&70#}KxS4i;gHXdiZe_8TzQ6kD+Q*L^+S zKQ#raS@TW`J1P%!C7SP7n>iQ|;0m8%2WVDD6sDM=V4Syrim?Foj7>V?xlHrD8>PsT zp8y6^cR*tsDCczyLq!3gW_cb{U*P9$L1{?4*$u5K0V7O@3min%p6nF#A_8h_$F-;& zkN{1AKb^4Gncy(dD+m$hzn-74m+sS#l~OMDW~hA&rK0AE3lx~_#txj}hv04owE6|$ z1iZ!tvg;$LseAM?_>;N-@y>9b0M8Mp9Z2#qaa#kl*$~{+9rU=pOa%W+Hb;$@By_?bUj^o2u~8Q8ixL3FEGgH2lq}9q!A6np zN>JJp)Ed=M9YQ^&D0d~2jXGdU)O-B$Xx2>x-Xu`5L@~dq$Pbm7){Pg#j^3xr#0%

5>aGlw9bCD@X#@;$F;bn1cXC=%V5s2yi024Q#(?{N)J7k}O zk(YC}CnXs>SCF8ivMvf0DU(1^qrk6*tz9sWRjvfB5<~!~48h6w!NCjypu1!XPFmjr z?Gd4~oHMxj?0cbK&%m+;b6~sP=+Ew@vrE5|l@+UTUzWeJsAxXFGyk7L-^1=K-4D(5 zL=gqs=Z!xh_5o87_HtpdywbMd3(LmlsGWZoCHhUX$_uZJaJ025A?03rRIt^ur8(xw zyF#zYbB;pN&fS6-r}1qcv`zQS3wLCxnK7IFz4BXw9Zz`WWb@uH=m%N^{qU9tQI5g{ zr@5o`+$ZGFn>aa#2V$HOtFRvo&F1MNg?o#juRFQ0C6w~`9Z&B#)HBaK;bn~R^Saa` zc;xi2$+LMj^qAVIY3`_HxPNgsZD<8nx~hWJxpX#dKKg5Xy;7jDBmQ0`!k7O@A5Wja~@_orq(^){@t}O4on!J{?21mSj-2l{E0; zTs-HW%H>f#E~>f;Jv9XNMO_6)9Ez#dfU6ptCXU>K-s3q{v4b$ z!3XnKa^UmP4|NRCL^!UnDxq`V*ZHgkyi+~gF{0#p$mrY^>bGY_LEwz-q<41wOFmmm zW~IvoEsr#>aX8NySF~fH-5mC(<@2;)95ie_e_it`ch-1NEujQ<;?bD*?H-iT^zO@{ zhlA#I6f`dmTj&!$k1OjZ3JS?(#SNW(WqRA>7#~oAC`{PDGt{u(nB`N!mIG<b{OGyM3$bO5{(oYi zq$RF%#5C<9j%732OZ`2aY3&vB$lu`rF>j6D4C#L7TclaFJ*L#bh6Vq`)zO6(!5mhvv>X+`!Cj`s}r8+t|PU1Rr4Eh z)&GXg*GoeYvc~xW@!7M}IUf!PnCw0bvooKDW&$nfj~Y9|1#_kKK`{DZV6H>e!@l+y zrw0YTx%BybWp@r(9p>*vWJRC(SD?$GyR-KiV8W ztT(0myuqh(eVD1mVDJAc%IP_K9+S)mqdeSE$k+l;3!lTlG-QoQ7J@xaI(kw=p9*zp}O>#vJ?xCNhiL&&>kB4H5s~ z>zV9|-bbFb7UcEV(UYA`MRxx>3E3(!5nm_KS=cdgVT3?`Cl0Dxp>akliE3=X>~5I+y7oxb{g=4XkS{B zRg44EyMOi^7;Ws@lF5AUz@tC@w19Z}(H(sP80ohm*Ac5sgEK0Y;DA5*8fN- z#@ZLo;Z{!vOtTb@6~AP~<;~alcly|Q9$*0GDV_D{W7GLgPvKy7@pD#Xz`SYc8ORQ% zvC8Ine|^deOskf$-qhqTonL-S_1SJ;{QqQk&HU`H(X%U@pIzZ}4r@NigE_1x`W%+c z|IG6J|I4^V5Cw_1$Ghfn)I6WrWI$+7`FP#OHFFO7`Y>sfFIY02d5z1@ok?GM1W0dc)Q&NUnT4xpjzwUC2BMVrbp7kwFhf~*owlh(4GbEWLWOqB5`YK3ucy_D0yP3StWHCaQUC}hQE89Y zQ6Oy?j)GG+mDR#Y`2H1vQvk$*k2JLej*F6|q$nwE=BhC$4b#F?K&WlnCCTy;ff5!F zIc|e(5zYnU#P+Y?WEjaB> zqS{-=fw?#XrBWy+1pol_Q(sdn-xQ?=hQm?ZIW8FKr4(IB3C4kA4YBVhKyX+9D;1(7 z-r!4jjr3d^4jGTWt)q!3T3s{48>0w*s?6^kg5v;z641oRON3!06%`bwmW8h1MA((k z@tNRv78({XC z61qUc@rBdu;o43-xfVDNKA+a*=W=vZ9y>|-DH{CR7n?l_vVlPZ;FDqUBp~IPV*m~7 zt|q;NMoB{5#!P54pk&REZht)R5lq*D@W%FHm=Hib*sMi>4_Gl1*D+c=_-Y>q*_UmJ z0e=}G{aF?;4r7}v1|&_R9B0l82(Fj&f&ob7+=+3DT=lh5((JwTCIJ{}jh67T)s2I4 zIMy%|*L#)0c>|$nGDMPWKrM0AVgfOJOi{nLu6KZP2de81M|pAOPSz0IhJthx z-sXyffQAY_AkWA`(zfZEJ+v?=@|A~HT8c?lnF9k%@Y`+-j25my@QpdzF{l)4I5pl) z#8b6^u95D;(WrCzMdL(3J_x>T#^M#>Tu|~so;f8&E;PqN9RWPJ+&|O;oT}MaE{7w5 z5uS1xuSMFS34y(VxD6Gx!Md_E)h))8c=Q-dy&C9*iW%fyk#Y@s@)C-M(cH}O7Ewd{5i%{~M!Jt89=WNt`B#+J?HMrWs ziC3n7=KZ^fvdJ3vBQ!3^Z6YoC`WjhFTdBa$wqcd@F23`3err1U04_1L0Z^?s!`PQ< zK>+NrYlF$9G||!@)@|6Ozx~;P>kD@L9ObsmO15*^?tN(@#|=NSrv z++7`iQ*8Ic)Pox*bT%I)OWomVIfIK{tr@eft#KN%r@^$7ybQRTHgpVUbDn~pl(a5M z(v4{jnj^x^q|a8P+JRr!{Nie7ru9_bTM=7^Pi+dCxE5Qw75lb7dYQ(~nD)%Lo=|=f z^ZCGwqftKfcWx}a^QbM&!=mm7quNDFlglq=O{}U}q+1pE88kCyh33MVm~5YVs5t&n z;#O>Qk`a^kqlK=0-Z%c?{d5ns=hPd&m1SXdT4xVgHt zul%C*TBDs@12arXC^gMKbeB*4_q3zp9d6)cP-1Ccu0hwb@{78p)KZFBN!7-Zb59!%EuF z_7l^61NOVBkn-Ea@MZ@|9gcQA3*>_9K)AZl-J;j*j@ZuAVLY}TLJc-D57@3>uYSq2 zhO{+cQGcNN)NIW%8E6sN3q!2A(M@Rw9C8*ys2hxSf~#3;WQE5sYrB2G0k@D5Xnk>^ zfi+h(5)YYe1l!Sl6N*a5?Q4yeo@r>=(VTYRh5l|C4NtSSFlsxuOJx5nt>{j>dI{JC z?7sBwJ932DAPbXMX@0C7)5N%6s#bHaHK$4Mw1;_oPLy zUd(z)FPIq-dppXhpqMytR?qs?g%}qLy?uapR1yj_&)|lFg)peBoMuQG6`sNnx^8dh zzP3OP-`2}QFAko3dhz`2T${2gL^#xGZ^Nm5Q{y*g%zr}zPpEHSz&E;UY`LMKe)sUx zg){b_{)n+4(;L-=is6Wu&xV#vt^(g%(J=Wi zvZg;h>$HFfonmEJdgBVALmC1ZvFCciF`!lILqRF~^YLu(|0%dEWY7Z1HEU^LmyvvmFcZgZhdo)VFw1?K* zyoK=BY2_DFv88=M$i3hWLi^N<%#Wv6FVeLysc9)_NBKqKqBgxc<1J(tmk~a+=*H4M!@9B7o%)TYa<-3Mp&7xu2kTAPo7vx; zWHqJd34c-KVytp_YuwFI4vr%i(Z69(%&ScaiCXn1u+PJ(J*)V~ zPB`CvS`l!<*}f*>IZ21Y?CaShB)*Wt85F&VKk`fq{HEV-&#=m#U!!w<9x|v>gdnu) zyM$MM{VGK|yH>Qf90LPPzbG>W>4o|^V}-H#;URsa93PExXXmLU>TP`w0uX<=29#Y_UMwr&s)-0t= zQ+}KPR`SEb`Lgf+dh%CK(s07Hgy6r>r(=0sd40NW3(6a8r}iv-SlF5nF6*e_X;w91Imq4g{rT={*F=xo z%&)lMzJ{a+XPXABf9C^e-=_txzqr7_=q}^RH`8I!q+up3S}hwtdf0yRE~xF0OXnL< z*kNHe1J*n&o=iP**pQvsk@>}%=a*L@8~yK67Q1GTr7EJr`IfNK>!2QwJ2T>sjJ>Lw zFgd}Xbl)^B6%MNuFV-FLT()*u)s>%Y_oRW*7Q9z2GwU)~SNFrRrD~JzmbKl%9<;(4 zCN?xgE-P1*NTCsoeOJ=M0jpPtbnjRe~DaxQXRFQ~fAjSa4|63RTOciy`l@)sb`VF%KJevaao zJfGpw{jJ_fFKe@CAcd#xcF0+vD4!j)^wi8C+yavB3;i^B=-g>sKm~x)te-OtZh<#Q zJm_cf?pZ;s|9g@m{xWv)0%+%s7Tm@sZEJ>6V>%7{$JuVXZ-2>6Chcm--@vUl218kJ zwpqZ&ciuk1Xgmus+8TYaA%FMX(X@Mr`0X0z*$Udeq2R z=9=-Q>=Ig=d92Ql<6N}YxfB>umV#fzn`rfc!__EjxzD@8lVS!R(CZ)U&le%nG7~Iir*f4MNsn&9dDNzbt^6|1zVn-PLt7S~gkd z0>pqn`vV$X=DG$%`i5C8Si#>Z+a6RU_xQTr>b=wExci-boL|>FqquEzR1Mn4%jN4# z_NO_YSvcLq{c;iv?mwheT#0&mXWWh*{+|WZWn8BFFVisc#)4eJyGXib-G+w8yQ|ku z@39RH%f_Z-Z|pjMd{!w@t_>20IsuIzEw~VM;!B<8%8ZX4tmpCc-3&sczdcMdph|xG zGtD6BhCx!)f+P?C4AytMB=&!AX7V!Ca@O;jd_Uurtqi@^1?d~IpWmJ{Vz}(b#Hg)? z$tBCD$JDPKoSmW%3ljd;a9lruevVIP=BRP0o{;u4Wql<(&nmNb=Op2Vc^+63H(lGy zRF@ai_t)aSw*7}V#Rlmlw`%FtH|2(sZww`UUrO}AC$%D}eeoe_-*Gcp@|&3f?l1J} zGi)2G-v)O3$*fo3T|Z*MyAeOZUZn;l>Hq3SIHc8q`&QEDZ|0Ju>x)SK$@^lGkMA;E zah-=@_Lgtpk7&b93O>gTknq6Y-}~xEj<#MD=#r!w)9m0=}$9Cx~KzrrnXbJ~NT5&u;O z@5bq3;M-R1DMw)<Tp8`jR)M2Hc$*>;!S$}AbPX7mn_xu?;`D=B{F zUjM}@7SPf>L~mNtQtybrM!S#jXitJ=&)|c0p?zvxpB8KW7+PGc5_w3#v2EM&-C7ACD}Snp|Ue&C-57d;|B+pvCmHEWGBf13g4`3n`y zZ6F6f&BMVpi{2g6gG}cPDq3i3alj!@|95&C_gUC}wjotf6$G9(62m2{%hQ1+lc7(^@ z3tjVc;fl=ShU?(K4@LQh-Ce!J=1>BsH~eqYdtV~5Zi0*1I*-owt{7+hcM;@Fiy-n} zA{b5rC0ek^6+f+=_w_t~gYrl<=RCMl>LD)gUy?q|J;l?T$L&QBgN@V1wswV;NWZa; zIN%m#m4j+Mx7nrk*uG03qemPrQ$U}6h+D8(mWj|aK^icfvCuDPEHw7dc4ziMy(NI{ z(_`GH^kHE|+aC=qP|l#~vdw>;X*p6|_cyhdHq+F0F8P3(^}nbE%~E@?3)Ilk68+!l z4Kh2u^nti?0<^(-4dL)5{c55%$CZ63xb7nkWnCakK@Y_8?|+zH=e|oV>KV2l>=Gq< zTxxuvU)JGZ7O8ZRE~{3#tx8c=mvyV%Ra)y7(nTn@E?A99vnkTn6d#L-l9mu9p(tG@O?E@I zE}?WA2~kbyUNisKIq&yOVI-IAe1HFWJl+rUHk~=w=j(D_=kaF;DQCz zI@y(&g84KwKdKO@t9-%JMiP$VYy!aV>NgPfHcY6VYOhxXROc}B9aINwVwDnN6SfC; zzJ~1)3sJ*B_MnRr9n&R<+i8CJYU8sojDTOutKXuo`8y&O|A^+Nf$Vh`x6mrY0FJO3 zPmni{znI9)9Ul)r0?Oa`CWiz3R1=)UlU#^y_(23A2tVHAieDgV5T7p);67Jl01lFfBk#4KYvxe%%?UKn@0+$N)${ z5HkieP4~0d5q+xe=o?%Yu#__miySt=LU|$wu%uFZ5@8Acj{8MoscL@tnuqi8#JxSM zrx;=cxA}#XdJ=q|g60!=3UG-xcnTfK9iTI+E%}=+KI8=y2)`-OeEm14W*`CtG6Syn zT4kqZAW#C50f4VjdbDIxNfDMH_n^+#{uCp5RcaFAL$xqNs5(P`f~Bn=S9~@Eu^a1g z0>!xTR_L%mY@KA#*FimpBn{x_uQe7RDb@b+(dx=2J1h)?DWxiJZjE3A{Q3rmw*iK| zY%~RLnVn|zcFSBCVU9MlZZEfzyEERFS!+g~2DU4H`X4kIS+o2N#xksayHW2%xfNcz zHT~(UI-e)To`-CvZ}r<|rk!RAA!!G+(;>Chg0>ndpXQ3cZ#z|mPUW7hRhbukEW^fceue=28FxXs^^YHS$hnJ1whMwD^nyM15G9n@JzRgzZwz??p&!w`sl+3!SvgOZQ zH@zI(zCJQ{)Eb40wd#3It;H|E;3OTgDR!66w~X7q60X1c$I;BQJFX{YY1Eu0x353? zFP4X0eo?8))r%SQ|G8Zc@;6o8Yw5XpA7T96O)(XdjnFhTT+K+ZpiX_$Cj7v{aKojC zW5+0ey(9iDMao1j;*vSgeu4l=^k6~qREzI{Ma&WK!zpquR?})H{~%cMonSm#d-WJ_ z&YuPRR33cQSdV^M-+zZ#RNbSu4e1Qfw~_H1l<)4wZ?yF=ejXa-Heq<0$(vFWGmIAvP8qH99Yue@ITx#O~QNFr#)bJ2LhR0h+5aE=hy>MzE za6OmU#=3bKn)a)m`?KsA~rZwXOom37cGc-`0eQ@)rFd-C3d88 zv|BR%EMv{ZD@Dp7BgduwBp0&vY+a7u`JZ<4_}s4!Ns=)yw|FHjdpQ|2(qKv2Tk647 zIn}w%3M)^%eB_yK_h{=`IPbIeH=Xv)n%#rYcc?+oxsBpK0xWrB|u-uO75I-lA1|8QgJpYJ>yy z#-an-X|2y+Zm?T@$EWi}W%$VYjt8yLCN=lGJF?ck`igs?H28%(u$AjtFAr3E%S}+3 zgUrCsR_?#$867_9Hw%^dId^n_vpBNO@<=Z0dB0^L2_uDpg;_U;Qo4?XrcwRyX20n;(GB*3@h)vx{owF1nQ_G7Cu9Ly|hEi*!?7f zqGqYTis%pj`A&Us`h)(YiLB(DgcK@ZtNxze)|p)${&ff}iE@ zMHSf4CtKzoNpu=Qv$Is37 z|MVtDNk{yN#xz>pXe=5onhu@OxZ@5%#Be{UNj-I=INX4WdTQ}9VzS|1jgOu0pYfO( z^2Flc-hRutNG|cZPoHmrOT3q?AAf!tUIg}^PS!uNkNUriglN*I<3#{f?8atl1koD2 z(w~GE0fab8x&}jkw0iOQzJTaVb)zw;-Z`_VzaS=n=~}=#eJoY%oJGa_V*jo>%y-_! zNNDXwIzUg?$6j z1Ad<_(*;n)w~T0#N1OK%kJci2v{j$*=wOM$*nJlUQ1+bj^N+9Xa?}_h`^OwOK3NAh z=JA}E!YGxa!SX*@^UeXn*JzT%4gdbKaMq$EJI(?MBcC9h)iVMqvXdO>{BsKA53+*qpFE6l)Vvc0wcHE)1^o#hPw2|7MYTYax?N4;(++476-N6qXi|x25*Nlz zu44Q|){j3wt+LfK=x_JmjI5vDNBuvG>OGh3zYMjF2g)R7;f!w7r#JbJ|1>vzFWLL8@ei`P3s94qUB=jA)i;x4|_ ztHtXbA=BWTu4CFExs=xYH_gcD5`h8Zu#_2XZUZA5@gIg zl1E2>I>QtwWA>6fTB}cZ^mYH+KcfLyuVCap+D8h>gE|Cz?k-I~8nyE^ZPt+x0vFwP zOVhU}w|7mRurMScN_>*qz-Q#r#hCj82^92A|C8^MBoNy-B;Xc9lEBZ4@T%a4BRUDkCZKwTw0H|1rMORYMbqLeqLn*>F~uejAd zJ0_r6ueRV-+V=W4LPJiy5gL**{H@TCl$WoEhDe9T76f!yC96EpfY6ZtSsl_@+&0O2 z+Pzy48uE~G_DJKcVqK3LDw}f9$C22ZM{>ogCA_LKM^1W}Al)8yb6*l1a(BcxS|(5@ zs0L{zP*2=m$u53e(RwZBLdX9SuQ`VN#5%c6dF!pbDyBKa$hsX~mhBHZ-#xG;yu)cd zWfh}HKg!8$)=lq5{koiPXng$Od~BnnWYjRpX}`3zaen4`IVk=bH3z*L^L;*dOKuuh zj2t8!=#ojKFT{^KbO}e}b7nidu;U5xqzePrE;%R{DtT2FKCvejbAjP01Gj=SvAIqK>4) z=sN5_iktk^fpG3)sLGuteMvvQN#=s&h2h}AcJHKHEa}4h7vnI|apQ3d(4X+!d~B1! zr`%#ty=Uf?&qc$K;G3#7oH~zSu`g{1aI}{`@q&yiNN6Q8TiBUi84{hUi%mqRaXSqSHu-dh`)Q zn@Nb)d^*Dv08w2zRSf;fuE<(Jb4|ot3zaS=$^brrm;uq;leZ+&X_ysYE!m5bq5drHYfI0;*1OfU- z7$JT^Ose(~48oV$9@LLw`3Uv>qwyl3NsAp={Gx3{A3+q0Uw~*$pJ;Nh<-yROJgzwQ zllK(@Cf1P@zaS=m`Q&|t0NMvJiN)`|lXbjk%+D$&gHI9S7kG4^=!s#!mTx(Zgv?6%{{-8SA8_kkKQo!rXcU2z}q=x9;~;9W5`KJ*S6 z0%W>?iM80FMQ&yAt{8{4el!{dH2J5b$9UX8kfe6=V!q{Q_h&VzU=13$5Z)E{!4l(5 z2Grjtn+-4sVGSDU$GhS_=>HZ=q(Flrl-?EiWV>WXz|GA`)6RDE8zC9x<~^K4?Q-Nw z{U0SSRJ*zpZsJ+8A;}|LOa@G>ww=|9Pg}=5NwwSTNi}Uy-B3Gz%o`a<{(Lh7$sC6_ zGmz*Nr@fvnke#fw?K;=LXpiwE)z0r)|DtR<-jx$8|KSoVEy93G*iqvqdrXu%qw(U1 zxa)Q29J3bzQx=!l!X5AF_YATjSJ;GzYZV9YO~aW1wM=3v4;&t?y2(Px{3Yx9CLa?6 zlPi$@3=;lnS{%%uV^(~UvV36Zq1Lr|V%*klE-)(?XAO=)Vh?Z~y4U^-8J-7jpd~y1 z0G~;wf5{H`#LlOVny-{rfHih9`AIr?L9P$vXqw-^_o`XNc!Ym5$AU`hn&!{zFDG(| z?8%Aa3%Eok;?GE+4%j=!4Z%NT{X~Sq=kGreR0NR^I6~p` zLzDAIJLkLI1G^4G_f<3Vi@ktU&`rajb72Koo1xphjTB)@O(4pM(aD zG~GT@BM1!|G~G{k02Uw?K#d@y--uY>&&{KET2O6p17NefoPuh{&+5+_CXO{|SmMGy z(iC}I4uAFmM6m`9{Ws{N{wI-|E)nbd`PB$Qg9c5vPc~x^L(B^R#j(Dh8=_#-#Tqnd zx;WPN^Q#er1`RwK$NKgGkLKl(=$ozHN`@%Lx95Bl08vqlZx1OhK+_e)`1WLp{FBnx zF}`t&$M2yGpW#4}v@7lI$oA(!@V^9?ey1+?NJ-?T1W^R~L>71C?Q&b~#kRw~_A<58`XD$!t#-^+>*idUTCe>2LM}4c$-%~4Cq1QF1 z`J6thU>wgT?)UgcD$VDWG5lv}Wu`2?@#7n*kZ(|ubR)xX@j}~Ub!M}l1~89$99Lnl zx#jgr|8oB~udYdWGd}6q+wnTSZvZTw@K~PVlO(`%&%o`FK=PQeD&uFqVc|#A}j(0B%-H!$Tq9k%|q*g-)ag;tC{oK-@d%@%+;IyWJ3hqsp!PG z>5H!Qix?q2x#4bU1gCr89@Ae7*-t5buayH>_qm=$c!Md*AMy?h zI;g**Ong17zs;nHqNb0|i$$6EdYV|sACe?;I}_y(!Ff>eiA&Gz-Pr98|AF4}U`sig+Y|2F^S#$;cJfrl-%51jzN?8@t zefNSQ3aP}s;Jd}OL(@v`)|eSTm2}9HV?>rLA#V)dEiR^7th%*M)7bDuV`jU?c}fUz z6F6A^?bF3QWTi^}5?`+NBE^JCbE=$9URe%@*A3#XxBaqg)rz-rj#j^Ri;s$(N zVEoo`!PQBVr9vt*>w>hkX)<{BgkptU6(%9C>g~HR^L2?uJ?`hzkRUFtx)R|_}rmQec zzFgnZR_4dOm^K!d`c^)#RRKo}?#^p#Wryj9Jj~fs)#>fxy;<%s1#UP;cS$_nm*sNX zKW@7@Bvtb`#$|W;q$=u0Rc(h$yYGe7wOKh6354Na@AhvJk^L2Xi(JTCDt1%gq#1=0 zg0qMRVT6T$$I5z|pzr7u<4EkF1!gFSDRdEozfIO0oGvFudfk+qBb=#GjXjwI1Z?jF zxDE-p3Im*;c^;)AR}jI{2Rl>$A9e+KDN6U=cvR`qT?FTagFG>2H7|MuVx7_ ziW42z;FJQQ;~M1N^x;=lin0Xs>}c`@vIMLV9oPK-@3=-lFuQ=uGkY6Cj;|gCo31EJ zfS~jXeV-)&t^&V4Kr-swfF1F*-S5iy$ASoC((4Lj+Cc;|E$9}=^eYj_w6S~KqZddUQ6PHfbZKNH?34|ew z^Wa`x<|H7awSXMLVUmU9btpu#?$4h@doEc&{(M&sWZT6%0vg0_Y+hPhdqLA+EyGGb zPkZW5Misl)|I3Pb?pdHWQd$Ns8$YcX_hi= znYvGxuldpYP=o4K%eaixOp|DZ(nwl+NA3Z;j=Fghwl#~Vd$AusOKiwF%)Qqfce3Et z^YpEp=SkXj-VJw)iqdYJ>uh_FYhduWHL<~bTk+YgH^kPxn$Df?@?+C|>MMiFy^C&K z>YTz%m()Q#qxQU6C-@%x0kBnNT-c*#S7g~jM5psD5JV5mQTkSKD{hy z!gP8(uBFOD&b$4G$EnvB)&;m+|IT(GH@`3w0;-so7s^|$Wxuc)n0_-`uWn)85s2r@ zG~`z`L9hHm(;s8r2trJWEju87Pa2{JsWV;bAbK#pTl8SnFj;m|xwU4h@?P?=KRGqc z%+PUC`2@{kwG%0g`zZ(Alx5!z8$3txh`syh!tzHd;9DYIS7sGrF28a*dTeZ$YaG^H z;->j^g!S%$;^)immVOm6aLI1+DQ&->QevS`-K+HKAH6V-<3q|XPBCTc)h`VXTK_OU zp0hNZ)^tv3TL!n%K*P&s@T*(>)jAiR+dScjyUV`gvP-`oIj2hVz^#*oSGCRm`st2I zpiS$R%5ZV$M6S`($%Wvi66ft0F}~E%+bqtTwq9j(?h+JSy9L zcW(_GU#j->lq;$xcH^8JsOQT5TlY4lxo&zk7^ceJ@^uhN+F6!Mn zdw$D|bvcc$T^X-0R}^op%c0JBaYTw^Xg-pTgb?kly*<6Sd0?bp#&%-%#lwEPIt48$PrdtG$;I-!uri%gVI zsP{7cZ9AOEi|oBFI(?l`NaRKKUM?yM`WFTLAJlo9dkOFi7vOR)@*)FU5RtC?U1?{> z%FZS8M&M7p{}eEj0(3wDJ0pSj7#NWC6PdEn_Oy44*SjVm6bi>-K(t;TWp^b~azZAb z+dajme>_B!MM3{PO>Ex>{foTFdQOG^f9tLpdj@N*m&f-O7Sz3(9kUub{+D>oG30Me z6Q6PM3dTv~C35BT@VW~THTQ0N(zK?f&6BxeaeeDzC7DQOs=4dl_urad-Ejc&gk6YFUxo-p~}GY{51@;ZB^bS`Z?!rb>k}z^8`k2l;4kINO8gCQ z`IPmH@UGID8)leVq2F$p5*4XM_Td7hVM=*6>JejNc-;zK%@6&53a?v>{^xMOlG?2= zXDq1=R~@1D7w0LiX&&o&KRB^rhKI%a8R6${YHrTC#v9>{hyEURs3}x=O*PSLROv&_ zSHGbtfSzwVf`*1C1d2=Xi!HrG{|0R-NxkZt`6mM1nx@P6cdPZ*f zN<7j~%a*q8^M2U!X-FWHy!61oCJYu2P5DFrCE;~Xaa;FS$*OkiJk;+Kfm$nCPtG&` z!Rif+z45$>tjB}Kqt)3U+x9)G5o%AH%U@C`o@j!;-txfTX&ag%qVzgh+u~`Lh>5Hy zNx(gU`ok_#;)zyatz)~b>g_2}M62PJL~n5m4)-)uRbZ81;?Gm;OyYQufr=6-k8~5D z{wd-4Dzf}$H^{CnfRQ_dTb`Wl$XjdZV+wyr&Ak~?fIOWTlGJxf-RgeF1jOKRAjmwc z>Y{=Rc_S`hjN=oDJw3vpP(g3}A?C9z)db#t?x>Vrx~3 z2nO2tI?gctBD(M5pHMuUkA#NTknj#FNhx(i>>7~ps1{K!u`DphS-kG3)u8tIT#F#4 zbGe${-Pces8`9jsXwO8X#Lx_{Yh+Jp)QZ_(?R_4-0sAAS9;6E%2vK}Z zc%1`Y@&lGF=Xjmm!1&9O`tKQ%o&B|B0}q2R3yJ(mYw9*>i2Y&q1Wcg1%LXKt3MbmK->d zV7cIa{vFgK7&tA23{b@c#Do(I5D6ailaZ(cjxZdPJ<^p9eu(8@piA3L@dlWtB z2G`XjY^d;OlI1X9<_YWpAL_QO7b&$wTZkCC&DjMKa|rW%`8~zqUrq0)JWS?yDMCOx z^Rc=BFo@~KCN5AS#j(%|e_Q=}2b&}03d})hHxgV!t|wyB-3WXgq;HBPuxhksQFnrU z!2_Su>)<1_kJrWEMT$0`m$`TGGN4N0YfuBakqu}Ke2wzJ8ye+1hIA7P3dAZKx=EOK z>T%6MSSDLeDbMXLljlzF{!C$qsX4rP%y&7bMTlh}ChGYa4VP zzHVBwBh7C;uk?wtpqiooID{{x)?b{_z4&GHzZZ#;oi?amTz%Lj$-G}tJNH-1MO;Mn z;_4Zx3!ff1WDT`ME_|AVUWi|;iLI-sLZ!~#9GBXH>*ICi3hu+UMN!kPlZ6*KJRFzW zHWc*{y1uw{`Xyfd4U3|PK0@v5cy;6AtxHiuP~5<7Jgyma=k}uVXYvXMyjFPISyWm3nHjHFeS3o}40?T{WTZZ-fMN}yWzzH3BA#Jp@+R9>L6vioA-fugm;_2DT)YZr-z z&6pBf_ZZJJe>Lzl-FK2}!@uLNolhJp0rQfGe@HAJOmFQs%ZSD6wi+elUX83hgXfEQ z;a5&9Y2LV3n_gQCWhe}QIWK8v63<)HsD)t{Bp*#lfKHmk=Hsd3BVfY{m>EDoktVOS zL&>y`{I3tplEMclblct;0-R!QH_< zd2)6Jt`CqxbO+|q6pke9tL|q89)vxxEVmhqt7~Zf+qt= zA&UoYwQdtFxHO=q*Hib7$+$$)5b&OsZWH~E(n+6;qcaPs-zVc46+n-lIvBy-+aRY( zEI5$p$Kv1viQ+MjD73x|Q8@94!iYd?4@PzUcX>n+|7D266*q$f z@+Qm-G57flQzsZl7Zy@Ia5G3+ek3dY5Do!SD}bQ2)p91qNHTmlEB>I#*dS-ZC&6bQ z$%+L}onX1NB(~1m4bN!G8Af4u)l5^MT=}5ExRP?}b+P$yoDm_uklyfRh~jS^QCNK$ zqR8VD#g;Ea6z)8t2>LQa5z8YA+mF;wJ_tt}Yn&B`Ka< z@+JgEU&|$LJ_!kMsKh9$5Cu^R9*&RpzzACM zWt25yqlA>T@-HKoh>a4Epw$;3!5d3=B>54NewAFBk1e?)gb$rH0{1(D^%KF{F~RB+ z*t&>~5)eh`mmvx(K2dD^GDJaalz=D_zYI|j8zmqL+b^T65gR2$6oei4!!4{If+N_$ z5E~^R3c?P|w})erYuG(9f6(5~}AEjK66 zq~j-_=4@9kyD^X5#%ZrqP~%*saawDATC-CkX)RJMT$7GDTuwTzCDgmKHa+5ZZQ7ku zE~i0?d#9SKp3Z4ih}X`hb#%m*rgL&SV@x^HoEBPGZ5pT6yG4Q9RK=~$E#=U>TJ6fh zX^-;KI|A~!McSsR&Zg~qxqF(mxy!g&u3S!*X=Aw>x4x3gEtLw$>U7ekMcZv_4bnC> zO3_a1Xp4W9OXGADa$8~xxzC+wjd!cmIGap5ww89rFt%Z zC7pJW+>S?Vj#I#GT1&fK=kr>VX&nvhtaO&0vJ{P7FW%9vO>53xoZgXB$Q9e#nb&bw zo5sn>WapN4KC0!^H58`DrMEwqN^h$V=jL`aR@wQm+1$0Xrj$}nd91cAC&{Z-!MiCb zeQR?~Wx`dCpGU22M6pw?&(q9p9fjLEU!-v&J)3LtN;;oubTmb_7sW?bmU3ROXti09 zEr}l5w2Dw}Wlm1}&Gf>jh=*ZZ%RouPow=2Dpi@7$H|`W z*=%PU`8TbzMZ1GFzvUL!=CMO+hZU_elfz2C8+o-|=ZCZgS7;=y6}pyND91jMUQ)}U z`_$U88|~V1Xq-o;K8;1CG;fWLSnjR#)~t9Mr*d)RHmc+S4{lLPdRqgRrOmC0=ho+O zD@?hK+*TU5GKqVI`|MGCT1Q8t+P21y_U2kn?qa)+2CjE&Jj`%>tq(gky{$#9{t=Cx zYgeCZ+E(EaxvlwRdkw8do7Pa?*%(l0TI9hoisy!RJjqhy7-;7`&!RnP=AJ6$R4Amk z*Ee$?sx^hKt8ScMA8%EZ+t|eMPWB1Alvfn6$Lmpr(?J^5*d??`?W{j-syR2CJ9;0d z{BQ3AlemHP!4?J0CP@Yd5D@nR;4m z+k8KO_Pm-__n^{lduMy`gO}&q79VE^YEwG23vX9Nszs)^)CXy&8QQ7FR5wt$9YNLQ z-d7IS9zm&2TyHz;ceR_Z*F8+4uz-9)B-+HN~vvHf~3asXS`M$?XYBSUN+t$Fm! zwAC^A<=k{1Gd+)&ZGW7uxp3LewE4G~-(nnF?z19)_PCPaL~%-}c{NF2-st8*XQP?0 z2&}jQ>P|Cfe|VV2b?c>EEu3xqnK$!RINR)EzKWSDO%D}AOI0(19v?Xmmosy=$wMn0 zfZ2hn%-fVx zs@I>M-?AmYrESCxviU}%qO6g!N(YYWmQUEpT;)80dPuL}KD)W;2MztS(fTJiPmUT} zd_#7@pLrx&x6?pty5lINPSrCKO4`p)0m@R$ShJ1gaI5YLM16%v-P;otl?tPDxobjZ zMcZBeik_eBs^7M6B$S7zz3hQ%NmzdJAi7T_^IP=2u6_yXxqG2=>U0vPs?FQ6M<=A#xc_;IB=T=Xyp&Bk6>DkI1T(h{{DZt$z-9ZaijX2cXlxf|y-)iM2_vsXN1Sv_foFUYz>|Mthmgl2KxQsO+%+<`)VNY{wyV(wt;lNjHk_dW*JoX1A7z$ z-3wQwCg+lD;OoOc;DN#Gt^+mR2(G>X)M$Q;jYk7BO3bIUl1C=7>_e1*z@yw%lz_lz z=|{MzXzRJOOfWsmv{*mOPG(yB$WH$f&U04ewtdBE+?W;vh5Mnc{wrmkRh!nDTx&Am zE~w9$e*CuuZOa)V6N^6l_L2!U|k6rY-XnV!ul4-V& z^*0uB>1hY|cv)RFyWFis1KtfqD22E&br zG`WvMbuUfpY#VX2_+s_=(^qak@#!osJaX?yNV#JuZQP@0{Ub*o&c1RxH{ZGrambCe zVUPXHoV}+xdv^x&xTt3Y;?MLs`C)GIGg%~gzX(ePs`j4aY(ZaNV8n6LG8&b9oq;jV;psCr*P?aNs)u3&Z{wln5*n>(89zr zsaJkWO-(M3epSu7w72M}omz9J)Q_5>`?(Ltr5o2+>i+E-+Wz>VEl2k-r-B2(y0VE}#k45j_CSNvz9|*oddi9=vEnaJ za>Fa{8{RhU#1^;nO36?(rNgmh=b##`l9PjK{@DA}a&U3Tfulo;8)?z5tIJNzzAE}faNsU%Y9zXY(fv(#$+lTtR3O!eC6xWJ{c9oKIO?SFFm-$qXJ!E8D zRU2$0R+!P5DYXk1K#gW+blw?xH)FZG%+)|&FMYQmHe$`6^tDs>h$Y^6v?s&O3$s?(GZ7L{M7(%sYIva`u&f zV>7Jlbi}sevS+f^|+|{_5{{wXZrz6g8^pg zm*o|Gr4@bM74#9aRxJFzz%@=~fZ04>H7RC$0;|@zpP9Y4p1pVHE`kB|XL%CJ!}yFa zx8Y)}aXRuwHyrGZN+Q%a1;-ta`zZ#pEqAet^2SV3*FaBP4r0gGtu2{n62nF;4oi5x z=GJu9GjdA<&{|?(aT-Gr`alG1-A9cnZ zN6b$t_~%mupi+*aS~HRd!8d*xC;wFXiZuicqkAXynq09@8;ZxKk7X#=h<&6fulTyaUj@MESgS1`ET(ugc zEi0eum1=5x-1X!hrRG==Hhmkg)q7@Yv|DN#FVeSCd0}paF z6Ki?PNlHE$9Tyrb=Ompccsa>=rG7;=zMP!b{>+zXUI#Hd0;Wm_FD@8KEc!T4F+v6Y znn3ZKjO0$Bi`ymvvmL}F>N4A&GZ;=86q&09H%O73V}-dGY_G~av~Qi zk5@{NTKzkl>aAR&X2*FR5hKMdyA_mrJ;L< zP2{=c0YTxB*Ulvm4tkci@f&$7#!2|wG-kz53UY|gJGd)MK=dWQ*xtQ;ucG{72VE`_ z0{D+01jhF$1X43WLR5q#Q2n5B)V}dK1Y>KP?b$c2R#@BY%zouGby(2ibQjc8j&*9= z2C{c4WbgV16`|fq2DRpGRG05OjVp01a9xV3n{8b@Fc&FJ*`uvr1<6<07t}5pY|rkG z>VP2(!~>9)Z_YRma>v1)B5zI?%-)VxH|;8tS?hG#IO-UI zJnE18D%w?NX#eP19kYz59?pP2U`sxMgWfDudQ4X$*oSV`FW9Qof!KdVre%>EFahWb z0Q5z&n>bXO45Dq5?3R~K!^xdkAq&m&$}^gd_duN+f5W;FsdMhXVh)r zbVmkk>v&3wcij=P=^jfu9b*qb+B2w}6yC-mgHSo8l?;%|IZEj^QaMW|Dxj_v>nhoq zMiUx$esTob%FbZP=xZL%&QBgpA855nQ>pWRsNrqV1+Ht*76*PakT;fB>y)&j3ToF3 zKFX$=7N6Rqbjm$vZAZ(fY~W>xoi+Y|)_J5t=LzOZDd2ifn1AFVTNwG&Y+y%+$K;D&n$mBEu>5$WLiLUEm>pDcEoYFv&I>=g|NoJKaTxEVzQ*k zmP6Hk#g&=6*;riwXlJ@pl=X%>y4eiMfj$losW2pJGaQPmV@=$JxPf8Z_GrUfV+{Xb z%_^gM8o?kk-SgbMJ9iU<*v|4ihSbQAb!B00U4t+RV*RdRSTi!j$z7Qk!M0%=09|f2 zVmbaD~atT+GnzM8jusD23ZVq(8pioKX0ntiIYkBWtbQ;hla=k>>Z6jOChFtRkb$9_G?iVo z&9r zo%$YlV6Y9zNqm!obZ^|jEwvPsXmJDO1nH3;{~&Y1>)g|EvJw~qSK3S`41o%y#-iPm z#*i|AH1*=&Rd_ zw73Eltm^u)pZ2UmV`a}{h#CIurjZX(eB_`!0KV3+-;A~KLgEuO+_hm*VNQpy**Sh} zPa5h7%O?}W`y1Nm;@@@4K^t9YKLKf@R3ls0TD8*#VDR*kVZ)r-?{ynFlbE@su=Nh83h(;Un!%o{_RI^(L4ww0eefKEXMq?wMHsO0Tdb=pk& zon)uUJ{`MPXiPy5%kwBQ#?a^74|7-C#F}KV2+I;%RZIX*hG{-O@<_m#0ODjf3&Y?{ zcNOKYRjXzhM%2a-h*f+K&r?^{&a0+iLLHpbvq+H+Da>N`Ls*>l9@HKll#}(0%{fKS zq8BGGGw^8`@rFFjeGs-;em+ZPvb-_aAXAYE1KA*XMnJ(fNHxxxwWsg=NcUQVXa-M{ z#*{d5Bz5m6`_qAD3?^rLW1v(xb*@V)V6)=h>1i~>TkDTnwhkVCVT>8`*N4e+Os?a^ur>6yJK z)S2LxT2i7WC5{DT@-jo8hBvi>>hiG7&`~8rdE;Aa+)_;^)@nE3#zMwJGRO5z>EJk3 zIT1}rVa_IQgAix7;5hFn0fUIJ3Md9>(gX?i}_b#n9_lh2~XF|oyDr$jI}|P z_b6`xQEcjET8meT$!vGn6?&Xz)_VU4%mY2{#`$O`!mKYX4f_p{DrvCa7-UbXigyZ{ zq{8>87Hiy$4iBxh%1g~HxScqN%ljs4-~Zf9S3fcdJy`i0z|$7 zLznA5*N?^W@uC^qUULW0NBe%uJ*z;Q!JJvv-0Ku}bcr2m2tNniZhY^a0g70xYL&iW z#89=2ZM4G}Eit9;9ZfSIQVyoEc!mASV8;AdGKPzc5g?aOJkVU2Ww{XG^sq@wsP*+EA{3ES&aGEPf@=5oOQ<-r|Im?SCvajwNLK)y-FA{c5d&ag63|0DCtBnSnxFnK9zXb* zY(LgaV#v$3vqzDp4T<1^_Qf2Sc5G|a;8pq&wSN`;bO>6hrUB#&yf1=DUOf!@q7FU8 za}q(mp!t!6X&Br;`l%)CdWi{z)s7)*fgj8N?%v)oNb!KLF4rN1SLsL8KH%eFV5%A% z>PK{F%K%n&(bqhr>W&DeR1MLI>+hI}ta?4b;Zqi@$0_Y^Z$x5rj*cp^>}a+71s6pc zWF!v`Zk5{fZI5v1vG$%9tj8&({LcQCK-YJfR2jVNXtn!;DGvApHpT7f5e_}p{wZ|Z zkC{j;Ch(ml1StT~e+^c>Zk(-exI)h`=%=VnvMQNi1p-XKQYQ3cH37(YrsMwxWT||R z*$NrRH2ENt6)upa@Ikg*xIm`H2bq*`fy|o^G816}Su5M#Tb0x@G!*ShZAmRdBKU86 z3qz3Ra*AK8!shm)b%ma}!uzB-skeYM?@|SXLYiw4=mKfJSD2*vS2_`-dNf)wPsmh8 zX}-$1OSn|Vg?yEfcN!)nDx(1(WZ}XEvJyVXYK04AEyH*q^A<9Y&F6z`tPt%>Zib4p z*lxdE9c8xSTV}|Lj+V9=gx7)DN()U#rf*ho>!#3kAqh`5-G1GLTK=gG@oVKo-CU z*-YUAStK81R>B0b{?10K1hx`JE7{rEA7@K6|&^I~fVoruH^Ec-kG;p8pBL?3y3m!n%BG&LlAagGPIFJsDzzEH_v9?GP1x@=G4qvzUtX7D}2U{*d=nviJ` z&Z!buOd#nn5FD)mWZ2RAKLgo9f>8j-#_^Q|p#YfyA7tUe1+o%8$ZCZPWG%yZAoCV7 zkj>|VY^*SWtRFqbkHFTYS*+@6h;AWNS>2Iz3h3CxF@E63D_1=;`1k49q&{h-uSx(; zXmspv`Rb31aH&6ueD!CEaH&7qeDy~`nA9J2=Ttt(Y=sPDntYJS3Kz&y_#j&@Tp&~9 zgG@@eK<3Q{nTargjB=FiO-juD&feR$@k6LqN9&e@j!lLr{zp1CY4HIayUPM296C0+ zVbW5v5-#S1oQ=K~E*+b+_<)YBE==mr06J;$0g%NCnU2i|nX8b2jIj6s$Wnz2 zWTeFhKsHLaKt@`80Aw-31hTL6ZHJN)Q-&TNuT4h7_%qk*Ybt{sn+!1_H+vs$CI197 z2iUPmsRMRw!d@*jc5Kq(19t46giHO&3W0Mvi0GXU{>DZ*j z2S8>iTp+9EgUmy?Kt@`80AwaY1~Ss(V_eW8RGjR0X7zLeTg#5I8yg3bhX4F9I@2HQ z*axB#%GUg6c5Kq(lc2>r0u~xOHevBWIyP}SCp30!(&7W^4|xRqr4CCt#?D3%55T!J z_drfNt8xpK=BcBhH%UY9k`7C&#Fk9Ov@1A#uWo1RDCYON`%NK3LPx)sx$U`?vrv+y zYxgaJOViSJ<1|Z2P|_*D*rh+j2Ze`B>H zGcb#uTMW^A5XF)-5=A24jw4Fof9uMgjtq$|gXmLTLt7&5F`U815soOR!McCW zO)F(L8%oYA6jf?KgnyoJOZCN3uMjS=Kf}F2R-6cq9J(WVKSaA~7;f1SeF(q6`@M{L zR=*8bmRmT}%_tBBl5TgLZy14NDR6HFgcL;@mL(4hX+<%Z*(k;Wb&+^M?}H$iHM(p} zh^${U5zPvYaYcPbo&K*ny#FpKcBVW+i#2`R) z9+akJvL}Ryp&$;+a;iKTN;)7%2I46zekbB7qdva&Kq5+2S~-P*!&ULjuY>XENkU(A zp@(=*7LzY%eult!%;0BQ19F0hkxtpcnvG&z@sH;~G;N?55ltJwtMnskA7oC%^S+QI zUm&#Rj4v4=d<}Yt=VW;~`2zDZ8Kwcp)ecjR#}US5_lJipCZmGQ-6r_5nzV)*PV{%= zKpfV`*RJ^SFqq+%$_H7Akb!I>A7l!`1+oA>$Yu%`$Rhb5vl1qdsk<4e64*-6QnoAY ziU4~CVVDpBhQly_>5;NOf%bZ)j_oXx%K#hiBHYms^LFhkBIa!-kDvuocF(nc0t=Q1 z(IVDxy=2Z_KK};s(GKDR2ik%7Ain?H48CU;JjyVFlsaRT^9aBZlJ6ywd^nb$%%>n& zeDqv<&kVjt82Fb_r3sk^0(Tb{6G%Exl#@&WWTTWD)T;h7kS!z_1%PZE!PP)I2nEOt z_#g`xE|8V*K~^hVAZr=M1DUswfowh>WMhR1WCKFfICBV1c)y$XHX2_SK9Qwc4qTSZ z=+cw^)Q4P_RJ(x7c4^7N!DUI2Iab+9xCnsM`EyRV5t(jK5V&w~SyJZ*E~_p~1R%lF z`2l3HLdIqJAafNmkP$jRfGicKQxYDKkvczsY?N?;jMVu7WHG`7GHJsIDFR#fWkcd? zwRtH)dC80^N*fn@TZvaq2!{$R<#$q@fDONJ_clNl;x>W>U>lSv)|2#t=tgulro z4*`V5lA*x2WRQmdpfU=@M$VQGvUni_nJf=vIx)Kv+O# z!Uq|72p}9bS;(7fOsZv8hG}W(=(G|)x68xa;It6u{r%5Q3rUL)s6SmtjY4r+XvJ55 z$U^`)Y7~moLek=cj-&~|!D1!|#gX(zm?C&yP;w45E8rx~h?|*oGydxsmgL1W7gl9j zo!+Qnu+h=Lz^A>9fA(*&((#_}O#1jckor5|C_Ah4KD!C-_)s&kZ+{%K07v5wQR2Sp z=GF2$^96Xdj4!b6M7hE%lHADnecKM1p`_>I8$sXczG6hMdx3TtN+wB!;kR{;+?)Tj z(A7Wx>0I#rz!?Ij@qA|>5Z?o3-9Ew`rt}DB884$lZ_`1DoX>Dxh~B4z_?_7xaz5k7Xiy+o2+or6z94Fm z^BLl}-BYpj>|{QGPKFzT?>(7+L|7vA$#6sPaEuqS01qPE5CwP$nTI18ZU`QZWd4ya z<>B}~kdfhr05UTFh_HZ+3^xRjk@-i2!;N-8K6NS)pzk`+Klgzww^&k_}pQU?M&y3*JQMWP}y+z`|s zGXIFMs6S-5A*erO{t;nOf5>n{P=BXuCEeU`V z{^bZgbFzN)P*KKNey*Wj-|8UBI7|BI^zw2K37*9Vt_~rOfQ99-gtYjeY*<|ix=>sl zBFZ@Xp&%1woJAMap!1I2aWcp_yH%8N7T@24tc1L4dwRZi0d95RCj+$-F7-#0arOh% zA5q5HuJevwd%cM=&VJ}dPG~dEs!EBERz}I()}LaA)@rZ6MkI4%uAj2{uwilX4Z0l4 zlXlmQ%#&7$Uy#@Opb$@#Cv6wxNmCz6W?}mlzd%d}WMPwqJZZBbPuhZPGEdr{_=U)m z_Phe}r0GDOw0{gCGzBHP`4_(sdD1rU@}!BPi^*v3Ugt^6<3~O?30L4JnNjH7(Zz$5 z)e3L7->%$DrCo`bSi3D{kJ2f&R_vHb8l29^{JE(er#fuE-^R~K`1RZswi8~hU?(2l zm8~^_p+2ETG04i=e>QrG#d4eKnEu(Lt&2Op-I=}0+Jd%UHi2rS<}R(^?w(`g-5Csb zy`zWadFW+1of14JBg{=+gEeWAywS})&Z#I8ffZLk<>^w(>()!TS~%PIF<<7bAn$FG zrpK(ySr$CfB-bidS9WB1{1ecB7MOxnnsu2R1pHj5;{0tt~G_DxveH z>Anv4U)HGX^J$CO+-`bfcn8<5++H-3SJ$KOj{O)+!HDOzk+)0SS4 zq_=UttLe+K&679MZ8SVubLzgM7h9$NN-rMmR1mIsIVnVLlZHoU>C^BLmy_BWt-XjiAlCpiAC-3$JEz4IEspw}eS zQgeXmD6_ad>mDmzHmjMU(JagFTFnEfo?fiR@mIV|mM9A5cd1D6vI6b^twnYP`Z21* zMQ@`i`)BCX;n^DIHP6`f23yipO4QUsbKBSDcsZTFef~DBJ|}GN5zaMp{Y`h{Tu+{! zJF>me(eAgUzkP2OYRoycAVzQVexKn%a|;6#IvnPTu{zmQn$d6T=gMm6rVY{cX&5n^ zxFnO=XjqgrQg%e{-(j2O^;j}`^2Rr%ojY1?K4{O4-{Pt4T5F|JJ4;VPZ|D@3mdP

z)An1xQ94^XHuQs9TqS}}rH9x{HHa(1b@AwNFSWPeZWx?lEpC>+ zRHMI{2m01y2=R$trzaYx>iW75QGDc}JOI8HvrkRQk_gU7cG4+%E>g?RNFE&ADz)ib#ccto zBZc;_P}|x%N>QVw4ugMZQ@=rXml_AL8}k__6Z-ik`=FN)T!p0JZC=X}QVkZb|fq!fIm zqS#tS`8uxu56I#twbQeOGw|lSe^cCHO@L`AFaNigi_aM3p zq1PZ2g`<8b$VB0&ALzy-x(i`GdB-#I5$&~MP85#%p@uo~ED}5{MB%8tbmI|)qkbsJ zMB%8&qSkv(2H~jFMB%8)AA0yro<)L(1?ik9EFKo*?U$l(R7f~8#$S&@pJ6zP6z`4# z<@|Qu?U$l()P!EU%JXBMMd7Hu1ewr=qt=Rx!coOYtM%yK83CvBZod?TqxRa3M--0w z!5|Zbqmsu-y#|>m9Q6Z1_5+J03P*MOP!ppl9Q6ZDjQ@wjQI-9fIpuYnEmKoXuN3SG zzTUF;r{N={xg0BJt!11AUfL=qq|bsx@IWoyiHkNR)GQf#t)lX)pmP#I?b#K%TEpcX zq|sBDhz{_rZG5v|TCK3Q*^%AhG<8_e;?gC^jYd~KJ}prK{pMWq*ZYy9Owjmq$(=t9 z4vIY&#+{(Gf;|ZRaT>E?2w7co#(8i;aB!!{8<++cpvc>jss3%_%kwc2cT{aXKnJ6%`*KIp}Gui!zm z6Gj~yonSfdsVdhq(lc+YeD%4V`!7wpclv7eWkpNcFGq$u-W}QcLN1}c(?HqzMHIUu z_OhnZ5S)&e^_R0gzq8W%N{l5G`cAi<`OZXlv}Q;1)4~KFEf{v|XDF`cZ#EM{!f-5E z3p#rk0KZ!_BYM=~QBVt_GUiVOWGx`>G~joMGEhADDBFdoyJ{Be(J)>-iDrHaXXH@* zrhF>ru8k~Ig%ou6U&*RaZ4&U~GpOa6ydLj8R>1$g8T8m`G!!2JUBIUO!^6p1pd#Jv z@VoI*(EnjQj@vAssz~&GY61C%njWB3O3U(Psw(BBA6mz2bnYMIEP(%`;&d4IKGX$? zzU#V#k{UTJbM;LI^OGs}r`M*J|KKP^ud=&2nK$E~f87Sd?BT@{JnjK>D-sjn5=wLv z&ATtNxzz1wLIATN{>h=fTetV%bvyF_i3wS{HqlL3w6Gso?XHIT_h+(N7jLrc5w!0a z{3k8?53J4=1VO~iV&z0?lOo-pnOHz&3=vma=RDZvKV8^x{@jsoaPDPslr0pz#NB{k zUYm~b-hgdV^wYRI#puTR5wyvLvp#_xya!f2vq5QnTav{dc1|TYqA>9iS3WN(5k6kx z!RIBl!pBRp2tIf#kV(G5zD`)gSBnmh9@q{9Qvum4>+H=1M&jjc#9bQ~_zAN6lh~k! zvp1<1Of6{X(m8~MSknk9U>$b$9>LF7Asm9gpHgTL$%AF+YP7EO;dy2(3TSj^qIBK< zQ%2{)=OyHuFo}Lr#{_Z}LTz(0pIp}p9l53wbif2vSdYI&5EgPR>5{D@g^XM!l%)9L zi+mFvZF4%SOMC?oOht&)IrbX<*6=oeYbP|abrPRgR|y%hiaC4Rkn-zK2*_+0NIEy< zQ>Q3dCByD;2;KKT-SfMX90c@q;o~JWeDOuT36uDW8uA`MqIo{KWpdtB5t?^sVN%jysls(lM7Lqj^;utFmEn_8;h9iGo~geA{Hqo%D9xM zsJ!Na$TAuND&jzdNGv0}fG`ZhG6S=G=iF!RgQXFg|9^bn*YC&AZg-x0o^$U#=iGD8 z_H-2YS1hZi>suY^TCF!OfyXtg!(FSXamoF-{PPZWtsdbN#~7E;2B!Bkbs+zeF?(;- zw>r|jRc~B6+&8EL+Q9V2C9nxcbUYiF-nazJn%cpbwM+U{`|$@{PeJWCw~wX>v@Kr+ zJqRFwo>PZNt`@tlN(wCMnB|mgB z>^k&@;ZVn~PJB32UxDxL^^8&XK5?DAdr}vhNK&iN!fa?-5ki5#RbBROaXYZ>#Ak;m zSS(K_1rL`MIt?aJ0MI1YOFV7vXP0XPaV+xi>N_?hOPe6m4)s@4BK6DCZ?7#g3)r=RUlzB>EFONkqgWN{z7SBLOV6wVS^CL)$?`1Kd&{JD#*YB@P{;zEM&WD}@ znLYckP~XCJ?>1B_OzD&|e5gcxIFM4>|G>Vrje75)CM-W#?IB!;{POBvnYeiCD#N|y z{Cn1ge}UiH-nT!Y*KT`xdR`tgRMaXbItsIfvdqfqXw3R$@sr0vtBB zxWd)45Pq0p(PjMKD(G5eiM|CVOh;kYt3xQe>RZppuH}4#l#~eFt;XyvzN-dz9dbb~ zl^p+CW~kdKoa6XPnb_!I7KaN8Ec3T(#e|6`Zx4(+ICq=;Us!HZG;yE-DLnc9f7D~r zA4k+0^&L3`PJy3XOrMgkHaP=Hg7xZy4d34b9)xNs; zgM)lNhcJ`zyOLX8!z>8l9jHAiTBr|dd#oUj4xVdpGC||elL^tXol`8htK3jIB&swx zQvUIVJ=(98yELZFBfML9B3*oRNn@hWNGBA3sac`zJ}u+}zE-21e6vxfmVGUpe(IMK zKZ|vupPO`Hr`;<|Yl91e{i+0s;?tss<}wpaNabATQipnl@|)?!F5k3#ldI#^mn%j# z{lbsecF(i-yWKD{J2bDEyOSHiiQ(3nW`*Y6iGNfsAL)_o@xJfvYMp7bLiLSL<&YuV zFJmJ)F$pEj->lH3)RxzeY_idQ5C0Qmq_IpWN$_PLiPgLS=BcW==Q%Ml)i*68grE4` zK9?6L7{K3TGAZF!#aw3{H$#*bnwN4qYN7Vkn)3*>YOb@!BvF(RnrG6|igc_BegHT^ zm8ds=6N9ZCf0Gnu@Z{TT7zj0dt?A8B_+3A(Cg0ndueqlaN|x4GbNx9n(dB!B%^n=N zGF{`Sn|dJsh*s%Xe^+){(|<{9Wx))-JZGiCl4~w zK~S%H+A;YrUH1uI=YOfspo1+gaKvHH+;?aRSS3dsey#LKX z!hk+~hRMsf-CQK>qKK&7-?h&$L-Hp#-E%Wj_)5P%vp=X`bzb-R+s@f$qgD`gPr7GQ=I07x35&uG%V{V91a@Qtwv zy7@f=$Bhjaj>}FgiV%kNT`3Q;{h1di=56euxui7Esw_g@Z{SaEOf2G>4Oe|8H_@E5 z*QK~Nm<-Sb3K#grjLY*Ebm2P(4-$To7n-XT9_NN|qEk+D%QbzkMmBG%Nhq zPUSlb9~+$EM1R$iE-6f{-m|?VA+J%_R}zWms`;*_J^4iiZ$wrg?Vvq;i zRhxV&tG)&vfH&f!ga;I*jW*h&@IO}#G(!{e3VdVmmAT@2i9hoc!B(c+1U#UhS}(q{ z498ccR`Z+76B#tfC=cHlAl6d}c>`)@R|#X{9YlQvF_(vIG;fw@H;%nFL?h=t`cCTD zVs>iF3BNRnFfAH>^X~a3H%Vx_*o={5yPPjw{;98hf@aOhK@knGRl;7M zs*AbDFux4`9yk(89J}*^=g&t54(Rb|Py5u7|Gmm>;^{uiH)%0%scNne+d2BW_A+w2 zpwpB|Wl7)lQ_4!}#q!uhajC?JEi9aS!&Cc4*Fo;9?_%7waw`OPzVC$BT{eIhqQ?Xf zHa>hX55vagj8opibTFS4!4OTOfk;*B$>D-2p>v8iCQCo@f8Xh`Fy+f+tHCZ2+Fxeq zYaz`lUi(DozN31OErg|OJ%&1|Aw%UCe$H3q?SOz~HG$XcR?>DD{$C8``^PTwqGtVn z>>@AdgOhh;yNGAJK5t}9hEiVMgXVwAH%tz91racKaOb}>#b9Q!-m(fdrH*G~&0|CP z^sSC$*4GE!fYgrac#-J(pc^=J%sXCeP;1<62Xu(EhRN$&a3pt>&{lnJ7e=BpLZu_6 zjp%c`+#m&wVcU+xtoqz8RIxf5vu;h!O=7J1^LHf&b6ZtF#}o1$kob5%ec;uyw;Lq1b^LHR-)#r8rvnut`{2hi_J54U&=pFhWO%|wC+t@4p zkRa1MNTS}EeEn}tjlas~1L<2GNtSr9DL497M@qTT2i-upfj*kQBgvB1tD!!czXPSS z(x4lVB^~eJw`9Z7^sSC`e6^;a>5E2mq}U*R&<)&Mc^&WGst>vWX4Mys=rGLM^Qipl zKW3&8lb>CIr0pUcBb@#*Grg$E`X4jXi<+$eF*ChTBziYmLg*helRj3Xy_LDPCa3&k zW_rQGVKa;WF*6N*k-}kylmAXLlgj+K+$+XU;r$rh>Pne)#;xoCVJi2;BvqZXN>&+a z!aC${LF|c{Q&0P}uhNyjLhOm(^n@H2BmDW7$@71itgV$8vHtcCoh%jLN?$v9R8-k+ zr#OAl*NC=CbUl(UCNTj0f=szFJ=hfdpP}|npi{kPW$(dEYyg@H^Hzy?d_Jz}cK!v8_tz3D+vyl#5XDyKLmDF>8O5;ud{c#r|(f(78&m5C5UkXHZzDM5w7Kr_GiBd7Z5L9?BFnNhF^rcX?vbtU^}c*YWn>J~KV zxV-oY%E)oDECkA!GP%q7KdWgsv-l)ksjF+LQ}}m9@#^Oj^g*eWv5341bYRyV{uw&6 z_&f_?{U1R1g^YugWu}2N@oLba$=|`_# z4H9fxHF9$E?I6R+R+9-egBQbuArWAO-^_Is5Fye#XqOJF+-*5cKmSe8K<@_XL#w#?E1 zu|%@``#h^y!0w~VAMN9x%Tf;(3H@}QHbm=r<9jDP7Xt0SpZ@3w@DBWAIN6w$GyZ=x zjX!~4<&5OiEojkkdF~TlzlamRsh=26Hv@z`^E?uz2kwRkp-PtbBL0Z?{!ENiy~5D_ z$iZUG6ZK)^3#Ip>oh@~HZW>YV?to0lfW}%K~ppF7NeMg~O{sdQA*Oe&`?ZbsKctX|feZf8a*^v5q}5 zo8Fsv(Nt@9&Jr;GE@Pc!j>n(4L3hg`4(7>=t}9p^S_BnezKG`qyK|4q^DCt zd)}5`jGPSryc%S{o}hnp{^_-63|7+XjZa-^czSUTJW%oM(+gyeiqVze+QQL4{yT9E zSt6}RSR2&|{_ON&HC^Xt%fYs#&&*;0qjt^*DN`-J$KLV=#?TtvAUE1k)v*m$`0Ll{ zSA&|Euay)-HMqtnt}Ye7tpxigYh|pzjKX!*lQ|lmR-oFPM|+f?w+D;J4SWY4V7@I; z3YLuChnf?#I5$1b`+=@cwek^8psd5anCA>P(q{+Pvt^)xdbY%T`qQ!Z*L|NnCQGT3 z8BJX|g8UWdY_Kfen;103eAM{zL#}!1nl6~K2C1fL1}-%J__s-kkESibv}MR3HeUQ1 zWN0zDtTRqu>o;`9nRj1Ju`ebW&ya(hO|##Am)7{`O)?B16u9AV210!C)qX?ci!C4- z*TjYNLE2_RRS=Uv{rha(0w#GG(oWwXNz6<#aWp0qcTdUWz+B?IQb>L?Jd!qDpN9Q= zD9e}N3{oJSdP#ph7)Yl+15-J7rq>O5%|d3X{q}kUpTSh@r&Bafkr@C4rol{Q%HFv* z7UE21)3uPNKXWan6e?@ohvEz^#tbzP?Cq>aVuY)&?#-@416?h3o5sJM!gNFCbb_YI z2UE7m-z3QY-SCsVJ~d|4P?3HtOg2;E_Uw&o8`X9sRW?uSrQi8hOeeY4yAOrraf#cW z>u#}51U0w$76P^A6=r8`TrJ<+Ynli9(lzBeW&;l<{jm8=19tlE^@X_iQ})hw%{xoh zx%hk9dfpY!XSN!a(?j;mCAZe^)E{kGqz5yHPb?hbncaIjhu&rh?f_(SdoOM!oBC6g zpSZ$51BV(gBn{-N-w2Xo*$5fYQwu$taSa%{2Nd+IKo%imI*<+gGut)Jo}upY9mUZ? zu|7@TaHzz;gCwNuGrd7d#CE)d^nWw?w;?~t^{uD(PoF>hzh47EpXm+c?aQR5qrB)S z3F-PwZxAz9tpyx@EBpVxgmitTH}EyTqa~!jlA>A36hQ!fO_6d4_v6N97JB{!QryS2 zr`_M0%&)H+ak$^!j#odz&786;ZFL}ab+ss7QC*wuxtA5qZp>PL96^&?~* zja^?&No4D(=vy7A27mJgGe2Tj>D|ohDI6b8NzfZS1b6Exk`+%2=A5Bx5nb(gYByxf}a2PZEPO9cKX)S zYWLrF^y_s@IKDcdwz-Zif0Whn${(@iz~rBII9U?M7JKp3s{kEHmKd{VtG)%-y$(~W z%%3fPWYE#dA8jknWY5-!j(0U&!!m1X2V>UvA9}{>ihy6ns+=|@{gGbtAw&*wEd+v z|1mQWn?9@aOo9rV?Wxn*ZEuG*Gqof!r`EmhDZyess7uUWM525L*p?d~4!rue7PQn$ z5D;`7P?ofoDb=^Yg5OcD)q3Mn3OEd=FxIdRqzdbeOK`1@>uA^N-b3}qB`{eRbUc%F ztDdfJftRPllFYgrlIQJ7V4TmoiQPV8XJYG`3>^pBb8MUVb} z%uE>5(RxK`XH|Hpvi*;l=>_%lf6Po6MA7P6Ykx`nf6PoT#H>*1`|3YtrV$qRsILX? zQ0@Ip0|Y1ijbT1O5P!la**lbcQ5^7>~jdJb-8*gDt6;Gtf z6*kwWRPe2IiS=U~bSV)+u8FSPWSFX++Y+U%_2+Av#e$pVVoha}P^pZrHPNNG2s9kN zcDhz3)I~~lWio+Wtf`S{OHHgaTusGnD@_$w$JIpWe&p%mw9wV4Q*3;gpmkBzyHxSD zjXa%wMou2gC2s&%Wm zYJXW&!W+p_t=z<4s#OTJ_1u&c;ZHhMlStdOrC685)mEB|wQ5N^U!#E8H<{Qr=L&Cd zbWOtMBu+xw-4tDskytskyI7qh9zI2?OXY4;sKn(qn-nU3)5v%ERweK=V8@-8E>h3c z&e~_Ci?p(-2-Zaj?qza>a#OeF8eQewlLA$s%ZP?jX{L#`R;X$aYC?o_g?sLBgsQ~N z>LOjk*V}YW<-!V&&=#I{x-QFB)1o^dY)R5JiknjTmt|HhTy;^V@NHq8tk^@RPUWkc zxbapdI)AaQSX@*rE*5JVL&eG{u?n`T%;bCvUndnP{B`v$QcbgqwkA`0L8vX~wq$Dn zff^HSVU#Xg+@c8;=HrhMIyqmRZ;~1ONGH;*73T-LoDXf$R)~j2yIeWv{$oR^^Bdxp zMuY1Sy1G#z3^+bj%EA=)Da~&bNmd=0o}j6` z7&Ux+QMrx!*FewpAI-igTxzJhU^HNrAt%1xw1^uOpu2S<>q3Ck+U}+#SQ$T1?jI1S zR2d5UjnMXSGvsoMq8x5UT^)lEmY0;hX>P4n2S@|+;-(uJ$=|yfSYFiha}Viotzx$_ zIBsd*z^k)o8yd`s^K|m$#QTk8;7>Y#A>fI}Wjl5&C1yq3y7eDl2#6HSvFt5h+2DRk zFb5!;BvqEzezYT?>u?9(kwxjwyFK43O4_3Mi;ZLX{p5-f+R<0S4608e><#87zs^HE zA2?fG3L9=5;CUh6*U8)(QHfQtZ^Lmg$Lg}#v15w93^2+~^WU=QW@kgr6M#ej2v$h~ z<9?y&o~Gj#(Qy%U9FHP^;}`@kQv}vg1Xw^nFo?f%C5%JI@#(k(7V))o+|LvN97hnJ zOA!dA2(W;n1HBg|OC(C0d)~urU0?SaUXrxaJ@%BvSC)o#D^p_ZzdbxFyqnjB(!BBO z<`3iThzWZqBVhzw#{$ zJrP`5vU?^p-YQvfQJyzB9HG6$#+2|`#@$o}8!SD75UH2gh#JfrX0Sv3>jq0~!OU|! z9pG&Q{kV0OxIUj3du8e8s5m3XX@>=sFDb^AFdrg`Ovc4=nHp|OQDXrWz&Zfh=W;x; z#eiH(LE>uRvMI_A+aZAP5b4liq-(^@SXl`Uj8`2|*G!MW39IJ|n))5bmhbEGnlW<_ zQ&qpB{Lae}uAmQvRpqv3hm z;NJ1tQ8_?L?&hV%*VEi z@GR(;zeUnRLE- zHT;2wI}Z~AY-|x~W;ri>zU>an-gSHOE+5+iE=*f z@Oi=qnfpU+Hj-JxV>kk)VY88Me7QgJQt+<{EGK*YvJ{6}t!rVpBPm(o4OFaB4b$CP z#wnp3;K1_2vs!{?e)kwycVG~%#%LJI65xgg zuXkO1j%N*}rkB-l*gq3_`0}zY_6(JP#Ef(&a?ESK;EVa=kvJr`qgay5Vo8pbfVM2j zm8HFfN6~%XNsmraDVN656-(3YVva=&txkMY(`_L#ta)&6BqQJjpsYmp)JXIo$SRMh z8*7i)-I5rnh=Nds6rZ$Q*O;ysV2Z{C1Ypv{M~(j?$7DB2qTz7@FSvIwIVF16*~lBB zi;vM=#uH$~Fiv=g2~NLHUC}g^ytX+ExX{5@Q;qQ6E&+I+o|<_;a-0P178H_w>Q)we zSu*r^x#uSY6FAgP6Y>zjafvN*0xzPB7D2h4M+K>f(y7&WXmPnECey0EvLn1|lzKG9 znr-1a1J$h@RBwT-@>YqBd~@ls`{XpctgXVMvD{xh!twGxMnudlFKH>hEL7yhPaakh zu~Xf0IBS-m0gh5w*m+j5bt?C0o+wrpnrj|rx^azq#~$4Wch?yR&9fFFqrI)L+!Ew4ds&gSJJE6O)0cxow?*4qg#{NVb=Yuxx z^=JXA@8eW=3$sN*M4|jT%sk2+_2=8s)5O{hrthGdE1y$Z=C=j`tFF~$i>lKXAR5Ml z3*H=zXo!sr-jEre?2pQ$L1w{>og-20HA%eY<3R9*?A&asW1govrajd$W2uhmL6ub* zRaT7|E!pNmz9m&#pKjD|Hyj?0s`#bvIYqlr-DdUfHX5js!_-gwbyfZucLGq!;a0+h zE5Kh><)6M2ph^yiM?P@=tE&9dcY?g}mGcI1xy6LaZx9WA2x#a8M!zldIqXVxIg})IL{zAQ)i)ZVX`&{&DJ}Rz6 z-+vj6Y!EVUmH5DQfhyiFt3ed_-gWCQ%AZq}XSLEYI7&f$PT|=)ClEa#O;%zqWi$wn zy0D1e!$QJXjj`y!Ai@taf?e@25nbJ%g*!$cDg2Gu8# zo$#Qx|7#T*=AwQ1C0>GCF9WF9^{xZ^K-?HTacpMQl-5fy5-CU(_qs4v zk#eVslnYDLsJo+L54YxcMhBPnyk5Ab3lH8^H!k86}Vc zDt{~);>*}zX+R%hm2g!4$wh)~7&B_Q4WpI=(O&E>iD30@9?R$zl+i7ZP__Jt$5^#o z#H!_1EH|NA4!43SCYSxFdi;mi*LE=h%T1td#e?3ZR__y*oHg1+rVDy|lu=tPuEymn zJ3t8Tz1i#yxQ!NAM^Jt3JWP6s(e#M|$KKoiV&go~4V&QVfSNwqYhoxRTw-r_v6Pw; z+Ui1O92NTCXzvA#GVapFp6@q4&zR7ktf8~qQor1aVwZJfILl{;t-8#l=^HLn8zL6v2{yO0p0xpdpRz_~e5DVL@_A5MIDZ>4ELcDBdArhABf4Dgc_*cD zMz!x<_nB9AjKVUQcM?%@2=Q{7_?lY1wdv5^*&$#@#%lZu{c6`mF%Hj2&n-`MXyH0({R)=$ZnsyswMmM=4HIq(v-Zf4z&3ux31r zatKlVOlQfVi}Dh>a;^7|DU2{xkNEs@fY~Ixe>sH3*#Gh!-l(D^dE;Lvru=LtXQTb- zUMQ%V93A)xItpZ$59L~)L*GG@cUtxF2Y8M1Nh{m3a3fyK;+@@NN9%3(F<``pn}$o$ z7WYj34eO;f;L3(qOt{3bcea<+SORxH^bBn5?QXGM6Ud+7@}p!%W{Gt&pAOJmx{uH(ZPp`{2Da__O@}N*p3f zdPP?=#~LrN;ivMBoC-jIefP)q?T?NX&*Pgsjt|G{D{pa4_(DS*Dmj(MzBe&&BLWF7 z3f$=L?nXw87kFNnhu{((Yyo!^pu+g2e%G*|o-cNs)^$8_u`RST60*M z&YC-v&f346nX01b_m8=R2ZmJ>@6E*{ysY2=k%`>#LbKNyJwA%X8Zyty^3%;^PFa#n zGeh#C{Q=MCWdd&zI{NzOrakQ(diqA`+kP*T>~dI(H4sLG4dIyegv1?UWBAO~KPo?u z!w^fhbBz%(6%?#DZwe&V13DHs=GQdMabjcesV);_5E6>t0(SHNuQ=umwXz_m5f@}6 zwX)b!D+|kd1&g^1FIASGq|}iXa}_W=-y`E|q&tHsQ zVeW3zcX)ZkhdXwYqT;jV$gawNS7+|pP3E@H>s^My;W5_E^~7U|mk5J=_G^UyS|V2x zFClAzq&_RK{Md}xxK8>p5?H*ux~vVa>5DK1P;%8X_yM$RJ!d?trK%8`63GbE-@x)g z8!Zs;CxKWLBNBk4=TT~TSq(JumD~7&=bNR4SV}1gtaHD8UA91fAbO*K+9IQgTq|0^ zwWXVXo~0~1ma?8cNuK75FrZN|r=9y$lgEnLSQ5)1HX0#N!dU2MHpY$Mno&N!rPZ{A?z*L@9nbK-0t zny|cpNbW);r=jT-Ui`q>yXV}SeSZ^s@C<_`m5!=Y^rkwOni=tR;=Pb1t5L$b&k9PaFmtU!wHoLpQ+m^b+g(BZ8S$x)oL?+)4;^qcoM&}&qge9&$a-)rvf6M}EXc{@9=bi<*_FLe9hEMX!dD+``!wa(p{1WN5G8_iHHYJe^Sg~M{ zTHleP?+BqCsrrsgeTUz=nMsz03dhT@kyanYx*qG6&IeSYt{gpCdegEmbTt2>e^LGE z*ZRY>BF8;i)Z?A9uMgU;NRJq>7*+!w7TjOTj1v4x8wE?@CyDNQwSkpAeLj>v&lz_L zmu2Hj{_+JlqhGfrTslhT{hHrezzH#F{+Yh`2m0c<1d#cP^jvFbeR)v$D(nscRj^^E zi_uGL0cz#|&U9tMk`?LmDE=?2feW(hpe$>^X1a?nt5JUj)@sh(sH_2`MYd}RML&`* zzb#$B!)-mnjM z^qjx*y)*<+8KX*zi6OLaE}mv?gb>Qh%*)Ggmm8oqVV>RHz7xc@k~CR?aUcBE#UP*3 z{ANQ|8 z#-d1xzdT!UA@IugR+`Zi<~ z`1J;(PPlJFp}&cywro2-V^f#pA7%Ax;!=Ff$6$q*$2{_utjkeW%c*h3`?SsV&S;Wx zs4!$~I+-wZUZ@Z*n{|8NG) zTm_Mp#2f;Kr%{R@sI}#VyP^Z%S@e^HFO93ecDMTYU9vIaI@g7c=qv)T6WX@@gEV5Md?1u=rUsunGzkilGsD0gymXaCiakPU=IP6o1} z9(N^etkU~}UrdvILT{z_Ce}^;oSN*DYAaQJ1z*6;AFgGRq^MT4bqN<2;zDzbcNMud zB{aCR7Lcd)R`xz;4mu+6)rt%Gai^*E!JUG4VKmXAU3cCfmxkfyGA1b3p`csmTT#ENOtB-wbsX3vBy;ZUPd~~{_&U_^dFKh68+YK7| ztE{)SMrOXKv@U%jfR(v$ofa6UREI_Kc?0C`BeW?8vxc817s=^al5$Bhp_{}siKv=f zOl5}yh1v}+1jQrK0xJlRAPaME1y{t)B^TR*X+}DA4(QLIA}@LfPt$9J`aPobHh)L(Au?^-fREsa5 z@egs-pyEXhehTCR!VnDAs$rb$j0sK+E;TGwu_4p!-Z4uUm?g<)FZ=A342@I}pKK$y zQ`f?U9%-Vgd;#5cwt*HbLdUK4sMa`a_9?b;3|15)s+V%v8;dc;)Do-^g#NueDgCzw zaR0v>QVo|o7qn)HjOD>d)?_c?@?One-d{rNf9;Y_3Aj~Q{Nd2J>; zPz)F&8(0g&8QEZ~$ukH0oWT1gcjeMR3u4lp;ap&DkV)Jj{%d7njPc&%_$KLLV$hH8 zyT7H382MeoPkEAKOE%+UA1R(?V2@(kV9+r>8PBfuVJ6y zyS#{XbqHAh#rN?8(kdZ7W`|iGqk2_8%;sk%T z3#q-oNusxk99&Haf!y;?So6Sy2S%%VM*BC$nn*2s?nza~4ANOa(B=w~q%t@22;V9% zx<82o`68(%Y@f}nf@#ZCb%h147)Uie>Z+g0wH70;B5Qvs!|;VL4qvpW3l9(<_RrszhZ;0p!FbjJul#Cw{N1_uxMg@lX(A0Ix%6lZxXI0j z@WLRPsXN3lU8>Y~#L|w(`i?|@jGS7lsx3|wVdx8qPm26XT>)MEz7Re3 z-YtGwlo>}tLP(MvZNoV<9BtEx0DOr&XMe)&QIzJ8dH-?q2NK;7xn^H< z1G?sma+{+tq(dJHjIntTI+(2Zg61;(S!$Sm8LRh1zxXz^-?y*@|x<;!M(S@OAT$-_7N3+9c?nxgC7c-D#F(qVq0>_ zx2b~OjbF%~6IyvJMbTK1X)wV^;l4`im;R10ElR4LU6vA-q<$p~W3Qy^Zr#+Hi<{d1H+pmJ?Ss++4+Hzt}Zj$-)7(nDP}>OzN37@5Dq zWvjsVs(CR+aNG}c6LIsHaBWBn!pLMu_emOYb6y1!Q0TjoU;|q(64{^Z?xQ3TQ%2$t zS(r!IS2VcCWh&D44@O~JD_?!kB}BH3Yv_TI*y57x*v$S6*+H;0#4bXj*LqDP$wJ^9 znAx&r(iXFl2!FNvy>-LHJ`kY-agm|n_BkAh%az!vAKc;1S2fKvOU^SPw%V5L!&bOa zeYj%ZYtawUO7-)4R}t4Q`}JL5zVSIdpt-KXn;0|}_w-Y3HV8#~)DID<@VGOY$~gOH z^R4nPMk8fZ6y|b7=Nao)!#@AJNnmjOc~Kd^)nH03rwdkq2?ve5#5`xHSP$l2Z!RgmfjMg$ z=25$ih|;DNwKcLv=jKnqZZo_r>XRAu%Er*(^JozaK?2-8!IoHbj(9u8+K-n$E(^G+ zE;*?CFx`7XbmnlJ!ItF-Et{pps?bXHFB2d6I} zUV^T>fgZjjUV?WQsOu_v^&^YrsIg^_4`t1m=n<98=v~BHh0}kI^UC{ zy$lR=#-ok#{f3GY-bXz>H_ydBt7{FeKMzOa>mk!|!D)SA2%18@Cp4WHi=(S-mL&i$ z5aKJ#oo&FqGaLxhynA!)=VIIejdRWS=roB6zoc9^V1ndkoa*D$#NZzTzzve-xZGIq ztu^=#T&yzdYM%rcT7t|~Hg}W3klhS{Up_XPq4?i+fIA>NDRjUDgPZCRPDuw_0N1Y% znu{;RjZe4~0GpA|8E2f27Ur;E=lJn|)|?7Egmzd(#<}dWjB&Wusz>+ND;Ns$-CT8< z8XK?C#yUH_%Y?O6KHU(kBx|X?c|Vo6VHeCiUtGq>?MTTbQ2%dR)EqkFsfM2u@$=Y#p9fpSyVB1cnK~y(FBA@FvI9>qz(sTi zu44$!2&|`mdV=#j>KT9Vbv$&!79A5=W;nEAWjhPWG z>xtoBcSvfum>BxIdsAOWeN8N(T#d8y?1ixPK;Vqv$@)=x^)NE((9o9pif-=!Fx&2x zX#%7fVCXOn(m_LP3?pyK%p}=?9%MRYu}8C0dyqNW?mx;&lpt!#_jIGPjO;nEs za7O+hs;{x*bCZDax~|k3UYd26pQ6ZJ)=9eTd-X5h3Pl%_rFG@S%KG33_IG|z=ZQ>2e@=)8$0?_Z`nWDnU%w>Bct#zJ(75nV^T8~1L9>vM+&sH zks&0u^4Dn}sOt*v8RAKPZ$eS1fyZvlqV?!yD25Yz44&Bc0{em5Ia8nVD)tVXMYPE| z^3ufCIMVG*=X=meb;j0I1ty^ya^k$$WMMW`wl&w0IiSa_s}4;y&-RaQ{6Sq}^f19- z`LME<;#{84yYu|Jk|31`J%B;zdMY@*17!3O(j4;@tauZ1ItRLfcIALaudLr}Xnszb zi?K-#WZAdaY%0XXyw}4G+I`TeDZ7Mf81$A>b5wc>Aulp_nf%Z2?8N*}c-IHWi zZxT8mKXV4iz^@N_gfCFnWd3=(t|FWqGIM#OQBNf8>7>n))hy&dAS>3rG9!S|E7DmZ z#{T32ZXb|`lmFuuo1YNFuYsdNofldHn=-a6I6InKeOa22Ba7zgrY=4@Q7|i6XSwFw z)|L_D(aNthvNL%bofpfx_%&o4dW-lj20w}nzTc@k`Zor=$M?Im%8hhSl7rV_{Y-Qd zgvefn#|N8`{%hs_Ch^m|8r5cYPH4J!!-K;NP3TmgWnnT+W0SRoS}{HX(OC*qeSNwmJ* zH@q@gqLu$RR2S0b9E*VIC zL2bqSVq7oJKzSm2^-GQ2W#fPsf!ivgt2$@>#FrVn+X@SvRhgZ&l~cZJXY8&u3GsHw zP<%p(lta5N+7I0^S6R_r7qDzx(cYiXMOCm&xy5ZD3C)?G7#&#bigtAm;{^Mm0T{dz z-&bB;RBDW!OeGMdpY7XPbb>?1!kB{;}0ZtO(@c3dE6bzY1<81D)95{F5!47~G# zv9-kB5tbF)ofJ@s{_Ltfgg=omsV#~&yhhJwd13*f1qpmROP|*>(T3%z)r7?$E`!1? z>{_r+CDx$qK}}z1v4T~9;9S7Qd$nO{Wjqf8FmxtTX9wD;(1__Sf6gu;Iw-(XbwYVx zGP_{}IzYgF%37?@K1EEpZN*u&7K@<z)XDZ%H{{MJGMNx*ZASw4AY#x@LA*5uK2_xx0>SWwUWLoU1r7Ejtm|@y z_Gy4J_~zOE@|LROKN(?hi)l_@9TYa7+}u+3PRT66x?8$|7nk1r8hwAk-zdOk{~kIO z!+no7f`|VMM$vi9Ujkmao%jTA>S0Jv9*4o#mN7rnH8}cMFT?JH<7#NnNBnqJ5zx=N zraZ*`h9MD#tA7ZH;;x_@z`A8yZIjfsl(+FTi6t1fAD$;G1xdnfP*l6pj-O6MZch)E z3nHPZZB_?rALUTD-)uUi2(Xo+2NiOfDNnS|@=k56Xt5`xE27NR3g~|<&K35e`gp;& za>XQ4C8a-8K&UWp{5woOv758eNG6|nT6EwcCZG6lu5|`UPY#3h~Pb+$(@}+g0RKE~&_McRdpnKwg33t8g zY!!#qrL-E1m`zU&r3r=FO*B1~&!(rQvia3sG*htt6Ji+8ns|#L19{p}o^Co6N6CD? zGDCz8p^Am3h~NbEHDqBjlC^kWJwM?zG2*X0C)Se;P!U>n4R-jtgrCQ>dRQ8$gu-UJ z#$I6uX>{5U8VRtY4N$MBhSbg}kIOM^N39hyV! zm`wH|l8Aibeu#-(nMDfAod4CKniSf|E~~kdHMcMNJQP3ds_I2BbJ$VdPzlol%klsy zn_?~`8?ZvbQKc~@OXQu-MTU;T+jZI8zS*r6NEkA}yj26vM1ogQ;N5J0F;k6-qspAl z5QTDYc@_hyq0>07+i1*T6rax<53|zyTYM*t$GTE3Ic~?GlE<5nnV6j#E&jGjHFgkp zWU+9-#pO3=9Kk{vjwbh-3mvPzM166?8}*5jEn6@O&M~-`P?-~l8l!nkMIKh%kQfiq z)?SQ{9g9En?X`uDkrt?x>MqcPa*Xl>${Z^BYo2N>Uo!xFy@@C80#tfXMA4@l=!x@!j(SuB!E+i74oDi< zk{SF?pyzNbKCvxXhV;DS|LThBpkY!kwO>cWi?O@fHetz z-r|DoQXjCg2*l!yy%N^esoyTg{Zr}#pFund5Pz=Xf_$p6#j(LaG^P!%X5fxh4I02^7cgN1*PO(ng zkndOazqGO7>)u$kr)X}U+%l5XT%f-8<60v5K0haJf%@r)P94pl8T`nlkUjczWSz#B_R+ zpZ|O%6QE=hoGlq+xA$TTTDj7Lv9&B<`??C5N>~|C3F{cGgwtmb3CWQ0Rq8xgS>&#^mHL1^Uw0o`CfG zglVK)Tp-kfVybINA?LoOX5k7XWaX*q1h#q$)^WrGZn`Q9Jh!l|gEjNDaWd)SXiZ(3 zK@WNm!lr;z+G6TMf##ui0>8i+;i5&-ymxK>oi+&$Ji32fnZ%r)ohPHLBp2X1+$P-b2cTyvE${ zETRKysQQaH9Q@X-KoHPv4%pgr%nYul@%iWNo3F{%czH>YF44wYou1* z>pZr&3#kqTMR1^2Oc{GGOJmDJO{3+Z%-O0jSb?hVu&D6!o?kCRWjx`QuLlYKkcQa= zco;b0@tD^2(i3GZLDxm0^QI)0o?%a`@A+)KLM#P^WdS9(+bN~l+E}%g#JA-eu4bh= zDfI`10O871=zoFe=?1G>>%@-M7wD;Hg>tKSXYT@SiTA&Jx1(pGh%HURUJ{w|M7C^Y z95_4vs6y=Xme?UxUj>3&+)ej;#1Jjw`76e@S%d0-y}%At8(K^5yigC(jovEB{!NKx zdg3pkCYN@W)Wl=?y<0B7DIKNwoK$OivZUrb3O0by8T(>MJEvL$kZYpDiF~z%qOx%kb>uwQT9< z3Ml;ydPELXfo3ZqXD(uDD37`Mhm|nfX$-;o$5>N2sGO;U{CsrY2E#yowJI!-Op0m7 z?_+31UwR6adZq}~Uu@}X$M&v+g4@oNzn{^dCX9`&xrVJi)>>c;>;FQ%DyV7AZt1fs zNBL0m&Ly_wRBP8CvqYP8pG8#Ba8N}>QbA3_RbO}CX5FbpB$fXW}$&GRm9Vhp3NHA3%=U-X56PW@^v_lH52p=+osT43=lvOz(k7W8s$FAw@2} z-!Swtt3J93DRN(RBYxxTVXcnV;0o(*m=tGQ@A>c}lFjB88D%w?@s#fK`ic}enz7p3 zZYjD`hbdks8Ek>K>QBaFeWDVdM(|UotU*MYj6>tS;5qPDo@=`LIE_tvEAS&eYJtqJ ztGJ~XGm|&fwQt(tqZuu|1j^RVJBJYLJ+t+>#VU1KA@AxA(V<#yG9>d0Z=xz%#&@$B zgW75N*wW&QBI9?+J^8Wa5~Vzc6V*rp=D#SYRw*A>7h#<#kvtfSw<>(E;_;WN8=SjJ z?00cSbny^w;fP|#)sX(UH1Mj7`1$H0??Cy~H9qL=(3v$!g;zKvwNVj!)rRQ7YT0m| z{G#k$GI|N53hpGO#<9hWB-!Y8`-EfuRj}297I2O9n@e0HyBo3`xtjh))XnnxD95{3Ce#(Sl;#>pT$XzVcK0R<5--@*b()%QDHn|n8-K9?T zr!2D8h0hcZ!@D)uyf;{C&hEfC?Pt~HukQvru2X?MXl{RG0aG>oj64?r`;I zV%!7QqzfQA{i$+#0yidFT5`K7kTL3e&QIVohW;e?x+e_nMobC#B=hZ!foxnfQ%xE^ zKad70ESNx+`mS9mRgWY!q=mOV7#nuHD%96jU(8zgf(=^Kvhq#llNG)x&-XcscA2J_ zI=@(_k-c#}U*&O@Tb>S8!_u2z+6S$oJw-U%;ub1OS^?p$q4O{<;LUoA*t-Q=0he4) zNbUc&x}I4lm#LKKk}#Z)codoc4oVzt@)S8Ts?DG5or! z?SAj|`F2i*W9NwM*zYypzjMXrmH!S2GJ2q?&s~2RETM73OKv;b&i5d#8?k1JZsD^8 zez!!M4)lltKabfggH8jbH{QJxOKMe{s`>7K3w9${ngJE;l;E(^cO-_f8AD- z7~u_G->_E%Ue_hfUTN@zU^#hX?pm?NiT70xWkaVZ;V5-uhT^|tO@g*Zx*Ccn7s+rj ze8$XjFs!?q|7{dEFYD?)aFx2x&^GwT4mYaXz0W4<_KaaTaf#&!ZDXPh?^HLhnYU8z zPI`wgyy~_Z7w_}8R8T9T4^xM1QKg(hZ+^xY1Cma)omdfaG{Czdp8Pb}`$Iz;jzXxOkLQ^S{5_VD`fR!C6!_i(B})z2Zks4@M>Gd#`*hWf^bhVYZW zLr7f%p2A2S$?o^T^=FL(&*}$CmQk1&>FXRRCig(c#wo}T!yOu@P&|zVgxNwfZ-uTd zj)CKhfsI`RHhu>Jk&@tzfZ&S>M`S8S6gJlFC$Q~+Z3ygEKv;5h=B;di4JLL5Hg*x% z_FkX+a` z@ey_b>^12Xl(yBIMRo`?jwiSVRm0&m1*Y75xRJw~Wg(&(@D^L&+TL_K;>PNI`}ihx z5r<1>orjw~B)6p=U5oZ0_<2qGe1VK z$mA`Gr_H0YKTKyojomf00g+{-ywu8O$PztfSpg-#AeXekZpacnW+lA+!d%h@yCF*e z>`_A`?cx$Dpf0f+%V#&%1veHLro^u<&5vwSot3JL5{0ijC5nU?N)*zM8QKY%83rm8 zP|VovQ$vUdELolYG>ah{0Ismc&)^J*)BtK&)}@*uuaKtO29UF?SR+6&1piC7VU6gA1Shnun8`EII)VZuAh#+TGUKmrh-hi%ynhz$VZf7p4s;?aQP z`;2z@_AHon*oG3FAM5?Ci2tT@Ai9$s_z{OFq#vmO)iX;G+y6L+Fsay|0-$U zQ^sPY3{HUOzOcZQ6l-;J0H=W$EN!bN7 zK>u4hwCfZi^d7kH-F_So0pkttrp(O3bHQNCk>aC|@u=vUd(Ulw2a3Jze&rUU=|PCW zQ=sa=G0&d6*hPfnDSE~%q-V?tU|e#>*w8a(FO{-G>G{PYZ zEWb`>x}*FRa&*3JiJAt;j(JnVBV)}7u>Ad5jAC6^bEmRqH%cupk2PNqwK_a5_Q%1X zYlE;#kuHtyO-|hv0b#e_8pi3SI&iq>uX*$sbs5DRz_*X05gX3f15XH1DhxNW!qB`4 z6mvMQTS{VaQoZYDfDY=xisV>UB(vgN<_w=Pf$2r}_K+}AQxYO$;d!v|{IgG^+8bO_ zwHQBxK!h-Ug9KHGp6@~^0IVSB3*hfz^o4)J=aK;3Uh{_1eR_tTfjSH!CNwH++b6o6 ztYGO2yNC{h-wq)<4BEO0eeoy_gtM?IeR)wr)dSidR6ZHh8g=tNZs}O^u>-*Tf#>|~ z1eWmz%ZQl-yusA)%%kLuU57~4GI;67B4;JL4`%d){}fMqgL&zH<%hdaJdn;|=MHYL zY!~UXb8HU}A)N#4Z#P)Bi}c%2UY_QmdkpNu8!R2^RIm&8^jRu?TRcSfh6Oa9f&I+} zOCw4z<0!o>XX%^6l9~}qYJn_2Cb0@eB`6rkU@U4Lbr{ylE@4z50Wn6t$<$ zAy24IRTolbFLkBNzUeAN?xKEdKh1KT8Mds}`FO$yJ^*{)Um9D-qWyxrBJ;!*f4f@KXH3(EnlVaePUfHjO+)-a&N zL*zYZ@;RP+f73;-jFd&)pNkJzKt$g6t{ao%IiJElOy$pHR_PS6B*tS&%#bHEDL1$mSre@{uNrFucl&@H*jig&i;)G z@D}QCST&u-k={<{HY&CrK$=u;z5iSFd@k5^cnQ@@KOsu6*_f$-P$*onx@?RsC&$N) z^4oa5g}w)#&KOcaxa^naSq^>bR-Y5oD<}!0AmSVEo1lY(_+};g@2;R67t8F=lupZc z2ES@|J?eF($HW8OqYo^)8r93gD^Zo!HF*5>A6hCm2bbDPrGg*J|9i8g&NGy|qoLZg zsyYeVp^eZ#aZwy6*uyJCm1YW6mE{TV7A*3LS5%vx_`#EJEE_m3K5{`^l(@oPyI2`5 z+H;`D&ns@#rFy|Ed4g3zDQ}yw<#x^CfTmLU-u!9HEdMpWz&6EajIg;Sm$zlr0)+fH z`C(D=QH1p%=tffJe+hu#MDHa(dh$(V4@N8rOo>NqQo@@YE-~QGl^(y`PnKHz=K66) z=Li~~u8(mVN1j@qx@7&Bf>2(c6n!gY`u*kSm(P_aSQcEkzbR|^ZouWI;+kMS>*+vyoDUAHVFzZ@fw3$OEb`|m4jwEHEU4K8`Idmo2mI+kOBVTKbf5tp z=*6xn4kS1jQyl8jDGsfm8000NuJ>Y>YY`n7&JO&A4vb)NV39vfap18yu%O%)thm#Z zr4oDu_RigN(aLzCY}3%ip|1%1uCK~3wHVDo8)(X}scsASuY=t&xFNLo=yhVqT>tNs znO_m}=l#$2Ztt_`dX$0Z*(A`?Poin_)8J{nc7IF^o1@%+fehBtPA2a2%1%MZ4Fj*$63tS zaQT|Scw8F~6W=M2`wT7fjEnC;Iy8XU9lnI=vaLT0>CpJL_q&nlx0?6pa!e7Uu_y|eGY4RNZ#9Y!#uh>LEpJ=O*nYDVRq%=U8VWZ#Mv1n#Ig{Z zUhhj@XnPPdv6)w6CN>}qnb^l|$eumQ=?}GEVd~Zr=Z7<~%lYAF*>r<28yGPCdi_NF zJP;uX@_8V#eE3NpLK66SAVLxf{5%lZSsX}6f@B>7c;-t(gt}TmA$8Sl6~&BFAQ6&* z5$r&gmhjU)WFU{lfh9{!Cnh+Avp6uIf~S0!c@zdlcGiCTzsTd zLX6`Ai`eH3f>Tj?ayJF18XJf9M>_SfYg|CN%pU_)V9v&&GgyMb?EByG0V|Q7!BUKP z<^lt~5Fdbe{zH}mf-gscx9zGPv*z?xtX2TW$)USmEN3W?g$QSm2Z7V>ufEsH8C_Y< zFkm^un3*WBnk73eJUl|X`rd8(sA%N_cDFKEIy%7$KvSfnx~)9$$%Xv3lMolLW;^=e zB>7!Mc~mG`efNk6|FB2jVWn##?N&2H?R?zv8OITllGpWeH~^VN`3-}x!gNd60u*wk z8-J=exHCBU3z2ga=djhprJO?Bx79u?2LxU%KZhpJ{RVcL8pqh)Mqp*Lb=ak=ar7zs z2n=-&s`MTek3YgOt&GM}MyDR*bJb=>fx8JIl^QYK@k30+^oV6`iRlqPZ9`0tfz*a+L|-zVz8@hmc2yP-RKo3I;(P*4)ybY^yTjpo@1{oT%E6ed4WIzL15{pNI)#~Ow#B>&&jF!b4KE=fk z%ZQ8I)5CXYo-y&i$%2Eo4hi}%oxdx(N&^XSi*jo8I$Tovk*3@VH8%w zguAEY{KuFe4Mr1@{df3@N;Iy-PV|DTXf&>DS%VQl*0)Zq*~bq39Im!-|DHcJ{P`T* z?Xi9tF|a?J8vc9^?lxR^ETAWB%+%P1U2wzC@jOp0A$F`yi?y<}$5W2ieOQyZ@YPm& z-Ji-DOTt)VNqZfBXkFg6Plje_uxW#lV$(z?{6a6Wqd7Bg04q0(>(ds6r@iC;Fs#Qc z!P}`v6Im;L;UUHYJ&J1&D5)a2Ot9+?LxzW@eVq_lOwJ;-u`7;wwE(-gJO`;_RJj z`+F;gMH3^t@vl6H8)<>J0Rw14^Avo#j928vM7Do$ts zANJk@tf{m8A8%i+6QyoN5l0oP0xE(swIF*L~G+nI!(|^?gsdTqips`)4JJ^EN0>-dyA1 zWo9Qk5v{%_RZph49ZM8%l4#eRGVPim)2?zAZgqG8UASyk$2r!;5M*_g{ z{+;8bd&UP50mjkgNB|fn-1bhnp$zkUSOgf#uLBL=rkcwrGekz2(}u6e-uLked&y@= zXi?exGvAXl5ohnr#V4{?PmrA3vAXKO`ZXYUjfb82D*I`*G?1CH?2trsLXyp~lsUk@ z;THo2qnul%vKR`L+>k{+6qLP8%ON49|5MnK5GbOZAvb0oq#nydWBr}`2#T^$$i0z= zK_q!QpnyAadxOMJ1#jfxGNew-7qcrN$~8#sERPb5l?r+jh@tmsX9Uzi=qJt#(YUkT z*#1^RFp>nqK<5~Y0iY+1&rWVdGP@8+m?#Pslm9^O{e9ViAc(dD0e2?SH$m8$5Kn!VTgwzBtQg)^tsX8e zDw=J4^KFsE5wHI+yXxzRo^7 zI?921*^4TCm*UmoK+ed0O%n?f$R47s`0&DPnv0kp%o1>&A0?5SQweo6PIymif`z!U zOf5@U{2vFujuiw!qd&DR+@rf~g;>BmpSjdXsMF178M__thLQMi9M&}F^5VrScZ+#B zOi>isNXQh`heTCt<%G{5bkW?zxoN^T@g?@1b!l38Ek%xMCE-1;ot%B&MTILRtrd0g zv)Euj@XjJ}3zyx%;^)L?)UtZYy@c;_L{&s_MR<2vcr#zEhr{fq!D?`o zMO{qcY=;TW4gOx!PpUDy=YLVzQ%g2^l@ovD+s^LDjBc)%=#3h)?b}MxYGG#%;ayHA zmuVzCD)dhxv;-3ZntJqEqN)_(ukqrmoi(-ME*gv3S*XRYQS*V;ayVp<_HJU^yGSvg z7%r}_A`7FUiuf)L)JSGmYZsw4Uc?Vp6L8t$cU)#q0a;YwLVd@JuMl}VFe`~-AS`d~nS;352A>O;o*nQj;@t?#8!-Zu6fqJc{ zxLhc#Y*+TQ@%Xc&q@(9TMOOn~L|kUU%sprrRW>F(r)!8Ptg=14RjqmD%uEyBlC-XJ z<0s)w4nn&48?kFn)#NwT1^Zs#GtV=rGBqUkm^9Z4jF=6CI>MhTI8)WkYKsa&OuC1N z;-qa9F}LP5f9K`J6azrai=inK(ps#pX;4)BQI4X^f= zfN*Ln*Vch*A@0l!6qUqPZsAw<6it8Y$*;2&H*+;KDtbnF3HYy=T?DW0_7&{~Uaee0 z2K6<+mLTxj&9o^aR8pHN+eY`)^R)<~T8qjz?Kzdg#EOsvGL^dRU5D^Gd59n?bBO~% z#k-nyqZ+Dz(kFnM?5Op#_JNg>Mr4z4#7f zYIikFTvZjGu2Mr#yQL=VAu_uKEAnTYS;4IKd|u)4nAuj8-NHK4ViGUr^D7B;@7gC+ z_S~or$*~vH_6lkHLX*0*&N%9Em^1wL_0*Xe<`nspM8{Hv&zaweyT9|&xA#gBzftE| zWHUuR)#_g9GmAQ>l#y=}x_sKSDn!ru@lm$o=WZg}3WBpi6uF+++11|GVz^r^v$d_E zik#NPq&jDWv0l}db=Kq@$!rh@i<`^+lEgvjPYV3hI!(KVH`(+&AhVjj6rB-Y$q@eR zKqU~U6oIhk&j$ad9=7mjgINxuXVltRUMmU+qLvk_g)RQf+V~QhxV?cKD{e_6zv*}= zZVU*7c7N^26(o4IcRUi6vpk)isvPFM5T45HaA8YisK(?H!bn(Y4f7CF>C8g z97Ik>yf%tkf)|LN_`AB8)E%ehmp$ldj&E!5@A{ow*M5*7ESTaT((B=hyIc8F#G<3Z z04-xteclQ$ZoHSMspol_R!0%pv!^;Bp4n5zB8a(qCf&om8pPdNm0lGYLY7xkM<-ca ztsENZ;8n;JA8evNQWkc5HFLUHWKZ!Hac#Wl$z5T&xV<1(kVU60!AalCfo_sy2GW}6qb5z@$+M1I`;ysVE z+m|I)d(@c~HCb=W7QLeiuIn71TA5;4==r$^>$GeAo-nuE%8t&A_SKa`dNi`%8Rj>g zh`GJBE7WUvK%Uy6S(>lsXujSUu8REc@maf+cY14(Kj+X1|2dle=m+hi`ci#2ol%tg7@#>nd7f#@q9_G$R?(SsIMeZC&+;-HHm8t^w>RX?kFy-jw zv%Gn`ADdb~T4&utGm*A@>veY+=Qp@0Z6$U*$JkGK6!0mxql}(rNnf_%D(f`8{n#aO$xUl z@oFu6D^-3RS~aZZd-{0ChI~s0djH<2{PJ^3Anl=b&T?&HVoI2~zU)Pk25;s*u+F!% zp&t#rHGCDvRCUb`qB0n3IYvuh9<@qWt~# zxqjxvKgg&EbuzBfmK+IVjfmOJT`5;dx$P|PnQfhvqeLSfQQmv-lKjET$ya_x*sk~BEj(IIUyiWWZiKZg z&)S7}`}Wa#Aa9{#dU_vmP~sTbEmMuH&b*3r`$qH48rk8#^O&&Y^e~5(9XY%oD_+Mf zbkIo4+9f}TZg#IUD!6W{g}c%$tK&kGTzzB*Z=pj2+-DS@>E@FZo3>BK(4l2=??I~3 z2!7>8tD~%hhA$^A_O8{acr88R^3wKc89L~skA-s!TT3!FJ@~>}eoXn9SGVybjJXP# zEKcITA6d?)n*>%N zVzl@2ugUfDNB6yUKSes-*Y4%b$8gJF(9)2Bm>#^x^(6$>jHgxnVzk-?q12k+oP?D$nx4MJF{u8-R~!t zn7mC6I%}8y?uc3+jZ2ALXFO+aec{{rbW_{^O2^Pgur&YVnXfheD0oC^5X}0^#S6d| z8h?~OqST>YJX{z(C7@th-#o3e9`j%o%_H7``GPt+P=ARmTE3pNiQ=Iq!4~e?l#=g*?1#! zTFCE`gYw|2?I;k^`f6mm{3V=(0*X?;++rNVxq?;s-jECcO=I4z$)seZbqSLwJf z_*Td5Ub6v5rFb1lH9kAWhcSw+L->giWJz*h=|_xHksMaTBkCB@J`Cg~g_}8T?8GDf z%|AuZeQs^zc@2rf zC|ig*w4?AYeTu68oykWMh$st|`8PIOuZBrz$+W?X+@tLR{rn5N#_gD@yM~j5fm5!(1)X&r1#FCR zG|T*ROm6jC_v0n7M$lmIvB-BA%)=;3fsYG?P2)A}jFL||{6Sx?0{1N}PMjgwL}GK% zANFDE6qK1%tu+1*V>kE9#lFM8{^dV##1KYp(AlXXZrpkjFho`2O3Lowbn$oMZ3Tp!eq%p;@S^|5%r`L@uIpBK#%NwgkA;-*7TjRns zLNv=&rC^Vrvj;?KEw{wc%=y5dy{%7puk~fDNlOCU`XK=sTIm^K6kt1gwWRG;+=y9h z?u&;nD%R8-a@PP>u(Z`QB6_lPcqz?FEabR7lJySZkWl}4o&ABlv5qfxOseoHMGn5ne`1swFFLJF${k|>KCxS@LSX$1tt(iTm5%lmtkbrx z-pFC*dJ7>`u7^k5(oAcYKsy^i?iz~S&cCdVK(Vta&c{dd3KGk9{h=U|WT-w!?SXYo zij*WI%XTP?=iKkbydi-!5-X7_U%BD$t(+Ty_yD^1SDRs8js8rVu)KuRvaxOcFrJbYdMylB15N*U&y$NBM7vcKJ$UKJ3YgQqwy0$ z&GcFF{&dffXav=o*2A+M*A-O1SksSqyNh%=T_cQ$Nw%X|wA9cZj=$|_`LjsJX}{aF zFA3;?8K@S@x+j@qDO=dk_XS?1m0DY%$ub-Y9}oPU#R<0iZBdxQ{75Z}jrlr+hZPTx z)C9#>umi;1Hj13CS##*eK%;!h60kkS_8W@S%z0#;_lI?L4I|X4-^Go+Hjn{gMA#}e zC^aI04cyg_rKjv@`bN>jkQsUQc|!tuH^2RrjxLAI+WDTTc{5*UY*F*md-l7Z@Q>9nc(;>=2StqrS^muANfpD` zYo`9q6EdOBOE0Dvu3@vyNoR}@#VkL@JXr-M;SEi#x{c9!yJWXZl!3~%pF!uXC)IvK z;&U0H6q(|csDq7>$i)q$8pe3;GLAxn#q7_yp5QMsK>uH z%NtK=s70(PE90P&>M=tLOGU2>K6pgaxr|uy&jE!u5<81&F@B8S|TXqoVCvGvpmbG`gg(v0FGXaE({2@HW{9Pc!b@?24gT zA^5G|W$C0|ryq@=yHku%DP%o~w*iNI)G1#SQvjhU3~?qhL>(Zi%bNpI`gQajV$2Xv zGyGO?#8pd6XOLs*F1DcxO9`akJMSsf^34F|V(g;mKQWvY7Fd(}Si%77NtaUK(tO8$PxUet{VL->+@Sv8${$&#ITWLZ z)>3bcR?E%S2$6^JjmC|$U~o}(8)R>x8|QF>w2LWc82e$>oJa{B6dCkGh(=1b=Zg2y zVLYg>hfxAg3;NBEl&3e4{FiXp7NiOk#$CtNk6v_*4#uM#5&AG%k!b}IX&vE6(xQxT zp1S)^=8q}v*}nbmie3~)=YL+zrt=t~{B|kWMRW{Bs$*o!!4criCvR?AeBK0a-|!{Y z@l=;-vWKK3LbM|3<_u@h*)^^t1)`BL;$c6F=)4+N*$m2wd*N2lecaYlHnr+X77~k~ zkKQ=p_Zj!QKB(7u*2Fa+@DwLTHlMmV>c#sU4HbGz93mwh-nbe@cMOla^H$H4FBPss z_lYMn>m%sGaTOep%K~;&^kc8j`#L5WpU%qs`Iw>t#P1^DpF|Y?S;uX?^5zsHZQfOd z?#f9fc>NmE{ewW+^0!H6(3jzNfx%@{4A7*<1;%_X2oFV}bDeIe0`NZ0o#hB=CKgduCgkahY?MTy8*2i8*3SIpwsKk%E! zlNYLSS+#4q^r49P$MC)(6C_+mk2t-xBo>jQr=)z1euTs++UcOR9HAy+_Xu}uPAzL~ z)OPvQq=$nTnFma!zzlNMOGE}R8f5@C!0h00qv$l-tF7c!{Uq@^(wMOcXJKLVA~YSo zy(Q}w%&Js^t5AIJ9~@e&Q;MoIf)Lg`tFWZKtO*3({TUa$j?Ec#oKbf~^E^JI@Ocb# zQh?%!WbFL|9h%RzR-lV5GBUQi1!8W$0%yr2piGt!S<9-KKPmDC{H-!${{)IESh;1( zRUC?v=lue5t4QZ7*_0tDr(hbFv6hrj(DF0g?!Mk`MTsQCCXS?$l&c>pvGLjN@O7Ac za{xRS6{WM3nb(u@@HAH5kZ1sJzt?n**3GFLzkyWDu2Z=vTM-&d;vp!H1c`i>o@d=} zmSwU63o_|&tqKr!4niI3Ro*fVz;g1k11K!K{3r)>|*#k|0vaalCJ8cdqz5R;R zAgAwrFapk`Ul@yi1`-aX&z8>>Vh4cJ#t2c;Z{fWkrI#YA%gW{M9LUpA5A%l*iZ6-C9sL%zTm3lH(6&aqyREfdz1tsu74WjrWh zcB$Nrpsx^Xl`RL*-i{7Ctq}2ZT1M;=kth)zAbvJN@8eK=f4B%89Rr+LxtW;GID!u0 zI2)iv-;Zh$y0IP}vPXRgOAj3?)_HMj+-A-X!QcdxOFp^SyN;kcRI!Jxhp?bMD6ioN z-j!|o(3|sLM6jEgbX+Sl?*4v~2@_X!)P#X*8{!7GOD4ObJ9xye0qpSDgbQ|HR;K5L0oMk!^F0ehkAhl>it1)-%7bGfh2W zJfaEV$}y>*SfQ&R3SH-apwL4RR{U0hJbO)5Q0PH3SCPV&9PT;wN&{1GL->x=zyN2* z;Gi$a%(5A3n>mLEVeuTkPB(ES6A2WO&@UFvB!U|*BSKA%HW2A1)2%OT0yhV!dMk<` znL<7Z59y;yLY&FEo4Mo~J!|Y*1qm_;aD8Y5sTvhs>M;Qkvo#& zhB_OFK?lLa-`ri#YF$?5*S5{35dQ-*LZ7r&?*HKHN#eW)#X4iaws$50w*z+320cWyp~zb&9cVa58qi#RB=3_+QPQ5nS!8)a5p z4A~rz^p&E&L+rzCt_V*IY{2ludU>%GOtj~fv36j%_ zq7EuRm~RuBl*Hj!RpcSXIDp)@%)^!rcv5mQViZQ8*};j3eYdC|c}nfO8{i#4_oRSC z!~_0rrpMNhDlRIH`2*lEwk?KZ66$TmF$u9vWbE14cgAK7$r;H4kyD3^fv`;Ejm0|3 zLnxPNygGDc{afae2u%YeMSvpn?cf-N*bf;Xw5!PBA7T_9Kxh|&J&If|gF@haL^2S$ zujXZJH!comohc@b1fJ(Qjgdn}Br5Fa&1l>L!bP0{-msFs`RUbmfF;3+4CXJIpAy@r zG$}^vd&7u4U@@u=H%J1OgE72c=ngC}J+YngSdO-JTpXG3Ju8ufEni42!Zh$@SdUv z^6_j29BtTuXhReiDaa0Nn*oF!cm&aH1{@bDc6=0D8=BQ1+8;fDjOAVd>c)%*;jjb+ z%NrX>ce{q|C&y_Ko7cfu#By3=db%U&`)*)&1A~gMs~S*wPm#Jc@(Im2spmPK!GbV2BzZ!Ir+5)C4}m z^ElnmLFD-aG%YJf~+FB?Gw& zF>@w@5F3Y9+_EaF?F}Faalj7=XLrW#;p%b>#FI5aHyXmMN7k> z07oEo#bT;1^HsV;jf{NCll?q2M=?`A|yL28!6Ia;>sI%%T9X#Qjb0ulcQ@c8z{w7}`AV z9GSTb({GwM_V4;lvGfe00Dzl`t1wftTqLDXl6l9q4{e#7r-Z*zKhhfLb?U}n@n^vzCc6n?lzl_1GGeM3J zuk#@P87+Gh%T$19r#X%+=R;1cL`um;gB+~gz>8#Jr4~if58~N4la0$==m&kJ&zr{#kP-d_^|{pfowejh)`lG zxOuU<$U~7bfzcO;0YQyrAAw*zxoVT7Il~)Q9 z2RmYjxAy=CTmFDJ<}ZD$V;(1Tg%eHuzcfA2VFT}d!HY%UY!(=dN7f$k$d-PrM^*@*;}qz=qHi}j>P1PQN4 zN5cPHd=TIqY+ger@qfrw0iJ?S9<;+;WnadXkIM6rY--5*=uHh+sf50a5_tWgC^{Q` zhw&%Q;=>FdfS{M`-`W2!1tJh&JAzm)kjsbWAo|4ncW~4Ad=U%$AKAYXg{b*ZbT$7; z4TJF%-;*hr#Rss=r1`JXUi3yZwc_@@uePd;9p2sf8Pv8RNJ-3O2eBK_UCcgb{C z_!;vU`K~N?0_L_&NRz=%8Z82Sp16(U#9zEkH2S{^dK$J-KmitANyZ;~a2Yps3(G5Y z18*xW9^S*w+4y#0lRcjW2aUhu-i=^?h!KRYx}1I z$x2sXd7~ofFKRlW=0R|kqQgh#ZI?PRv5OuUJrqdFez=|ST%$KnP$%~0Y&x^r!+#nG+Di^J)5blm_EOQ8ysV>eg0PNhT!Kp7Ob%VZf zaDdEXO#FbeaS&_BFi+UYO1Q-fa9aGNHl;745HCv$ryC#cUVx%3hOjl%lLNWNgUy?U z054Xu6CRnucCL9yrpaF+Iwag7*`SfA*`PQ@8*pX>YjY-c(FQOq@ro2+Z_dO{2*ing zU>D^I!rQ}&)8e39s(BwyIUPuyD+p7)Mh{cjBU%Zyu-52SVO1cApdW?WO^H0Hmy(|TL{gceZtmNoq;P_A=vMj0LOvD8 zu;t7>?ALM11_&mHmh@K9LkZaer`dmh(=2##BLK+#5Ac#Q5;TCaSRcC!2oEe^+aK7u zrFJdIj=0GmyCV)K+JqI^$F=eC0xem8KJHlHrrY@26hggLFy@ zCn(kT*DwK2=p_9&DmvmFNWKlS%9p+g zP9X>>NMX2N`C9x%e>vICu<8R}z6E<~e&FYs42K8yry!eLX z50wq6Tt>I5CB_YdlB2NqAL@mn`>8)DKPnO_vg!o8EB?CE2+UYxyhIIoozs^XbxvVh zc5oF%!6cF8i({(U^`xA417gB0oc0gOyWi*Nu?9rAB217~2`y~-ycqKC!Ix8k1y>?J zuo5h0e)V{YeP**{FqP^`;n=UK2A5nM4+Fw6terNBq;RUPayObTn@rl zOC7xyO&hyOvtQaOY$y!b z*{G_&VO>0F2WP3_-wbczpqxQwj~+x~un?A1%gjL!Kw|D{K%z~&aIH=Gl@B+A?RTRzUzJhmH+eB{Q#2_(~ojU$lNccR~ z2N(N0j)ZNXc6`gnZt6?K+n|lRsSo?J9+*SAff;3-1N9Cus;lWBbvj`SUIMDL#!iy? z^tl>Pn)H(@s0Jh;)4vFUtVBBA=6&q?Z`ip+nD`qz+6EpX>@Wh}rzr*%Z3962fmMi& z$fVjoJxTn(_00;*G%ji7ebi6mz(*}I7$6@9z2{D;}GUUEewydO&H6)25vpo80?xRIF(JYT7>6{42dHmshMA*<+2R~1CXFt!ag83l zG+=Crjjh;lib`Qh>oDlY<_)9;ZY9$Dx`JO)!E6z5fkkXNx$ zUuB0RX0PuT!5C;SJMJ1|siy%1-oK$dLlUwfryPAl&L_6y2b&`Ikv^gEBrxCp`mrOZ zPUnYPAjD#7J5v7#&GUm*(+gW9fE#f}K2p9OqdIYG27LPv?NcMT4s7gbDJFpSWn^E) z`K%K5c23O7i`YBUAPIPIniVhgdpc4r54B&4t^iI-1(pX0)ZYIU1E368E`8w^&hq~&1|TVf zIdIIY073eSrT*oWKyaWkR>mA|78~B?Fl_CSh`B2Z(>xfU7=RAa;y+T#JWf)|y!8KR zDRaE->$qEKu`|yGmEJA*cT~)j^2YL(@+o^$*R)L*8REn3i@Xs*`Ua7r*1C!_@Oai5t|N3E(PtPQdc$w<|Q0NNG z@@a>QqA|ashLg94ZLi_@pg%tU2>fx9?+-uyM_e+v5$*N=SjEg2h+x={E*P-mMM0RG zJ8_b<^pRrPisUZ;1^~|H&dG?bvqJwIqXweuK3&C3J5?NS?Em>KrS%ShNz`!SS$ShK zPciD3C>DE_)e4V8Rtr6>h8@pxo;tsH-YO!L2a^A8Uh;d7y9N_@ovRxDoJj zhA=7n0^^hI$;0_F5%_GdK6nPN$N2m>U@^>3vSBV1%!5BpyaOj0566SlfQV0&lpx#y zGuZ90dk=l-|EU0TBpnZaVooB=JfpRx4Ne{j}h7O#t?H{CmCAam;4+;TVS)EB7_dE9YzHyKp z?pKYlTf_mFr3flT`I0TpN5UcD`y*u!tnTEGT-^b_=Zm*vQrilu(*3oz6?R634)<^E zX2xMh96r!T_yA?+EQEQCT}_XrGr|h>6%h3l%FU;%NX3>na6VQT2YKHg{1Fj=Oiobz zLQ;dFH>NM$nyJH8k$l58NTH0aCRb)4;AA`wxa<4lzYGBQO$E=8!4`x#GmkBSFsowt zBGxxZYIJvQ0iyL$gH1SFz_1dIaDz=gNO?H;?i)%H#-Q@DFvZCL(h$4zIG@27RHj1N zzavutulgyr=L=g-;$TSZTv=Q>iPK^nwoyMAmgLRAVaZROD~m;G$Tvei5)@cgQj9|R z?Q4nV-{@H~%Z2-){9KO*}Y2=?w!EPBJW;P5Kh;CM!``4UGi2O}x~J}-x& z0tOXI!^}_YG7%`xQ8N)f!XU)?q8dlcswme@qJ+9-h!!qR zUm1U3_;c41nsdkxv9xDKp8MSkw^P(FUtggA{jTwz3l<)&@#q@zll#4crs6T*SDL=$ zY&X-t%m3_zoeha;wx@E4C1*Wl(suZX(PZCbY!BdWCB>Rj*d{08kIe0y{Yq_&w9GrN zT&5oJGfLgm|E?H1mwT+X^F%ns{-s_8Oa3%8#a^{MT9d7_nbKuVTn9hB?Mh!l9P;!U zV>@RSJMn6=V^1?X(W}I={|%Jhr+r^R*#=9_T|(Y=uh07R5P8Rg%)>Vr*-PSS>0JHx z^ReASHoV`zVKev7Wmg|jnS}hrnkrl#^9?dW7`_!Ud@F@3aGP}aLo5Tn&Yi^GxA8aW zq)6Z2+xaDI9m)#d6Wkz1us6!(Rcsw1=?mni-&^^Tfv;jGZib8SgL)CCznR;KE4Gj_ ziJZor@3qYCZCS?>d9CF~w+u6}6`6^x=rh6Dh+N!=b`hu~zkKN_my#|uVswc!)tEyeD@WX)*;ut%?;e3bxN&__G-Er_)O)+U zpQUadX0_+J8)Ng*=;y*IS2@+T@@v2-hi0k3uSzt-gHF2+KZ?{9OZ)i%tgc-k*J_g` z2PphFK7|LkDYm?oB&SYmWZJFKrX8p=_2BmH@B@t2$GJLRjsc+hj8>NcC{l3c+C-QG_WX-e|>X;YjySF zZB$W#Fnb68%R{_Z#$zw96|}XjU1;?)3?}i14f0{oLUTAyh0*jIjFP$0^mb}VVtaxn zfhQ4KFhJ-r(NiKjHc{f#W9>S*rA9nxLV8IeV`%!l%LalY&p>H9^~|g8=LvZ-$tSxr zmaggI7vH%vz#vDkQ&Bjn{C60_q8IU0WY@nJ7b++ygKkBIGU{m2)wAgeCUmWw#L z^GtG)UL@lp*UIl2BS^3lxY;4&NzZNQC!K5Z#GA(pKXYZrX}MTo$1`5)Wn71!-Tg)) zrLq44jm<9_w>`jRs;*#cW*Ige+buo8JydT?N@BUUovx7(vnAn#t~FU~c<DNy~H%eFn@il9cYzO8htM-I+pO0 z{Jp)+9s1KocPpv!)|M^s6M;%8aodTjDRKQD>|OWGl&cr5w~%gqh2Fc+)PobZ6Kk== z!X|{>-qUh2WdLmWKjFoMvs{%7hBJ%Nf2v~rWOP;(4Rlu2Pg%%i&*WIzHOA!kDBQT0 z!ml6~uV7q!X%-0-WwsWDq5`==7Wh(&g0!qJ=Sm5K^$M5me`D$5ERl7UGfIDc)_@+v zSg~lL0HKKj44NoF8ZJO>crzs>c>Ox~L0996TM$jXrN2Ovs_`Z4#E@wEE1F%$?S8}t zOe_)p*SN=4_@0BGF^UsKA9j5;@cGZNb`hW!;iq4hxskmWV~~q6=oj4sS1YGZtbi;V#W(#E9{ZQSs0V!Pmf9ozlF4KlwK zYuC&zC1B|+eMG5;z9%UBKSWUMKsa{Cpk#sHN9pB!-onnEoZ__iw6YZP4*(Db1h?KS zN+OX|)1R{Cutgi09c@KslS7_?q!PB^89e7rGR5(RwqvW^b4J7*z(%jFDTrAFwtcwbD|#)TYh2_q{3yOWrdRpd#M%|b;A&1}9uS1+ zbtOjhnF6|(LinH0yx2g|KnO~spAM9Pe_WjoZU>b-rgk&yx7wFjU07wOZ@Zni6{M79&+R;PISAeZehN@YP&cY)1iS}$X0Z;w7&Jx1im4(4f0!8D zM4@bB>v&Ka!YJ=OtlDc+-ueoF|JS*4N<>yePHni>=pv*~i{5KiYK?9u*&!G0P%myH z4Ip4~Wj?O-#SyTZDfS3)*`pHIz|t2_OVhJP#PTv`uCX_InG*vmf#s-H={4>Lu&}SqZsKt^rGAf*TX z2H>#78LKJfoVC$$X9O#^k8NPFl(7XNs2_nf@pl%Z1Z3t%dx)-am(5GL&e-(r4n-3~ zZr^1$r_kGDdC$Z5VOq*KthJ3aT>?*hvEWH47u-PRisD8rUBq*p zb@yxA7fSQUeI@#BX-9!l)iS6Fr{o=1qY25}dy`FP&iM#}p;rYRyZ1nwge`9G?i zc^o0^`a2*c5!edE8+!O=01^5>11WJ)_N-^VUUFf9r12sdJ1qfH!d_EK-AI` zkqJyhn?P_q#US2QPVt~58Q#i(`xD0ps*4C$T@2yM_&dBb8EJVkYRl2!ScQvMFfQU) z5a3-k`}cWQ3(67iYR$jOyBhev@~+~e%9~&3g3EXLyq$`&`$NoH;2i^{MaU1TzX6|j zF0&AQ@faK8;P@)=b+!lnLk$k-0Au=UicUuYy*#19Bce+Z`C|KD8^hrclr`c;$yGj$ z4DNIspE@A>Uekk*W_nlyF!j>{KVf!gl@N)0$-M+}a}vjS0nWS`WQY#Uh*y-2@&M%r z;IV;{1}3l*1CxWZ@lq3T;|(}5r~y2YxQ3@$&XRduA8b5wjtynAU$P*y^f$tNACPe{ zkhZ#jZ{pyHN?i9IuH|%#u^;Sv@CIWA&T!p(xN;w-zewP0J8rn&3}G6xe&XSSoK}!B zvKbMn$yVgzdww!`l>(*9%7dx6RE{4w+ktec zpH;h+B=3@wq)V8&GeA-wYJOkjE{mtVwgq>aR9eXtvVw7lDLHR3b`0S00y7sp6zKL0 z05!ZE9~_&+gib%Ado^5By~vz0<~x#_A$q(AOhd#o_FlY4?i;|RQe1SRi;0-@-6@n^ zVhdu0&C0`+bd0PO$gL3GMhseNi9(bBk{qN-Uz^aqXVM7J1)3e>J9F~@667%r*})l( z8TQ6?&f}y*;G$b_Jl8k^UFx)<`lTT#8;itUV-@wvO@=%uOGhr!(J$s1A*$a9UG-~r zEV&&GKmFKOzK}07??5O%6TE~LJ>zY2H_)2oDc?($}MF2ZhiFhflEj3wb{7w+poWd`OEn4#Y1+x zIfY1$Vq)}Bn2=$&>As3q7H1sIE)qr*tO5x~cF9~T|5r1;WwH*0_d*(-uP}4pP<&sh zdKY-o?L3P+tQIUked~#2_T))j8kPw58Xap_RoJ4?OrJj=H%}lDH-8a32MqEAu#*T* zZs#0c=53IZv;(|_7}*N}$EWVt4nKW9F6g|}ho>6DaDGRot4Af|dQkQG!!lQ2=ha#; zYMxmKnK~ZSEV!AnJfJ4ld>H)US7gmw=TcgbntL$mZB3b2_rx1U{F%*VWBDfM{GM&m z-)K@7t#u=EETg0|W!j_-Yma_SpFEGAJdv{}OUGO7*w>m_H_xj1#b^a;+C&DML9k1Jk}J;#f7IWN7Ru5~S0U*0k_ zK#!b6j7pwJ3?5IkKF2$d#g22)`Z=N8_i>WgOW#}VsAVOsxz-|O*|z9AIQt@n;JI#0s{GoC!X?=_L!~5>M5Kaw zRrWJhvTmbgbh66jWSEzelQ_qe2yZT0Uo<`Tt!D1Ll&^@E$29!AE5=F*@(?41k=r

1P)_jA}Isr9@x>|HpwS#!u3KGLMnFqAx)=j1U z!CwEPXY+ZQM&ix;#aBwV?mA>@9}~y@Zu71~c0ZK{F)SlGCO%#;ZC>OLzn*vBGmZV= z_$b0DZy*2-eQSrhxS!qa_V?UH=)qJ<9DeLw+C~2S9g$->yWH)rRUBg}0S!q>#?(PI zF6rgcwGN5gAK~OMZXDZbXga$jC&}3&Wyys74>tvl)V3*E6WG;*keCJ`&vyCBdQsXnwBIuAuukeD4xLqw1@qgw+L^u) zDWz`2R|0iXSgy9)eAb(*hIX@AY4MvK57Muwk&Bi_rWosWxvGl`oZR%MXAV#42{bj4 zu1ayVe(cX`j-FqQK`7|g-bJyN@~4!lfwy#kXlQ0<7inhce0Ma(O_4|ah}Ml^5q;}v z_1>e2I}{$B_S5Y?R-so-3K;pvIocLUyW5Y(?GII?1kT-yb{1oR4y^7a*F3Y%v8QMK zaICbzMNIy2q~`DQl7|NTIo|pNk9v}~);3xrk$wFk`%0-w^!=AQYwcs?>z)&<(UHG- zm+wMrSbv*CcDh?6q|kd^-`u_-B;tPY4xdp(pp0v!%lO~*e^}d}y(6;s;;~321#(iQ z-G4c6t-Vg{k8sj&$F6claESR7TI0R4d`3~-e%%v)>c4$C(tVNJvqTAdYzjV@FuAn; z$?KSkrBa#8c5*aB$klzRckqP!Mb=H>PExX$31!PrCAf1;k+ofcj)!9$(7Nmjh-;$f zvICk0IvX70CI{Iy*OVI7Nn4dja=4GCKW%wHjedJ=O39_Jx?9sT8%C8Kq<5gpeD8yr z9Zwby#6gxG z(Ff7Iygy*mf^$^S5yneV($e#_hpN;`YJ|G(P2qLgp0`-O}Q71wBi9MY`e$xv0 zwZd@c_SX0*>RR_L9`On0)Z_|d)!Nj`JIAB7G>;TIi#w`c_;}9gd8SoPRgHHDBaxa! z7frNPc+WLbaI-^oVj}ku@5+A*9NB@f)uf;;gdDj)sOIDZ)y1al7c}!(JTrC2^_HpV=_8 zIkmF+&FdF0Dm9Y|IywWqn(7+!Je~PY0=xTS;js=cX6UB*Jd@O@mhRW7J`LNb)Rr2z zw9c0LEM-=QnD>-Pa!~#)uYveutClTGOm+4=+FFp8P%Cz&baCJK+gh04DvF<9&ant5 zi1Vs){fipHS2oN~D4*-;-oowaZaq_`e!RoQnCa1~+oMSqRbJWE?p|`uoIKb&7CWM%TZ^(Q%x1>IAk1jpyuS}64kxj z+sXw+k!4=@J-_j{aQ1)O?o~luTPf@=YvNX2QqG8R5VM1u>f6U1X5LK_|0rna`O|^n zDN3RVrevt9i&MN>#U28K3gdFMp3gnQ_~lL1gb9_RE#y#Zl2>!ok&ddWOHEpI@@~V* z#!PW-Yj+L*McWF0ZX1=|~P5Z4sMrwX@vwfcyvn!-ERX@zGT|20)Cd|hAD z^P;Muqqe$3y)vEZCipe9Jj9wwb#v@`{rU$1^S;(Ri+GWUn_0>KJ-}U{d|zu>fR?!1 zRp2Sk4d{N`MlEmm5oVFQMw2_VMBQZ9QTLhDBpnxW6E#)XI?1Q&dpG^y#f%28#kEmI z>#A0Wx;n2eHaJf09-~p*OsW(={4S;TOp%??zC#$l_(A8KSJdh0<>qB#;k0MSsQG7$>*0iu zVTF<5gy`dXm;HL;2`*bGv}}`K%7dSbb&na7w666{=1ZY*NM`*dud^KwQX;(yI?@Qr zhD{+hg?9u-nc2rKN91bPM<-1?vZrljCUUmbzViv|PBtN{{SNESTxJ~8qu+(g+P52( zcIhFvF0l>NuKz{*c1z0>Wr30bH}LH+U4QNTX*EiVD!rA3N@XiExrKLpC1)JH^)kn< z%q*E;``wFa_m8)RN*~XkR??vqY^I|2dtH%#m42XA=k042gbabNvG6%JO06UQrHPT{ zShrb`J@2a2!$+=}d+)mg<=;_DO%I$}f8bR6o>L{|EjuoZk0|G_vf4G>ByEXvlXY6W z&-3t}>@Tf+)|7b-Nv+#2P%A(3Cfj3i)7R?D*UVkMM)3VW|*``{(LqdUUt=to(pU*?u75$YMgnJjw8mFIZE?JeD-;o`Kp1JG;FTUA{DB zEiUgM)4m`c|FJ!Fsh67}b^)dPdcC82v7 zJ?n-#p3sA{XF~QI@!aWhBBkx-gnW3)@r3HJ6DckG%172@1i&MKaMt<3$eQ~B6liF- ztfAG=&~Bt5H(5i&L-qvUecAfVR+af*$C%R=!@6%*rB=R8@bjgX92GzGEY`06DQ9Um zOP|_$_L{c-Xo_yIU$t$T(|TJtl)teROlchE~q zqO&oTcj4ZB{cOj18eN5(t$a3?kw=F%X7~mlImWm;SLOO_IIPOP5p?mK&$5h#OR|rS z)HpuVnlLwE^ZueEi^Gqu)m{$A@mb5um_M%AlVG4`Vz+4TL}KB?rqQ8^aS7~WRL0xv zWu_+z-<~ggTmSjn`ts2(cMGX4N6$Ardtqxdjvo4SXKX?iT$CIc3ql)qC+~Xlg5)2W zczNk>cDCVs80BQj{Zgl>B6@JRvrkuhs-9z$wtgfW3E33qoY5|43yrIep06t1+4)Vf z^LpEu!pV)El1X!F-&c2d3#BQ61AO$V_e9~H zwa9(NiIV$ zyS{TL3*m+ZhM6y;G9@et;!7X?5!tNd7(TXdWRBr}54E8^nK-*B%aFfN@KOqUDA)K@we+qr2R|5CiYya=?LE^ zW5<`eFLsHTEoJN_Yj#y09Zl;m?&>|q83?n#EDe}-ulnWiNN>UFC!s9k!me+B2_KqL z_~%4}KPR?5jefi>-!?Mjd-J7Hf!pfuY|B3rxzJ*1xZkmJdRcJxZl?KCHUC({EDz(y zU)M}@gtKD}vOHGBwoYst`87O}4`&VPCu%=VZk?!|_q^|(?AE0hbuE?_oe%A6du0{8 z&2X>6V^5IBo+>_ejQ0Q@)Ap4;c5U0?R~4$KqnX!hSM$JJAPf0XEejq*K-{){=V2% zpysb86ejpRbz!zBpr+WklHIzZvaBQFAzp3mcR9~H{4L@u4S(^8DkJmV{O7w>8*^ih z{V_zZvGl*puZKfgXqXf;_}ull7XAbnYDB~DBkYgn6s+2K%9%6dpuPQ!mWR*N9b0~) zJ%6#n`$@*o2s4jDmnY#v%UkNJLc)gv8}XFP?+!7)d$(snbiua#S`Qh?0vFYKECMcS zqx6wycv~EBQ6Z;~JUt4NfQ$6VedO7uR|({)*wEp+iHi)gu1L63!fJ0P?$XN|WpVei zg!3f)sGpVHdO@UXare0R$<5x=zV#E!RwDQL_T8tKRU%#3@_&L!e9Z6iuNySfl)t&R z%PIBl!@XU}&pnNmChRf$N$2zX)d9X|R({^@M{JA?TX@FsmnypNaW#hfBZrX@<4R|* z;Z5E<&T2xyv_{ufn?lQB#A%2I5!nX%w@nGNF)nE873^n1Y)sW^;tevd80X2(4G*<3 zeoS`t?)r);!%Tp{W_bYubL{EEX*GL$PTK}rwDd~<=c{c4m0OU;Gi41ym=*-; zxZ&GIhfjJ}m*c{G8l|>N_-?NYr-9HY5z6OVi~Peq<^ut3jVQRax9gx*#5ffg!`gAB zqRXjYM3i@-;Lp@GyBZ!5u4-DO0=?(0l0w$gqZ_J-jcX!=-9x4o>D*&^&9`2QpxVf; zH~P{xPmU`kC8aMIR~psGeEP6->QlH&3<7@2tb6=Y&uQLNEq;!LaejGIX3K7_R#&p) z<=>}W0hH<%Wq!#vP_Rsw~2QU}_uCq5Av}PY}J?3p6VneZgp53c6Lu`hJ*Z_t* zeJe}*uwzrwNSVroH#8P)arI8IIMcU&DHbNMe#WW_y){-vdh66TCiut1FnCr527nL- zYzStDm;1&^_o@TgH1%$XO-I*~O|Ckx*rzyG$htG@PjURoDgN%UGg?>qrRp|%Msvq8 z=Yf4Oe5C!-D=v$Xg;t3$ni`?e=$g9s?2|_KS#fc`b9YZobT-2qU_46Z{>i82>^IVrPMGhZ4s+aPMl|f{>^78 zXyhUHK>1C$r=Si;#DU;Y(vUR-QbOgrrRzBjv!@D=?L{7QRD5g}^4M4M$Lc3e&+|P9 z@6Ugx@Ywqb!T_}F|3R!Qcji9``mC%qFZ*QZXM&bR z9a}6eubuhFQBHQcGRf$5(kT$!Uq(L@(7e$1pWoB3mU&09oVtX>NQ zsJB+(v1xgMv%{%9bH?79Y`o}gk$)34(t>cmyDmp4>-GYIurt^8#FG&klS*$-&$Bo_ z5)_Z`lbPq9w8y{H7|~ET{8?$~%Gamw9rUdOc=RC^zE0>6mnXns7uF%Y8gs)>^*Ue$|o=<7ski7*}dv*sxZEymgBzIG0F2c zFjKEsbS)4CE#Pmg&GjX^7 zHwQG*9J}f2YBh}=uUwnn1$ewndHknR9_!9s>wO1Wl^n%KWw`#0Qd#m4H;{ivm5<5J zftfL-6~X#{^xEz9*T95n`q}}W)Ka)>dY)}bFxUmtguB+JX{<9g4{0Og=cnE8`K@J-dK$Iov1jqN>R*N*dzpB&X|1Jyrv_Ln1{)3l z8XEmTm4Vl@^`g@ zFl)+15Kyn3;_#UE_a!HoGT+d^CRvx)CxEkCZT=DchEq@teFJ_BIQ^AYQoZ_`IHRA=r&#P>Vl}F-qN*Cb>^EWT1 z@bP_SJ2%(Mo=FPuD)T(pdVHa9730BRB9CW1-t#*%z(V;RP~j6;p}$hWl$Z{-zaeeb^1=(v8J zu5I26ZYq7(V)eZ0H$5H0|=awL=T0I;8T*Ws`XNZgNw=1Gy9aw-@37@WqdJ^Jsng&`qq> zZdcoq8?O~wMi%Yor*&YC#&ZZf`m<%rj-hC}Wh>J^$XIqGV+qm#tkg5TUd ze%oaUPWaUSkG(g6YUxie3EJZe%C5*t>NXoFvAinF2PQ_C_;$e5qT1zcU zrlwKpx>bwu!B|guFI$`@mGtkHiBzfA_?WVi_!I^nD<|sVWh<0DB9wTAQlLr9FzsNH zm2OgrxQ&(@;-&2C<@L~5TWO`V(N%NOj^=(v_x#(xii%j-)GliCMdU3szx|?N=iy+7 z@&?g9CC*%-2;kp}=V84gd67tW8L3{?v63ZxVk6u}khFUn8`$kxS<9jJ)b<*s?NIgz z+{&WU#FfAIL?DsRb!pg!bn#XnQiHO{D`ZQ3X}9C923boixl6@bL^hW>N&`vqh;`aG zJHJ^i6>#d~G>@0@BVM(4Exc<@H&^EtA}{wGs*-6iD7wh!aVS?`WLj5SO1%SBzH)6< z7;A+*Z>@xq84`tI8L+7javtreIMcX`9$*24P{J< z6P6m%Z`lyA`MLS+uE4f*=^Y=Mo9sMM)vuly5lFJ+DrPgNe(aypgZKrjZAAF>AOK9}%(W8m*=r^!6yz1TY1MObM28nxp8B_z+v+JaIWRFEi`5ku0f8_J~wC0QC4i#%*eV{0Z5d~6?ler8ESl2AeP- zP0<2NLXc+49cz(^`GL%?`bl?B)>9@QYR_gqJixVQ&Qu8Q@Mg1IZUJ` zMgRmq0L@@D35+g_N|OkWVzRBipf{!}>Sw!GTBZl$=Oe6zCOY<+9d`Ku5TR)fA<(Y? z0(ogaxg#3${Q(mEnb}d_{P1`srHK0+aGhtCQV*^(*rk8r^z@iAa!{?DqdkFI)%XCt zi2w?eg#Mf377Vf)jDzo)& z@*0?O-_=M7x1g+;lxhiLkA0`+OB^nqRIkjHvow|53OO=Fm|rdKLh%$mmeB}zZ32Vt zhb?d?*vs3_q5}IRZPk^+E`CTKyF=33rVI`V@$GM6gBYFrCIZ)@`calnEEIJhr5-Q9 zY71&EbhYMn&oq}n2>q&SooC^gr{yD9lJb1iOHd6%J(T^yh^ z^%J(xv@;_3?&`>ZQ|8)9iE^HoG*D1nM3z&Llt4+|GO3(m>KoEiU*MaYh|00ru8vH~ z9cU6Ou*Nl|*<$`JRvJw#cM+Dkh|BouCBwwA{5~KlTtxUZu_D8wXoVe*=hxkd)n>v(dkfkAb8If%U4T_R;L zjjD;4)$~&31@0CD@yOnmmefd;?Q1@^n8B1vv7(E|u+nMn>Iw?2&sT^v37`zH6aqcN z#-3ug$vFWzdU{HxSfpuG=f_eOMPOZh5@a0AHHEle&y9Hkk7SE9WwYGXpQ~W$PQ+vp zt(6pA(M8S)s1A`@Vtl-OI%MRl<10Yfse>Z%`^mW$uU_=JHOJ~D70wY<#~8~@!|#Fv6(YJUF6_}pEcxdG5F=zZ;ncHtjj_ow!6+z_=6 zLh~_dWjNOT4>j;l5Nai2wySHo+Twh5`Nj=4gre@|Fhkl&#Ox#0H=xxe#~e%^xt^;H zijC0}CsFNJ*3`i5vSSXqkJrSIQ4gap-gANGM@u%Amqn#ie8(k=p4qSLl%3{J?G?vs zTm7Q?x+%OOYo<2Wcn%y-J zm%IJ)v7n6ZdDOJ%3n%odyMA?}Ht?c(w_?NDd+q#!%k7sJ-rovMufaX>P2CgC&CLRr zEXr0jyznVf=k0J<3(NT&kQ{N0Loyw5I7m@DLuzjh`!0{Iy6(LR4u|vcrkSM=BI7GK*-4VPa)+ zb>$;$uJ{~FK-8lR1StkIX}v^DQ-suwe6>sBR3bK4wpUOv?ZN^LWuLmDym~KdAGe71 z8RKwhxs;RJX(aQIUo*a-O5QqK^+tD=KaD$0^V`X+a1rt70ldAUdj-keude5ecTP%Y zzIyL{eywy_a_3i_syAwAAqGUL6kmlAlTCxFStvy`zJ9vjI*!)ty(y+xzt8yHGx>|A zEX0d9EhkPXdTBLzO^ly^sNWrB@3;I?TUL`sLsOz2aY|0UA$U})48vI3)YH)^E9w5A zBRPok2cFUj#%MI$7SeC@)H3wCdtW}8&oImZ#=bUO^4VdiuPM=*pSDnwRr#o7|7<5C zemDJIF3F@rZWRy;E%tpbDQS^hdo#2MdeK&+9EKAQ^$X|#Pk3Wu`(^0GKV=rb(|)M6 ztJ1LE&8ZHO${hdFBZW20fj>C`4@wJjASfxbYMIo_bU)1k}2R-uH)I zKpRA72QBA?VOz2QKr_>6FzEQj7v_zkM5T|;TT|jKefGi!+$VHtmk(mznn)R;sl>3N zJ=%xYCjW<@ePfd-!y8n$f<^0Io9RKNmqY0-t(Efm-cny*TM_F z$3uOOa}*DC616>4{J>MwNLNg`2vf_M*WgLq3Sj_f?9zP-ttslOPLr=GaokufFOqrd zxuICf2UBQWA>6m&Uw13_#RU6y>nL}h+bB8SflE2V$ee~ z@~gGxl-rcAD`xVZo8|g8(1sXYm+EIxB5rqR4tth))-ZEFBhhaJ?487R?|WcFQ11<+ z*^wm}L33(@mFu9m7xd7(hLKkQwSc9uza??k?`*Kja@*t;d`}vn<8aYR?y{J)4#$)mkox`oBtAcEQO&xB(1KTH3Qo zxFNk({p^u{r=MQ22bxrg4Y=v==my@vqM3POoB^3yK0A8z1LETsA*J zOD}DQ$asQQvSZ!Vy1v;3{S|iM4c8O}q!@3LM6-9>?F%ZP=$p0m24M4}ihuc!D956F z!-kAfNC(UOizrc$5IGIl8@ec06e?=Ay8kH^|5GW8jWlzX&Vt#rXopclKFmzsg`%KA z@^-Ofz3I)vkXd35xpqFi`HibhYS`r!2Mj7W1~o|&&#(h)g9|R&Z8U9A z5{^$ugQClF@7a?LzEWZffd?opNfHrvL5l)q{ep4wq%VvqSWG^=m>lP{IaUg303_{} zLMM|M<+!{Jr>h=)xe`({;HrK!>MDXk@a^AdYt^ki5ax{9Va-%olN2U`7M*jkNb28( z*#T+kVs@5l4@f(>yY*0bf@6KVgO2CqZyP5qZd^T?p)u@@MIDKQUq;-I-hTQW@z#a< z`>ID!4(K5hp{!>9pnr|^!zco`Lw@K1S_!UYc>-T&cE$G+>z+&yedfrEw9`}eK)sb% zabt}Yy#H_UcD$Izw(LEfTSd#flyLP!cy@&gymND>~}i zkO5L8nbrr2!JtlRt8f*qVkz%vsWa#b->hqu%@NrA_O59`(3NTidH70o6wZ{Q)ec{& zo*f9TR9j^aUa3Yj7@Z>VSocHHw3J@`GQJa2U5k}t6r_l-j3$~X{QFyuW=l@K2$A=R z1vH~1nLfCkO^Y|fkc0fq5%!5Fl;Unsm%EbAi8gOoyfB)m=|wU@7`cLUY< z1Y|8S9A%V55jzB}GS6`8bGe^@r!&J;kBA$0r{#Vw3{YJfP!lnu17mKZoKuetsP_hC zRJZ%`1(sn9FU*qNTtbR`t9H7420<;dxPP~c%yf(DiDMzMG~|PGLdC5U^$sK>o})$8 z7i*xAd5H8vq?!1K=&F54-KxSDaeA0?=KBwpP>-H4{^p6Y)7jR>dhTv# zd3SWxjUI-c(es-R^*f}Q3$3ifux10lX{RS+R+6sVe0cxC*HKj+O^EcHnu4F!rngR( zZD25{g@vIDkuPuhyxed0N_F&P46}!1jnindH3mGZXs;YPb#dCE_JwN$x4xT)`NQIWE_UOR0~V=u^~EOpdjW`WgQK4E65xxrX1%bd*gHV`!9FBLq*HfT!N z)_Zfk4y+}}1&T&>OU{qmi`gAJJyttZX3g10%6#W7fCNxjkQYD2^5i{7&#)V6cH7rk zgC#Fy$Gz!7yQ{6WvK7qAvGULrIp)O`=$_G=MhH%z9rp}t`aCy608rl$oPcd@mI0nj zw|uP*Q?tSLH&o`gC{kvj$2m;<=OM*x>+q(}QT@1A`dL#p%guL9bwif3{PPT zizCa5g0ut_<;%0Gx)=u@WbW*aiXR%4)9PsKlb8y~Y}~@kMkfLwK1VX?l>sGtAs*Pc zRhiHsY`Z-b!UTxP!PDEU0RfQYm7j;`waZ-Y9rCOxjuXct6uoRq2GQMZ93B0owAF)$D#;-|(1B`BFO$n5U}TVyPEPfgra5$nv*`ge1@$ zJ&k1%0>8*}Yx;mTZ2-IiupdBtY*^2@G0eQ(YT&zcman5nn4LY$Jiu&-2XiIYU;q%a z*NiY5NZ87jyTNvQede5f_cJ#i$((b~bM*~~Ek8c-{&(M8oU<|qDJz)LrwbJPI^Ha& z^%m5*POsv&HPC~KSufe%9qaUWdD5&clV9#uv(!5?sRQsHRk$2lt3_BUXIM}Q5Y zXFWXXSyt#V%cl#nskn%yAD`6Sya4Is?pf2W0}aM)IE9%6ac%l_RA9+oSl`#_?H;0J zw|mxY0Lj0k?3s-l(5{oy-LtH+=m#MCNOW%90;{bL;TpN_B`~L)*1{q&WF97Tq|U)R z(8}u%p3Lwa)?XJMJR#4A5PQWRT5?&B<4!hY47Qv&*Ov}}SKHRP*+S~JER(LQS4sjP ziq@B+-C~@|0Ur(ban1(-!}rD8Wqld2>+vwVc0=qc0qpwh4Z9!|Y}_nP-UGG` z1ixl9yG{Z|GqaDzVk zp|yWJ8d9R#1j~lGz!?^H6E0ly+c5`X!y1QHyIBzR{7VM|U~ijGS!w}>K|bW2VX*eW z!vHJu=LYgGtpZ47eoON`M}^e>b9v!h$*%5Y zB&KNJh+0c%pQ?R>kfOZdm3)Y=kkfRet#Y29YT$jcnpeunw*>bEi=};5{F7F|5ibK7yw+U-%mN{#3fElPN zuQ_i{yi;(dz()!>ft#=!BNkY3%Fe97r7i@K!ijXV;K031a4MdUvc-7Vkun!6R0&R` zYnrw|2`clIc|zdO&T?VD=#dM2-labvC7iRtW+Vb-^f%)He=q|`MK$IMMz$Z=U3W9S zx+Zri5OqGy@`+1EPx*Z?Bw#>uUF}eK1Ob8t2NYnK7!%KPR5(0`(lTMC0~UM(7ntBK5y9E&q<#HzqR4z4ftPR?bhBV))x0O zvu6cAa48SaItk4%+^3%CcLVaWz`Qr0&rxB|bq>=u92jDUwUPsyt{5_1yJ1h~H>|~V z!=ZYbFU^Cwt4d%xBQps=MWI>EDoh|joim!Y#6g1{Q93A# zX@>a+^r!5}T*+X*rC@u(>;mfL$R6ni>h)`Zt_C!6MAPDL!%PS9NG}oh2W(9{UX}q( z10xsa-@FjJdlsY?(M#LDfii<5|B^3)6Qplwz+8bT%mZB7JZ&hNOoQFyG7wE1o8S-& zMU!mEz=25qXQlf@lY=*p(!Qa#mQc$9`Mvhpn?NV0e!AP0wo82R0ocFAUP&$J9LvRreG@mT%$w2)+jOyhlYapiqY{y}_J*0WNa)7S7(&2QsEI_(r zIFMpaF1LrQ@X+!G0CSjQFL&iYl3UYPadDV8Df?kv^9F2!UI9uVSi3991%Ncj?rT7b z2x&WrO}^TYii1oh5jYl*dVx%40~*d`fCVptG&UGS;(tMj=jBO#Z#d@t8|2mIo%9@K zu7g<&VC8Nm6fEWu(CbDlxEE$W6rBch-o|Ur_j;a<_`rs>AXVAf?U+|k2xom$F&UW& z1Jw@0X}-7`ipF^iwdmPM$S{@-RI|N0;3&1_41S$<3P|oC0HlJ}mu~=!Fs^!pV3hAj z2pN0>x`~H-0qGz?88+L}VY5ZUtPBQb3(Oo!(!qF;c0w7)IZP9rVP9@q+VKKX!H0{0 z3f>%+Ybj(9M`Ap4H#KL&7Hl%d1|*=}Q44hl5bqpq5oMX$gOPVW6S8{utPRbOl^re= zzPQYVl2op(qb-zTfp7$N2EeLx&qoM|IkSO2g*7Gqv4#(AHIC@3<-Xklnc*|TeK;U^ zV5M;*R%+SMW($Sv&78`|st^)TxAnlV5nGyEha>u=uxqNvK|}|%qDB(pR(SUTZ&so} zjs*Hd<@W~@Y2Z8uGi%clNbV-q8NFk=Qm}BB929rw>>Cb!BSG5yG;ptbP5&hk&VkkS z8(J4gnZf1)vd--NILN3UzIqd`b=ES$?S?WW8JR{c@^nx@Inp!iQ0MhzB z6%ewP1Q2Z=gf!QT;B{4!bHk{PY1Rh(PU1yw@bnsRbvjb+?Cg%-xeqUzb&BDcBNe>#mAF) zv>I#{A}N7SyE6FW0{6*`=JsTFcUlx#c}R*QCdrru{Y{_-HaADkgj?-> zsw_8bg;zxgS<=I=2%XGo_Dc<2^uFR0rkn$30fRJWyXN#>u$XU^P428dtnHr6krz+(gQXF264UFB>~RY2*r$w$ z=invh;LDk90}{VzCu~SoeMdBhNX3wo6`ZnuABj1_kC^79$6@pnqiDg?8Nk%5kCxOhVTE_7 z@UTq8NN$u59MI}wYj@r8Vs3rWo=<2w#vLd;-t@XryNgW-Z6o+F2h#6n;wYIVLV_>R zkB9m;3rFd|Us3xb-wrPV(-SG60qQlh&#>hKNZ|ax+%BHb6Vc+K?&lfJwd2|IYiK`v zsrywTm#zCDlw!i)k=$dWKh*1&`BR<5(?`f4lGLkJN5)W{n>O$Vhb zdvGP^DK3ZlhqFDIXhR6Nq8@OC8NC`I+PeaRz|4`X@ra>hTF^d)dyJoz`0s=vKPCjE zM{HqM3@)@KDaWzon%}EPFg@DY-gvIRbOAu;fb#N#QyRUJQp*`kXql&6Ty~p}G`lqp zj8hK?x!4;=ytM{`2QRg{yI=Qe&eK%I{1cN5TZFO11klr`D?eA{_n)Xo-avLzb87jI`t_7#o_dZF9BnAikZD}# z=){GVL*r4|;Iw4u9(_%3Pa;j^ExK$%3Cxx=Yn7NRDUD^eQc#v$uQzyfqSq&5m-)4` zi%9B7BbJhA8d>d5srHg8v4(OvxNJu*X>}=2rzR>6Z;-aBl8`b*PfHQ+gifqmRei8j zOX=GaDrDEXi7AzOthLlwMH5-zuDE;9uY#owuBWt-<3Xqp2fs+iQe>SdidcSBbPbv7 z?}G^u=XcozNp+2&8}qrtH|AMaXyC_OFg;zU9R1pp{6U@*rGYD+myzOpl$_>9N6Ht1L#vLqc=?IG0Bl|nO+iv#Qig;CpnJsFe4w4>sP25B zucjSK)~r{H=xsO0@_EXd5OBz@DB$>!g_zz5Dy123th|XLOH(M!Huy3hvlg`}M2{u! z3)G7{x!HwA=N5HMqKdaI=5^nbv-pZib4_9W7psH5 z_X}SoEupQE*W#I2UJr|@*4M;z3t)uc^aZrBt8DX0 zFr9Y+O|yd<2Opg;oXFtkF}M$%A=t&fUzxF&4?c9;1d~*=geS2s>cdTD?8^mNo?&37 zPPH}|KJ>)mDs;gd`ccXkS`cE;>KJP#I%90PjqUBXd<-w>Q^q(iv}d;F7@wog z0nR&8|Lka&0c?IeCkOoWJ5KIkg0s#zwpccfyf&f7G33&5WcXhKSjeu68RLO~3}$wZ zl|k3P%-?ZU|HXlO3Jl^iCmW4%A)Kq@$o20onS1&vj^nteR4@A4PU>wG(aZ3M2rrO5-0B3SfpYvZ*h;ccqp7NioEJ$$I|INMXdy8r<{pNqp zh(DdP9|Z7-C!zEo7y!o;708TT|K@J?y+w5}Vc}nrT8x)ERcJJhv#%N_#~NqgZGFyc zzf)Rc5@2r?|1n9Q*#`}@g|@^_cSr9?Kg2zaD;YJ;%ZU?74F3{^`U`TlLUzIg%2nzn zj)tjEpj_nxlC~`UzrYB_3xJ^5G*+3`(yvXRT;=b?S#7ib+@nH8$%&Gy{FH#ZIB`_W zY~rXGNoV40xMC-chS4XEhM^Dtt(;i)IF-c|!$-5M9$@GxPBd$8saaIbj?-@SZ-ip$MD-zIDD;T41mOI*U9s`YckL9zIUp z)@hvM0Ryln95Z>ms=qeadyYBj8=Ka=Z}9yeD&^yp4gd7rU{Lp2kgd-&Z5vJ9Bj2^eR_@{@54*>|Wh|S|=5&uL{t)+)el+D6^Pr}NHqhbcS6Gz49|3u3eFQd7q z?=*olOmE_7*tv<~#K3lY0#!VYO`QCAqF;ymN9MeP=04LNY-|gcjAC7e&q!Ht7Za)a% zTKdOLK71JWA%(?1z4Upxz~JL1ANpF=pU&A20{C&04;_Sq2krR*r=stB=>OiLn)u&& z`-g7wy*F;~o@#JKrv_14oG|oM=O+}-+@OWtDLrQp8#(j@#Z)wY)pnGAoVH#Iy>aky zQbjK?ev(i+pQqk-)NJVKJZzR98WU-dEPp%uf_psFdoRzaX_|> z0SV|{v~(=paofhB8+~CMx@XQBOZR&sS(lLb55*ivYz%v2#oI>DW#z)6ttqrsG0y zfAU`odE;sShk5zZG6UT)vFO7D)7*T%1_Sc5*@~TW9HnDtqXNes&sL7z%oW(+Xc0M zXy8GkwI`Nl?f$PN?tgwEQAdySY(j0+vNr!S)BbUHlW4TtL^7RM38epp4B$`qzo3*j zHcWtHfe-QND*g%$&N48ZSZ)k_Z*gpF{;ySA$2I5ocHf}hr1w`S z0XS0oD^ggH0mxhu-^qvO#}6t$_|HB@pVIY_eBKo!sKWfulksXA`0*0x>gchk+kzx?qtpGj4>HSa-pyCr+HA*71ouP7 zq^#1|32xc>;__2aK!t}cEw zWo21Oy#wc_Uv1XpJtECmApii2W-8RroX?vNV8&_enJ#IhR!WscShuhQ26Z*e;kq}3E z5m=ru((V-2_CWOtm~^cQ2R?_}oj0X~T-cP-miE9Nd=9r;B^&Uz{cfP^bW?a^a4Bd! zeL>j?&81-RHRg-pkU61E zP}tU4J;9^=?Fk;`V<)-*Lq0gw`+GRc@w3y)c=VwO9wTP{wTb;-ENu%n`r)G!T!MuY zJ<2;wZ~^-MFPR|Tm9D>dyNaiHUffL5+2#Gt++X*5Sy*Xb+VAVIxI}v9wJ%|$*Qt`dXgem2pg-5?TI&sH^iOan{p*5iu9J$VTJ`B&Uf;h{ zf~btw>38b}Re*PD5Df{&{9ngb5I`X#&;Y74yj_Jz)pM$Q6m4TV1|{bV?>U ztY4^VxC$BAgW04#)4+gs&?u3v7AZb%8(i#uX)@mas!pc; z3QmOQrq?E`yYflNp7QcUO}UPe(;ix!K56k@vz?l^vi@yiNDW?@kf2Gt+*v7n+7?NU z3|<+oWm)0eTl>0GenL#vVntUhp*>ARhM8eC%Cr(Wr1EyYdIgTIX=zAsiqO)#T{mT+YvV9G=u>KEewx~Bic?{!?=$P@ToZS+x zrQR&=3khIGH5(=_wnIE@FNl}Dh$1zW$u=^IBQ*6F?ky}4id)z+FMG2F_Njbq>6S!? zhG=DZ`@9jdCtFvV z&u0&-JfgHBo%aV@UbOga(h0VQXIV5fVYy-`*Oh3t6w4I-uB{r zRZy)oz?+H|Ww@N;rlJ{Fu<`V81~%9K>2D6`znl?P)@iLg=uOHh{s{?|Cf^ z4^}D)#4a1+=qm+GPD)Xv_H6UQTpnNmLJ@(Tvx^YU`cLn zaZjCa)r;3Ln@#L>4Q|x3^5Yhj7)Rvoo$1UgrxxdZ;^W!%bL{Ryg{p^A)ms;iFS-fv5aZ0y7yuvqFE4x-6NNlIMgB7Dap;xoXRW z$cF0!GnzY>lw~*Zxu5BunhZar1C7Czlg_OVC;pO$3a6etetVAg&)f8Wp55}t2>_#Kk6LbE;gL5`XExRSJPm^Ki9yGypJyvJyS%|=o4#Jtw-A)A z;aiq8^?erVF?INZXUqTpOPo8P2 zpL=0+*NVrhAD@F7&Mflz=JCaMmWqLT{;dIez8k>+yZ|JA9_eX^Ko36;cIewdD1GMr za?)ohrlU9k_}d4;(0aa4WqHEY(KxJo{2jFJV9({Zdy3!8f$1KWiOtUyT7dF|Z%j3Q z8KiqylCHDpr$&&2=^lmLwjt!2rfP+arpS6}!ctp!sizQnFx^A_fO{}o2GN7*e$xZ9 zWw1y44Hv#J1L&<7K`(H$WL;;OMU0>a(>+SGFk4`L!*q}8f!PB0w9g)<2k-*$J7k34 zPT#!E@98i>Fu%Wg8#$fjL&$}D-2bQ!-Y=V`rf7~f%?I1{cZ@RX4R3RAHY5San0D!Z z_I6Jsq@II4uo(;)XF|r*l--bQPQ&&*q&~28fhjG9V0;4EbL2awwE9iYTiET;pFh$A zo53g_AbH~hU^955tMlI=2b;kgpU1i3-F-yk=A2)WQ@35Q2}@ro~-=8SU4aGV&m6dXoi z(Jmi?1$P2Vhn+aw1Jgaqp0(cy5TarD0lb5~#cU`FnSKAZJ^wx;TC<&R_Z)rG1JnIR z=&-jK)JT}_Q9_5k1&ka__bB9GZviy&(9abSZ|Q^Y)RgJ}H}ye(>9B|(-M{E@$phkK z!V)O_z;^J4v9Os81}4}JM)kmR;Erfxi(XMs(&-+L3^xjF|;oNdC`y0xIV2=zEdpNg* zd*HpqD8~;6kHHiH-b;)M_fYT{4EJ#I_$IxAbIZXVIC&h^^JWgbmv|GeQsCe*m?Dfe zbda>d!2?DP-b;)^4h|jwx%^r5B_D$(6g21W934;B%`%%cswnV3)*uFx$Dx@ZbB1%v zL7~IR!YH8+Z|-;L!^y%Z0m3_QSb%WyI4Ws{b4$1fP98_~z_}&d^QTrGcIuy9^_D(_ zdOZ8TnM7S&_9o%~zr4p<{+2rYpUtV;Ke~sHg-N&~19og53zLII-H(MyxQPC-FbNVM zkc<3N3zNCWnq;l(AwIBc!*jL_iwC`|SJkLWuTlLZ! ze=ke|cCC_sqKAW9)p5-HQqWP80K;N_Zcj^xcC2jkmLROPf>$hRT~S)pAg*}b$1D$i z5n!?~QGwZz`&#Dd{qmyJJh`R1r@cKs|20|v(v7^@wZ*h=H}7faXDxOr>hV}Ve|v7T zOW$TCF}dk?!^`0$edHG0B_&sl<872RkCDPJ*=;ei+dI(PI6Xz(U0XZiS*pwt6R;&q z@u>RvMtj0JEp<+`pf?FIQ(sn;R!~s6c)&}q#dfR?uZI_{f@w4R zH^Ke@vNFd=)~u1+TkX@uk7r;8>g|K+m7<#wD8&g*Fm>avGK%~#r~ar(e1dPJQ_1WA zaeJ<)I^SO2|7bEcA;M8z9BUr#9`YEkP7ast&QiE(2t_DOua~MyPo-5_NU-aG6Tep+ z#AP+O$cj*Ua&BQ!KjZQV`F?7AuCa39L}fUAH|CgpF6-(}T+esnur~TPdjbR0e3Lg7 zE48>9eNr3jv@*o^%{G=K$GPrX+Ie#;Yto$4cwM&F!opsM3t6xHy9UfEt{=KnHekBw zyR(8!SzGNZOKe4VwDMs!QTdB$)-RuuB~#~jWLjuuEgbmG;zd}Xiq#xzU=L^xT>0&t6-gu4G68)(}mlr2|#=@%}DL^N~Ga){Y-PJO31bra6sTbkR@Sa4VKCPOuu6}T_XD55uBqd(F;(tlvf zVsB~w;g{IO!WZ^>T|4WUxzP+M0(Yc&6*o69jhXBk_Y#lYTf;jcpF-RvEj3cUP`}xV zRw>SHH0D_G+8*6J2YExIG=2o4nz6k>u>w3>6GNd+Q~_^Py% zGZ*nt+eE~cMB-@1-E%MpOH)XwE~6{TpjcKIf`PC%GuczLhAi$WC}zz;SSVUr9Sg#= zHM63Qh>w``n5TxY&r_Q6@cr32b(JQb0a-~u1<$R!j@M{Gd(LpA zCauQe=tbpKRJ|iTSrAR#Sf^fC)imxC)QZ#Py^ z$eE1AF)WK7-}Bs}W4WP<^?$frfi7#En4@ttKV3zjexO>SOQ=4)&@3qE^u2a%_wGvU zq#12VpUM1*s@jfQjh=G0{W=q;ui07j}A&IPeXvS6aSDktn zUNtOu)nR@r?X+6@=`{6z;`gr3Gp=%6XB?a?wta0{Y)?4do0C4t`Fg@MsaSt-Vhj4K z@bgmfljprp(*K=$J!blMen|B30Jg>H19uaqAEuptrDmCD!P-{(_3_HDcZq!F{tkLP zjOX{ioYH#HW{SmDgZcOGihita`1)x^HvZCq=XVY~=kwaXUS(GI_1({-A`c_6ws(y@ zQy+c3N-O^m61AN?_{Yj^dJX$EqP5)S9-Pv8bXWgRMKHKLuZ>5g*`IF&<1^!?*JAU_ zzOl^nWfhl0%fIH`4lkKa{ygoB!^S>I(4FRCoKIwH@weRTfhkCsUY$g}pAD~a(CoZ% z$len$H9zb*ztztiW%^T6=7B?V*J|Y_ne5MQHFi%sW08I)B;=NNW9*Nqje#3~50a1u z0Ut7$-`^Me;1VjbcZrOvGmZA2oNK%He9NrOdY^mEU2fB$TLdBYs)Chi3&Xt{ zdDtAwbQxT+^Uy4QyLo z2v0wAt@th;iFhrpzIVVwXTC(*erA~A{e7G%#z@57&n;HwQ#<^>DYD2bl4Bx`eYOtD ztxgzdt~u=)%&FF+uPU6rhq&e&Ft=s4v{)=HP9y2Zn(r(s@TafD?d##Vcw5kGuSK*q zQ*09w7`XVrFXd6bLCMI3uv;mn9GbBqUfH{xCdPRxJ}U@|#vR&1cW*lGy+Ok-yw@|Q z#Jy=iBs*V%ML3}pLQ`D9D&-Fb+2Aso!B!Ty*w&kBTgH{mR{l7>rKt6r-erskg~5Ep zEzL_C8WwqPGMFC{)8@?Uj%-%FMA~A&VDP_FuqxOL^?g@C4l->MJ}0q79c`4A{cR*` zrxV}2gl62XDrrvcIdoN{$h6se{rrMzk6#NT{k<2h$lq7RqwW25Q;GZ63nH3jsPIpd zkLxcI2DO)aF4#LWc~#i2%v|+?Um^x?rFlB7Rq@(lEXnL2&Nf7FwvqI$Q*yDtL2i<5 z0*YQ#AXZaZq&QO5K1Xx_N;f?HG<+?((p!L=_BI){k-}CtE={*r#Ho64ql4pBS3N{jTYeY4mHg^v zpwzrG-XfkTp)=CbX)`XyJ`~^KzbfrejXbOWU7*31KymS{TC9`mZ0F`3EMdUSy9;70 zDa?b;DVajQ)Xl`r_I(<7%l0Z3BQK}MzuYgx-c?@hA~*>TekjDp#9J;zNWvMZJR0#z zz{8#!d`V6XFw^1Y(*eQ(!O6QSg6~nf>xsTJ;&~fv7=CDA@8rjywpG%V!Rv83zc-b0 z4g^38wD&`eenDy@FWmkjyk$?9Pf)^kaqNoRt)AhzY$xu@s%1I%-75~T#Ifgo-dmbh zuhUdxaO;Oxk4nGyGe5`WTsQ|cqMIZJXAaNSaTXoT^bL3|? zw{oRpmA2wmM~%VP1K@S>oM2R*-Ud?t^+vLCWrAZ>TPjtcvwOISmUR{8pse)AZUEkR z)xd8sBut*ul`~jb>;ZdWBHrqAD&Vtp3clcT>gm|Ie9(Dsc+}v_);uk!>slxL0tTy0 zVF}xcXOyOOb>#;2N(=%wxd8m~lAHR;%#EbYD4`wRDnuvsbZjN-Z0tjM`s1>+GRqK- zQq+M+qQ&)G&L55OU<|5TzAF!@DE%7J zg|$;yPfBa#XZWT=xUwSV22a*m(*T-^;3kzR_*Da+I$GR^Uj{jI0|ErNXE%lQsI;SN zYhF-@#WEdd)z7IZjSFL}asfM%h8QcF6AYNH`nk!0Za|ec{4&U}J$V4L`(P+|f%&Wh z<8t;4e+{%AR(+ZYGM6o?pP9YSGkhPTH1Kll!=^iYS*b%lB&wS3DuY`tu$0TslNncL zK(rmtujM>F58&H9Xi7(y&Vfj&J$r^Rgaqc0qwadrr$K-t(98v0r)Pw^yaEiEyl`gq zT}W1&FE861{I2-$zsCv(08jGHX#QTj^@Vw$%6D^|RL;KKIXPnez0J0Lc6iIp^(PM5 z^BR*3$z~hC?bT*Rs*8%KG$-UzMyU(b5gto6FFzkUqcl~c4k4&o-R~m>V-#I}K`62w zWDvEXZIz&vJJH}c)Q4o%B1ia8jsEg>-0T&aAN zQbXb-d+Aa?Eyaqus;9220m}g`U-W;Ex$%2z2O2~DH;2D5r zD%rWG10D+MO)iwCn&K^6A;(oP#Hb}BjQT=w2+ZRc$0*Bk0{a54b>^t3Ty%2>Qo)e5 zUHtd^+xi=%BczCPshrn& z(5p(sd1Lbw)GPX8wO|J9%8vY5FtMPPS_!J5yn0YEE8lAZg|iitD%@tR_FJ$y>8b za!N@;5f!K$wIrpH(!8KiN1DkikI+cr&Tmq2U4O1d2|lyt?${0fKCy z%hRG2ylY&Hye%s@rk8ob+$nx*Dn8Th_nnJhQR%I;5C!3fzDiVAU^n6|ItC4cqzY%3 zl3>A#|DKJX5!EQFYUVe?t?lt~XnUwVQNF&O=3diHqF{@WhNYrVH+~JaSW0)FrQ!$hfoSC}7~rg-5dO-pZ7Dlak3wWMfaoK@ok zObGs^lQb!t$Xyif@5zKh=%UW}7?`?Qqzot6G@HW+{Zh7cO}vc3wUJ^#>6d+y?n?qc zjL#qYWuSb{42!FkbxK)YWRVl`4#gOEYMhUBpF#8$Hz^If8ozdur74&oHBZ`$&m|5? z`<+CUj>@Z!4;K-3c?EZ1ULursnx50f!v`QUe#emuxG!BJ&tzVt(&Ayh9hAp^wv$F- z)>XBNF-jOD5q5yN64949(j9G!moB(k-wM&8Z9G%P50i9?C#TKRr^QkCCRZ8ri_WsI zJ44oKP6%2@C2QG{Sg4b=Ikq$=mNHsVqT)m!t4*6D-gEJ2ODbYA$G7aj(7gCoS{u!5}93hy5mt-1JW^EET|`Hz47 z*G&C-AVs-a^<1%{IP+?Tmcz*Io4r34oO?elO)ug+pN{4R<5xOzpQ5+zF&*zUbByQi zp`j(^iWyz}yCaTLp(p!K7e%^nx7n& zB}UTfmhDN>1CRh_>3%-!_et9+g%>R_E6Ms;`LM zy6oAh&?(s}g4rU+F+Ju;lPqc7=ISycL{(l7(E$jWT5?Dd%X{i)OZ=)SL zQ>=F%b)A`{D-H=cc!TvUHY$tgyorx=FR#2m_qST1-!ERbmV;j;vhuCtID|Q<&!d?x zR^#{9wFnj?6aW1(-}vny<%RX@Z&$GqVQckaKHfXRj6m;k zMG<}_KdSQ{R>hB3c`)R9cQn-2jvBrB8crw>_#>*`3}j#rdfK?}p$2l23~K2%1%2NZ zo#I-6X-+upU)H-L(g<9VQhOITP!t`2ahcTj4{$&SU>J?DH5%Z14sc0Z#ZRtp1x66C z0TldHu38`XCg8mu4GlCK*!&uj=0U34_d(P*0k09HmW?y_fMhB#a6;e{;6W;N2fn#T z0S=t!416uJ@{W9BbLhR^Z!}0*uHM{qjGCC3b^8*7z*4AJJ6#2g0hfTeW_) z-|cY1uF;O&HiU;j5OHCIEyK>m)-7M%J6qbCb^`Pc{hQfeRl z0Bk12{T2Dca%V}~=$#KTjlkd0U8imT@dsF+9^Uig(0Y?zH^%()zhONP+8Yf@+a(*9e3H$l~00lUcjMk^l5iY>3!Z7NHacaQuUv!R&-dWdxGUFx~t_Yt5c;j(*eP++S`_SwirdC zYOsq4GW=8|dVh2`x~y3 zIPKNFVE@Q{%~^&M`OvMK<%r zPR%mGqJg;_03L zx&UQg)M_Tp=@v9C-nMU!zZQc#6S8hA>UMC35#C&}-UmU7C?rug4yXR`thuX1LH4HC zs{v3f;)nd=E`Rj!h&4Q0E4Y{PSZ@VGja$jL=q}FQH77frT{BlDiWx{!Y&_1T5G6^| zAhjjU;z;N`1!|!lYM5GaaA=ZyFDWqi4P{ePKN&mR#d&mhr$=5jcNvd)=jqd~!`V*xDQHL6w$$q6?DKj|R)7yVO>C~%7&~B^4MOORVeAb+r zljG~7B9nYhO%{aq-sN6>HYVpX(UT4h%^rqHrh#D>*Roa0siBSdOY2N7h6#;B>H@^l z&{qg2uM-fpqBYfheUQxE_&?2yhZ_ik4q_pd>g|r~%M_CGCV6J;5judUg;3!LR*9U# z9QE-8TSs{-=IH~)Wh<8KYO&E>+REr52@wo&O-WOnWT2Jt>b1FOgYlW^ek0XVa^g6m znp>i0Hgaj$5IZwvuID-fqK0=AhwVoQwQh?g-MVm@u-{ z%x$5sEK~wsxJsVS$Kv0hG@nW*ros5y6JOSZtVNv*q8b|ZX=`yU2TF3t7+%#_XdKVw zGJ{HcW3C<+uLK(EWOJr6TZQD^oH?f6UJKNl%+?Bv80J^e_&5J-B~n3Do-Tj&s8fde zB>?1YLOhTc^xBJIyoxnfgm)dETR!R*Qv>7#7~T1ln*_K-*g?EZ*wMC8*Y3Wyz-Ujc z5*9vPJ5CV~4fQNs_{R>;ThhwUkZ;&sGb5ZY(ba=k`(_-7E5@(hKvoZGk;s6R41|2@ zD%<3{qTe0_PfQJ9T!Y?STVZnsUN#82eNG+fbIlUMGmkN++PpGl@LV*052) zV0Z&b8wjSDQ$>D%dNf>VGy}*#FQW;Ru5=n}PGF%7MCtMp1Z1}~$U^23GYKZvRuHkQ+?U$p12J3wl zvVY{c$z#9u^-k3DjeYQi=E=8OvhiGdv4~qBIUBK{Y0YD1RMg!M?J@*TkyqS(NttX7pm}%z}QpP?RjCNhx zwzn`&Wqm>!YfZyY``qZPP%p>{;sO2GqRmKxO9!2ff-w&VtJGu(!R7L<6=#8wpI1ZW z>YNLf#rX|cI(^9TbHBw5ZH{S=M82neqY3U)XfM2uJdEt%5Ra%}jSkSf9styzPsB3i zD!E$LO(xXOcYB&cM)SRz3(vykTNRwWFYUsxIy zo5E=FO_s@oq8q>RXj(Y|!@4BTE-3ePZ=+3O!?BW=tSCD)54pQL*`h+_;BWx)%9rc6 zIFqpy& zH4+{dAJ@Lv5TBkV;Smo+Fj)PSpq@(6pX6w_q(MXP%0ky9Ip{1CTgwM!jUi(s%jNyY zE>%3N{L1=uV`amSgr9PnFdTwd{g6G(eOY0+xS#0%;+)b1V+$DRB}Xf%jh)~BHRR}% z!*0xVPe0b?Adod1m1LPqe2{5YNKu5XW2&8B=;_GByghu;{B&sFTycMYxVGSmJf(IK zmXS4hMIb3&iXH{Cwh>H5%0ug+p>8o8lOTgEz_R95$g=0;Y~A)mn_!j})9wOBVWd75 zTJCvQS=F=~t1r&kpo~b21{)jWPX^zUJYQTH6aZ*Jw@O30>d`;4o)=3bv6Eetjy4^{ zg!vbDPebvHil7ZJw>-I=W!f^4z=^Fqt*x7*D?OJ9B~gU9WXY-e*cLjXKo=5$4{#Xt zgS{!}WBMCNdI!z$qr3Z2kqp}|!@tn~-K@Tj>|m^lH#S5fA3wI3ZTufA zR|KuC2*Hf-_MD<|uCPurxYDI%I@~zTN6~S?!5N~C`-!u%ha+DL8j-}1B-I0!I$_e% zSLRQ+azf5qU{yc{k^xSIUItB(2%=xp(S!5)#*q-UP0spfM8so+#ktdfzcE%8^8lcH z3+4J1{Nr_E#SiG>C!W*SB59 zIG5gF@i{t>mzc)_(go+I80ToE$s6FTV-EM`&a3A#EM9_EX}gzJZ}!+Is#B!{Xqjfq1O|&+2l|uT1g-vp|vX3WT}y~=HG zW0SFM^S)G*eJw5fL$avc$Y^*%LPys4QLsZZdpt|L#RUVWY7kf8I*!d3;L#6&|E3Dc z2l~&>7nWv+N&I$ynqP%*4U{-MAMgJ|Tt5MPLzxZx>TD8wZ<7xE4 z>{$fw&aE2fC)ij^a1nJv%K!zBu3yjIN?$xY;ocREU-xQ_Ids>B`NH<>@P+q*s?tr+ zut&Vjo=uGmvlVO1UH%QMF*od5r)E820`5G?e$IyWg5g{CIkhEQ+k42`o)-HQ=`{rTJIIM}onz$W2i(mK4S9NygG`wWj=th78@#BE zjyfw=&Y@3hR||A=z%M2KQ}DueV2N2Q=%e*xf6H4il{Ls)VJwXCoh`qNf^WC0ipVM1 z_)?Sb1jA1~(d^pQZ$ug!bv5zQL_{~wmSNod+jv$G4ajwWsHp_}pFkfOzsPvg|Z6k(qs`;(q!u?

_dh zj|F}b0KMQ(it7X3>F{bo1;ZT0g%=p3nmv!eJM`2HvMMm_IbXj>IMo3=m_W`k@*49e ze249m4|P~z9BnqXxX-6$kF+CpiPed!Y}YMOdhk>3+AK_*<@W}(AqQX;!^gn^>qU;% zZGb;$2Xrl?DxL%r)QTzZnn0|j`)^nm#lOp9I}`^qi$Z_AR4DrU)XC!G9XP@mMFFq@ zF!YUCfE@bfz7{2XsUSd0)1dWt7u2%U47}NJ`Wlq{GZDy#m4Ff|#UQmhBJgS6pt$0J z9U#RwZ8><&9C+DSLMVldLT35K&QiaX(o!p-whvs1J=VF{%~$Ei6&kHlL7II zU~2t{Xh{cC)(Wp7sQQDTO%-!u9`Mnl`)|-g26}f=p|Ai5YHgv9g8?&uMz=wO6v$zQ zSbq+m-si&#SGm=wKYdld3^5O+MeOV`!CU9M=D=}`@8l<|JorQH=ZX6+hlJ(u<}~oc zJYz<=gMPH%bUao~0m9tBbz)@)4(7px{7ncNK^@+`eF!hZS~7HyUzG_&p?5V!6yGy0 z4E6C~9Lx~(1<=;%A-JfE&yxbV+t=6#!%sxKZy*v8;RfWhQ1cLtB&6CQ=-h=Rh5?=o zo0;Yf$wbPwvcQyPL5%_*Kh7YY?xb$e(~NOM{6A@2GK!Ah$d&+q0t*NqefdsrkV-Ma z5PYf$AVf=1OR{9x)1sj>15pKNUO(of3NR^0OrY2lT($!wOXHTEHJA(9Qjjr{Irrx9 zT#~P6o?pUT`-P5)hPgpMUxx3S%DM4Kckz-sX4h3SN?C90yKJ%9OY8or%uFuR?~YVd z8WFl{SL&}a?P1-`nF%geP^pZ3m)%q7*%xO)nRqMe?<&z2>E=51nlf?qVY&X5v09<_ z;aVXD>ps!I*?r2I5?iDk%okO(=Gpg1ODtMK@8Y-p1eb33AndT@2Gxh&@ zLushbl`g7O;0*;n9r#{3Gw5#mr;v< z(HT0Kv5jJLC0&Ot5f9ehqtAaPeU!p^rRUvlp>N$%ByD?Kk>WA1LX@IXluKHUGg=<> zba0QMb3$$EPr*9E*NUY^*EWJ>wlV&F(kz47X=4>XJkm!urL1Dw#5FL%r4R|76!%iG z(I7<=>QIwupXmE<4G(@{%~c+;CYNNVlBrTW5}UHB|1u3{pl|eJd+qx#HK-ojjk%ni zH07#luj5`PqbHMjwGFSbf44NBsP%H$%eur3rDdzpU75{sba@Va3xzz%ncipAJ51TB zVQF4f&{dnDBt2Yjvq#h0*otd3Vp*zR5$S%ovYPpi^7_kt5^h$wwuIsE+I~IW_6iT_ zhQDLo^*rbbjaPTxcv>87XVn?kaFud(DE*-3Z-YWY4UF)>Bq-(2#(3$ z@+N2N3-(Co{!t(;T-ItB7ee7$je*Z|pa*w2MgFF<)QsthEKTJu<8!?kPZ1KCrk2AJ#{)?R>aZYE_O< zxJWT0wwA7|53rhA3kr>T8b5kBSzb3Ga^I+T826}m^UYe>^0=5Cy1LR8I!1A(RIZ{m zb=}BhaGjB=bjfR3;siyExN*|UH+4#ZHdUolcRjCGXgbtbOM_-|nttj#4{BJG(@Y$x zlG*^SIZ$$RXS+0^X%-kEoU-dnKO^FG6|GNUqv4MnBG0m&(lrZWM zaZJ@aZfX5qS@K+cG^NbSl5Xl~W$vo)eEGapJpDDLu#yrp^gca&QI`8RA6^iHg+di-t+%&ty1g~BbtWD8j0?rw6@O%*5>Pz zV`S9l4cd^R??^UuEv8lf6F0f*eYyh0!B2sx5iB{{N}&auNIzlJdo{O`nfkKYSy@^* z)Gv}74%RD_wmwfbmoctmS5ihBQhi0u0KTTS)*wG}Qhmt5{w9Ig7%V&bP%d6)ZDt5* z=VbMm=2WCR$A%u(krA#-X(3q5Le!RP@a+d_fbyklRs=-y9 zh@|YD{zsZsbHZpclexy0ye@M>hjl(#UM9gIq1KfZ>CVOza%JO5;y!(Sq4=q}fq$gC zp30>v(cbh*5YPCT4L`7=-}6p36paVRH+jFP%Jvjymozc=HLaA%xj@@9&-2vyznBAqoM@8E zN%HKpE^Ai;6aPJ)RX%P_?@e%4wxXG>QtyjPFvey6tt+ma!+hmypOJ5)Jc^eXqfDBO z$J6cEw4?r^bc0j|uEdIJs6l4nt;xY2$XLs$5G+A1b2d6fk1SZ_nQbR}Y}zXVT6ht*seE`P=+MS4dDlWCq|KWE8}5tBXR zn!0HR(f*wxsc>I;#BDq)N|YAygrcQ)hsIHe_F)*hyA@9Ur4UJrjg>Jw=)|F}C04)t zT8W??;pAAo)`5FtJdT#_9aY0L$2+$v%TC-OR)kMwkSVFSs|OQlg_ZIBdSj%SeTGKQ zB8y}XME~%6(L;#|A)PvhBzeLZP8IhlU1u+2l8bs>Qy|0+^z zT_a-Ji6rQ zS>BoLhDM1xXYr?i<8X?~>!PixC7t5x)ZO*|=J#qT{WwisqnyfGlK+$z+ckpj8^RoG zx3PQbWqg*F&XhIM9iZS_dUVA*lxX-CDGHm?=9{Wl8C*NM)4}@cwLp^55O9BZquh7t zmuUE}X|Mhct(H7ZBcG>}N6suGUf0y!uFiFGPjOj}=M@$kX8XJ1&Ny4)d`7_e7c*)s zB}&8*@#$HHGdJV4hTVuxC805vfwc_0DfqRNA;TD2gVmvtcXf(c2{W39W{!r_g(&WM zd4_2u`cRV?zD0ouoG~~7g~@$P_GM%4_*kerM=WxAhbPzbN-{8qn8+fh$ZV$NS^D(& zq`KZ2oRPl;?aZ^tYJ5;fkT31a>rdYow^y?_MOP19rjc$^80+`5(x$&vpjFM0GKcDP zJnBvu*ooQNn_I(4o zR>6JynI=?qrFfk|$7IH7G1q+WLuZ^V!*Cv4`)SJaIX6RzNhjBK&gQt7w(a^j$3ab2 z8TdYx;SkDb_embg+wIyHH!R7k4`EW6lp-U{H;yxX;Glitxe`Es0WP{7i zO^tt{5a}B>AGSIGI;1e((5<*xyTg-*&gu46Qq6X_a)aN=@@96@oaSgc?1o@5=gMRB z72z>jJ83lL9a>I=EMYRCKd6*4%@Jd5->J`?w5R!)kjG_Afcv9qvK>>ozZ!G*`8Ifo zX=teSCtthC!F zbU9_TfUXm|uI7dN+DVMRv~+KWFpI4-jAe=0^-_^UIqB5q9!;?PF`~gyG~Wq@=<44Y zJ87w54yWv^l_Kx{UdI8(8m^T}Pq#@20KnX~0Et)l#o+8Dc)vlQa^Ir|3WC zSkw>bbk(NrG2Hp60MGW{NE>}3=`3bKmX_bk^D3ha4@*SuC^nSnCdQQM{->8c5l3elFaG3hneB&_LSqh|_Uo3D$*Sv$vkOjWR|PlU|j5Z@)JbF00l5BV{Uj zBkfRgtoG3=T@eno10R_^PVI~%%}HnIaK{Uz@s9^}>(;2yZUiZeYW5p*<9rPd79Lca zkTjYL2H8bJZS6mIX;lmWJxy^oZpqd^iW#c>B@t~799msenu#TMLuk$CK6uVEm9ER8 zY8DiEQ%@pAlqT9t*>pjXBLDV;ZgH>#A(O)WJxG#hcZs&9N7-yggo*e`_lD4#D^E%F%KduWS`BVqZoCH@Z{**wQmF-m zo!pmI-p>tL<&>C~9ki;~61-MX+SK1q!E(yWP>B6v1Q4oj{>1JX6O? zKgD&7$u=^c-}Rz5xX9mrrwa#?^v~6TTMTtSJY8+oWX-*7*K6-qWoaD)*6<7wb6Xj zLy0jDj`HA`Qm>9r-b<1G$uM$hI_=Z(@@Ndb{`UaBPzIf)!Pz7+1s0qzi z3wtGb-d6!q%1)8DlqC8)NIJWmw^mlLvts<{ovggp0T-|YB%*gHx&E|?FRl!qVDNElv%yFE=l4C`4r6Sjda(7x3zwNcl6$ zL`qU9{as2Q!A8qD$x2a0gF8egMXDG&Pd~Lsu9QCe-kLfd zmAo9}duM6xbqb?v#+e;G08Iol_w}4$4Ng~+{H?WKhtk_8;^igd-+HOyg!=S!2i539 z*@i+DG|h_j*YLhIC+ed}O6ERw?GwFB z>oj;J%`nD=$jk1Y2G%Y{==bXF^B^`%RM)Prr&NoYgVU@K>9zxGpCmD92=6STk}}tj z@l9lEM9k;*v@ax%o;>??n~LnP&h~%5sy#ggm%KI0CIbld1SN zj<(;YIfof!0AfyL%+~_|?7PwvchVC6eoDfLMdCY5aiW$~ZkMsWvW#?sf40oqm zMj0O94l#h$=*CI_14t59w@GK4;!|GBIZYf*sbASa5q*$n=(?Wz=x0-0W_|xQPLbcKyH47)dsIJfG4P#OYyXa!aJUUWHDIV+Jq}!mSpuNG-3_tGF&ElNT8i zsjd5EFr_-=EX{QCR9`mUi4gp>wlkQt^L!3TW>Cwh+osP+F08hzWlvsJ3%Qgq!VBE!SEJA*U(`tsZV-zbqmXA1O6wxx0#Ul`%s_jXX?})RVUw?=zFUVGLk5d(#+aXb|*k` zMBy@E@y;QZxQ*l0gAvmDMrHsSD2ytJNV3XwSi3HyJc_mfSD<~z2S40v!>;l&u48&m zf^=sWt-aZ>$W0`cw{2j@en*XW>` zZXlMtcC<1y@6+KGpTbqi5S(`!5AD!7l%-7U-FuyfDMkKITIZY&#dDmLB5gG! zLfIVXnEHI5I=OmAt3&}%10sd?HkQh3@v<69c;N>pQl{%e8N0tTR2imlzjI7|~-O>=)$Kx{boD$D_#hsf$4KjsczT=fl2=UHBqe-y)e)#j&pGB2j-JZz@p%Eb;L_ zNo-~3KC#rfP=&NGEk!+EF@UAy5*_jX_2E|2_PquEmeLjra&P?<=?=ii`jMmt^x_=L z4BfTxEQbO^4#&99Y4Qw*2qOE#3B9-+KW6GXE$>4%ec>{uIGTHk$9JJsk3>Tmt20x> zo|@8)^QBpDL5>hjy<2^wYOD!lnas6^Y3)o@cI@-(hcBXL$BWrR`)QL@WeCtcE_D!uHt~Kk_p#vA|GEM}s z0RPSQSj_hAR-UVz>z$bE^_^=kn@(#;cxyb@=Q}wu_p)o24PGDh9hrM4G{?4>yHz&l zI~O`Pbl7)B|M1_VD`qXqrVr1xTg;{U&P@)_y=n2CG@gG~4)~S1e^h2UWrM!FxzKl} zGjDC*8T*cg%sEcqem6Wfa@cpGY=)cmZqDo1xmfe^vMGx>U-OEFiRHBIA%;$#uJ-na z39Flk!Fs)~DxTiG@rLHq@13$g(vZ`t+*L)3x9sEWbj2Bc)AHLH+QCrf$|(xtR&mPJ zt13kawR$qH>)kCoYbf$gTO?iar^qHl)yWs0#K|}Aqnt-5I-3-y z+TU|1RLFOttS|Jj;VQ^D_ob)W@35m){SjK-H~nBAAwPOj`3-H?8T~k^-D14*zWOK& z+PCE=`Zy`p{f24%Cje9L`eh)gMbeOUJ)Wx*Bx!WPuCQZ}q~vJnu^aCi(i~phpv~U+ zod#Luj(n1m2X2_2@-`!b>GO|f+<{9p;-9p3edX;bwFz-t9Udu@ma2CCw}IpZeZD zvBnYPSq8R}&iYPd-?y#CpjL1q?vy)G|8j<@YShl0M%)k^X3#5?cjXjzR1lJ+{=uOCUC5-MDCooVS%=G3V< z80yKjJe#pMtftL@lJIvR)B6wOJ{##FW~YR6mx(DYVItgM41n{i$H|qA#L*gk+;#=< zf<8N6=IX>lHm$0YbWGLP(DjE@`;*&g3XN^C)v-Hi+swIN<+eJ}%xRPFnclX$S%9-O z%Oh*YwaqVKXKl>W9YV^^2?7wy$kt$9?OW?f{qt0p(C$V7OZ)^$4<&E%Vjd1u+F zbJNkqC-yGeRxY;bSeVa5@Rh19UuT%PdnQCuBv-Eda-)LhZTt9h6D*C3nafRt*EgEv zj69QD_dx$-yjsMvCn6COhxgH2R*4@IUAb+~i@3KZj=wmT$WSfX@GQpu&OOhVFRodv zubGXyx8}yd>QT|+BoL5x{IeDnu&$99@K4SGowVS#+=XdNeO=x&# zK6dA1j_^;fZyXVA9k}N|o_*hG$1+CypBj^^S_3=->MI|KHFkz4xrjAn#Y@ zAM^j9o=~bdu=jtbes1)-^upZdT7u@C`$}zJW!VPSKa@Cd;f}td$fJRpo1t4xLRA&! z1_!hT*4?qbprGNuLhM?&<4z&|7yDj;HQK+`)f1(|A_P2-O_k^W$)`@J&-L=oJ zc<TjZZDmDyOyfuhdd)$|E!-}Qm zIr&9IiO|F3n+Ix0Pxn5)`Rw8=v8cCC*X^n?ylk}m;e9cA>4BRET_!f&p8jL{!7~Qw z#?Y1vX*nwcj^Ar~y8njk?eI9~U4>bP0u8KZBLc@ank)-GsVH+SRO|8EZ*N*!;$QcD zqu`Vjt~wCE=bAZAeN@k{x$w*(scZU9KQ|v1+uV|amla!U%%|M^v&;r`#`hMukQOWg8$-9@2$O%emAI2#6k3OW;i=vs(W5lc?2KVw<(7cu2! z$D^FqT6wK$-1+Qg-IK54q=QbUe-`)ak42+vi}0&@bJw)aJpYO<{)-FYjGox=O^KT? z?c5$1Wu-e?4yv5+FY|V@*?g&MW05i8e7;!H_U~F5wpwI~RWCC3M=bmHN7vv#vU4ua zx&Hh}-E*JGF7f5!;_UR9K~>6*hazsasnAwhd-dbM`O0C~po^c@DWpk)-?9aU?Z?F7IBtlr~guz*lebiT}7jK++7XMR3 z1M~UDqQY=?#gAlVD_PCNJBHVXOpmAP9M4fWa7;4nCfi|a80+3si8U7~H#UfwTv#J^ zbZfS7)$gx={Pn2n(^G3(*Z2)(1)UsgE+3$hB3f6nQ!Z~ZjNa4cZh0~){6YGx(j}8NF*cnX=!=wu(gDKN@hdo*}~a3EQ}KW7g&B z*FHtx9p{`|^L$*{aEEC1@UKIoGNJ({Zr_@MwcM|s=5TXFku0Gs|K@JijzjEy zqi(NZU;0U0+9Y~!5_RTR_P)QKt`2%?ng7$dr`wVe6364dAqa&j$!#nO{p()3@4*qx z8_mm-K8rj3wZXW!i^G-cdQnMnjiDi@j82ZpeEn?5D#G)BpEE2<`^gSHvWI58Jmt7& zE&Ap}VjY{>mY*#1buaLEGdyV_)pn$GjpS|@4fp=MV$s5v;j&_`UT^KM$vFntm6pUd z*2)bM+QWC7mX!^@svOUBP?&V|2xsfh81%~&4+bme+pD&-mJMauc8Zq8=L`m0WQ>;P z_F5jTEixXQy3lcEr<32M7P0WWwo+}X9q-AxD{lg%ge1+^t}s@aoq64|dv11$(=4^k zvvOye&rsa@6|%pEByq}kQ@^U=4$rV_G&g?CN4M$0gx z%%@=7d8{=!ZmagP`Y-Whi{b8<_Jwxo-q9nxf{SeJsZRP7gBx70(%z*rXIt1jWfkH2 z)#Lg<>!ssfrdP}RMrHjqm`14#f8~*$J>*=DUoCTG>qvp-(38&Z>z`lLd3n)r^5LfL zyBnnfy3P#lWUm|C8sbw@rLD`O>1NHksSJ!eFgQuYC7L$YwJ-K)M6+XK-}kZ4J=;a7 z&)>45cyv0Nw<2!snP=y_CTFy#A3rVGZAKPepI2a@u)zcZG>0s*H_6EJDR>@qkTg{)wsvi3bcw(;L3|@Lk@mM6abUMts44u|o8R4}T!|_jbpB z{_t*XdjkU0=HE^5#la6R=4P4g;+?r?eyF-I`v+b^24$z4z1<4Mk{dteZ9i(-@Dg9s z!eVS(|E9y_hW+ov44>GC(RRF{Hy)G3;rNVb&v!$YtW515uXB~Yjcex`7CyL~wp^$! zVMByn?m1vb_b;cdb~(^ajyxV=XViMCf8Hu0?074`CFQYxvuLT!BY*fgyUpm_|4Lpo zfNzRc<)r<9{pZhL)EozK&oVwAtn1trp!La(toz~PU4j=QBu)sfUc`awWnXUqYZ*Uw zqkpC}$3&uMsKtV-QWA*I+y0elS9?0~L0#Ojxba(?bFNGqkL85KXLu@mkzLuNe>AzS zkbg-R%2@YKRl-ct@>+j(kY2%|wtGSuAAVfE=fnSaB|X7LAHLFyzrss$tG@f;8~XvA zh-_8Ki!blH2wyb*W&WSPv{rYV&bRMce<*j=zqj+@p1?oXr{*{RJGB&sH~i{V4S@2U zvT?yC7Irar{jv{xO7=W}yEwJ0c3fgJW`{q#SiKCdW>5tF{L#aJe@$xP&*eV*_~*6< zaR20N5iq*>-{}49OTYQwfAH}B0U=z`4XjxTT3(<8-(3HFZ}RTXKiDF3{3PklM?+rt zRR6@bTc3Tn%v`0-Ryj%f(EU<12uka6xpZ$v^O)s6=}n^kfvW1J$JA|qTi<`(VDQCH z%!}40i}&g+Yim$_?NIk7NB;s+eA-if8JAcY8v69aht;!NDf&=YIeoP{@4~I1 z&fz7uy0GyI8U{h}Uu{{iGSczQy&b`&wJpKQ8>9WS%f-R^7XE0~);Pc2g_jeW-1dSm zl#Zw^2WyX5JgLM7>aKpb=j}-FKK?b13MX9?-TcV3iogNWi-+y5McbWrNRum=3@3aasKX^KJw-uiD+bJgF_~ z@qd{cyf_19;S(yB@N*S*5-$%rJ5@7$wpC^MD(bdzCqib2ZY zx|tcN-7^;q+qU#oEG#qTeLTUS#Yqzq-L{*^7ZsPY$nq_QLvPX2{7* z*{5L}N)&!_lJ$^Rn+-NNOTFCp)8M{~-+R1x9+$oNnc7EEV67n zWwGX~=!_TAS>3EFS9m>LAwDxB!XnrIxjHqJ!MlEmeYO3xg0id9A(M%)(tLVp z1|w;-VO+Lp&g3*Do#wn0&|K*`G;s8;Lzt&e^8pER(tVk2g8#e>AEn4_tJm<)Z9KVs z?M~^YUxIF?8Js)&sB!4`@#ym|WY-h-t4?L!+p?=Zr?0HncDA1@E$fxYa(WnV%iAH^ z=;C~lXO_mv-TCoH#lrnL9;L_AIF~HPbuJbw35m}CqFJk6?!F9hM=5_>&G(e3a@!Z( z>VpG6;7eL-diNe*9@H7S5Bt-FUn+WXlKS%K%fWnG@IK&|A5qRfXm);t zc^k&M-rL}#?8)=LLsq)!@#@ZL_l@T6hp(}1(j4RuRpyb)T&qM%*;iUUO5@|Iy%|4B zw)JZF9yn`VnZed(d|xn0eOoc{zY|}pUm&_0UwK&)*%G~_GnV`IdDLc?{-&GHGeO)R zOVcVd$vOVUIBiGbhp)R7hEAu9rRkr$4_<%I*gHelth}n|S5oqQy!zSZ)vgDoxp~7f z7pI4w|F)%&qroU7wQtIi`mue}DU-h|{^vUFbA@I!@G9?y^B3WE6C!pp&#b@r_n#ND z${Xm7akj?}?1|W*^|knoO~+Q=zj5;8x4FcxSp!xlU@umOie>f=UhGorBAL6;CSOYz zzp(%8vbWf%UYz#XtvCPrD<;OS=+ds{WzAMD1x|^fap&xwuXFWEB*t3_we9}ZxjOp; zXd}k2c6l9P6M6hvH8EB318Dp3Rh(k)8;MI(w}RcdcQ{m?lZKZb#@e#Y`uj{|TNsn4 z(qr>uNFD}$gOiR)Z`S6NXNbEL49iYzGfM#mr+-=3&cA%*%$s| z+D4tXllfqBWiR+bN$NPkL-IGw=6=|A@taqN9&jFadj$#IozOm(MMxNp)@_2DQi znEyA&f4e_#&(ypvAI?dguK4z+6yhCSuil-)cK&&)rioIGQDQkMcje~)4j`Ge65tDF zxHKtj@mwvuS)0aZAC@Vl#0vzAg{WVc7k&6P@CvIEzcjdh;Kzt>v^I$QZBkwN@3&0* zA4y^Jm(4#mmgi{P*&=aGcdoL6vX{xkncc;%#lK|?WryE8Gr09IWk+7DiD_Brv904$ z`QRU=2fAlp7>9+%7W|QUbklVM{K%i*t*5S6c{q3Z2WrYqtCB-v@2Ry8-T{qPH*U+k zmOge?{dCUp=#8i3RHHX?rT;h8=~#(7tN!lGE#MoF4KMxT=cxb|3|Nj-1MuA(#83IzR!R2vi-mxhgvUYmCdBw(Uls{yq$4wd7?}B z!~DJSo&|3#OWIVQjqShg>`d9N+{i6F)sX8E9C)!vJ_l^_XxqAvKk5u{Hc{%zWsNdN z$Ge|3br)`Fi2Uvc$!?R4Edg%rU-+LY&)qwlBiX%f-~;x@%H^#3KSsVh9?I|iJ4<$%v4(78Y+1^lAz21v3zK~* zWY3ZqB)h@b*JQ~yM%l}ny@)~x*|$(x21O!E>N)y+pYQYi{+{QL=QXd_y`1};>s;qr z-q(Fy_kGV7PLD54$mWaHXa8>vQu4V4W#@ybzu@ax{{qC|Ae{4K|KyrAY>d&3x&dpc zCSH{3_dT`{X$TXBW>D$G8~%rRczl6nJPTq}6V@te08|>d)vmgs=$^c&n!NA(IPvL9 z@h59qS)RPF)zydF0c@&+S{v7z-A$)FEj>7{c#;ml^E)Z`K=!9CU!siEk*V+-(Qr%-~s z@*9_bjO+xJSEvBxW}^&b0Jb};f9l_{$s;3 zsY&VKJAAsi>skEz#oy3}2tC%7%(Yy-#b(n(B)si)pP>4*ELY1g#!1M#rBDqrZf@4H{-6|0t4&C<@ChCXZEWe*0pCF5k; z!3T+0#T5ABb)5c?o-F$XkC!%gcC6!9EtUMI^#m;M*a)4*qksE5o^JeZVD$d%Kf&+b zw4S8#2EyV$;~=v`Dg5%OkLE60{-=}vHA%2j*0 zN3Ct;c{bL5;&iP0B`O-WIO4DmGQ_kH+=$-J~ehBc&}crmeecYlD6cOt%c z4Mx9p-zB&T{eZiERrTK+yWD-H0f(&X3vO>C>qM7kb_%%|HkL|1-P!Y?LwM14=qe zEps#_cY`4jI!l(L0i3!^f!C<22l~Kvf?FcEPU`CZ$>cM=`M^JWI?rY@b3B7<4FktD zI5TdVteeF93AdjXNKTLcDUjSeEsz9)0*M*HOt!4%yRyzeexDOx_8$I%&hwTnPTC1l z%jeG)tx}q%;6Hy=8eJdbCf`yW{`V%};vJ%=n#*X!zE#COtBY6oK5LV^)5Zf@V&SV6 zhhoQLaBC>n;QmsgC4vPvqu=Ouwf@K5Vy)VGu0`rbvi~ptkf_c-uBjFpCmvF$L2|9G z@_=H8j2nV5{97%;^!>~EqzmR-qyNC|-(Y%YuWdxQ=G4Q!reybfG)hArBL8PhD&1#S z`D^?h^hk}e|BhA}yyd|Z5D>faw=b-|ep1g7v&_wU%k5elom3+yxz)$+6NPV@2;vU^+3%w1V~5Xf}qOJ8_K_>M_b}o5Mx#FUG75KRp*b@iR%$ zbp7-QaewUtVL>LPNWI|W&!YGG*@dlH4I$NgK2-&GPOLXpt!hFRh&BW9YVPlU{xbh5 zd8cY#0XJgVIx*8=cRyE7%wQ#b;9%yt*dpUy>Lzk)QVIDmUCzu?+y)t4&UFxiONF9^ z=NCl&PY6Es?k{J^s6aqA2q5}+26w#C9*P-%bi}Y>KTP54c1)QhhuQQ2zNj03c-K6T zq@QnP?W4;Ca-VQ%SHIioL%|_8ZZ;~P+n8I$(<6SC`4k|2YG1&g?kxV^ot_@8&o#dv zkblsTts&+6b@y2L=lUD_W1IB)YwY5UcWP|nw=CUnxrTGTYu-BUEHN$W@%wl4r2X-W zkoI#lmAZ14P_IxCr&UJ2_p;NrUy_oWW7Hk>7rsB-|NjcCAkgxpuqlJ(P*`->4zqbqRxeW3zoSEXU(Rp3kJ)XEbKKTBr_?PLy zMZW-LzYhoDksm^yO8b5M9CO`yvorE~3E5MIp`a_r=1=QBS}gUiM@~#c4oyw0-+J27 z9@;n7NtvhkXW`^{pl?5&iO1m2;ZV4b;Mo4B1OB>@yFU+4l4Sk9+C=7(SrLBsEWR6@ zyLRqdK~~Umi~n#l?MlICTDgyZetYhGvU*t{p%rxef%awlthA)7ya}gnm+%5@Tkq7h z|Jd=q(e^BOqjS7Afa>udKX}9x@to+U;nTWTVFIe3$mrxvo zf@UsF;?E`{o)e#;MTyv92cFB z?fIT}FqgiQ@g4bp{E+B8i>1CH>SjN<-a7h$&24;Wow!O|tz%6k*PIWUY-z3`!6wZ>!RR^rWP%A3ufi`x6Xc~-Zk-%cu^lrKKH8JfY+ zn*KDTiTj-3koPvP%ck?qBgr;Y+pf~@wYMRRpS9<3 zL2bGJ^|hDKIpwvWcQ5bcG0ksx4$p+lZ*~qBv`+q6`*JJf@L=mh-p9c1j(eH@52oWo zw{BI1VD{A0Zxck5kCZ>${~(_CAfEot4Xx{(6Vt=)SE?#+-KK}XzE%0+-m`hVK}YW| zUt*$SoU^RIEeTirdH(GX8rUKgeycO3(#`|7LGj|{MJrS597Ble^Kdt%1ya`0!$05B zqB=&dn8rO9N@y3R55MziF#5+W5hm5w6;EcL{h8p}l)ETJ2#_K5s9QFIF^h2XD&|}6 z2=l}%z8(}j``%h7v;07PXZrbmT_S_S?6YF)*kTsZ<|Y0%v^58*m6^4Uwt#mdyZ3%! zO1=_DNw@je1U=3~&8wf^xCKZogg{GdGYF{^ypAjBbNBJ)W07kCYVF13;Yo>doN0>j z3Z#+cR~6!uk7B!Y(VA#Yj*5%{Qw)gjTx6Z?`EGzzKu)RenzF!pQ0qW$a(|({Ri#*vTYZwUE!aN zOk_hVvhQV1{64t;BHTay`PoyUk3wDZg~pVamUgf?LVcT$IGDa>qo(z2&U?wh@3Rsy zml7+!e-=~ThzT*dSI`raUiv$}uK$zQ*~kw^?~gjlyqwKMR_EHCp?%*ZE=*O{TA3e;&x}JsT@_P<nOQo`N*K#R+`p!q*Ci)%ZDUTZwe~u z+09O7jefQ>?2iC#m7bDr7Vf(mn#giK*tif(mKQbzN#$T?RU2z4e$zR9Lix(swT|w-YUm{59i`QM)u=4G)VP4^eHfLrI@Xyg!=m5#N)`sSqgFV8UZ!Dag7LR} z;H6Hgr^+r2!@WaGor9`wm_3n{kbNMvfkmE>I%dK;&t+J=`GHs~1ssfQApJQC6+LbU z`kaG0MN_?p2-js~T;d&3N4J4PX4h@33~cd50&c9Aj7t_ye6)sHrco!aVu*9jy_)SC zrr9vaJz$7>PG*_{CB!0^G=3kk^v2 zw<&|#uTUWMCS|{vK=pRYO(7#Q82Tzqi3~PC2hHa*bfRWlQpt8C1b{=ZYD()=N$Tqy z(2)&WmVPy!SkrXqxw8*rFOlMx6AbF%r`>$3Kar*8L}&=lZfe)( zl-^=B7DT5}N%Ocb*9-!hf>Ysz8i8EGb=amZvg%&k*B>LK%Fuj@Eop%+Y4UzCzAv;m zsohQqZrXb)BQWSWzh(!$$jBir>m?|ClAKHtOHh4Ltc!SoOCJPRg#~I={E=EsVK2&8 zUE1N?JeAfrrDiN^DGF=(kP;v?^B(IrUwon`Y^dj#69bqe1d&YdM8dB?tf>Dg0V=Xy ztZ^SNKtE!sJd(x-wTh-H#cf^?_(B^#qmxxFScTi1P~o`X9;@A3{eZ#st`r2CN-Uz+ zM`j(aU4a`pMVD4ll~ysw-sK%+T&86>fC1%?lq(tKQ;5GS-c3Q~+;_=kL|oOjk5Ha= z=Vlae#v$T+vr&ZUJ|pxpZL*6W@J8_grXAPeekH^g)L6Fa+Y8#m=^2;Ezl)J{^x{Ne zg`d&Oay+hn1e@LqbjBV!a#V*%k_Rqi%<*EyyXm+UoHYee%#ntt*Rht2rt^$pu!whV za^|nta#@!_p1cAi=Zz5(9sFltEwE#{X*Q-r$Aa2MkJqx3Jqoo%iCy%cXD!*~SF|G7 zjzh+`UYGo4;FhxsPWSjj$w29S;x3fw`|7nFE0Y+h*E#gIQ+iko|H}}}(_Z$Qe}Tft z@FhENdgZ%O9s`SZOc9yiBEL`f(bWerMaI0QgP(Nw7E-0Rq}xl?^iL1Fw}yj?)>+TGL2h$8omEbl zYp|ix>}Kq5fs3-_QW6?zT)j;R%$GUbc-CBl^s@k3v`E1#r|XefZSjEmw{&zp-b!#J15*9UF$SLhb0joH2A@rzFr%|#?Uzm%ydc6Zx zx9O=v*E~!G4((ooGSwnLNnSdlBAyl&M>N2IKkH><%W;}}Dm%Zz)}%f$snTLCx@4~4 z@VwOjg_BoKaS~#)!Zgp$XtxsHfX80p=e; z{T09p(-J!Xb6zL_bImw5a0vMeR3mxHsf#Y^Owh9EZpD!mA(+e6T2p2S%W5RowZ>_( zy?Am(LnrppjekJs6#kFkfQ2Pj+~wVWW96x)PT?QxdUq5T_ECy3*(vylS&Rjs9EldJ7dF5?yj_gg*f zlJ&`-^E#hPHw_)<<(6sZbxwy)70BgsIDdJ@!#J3rY*i<*;^rD;=;Rf&zian&H_+9u z#%&r{NuOV)XrC}IB`N(vvgU%e%H;}9bJF6mzvtuE#(rX->pyGy z>-U!(Q}-W}dm37zfp7aq4FjK^EIEA&bhfUk$drvUFnh`+qHGfke{tZum!Ce`DmqCG z8l7cD9@a|5*#x%SOD!?(@1OGM``YiAx%^>#)>20{ISAcuQDUt4aA!DezE^1c*hI&V zpTX1_Dbn65b@S#$N5|g6vFjIKZwM3^e+{{45fSK(k$99wDawB$z<_79%KKHKbW|8( z(JW`k9c*~1dal(3?Bg}si;gn-jmID6aWsgmO^vVfe!L zHFdGFg$!eEgJE+Mb}flyNU6NB#OsF-BzOEVPadNcRkX79_Qjv~$2vrl6*3kEEls|p={LVGKCJ!DtkL|QpWdiB z-|Xuyj{G9qLVqy#9tGea&$?u$Oon>t*Mk1($I&;N^X%TBeSOp7uz{q zKNC;vzbGfyGq{6*f^)nw8rhZK!^O*O1 zRfk2%g=iJOVu;pW$lyI;I{imtD6EosduQE+YPD0 z-=oe9D)vT>v)N}JD{-VkTTMTnF)8N)YSs?yH=LA04;0=x&M&mT0| zo~Wjs!N)R=($`VZr*$*VzJ(&7x(UgJ3Ih;u0K2AAWMi+rmg*k^3?FOxFh*&OzuAj$EPzLxW_ zn^4JC+{|Ym%$?ZFSI#x|fs|ofz)eUsVnuhXyz9*1qf+{4_V2uIH6(74d~PPG24FBl zV6RX}f~G^{rlztayIW*$q$+mh9dm8ZTUcz((oK z^{DrvAr0TC8q68)534Khu&+xUX(>zMY=Cgiq*f;fdgD-&g(2*)QCXZXf43_MzfE^F zpS@Y~$hC`(-FQ}<&DGCLk*LYrP+`rMgx^L6(qO2uB8j~jPeVDRrb5-@GLmq|kTU`D z^ehk&E?!-;rS~IXI6253(h3Abky;%C-b9huhq6)P;^~){A?sd|O;^<75VqC{U~0MZ zFo|>KzO)UU5J0ej>0fNJy*4Kal!w_c+`p_s*eK3t<@J*-eHw++q{olost8gX8mFuO zalWV+eS|xI)mSI;U{qb18j^T~(kr`GdzT{O)?Lj#`xHAht|cy~vgu}cd~W(W z$rvZBQ71l79S7uOSqTISNF=NpiO}1dF&x5AXA5EHJr##KvV|hmv)k0wLXW!U4$ei! zzM|eeFSmi|b7zVM60#oH8>#%g@O=RH{b62?y%b6^WU;cF5DDJs^$a!MC~`&{3}tVH zanM5(HQl#(?hga2gC=qyi@CpRhXJ0r=^(8~xBcdG;-flVTTP@*D`0F8wN{UkrUK{V zYj?c8xr|4}@3c7T^AD#l)XH&&z-;QC+?nVoLF5~Mo4U03X>68OX})%)>u#N7r}V9w z+iRuR^r#rK`O4?p+x=v}XbqmVnAD?c3VlMGXf&zMG4zgD6I^A3q5|Y9hcQt-j_b@W9_H_GKc(R*UzGgWbpb_U#dR*OW zVCwRFaj-8g=r%0_c(tBaob|2->npWeBwp7|9kNCDS%$Be&a)b>i7pOSd_QE%y|%vC z%_Hgkw%p-&)Cz-pk~YZ)ma>+=#HvtF8rGcAuY5J`Rcc&IC!Jx{e`2wmgloEO(s%@> z_pfYQaIfhygO6DHzKxsni|SBYdBM_5qzR51Fz@DEk0Y2wb&zro;aII7`gRPPp>$zq zt+SzJ!)C84_?MGRVrSXzMB(PMm@f;UFY^&4_=%q59(qv}`fnmw%9>b3qXPK(b?%yI z?x}4EMPzuBrbbkxWwBXalg!Du%-3~A@T^{JlP)f35Z7e&FsW_$sE--jtu*3SfeyUX zNWYwDqWywRGzvF~1N3J+P0*Wa4+MS0pb9#@n<_&1FAhH~(q)(8Q0?0%sWMx%9+{WcS;dL6R6SAVJ|3{m-NH=H2JxR9g6yGkE zzK68*Icsw)u2|Z|X!8UYP5jF=ma+iQIFN(Ntv(c*#1Nm$&LEkVN{a|DA`B{rBpY*^d00EMlWPHC!dI|UcC$8 z6H>;?B%T8;V@=%?P;X0Rw0V>=sLnouq38?1Z>YgP#TwHBzTuxnOfSN$`O&YisD><; zkyC;h3aM@+BDR`@9KHn{PF@ZD3S2lNehKOY7skcOp`i~sQ@@mCthHoqUg*aeOY6O1 z>cO3I5gov9FO{Ewa?vPYzRZUf2g~C}52gSWmLGDDxJk|cKzamaaY4FkCzv!WcM-N}5A%_RZPJO@#tpIYju>F)%SE?<@dVr+m;E09Fk<45HVIRG zCy7S_OiEsZ&#XS4Cht7&akLbk)NKCSO_yIt75=}YILB!d3#eSsug-6=@SfGfJ&%vQ zH;8*~g^>>=p_-QStC!BpNa=lLBA<83ly3$VVSH_NHwnM87Qn1V?z>Fg(-=D^*d-y@ znjlqAPr^s4gwV<1BBg15L2YnA=o7Nxj_9L zkTM+IR1TrZTcU({K0Ghu2Z)vyP8g?XU;mcGl97f{c(-99%?3;QIntBtVcA$OXXGpv`m7}6#x{NS?3r5 zP+M~EX<&^yOq*(3&WY=Jqe|2CT{Bv3m-1N>PSMonYm2$4sAs9LjLY^)Rsg?^_f?Ie zy>zI14~8jff`R+GnKhMBO8hC2vkXxa2JSb#dr+$4q`77b`i6$_NOp*SWean|@R3m@ z1>pPZP2qZ@?YoW3e%MoZe1e>fB7|jz_O@xyrB*ko+^!LTeynOSte^U&U0~x~+-u*; z-(iKh=2CRX#G(%z+WQftJrmmANZcO+9D3cvymYELOjp*OgF?YPXMAc*alDDzBscJr zj4+fmesY=Rk*I_z&5ou{y-n?Mb+_7vmO08-5+I&uj#y*JsAH@m48EdG&4j;s8~rL{ ztpQ6lny}Vj@<@eMC0S3E5XPQ*r$Pd4?am4Cs~TZl=?Q;tW^H5c^4_5XHsd)i9s^*} zVJA-UCrx6(fQqPRk0`*S9+-$h_e{CsS=z^12(cYaEI~=cR&DIm)fsCtA+kBpnnvQn zw^MNKkK_FK4{UdNj*kZeYCi-Rzl(nTEFlwuk4;Sx0v<7NiXr%MM!dB&9w5&HGnZd* ziAZ1I#X#@KHfS2@8)UpDAxs2-i{(pLmn?sa1T5Z0WCYU}r&vj=f^sqk7*b7}ogl=O z3E)gBAHZ3c>?x=k>*81k0WP4jnaUc8rk?>z>4JZW!W=u6?U#C@u?|WWZE-0HLK{Ys zw5m+^wF#EB%dpRCpC~o^U^lsG zV&$dq8*~8qZo=3Nd~L$yZc4Hnz$J~Ep(3_A1WN#e0K!zI@=*;C5g*t%-Tz*f3+0(p z&%IJOXoPHXLQZNpEL{|6kr1?sIi+_xbrk9iQ<>9Wc+@7jjo0{3cvJ`SE@MqO#c1~B zL|gzrvj4GrrKE$%Mf)9Rsb0tuM^Tj#GPuX#fq~}OBh~)LrO(1dd`2l_PlH4X^JPu& z2UcO!Gf6t19W}?ykfx6SUuuM$Z_p~%^k8*%s2|08fUo_T^#Fi_K+C>LGa6C*G=(_nM@utj$}c&)*iT+iHX>08W*d6 zwN?C_s)*yIKOdSh5+)X}A$B+EI%V24{nje1Tv9MjQJ`GX?x|`lBON3RGVOv>R9j98 zYvR|mf}#LAvykLb2&i3Fdr&_$V#GWu@E{8fAkLl!#_4g3Z|fYCY9x_j>yO&glvsd> zKH>=L@pbK2-O1pOmlIs-$EXE%I>pG1 zwvWx(Ib-aPPhw77>-un}zmNDD-mlfkZrFF^jP@pY4L_Il^}jR_7@K%nb6Jt$_@6Zw z`?3G5xlHFq4}S58h^^?D{=<6F@0sO}1@S^~U{0XmfL;(_(jGXqESkNRxMw z<0FJdIYqRr(h(#*x9-#68ry8!Y~%9JOUWGPE4ge3LGB&#q~@Nshy8vs_6i zp5fV4LG8hI+<0nFjG2R>MNmM`(qdO`1=;&3d9!Cp%+_XH5b>sJgpN&s4<@6<@D)*@ zqU-fI-&O?scq@jL=Vr~Ll3_U%i5bC40Of$N3fgk4msoB4tK<=YyFY91M>_s4#mWV3%YZ%h_UIgAUsCk_hZOmnSY2Q=I3fj{IYrbCNpT3{) z*>Nur*-1AFP~<@5+*!g?<4ZT0V@P476$XrKF{JQDZTd997W-MWw=nM~pS>>APCE1} z7KIQRIVP{lsZYiiG})R z#K>*!t)L4eKp!hJ!ZP`Zo3vTBya+6>{CKnzksEhd(Wwe+Pi!etV(+I zDX#K%k9TA}VwBQsj$n2{-mopH>0FNk6+?AX@v|w)5jAO7Jg|V;Fy>h9o_pFDrT}a2 z!&^X7`D%;a8kP+}Qa8zpXXITJ{yL5(SW`pReXDHFZXf_%k(@A z1Am5~QqwX`7mQGRE}oZb&yzVqU7cixT@4`?*9Qr(PE{@eLpS-VJT;D5?7wODU#KGC zJJAbBY4X&lZUqewF2$bOwx_w+zUOE@wNiCcYt2+ESXsbbjsAAPO=1D>LYx&}yf+;0 z035^mhxxWNNe#JCKkb?~#E3K0#|jJJ;qcd)d?S>$ znrUwwrbwL#P;VR30hHSI${1P5xxe?v%;SXy?t%+A#!+PKM%Vc^1)4B<($Ok>!WeH^ z#ubW?bK2^)*C0k<6ne2GtG*>mh5(0uil($?OCgPh5+l2T)d~yH#|H49(~i+csed>8 zCV0b2&H53E^k`U<1ceivqD=u-CDGSQ(9Utuv$Rp;KdNw+ps4T^tnHTdaIpAbxm&e^S41S(l;c;=MKnz6c3!2 zHO2EG?|to3ad_}$!7Qizz`_TiY(R`*+B-wHz#E6rm1{Y?2 z8kgN@wO_ zV@p-ef^^4IEtin**kc0#&!qMuBsFJ7BzH7XrQ)zLR)|-(OI0H1t8^ZpMW@;p=39}) zdlNOIsRy|PqZi==BupRSqZCGwOru1`(G+xJmo9}52S8=Awp9w+>daHQ=>0k}5uwiWCN&MnEkV`;s z8eI>!ZILrR5vC>DpA4v#-Uth-bA+nR_{6d1#BQhoE??co8s-G>bL=ioSQB>g=2aY? zet9r=Bkg2fyY^beWIKnJ-F#dR zi+}UeS%kc#iJ1;$vC0it2Ft$PYm2FPxP+t+G-|ND(-Ia z)F&aP6IW-hWz%a@dmIbpWgZj{i3|AX=g{fOe*Zcki6nn62{M>vjhVe%xJ7LYV0d$c9Q`q576WBAb!LvGx_|Eqg`Y zke*DKK9LD(D#W#+UIhWk=)!p4JYw=!Y`;Tbhi3k;f((2nZ2dku3b{3*jXk{}BSb?1)*75~@L^yfc{EOF;6(<6PW57QOcqipXG zSn@VR9p03uVtlHfrLf1Z$<7{W>%s);|1y}2ut2TmTx0J7X)pQ}!s6FzFGT4v^!_8p zPA3exkvjp)o_c!InwN2~y9Ms^R@yi${_xB&s-MNTKrg10Jj3?1^qtr2wnh6`P1est zC9@dsJ1f#=FP^^$;nSZp5_N9;}ee4Vk9NmUQ7w#dJ*AV`r?@7e%jbTZ#LzO;*fDgVK zSGpkecW6Xh3tZkJ{NKLE08)MDqy3aYmLQDQ87uq-RXCr<=!B%7Xtp{jGQ}yn9}Cq< z@zcWWpcV%%1&|pH%{imhb3dB*4SeNAY@_$JA>qy^dQbSsX_1Q>bga0p3LmpW^$lLY z57;*p4z_|U5*mP!pf0#G;)2&0v8}az1eG;k&D=iRHxRTW{E2m{@XT=^&l$)Awa1y`SH_6h!DRSVqqnHh^r!{| zoBsQTP?*dqDgPhVRfTzss8Rk-T7j$U^{4%Rspw=uOe|LgS17fL2N{qLkGP>8Bp`>7 zvC5-O=W&Z_dfgZ*H3HK%Xk;00zImVf0QFSkxHpBMb=-?vtnxA2u|5`}(lRdd_~USv zNjs34;BYYy*NE_^xn@i|GYqH~(l>*3#y!MW*{$)CTb%TpXR&K*;irjnD~gl&SYHQN zUhi{+{Ewjq7x-wO4&z9+B*IR|*u3j{79%@r3Zv5+Rz##o<4Wz7IA8hM0s|c?4a7*R zODkKvPBBxAgT3loqgWcIYCf^pp;`Fb}J0T#TYm4HOdWN5(M6XYDBgPE^(OG~xWV_CV(d4X&Z zHzrz%mHv00eCxcw;+9NWaieG`a*!xi;ZuAj0F(Dle^rxY`);0<#;W02rN7xzrmQL++RFkL+nR?2GJ&)CS}rFee!c^ml@c3oYO*8S4PCn@)Ijo!H$x<+Q<19upuUK@0+HdloJ(LsB~OruL1Sn z$5iJ&2Iyd3?%mL7eN4&lRJNKLz=g{Y3|}?GviZ-1^8jkq5#j(Bj|WzBWY{xt7pr`r z%K)!{NxfJCKFg$=c!z1lQYPEn%{uq;M||H{ED~X4hpFa$>@`B*WDFf^j=Wo~kscns zHh_5a=jxRl0HJ0-uIgDJqt1fr1Y?OZ=q<66?*;y}90_ZGqwm8&M!(~m$9b}%NV~oy zTm2(3rv66^U~+pc@q@qxWOzdKS!klV294lLcKjUyW;sc@v&dZ-8~mqn+j^Lc%o? zX{T3mu4OC6UZlTc9d~8Y3|IKfJ8}O49!7*mm?Q-gAC#%-PY!f$+%r?Y&?nrIR~EHX_=**6l)GNMXdb1)INSM>)G z!wU(-W|Tw?9c3Sh5Ha#^JWLm%^*%cifvIlJdwP8ofxAYW^HH2c^_61%q)!oyS&wxb zjX#^t@ss*}gNxKNNT-vPOtwPmfl!>d{c-`SG39_?@GA~QeWU&w$mi9I3}9VB$)(Rh z9g-g=210^p()qsy*vS=oqV3FPRWE0xJ-JF?VMVu zb&riEaP)QTHGA-kBjd6FUPkcjfZ>&N9QxfNa4f!rCVu`S34vMcUl2wAa40auGPfHr z-^9s9^Jy69WZ|nA0BXz}slY2e{t&eJHIiW&1Z<;rdUN`}7-b@?jhJ3qPE086#8sA; zATJ0xwNkj^2%6YQ2&#z&ko0-Kl0~@^9l?Y zUP#Rt?&8Zvq@tW>ceSaD@PC2!Hi^5`N2YepbW$f5c`~EtjVI|W+Jv=OhxjbKP>wkK zH*O@84Bdsrje@5w>Q?7)!h2Wo)Asd~@&7F9L9Y9;R$ENhJknW8!vJZ8+YjW^NZt>G zQvW5%Nup#Imm?#|5yb^=SkeW3gaG*LLoYuZ^4l$5ypkq^8fC%^z^0HcjNy-JKa~Rb zOZx#f=|7P5Q2?^jeh{$KMkSJq3kBmwHq=sfU5$O-MZ++XFQ1itmds zjZP9x@zBUT7mLtL3#pvW8CZ;Dn)T9`5WTbRKc>&8~``pBz4dsJ3B z`*O-54d0n~;(YwJv+h#+>9+&=^OeXG)u#{a3Ti%DPH%EQN^+gDh6!fHmbVhT7cnQz}}PEZf=tC0z3{l&xkoppG`qxyJq{zW>5fR7{1J-bJOy#!pTpl-w_V z@L=OUck#v(HlAv|7d8P+M_s*mkcQehN)W*wGj3+Y`qBFSq;XA)Xq`11t$DUh`@u^8 zhELqt%C@KV<|?Bp<(Im}SX1g-n!ckyEaz%7Rdu-4f%bg(6isR`y`yQKo!KhGd`7zb*|r$Cp3o$<x2BIZF;2)Td_y(>ICFU%eln z3}&6B5V1AP{@u2=+JE7s#8YFzI$N}TjIz)6=KU&k+3Pf;da3YWun({KUOS795zw!f z@($V=B=Ge-oLtL9fV#uQ8>5d9Vy>W2Ve;`ks6RYZ_^As@7{B}PM8t{m5F0o zPCSz;*jbXYn8tUuvV)|N`4!)5HoFSqtiA3C_h^1>8yz+7EP+7~70>8a(ZNtHNaX|q%eyvLJRqpU=@X>BwJo39>?mo z=hlO&4WBD&T%PAqp!~WBIXC|((VjF}GD2%PF^u{7(ZVM*4^moe*>lX!sE`gwssTJx zV+_#4-L2{fZXUDK#uQ(swNwVPh3Nn%|r~_7H%{+&|5MIr02-BC3}Q3ZhVbwmKjtdStw z#Ib>_oO<~*`DRw&8)IdH=nl_FT8e9UL^eri9vB2%<~u9X{hnmUMGrBdZLNVU50Q5_4CV<_R&tOS>~n-fWduEYaJ< zIZgNWh35*q3#A==?J{qmxv}!)&u&~w^nR5MG*4K%QRBP$+O)URmYBF{NO{8V4e2dwq_}X5RoGlirxOli6smA9B4&7V~}g^t}bXrB1*d;znSZf4ZsGVhy4qP^4Si zT5C~Kwd>)l+nA2gQA3psI#>L7_M)yjN!kurwW(RKycg)7AAw>jk`b{*ElL7;U+1_* zgD8SrurnX6D*rG7teNI3bP~#)K)r18wE7bCDtiHRo6(Jyx&b_vAv*j3Ytw{B1dPXS z053>*Prd`HVC6TK!8liNQhrHAV$TyDNr)9BcPoEp3QnXNQcaz4@}R~+G(Ij_NW^!; z-BFNByf`*!cg6L0w_t(G&Jh9Bs%=E855TCm!oX3dP z!!$LGNbRG69_1nd@O_dlY9!_|==kbIld5@8oK;U@6~M6pr~;gHc(uxS@}jhg9@Gyf zWGGlpsEW!uaDxgCz&x*T;Y3d1ZCy()AoeB+n38$$x<639wAfN7cH4GukOg2!whVQH zfXmkTBAFe{Jrm{q%wfwG5a)CLWPswH2leH_7q$~pm#++Sx8PEoR8Z1_1a`bR33&7s*H>uLhWbgP z5b$icK2z%B=Aq_KnsM>Z6AsfaE2i2jqvu|RPCcvB-d%Ei87&qX&@v=9c>Ht&tH#}L z9+}9qSz1@NyR?qrlwDoW?_Zmo4pwm1rgxQJ-Qt+}`goY0k3PjoLL-oi(phNX6>qpMkjQ>bfdV z&);V->G<-px@Vr%Zn*kNpKiYn9^Uadf>9o(u{jQTG=1BTX*y-xd_4ObRbdKd==G34 zc^8%J#QT*8^loqzYJA#6&P*1?IX-f8g7J`IfA42uqnI4+1 z&V7zFN8-S1B;|E)H;UMJe~wSTko`Dru_|CNIc>W)Y?}IqxcNM=6f;&B^cl)))%|vZ81#W_ixG5KS=8CaA zhH+$I(1Gw`5`{s0e2XKhb;wcm5;tiBvw%v8k0Fo0wU=_lj#c|;-tG7aV=*8&=J7}E zwmQ|dP0W{49$e=ey=GWZA4{&A)DY zYs!^!Omt8P3KJx+$D~1rexhV-_({x#?kol!geh&Q!_>Lqev=C8`@;mt@R8mZwPu_# zMQRv(xgT?AwU4j6CsKWci0DJE9MkhzMmxCh+vn+p?&i@c*{r(EJZ^MgV!z0r8jrbN zJE*_aJB_(VHuUqBOk-^#9Hm+}<(KF1V7EPClNBkkbH0m@dW-*2;oXMucq+kIvXMB# zmJ=!iQjR)52K!U9*qEHTvf;3hn~rzTj^w*wnf)yNf!Fn>+JmcjF@nYhyzfDlr}-ZZ zV%zoW?T6gj1Db>HwXAeDJ}>6Rv%x&oxXaSby(DaLp-q<~#K`aSRY7hJOg7<#5e4XY( zFXyb+5(mn9gO%|#%-Cul$(~5KYDabYx@UDPM8I;@E$(nA=@oU6VV=7`!|&U^y^Y5( zRB8Gz`w$miz34W218T_(hg|ofn@Ifm9i6-cpIxq)22bYi_KJ-uhP$crn0rlwgV#$l zFttsCeF(-@hhrE!qR1u#^S$q?u;!F^ubW;XE!*k?c8)Qs$mcg6Vx(RU`fJw)3_{Lr zc~zz3J*p=!N2_=G6f|MEDk{^TY!$ikdrkIz*yq(rIS%@)%&hp#hyHbtFKObAO9jJB ze$tFv-hii%K6Z;some~cCCFzy2^*T1;Ne4}E@x4Eg-Kl-PI9#|H>(Mo$F-NLOZ;q~ zn`>l2#iQ-g_<+txBd^kxfgWEZy1fxZ^DuX1bTFMpHdXcW8)X>q$Cu;$ z_MALhza2Wa5h5ciitKJxSYb3pjC;)G2rS~K+O@1fseE3KuaeFBG<`#(M`Ekw8S%ox zag9gM`E#kvh;xTZY-A4iI}OwA*TrztYYHmN_{-Ph~)Aa32no1Wb__68l^taND56v zLu<*Wxt_d=gqHX5@;ziaE^Kz{YG}>n4l#aH z&gBi>Gk(b4NmaTwwl}35Mm<>Ma0x1!f|__1-0DTIE6Ct@N8E7J&@zl@i(x!WYGI%3 zyD!T3e^K@pP;o6yyKodsfCLCZ0t9yp8r&#(R7u)0A;G7rIL#zWOY2jwq4sA#u?w za$)wuUjlZCgFrlHB0+2;FK{fD7$A}&UbOT$ug<7;ot!L(R+KO#<~dv6!2@JNe>&ul zyD){tSy=WK%5!AWC&nVly%NdzIT6+k22PJGKZ>M)GCz9aj^Pp?ARChj3UuUrMzAP; zA({N~vq%W`umZ7go~WWdvncdD8fHjhAT*xyPML)d<|Tn1F%{mMmb zK(_wzJTcCSet5K)jWXje6R^$b!lj4gg6Aa_r@o8u2jy9q_08}-Q(?IY!g(kvLaHo* zwQ->lANQ02lWc>OWMk}1G4SVqHtQR?mKEHxKHjhgLLv+WeRG7u!ekphVqOxqh!TRgeMiy3gTbuDPdvy32t$IgA{1|* zX(ZZ^i7Gm?Q^c^=pS&Wm*(F^BzFj1G*@*LnP%@pM15FYqtjwXe=<-I!x&~EHg1^R` z?HP3ql|w*ur?@Mnh+s_}oj=NMu240V!$+o1pF>dRCtv3bzc6QGGcA2=-mWjA?9h`H zZY^3%5M=#UNM)TlfYg)wtqnJPlwjcuSi_)y7*~R)Hygt)sKly z-b&VML6||n?<>(iWCb*>0xf%j$U*|J&VW(w=${)%H!%EBa9`?6#)u2mbA6;D7HEFS z+cOxPE>sZmQdz`&G%M;rE*aYdq##NCxEh&Q%w|9w`V5(Z%$g11J-1=nmuQ}-5JQ<+ zLAJaRALTwA3jy@T?=OIvWcZlo@T#lcN&@iwvQLqM?l3)QSFmjPA5l@7XT%)aL`c#@$DuSr!7m}!K) z7*J1%;O;<#>4ei5<_h%IY@N%-ujbGU9ue=nF!f8fiLN2dVHmrS1I;Nm5bwPcWa~1# z<}>0XiJW~@OiU<9n+Z4T)KN$y-;~km0>4F?R^`8QBuo*c$JizY5r<#624Lxj8&?D! zuz$C8tsfWv{5-hGsFxh|OizS~SagbzwLwuc6mSQ%)m{lh^Qy(c=^tSWuOv}+@h~d-;g`%zdD;~ zrstWI)Os{^&H@rTgYGz0!Wh*Sp`w)_B3^zX?FgcymCvD`KsCSvIJa37=_p^@o2_0q1>7 zns-}{GF^Clm!AQ*_0G`|m(-*cprxd@P%1P-?o#8qu*o;A&%0I<>{`}y*VQV=-}3Q2 zUnBFuC2T#rPnrvRd#2YS;YTLrM|%D)!Z6MRtmE2q&Vxztd3{aympc+N!L8Z{Nv$=v z3_qH0?47*WPoY7p<@EcDj1^5cH?_+=&A1C_l=Mb--#RSXCvY1|`q48+zHYv8POL8t zLZp!0&#Hl+0N{UTrCnpU;|%7eouBRUr%j!|=&&$q_Pwv|CU8E&TUcx#)m#)bo8Kvb zS*OjX>o^T>ujp6wJ41cO1)#}%9y4THe0^Fyi)Jw24Cv0<+1aW}nl{8H`7|kL&8-8aUd-(Rx0TLNE%|zLs6JB7|1?dbuQ`qjMQC z%D`rB^fKBB+TR1NCdPu6m+mj1U-wvg`0n-!XL=_n`CE9reboWp@A8P8QAiUS`xX$G&Y)QW7Jyx;2u=%l%vp*0P1Ddj+Y}Vg|W@Ra^ zp6W67p1j>!bACW&$aKA>QtwC#y9LNrbF-kU$7et?cfoOHZDqGeBeH3zm_jwP@D0l_ zvE8ffCAJ~Y$pEWeqc}C5=RH;EKi6?_J11KwviWzM84p;%TC};kvO1XhH>$|rK}|@fsF1# zyaH-Q@5~sa%ojx@$ zm=z&!raAQDZ&`5@8XJFlk-(1YDG2h=kh(YyAZ}zRMPwRxB%b&?j1DsF@ zGdE<4?VOZgtNkAB^H1LZ2}|!yiFkPCZqz~e>n_ufioxLhZ(VUOtD$L07Y+3Ia@&+8 zxA+BGX*AomeYR1|drjG{b_>@_Ap) zbGo~xiRU(^;Jve2CBvxh1f96fmNMqV=G>+1_~u-VfIq`1AQm#cIR_%7(VATF+U=3A zGAHr}GynRC5C6dzsI$t31Wslf*qiLz_^&6}q2G|439tifx+DfsuU?=J8aTy+nurQX=zWB9=@P2^euwA(EgX9&Js}WM#L_>|UjHarU@+MGuAsV}w&D zDLf?sYcz!hlBdrV*C}OLN!W1WRMk9qzFsg{xFq!YOHV~mynTm-qa@&uhe53`FfRt* zh!tD^GNvBBJM0sJ(|GinnA*7WH`jf%S(KOU~zIF*F#ezft4gFgTfB=|D*P|HSYtN_bKidfA2LnwPbR>W+GEOpqY&#hz& z*NY?b3DsnfJRR!!gtOK|sbZE%*7AY>G)|yyX@$pxqydEK)cr~#Zg1%m1zqb;EP#`m zvy+n0-7$v#gVHVZ_OaQDCpEtz?B_A}k+OsCZ?qUfCE_BMi{Jjaa!{bJ%e5lOB>e~6 zRLOPzjhrF*1~~*nU3d3vV7X2lo@sQC?n2C|diY%G@Z!`!nA%;l)l}^JR z8tldUO9uS!7X6DM!2H4C!tb|h`uDq}>u7oE_x?;KHwjhhS5+GBH*Jx& zHjN_wdi_so{Qc&Ng?)?7oVVnEy{(((AA{1p-2EnhWAl}G&qUc6EjTYJ{}(dG1_%FH z9ptTq_lZJ(6x%w6SA*c>Kh+?>8k+CWPXAt=HP(#qTL1{^$Z>Hto-OvLlm6_g9?v!$ zV_7{NLVtB*N08o8ptdd-+^$Oh0XJ3B;(TOG!F(j~uhw4y3yGR3tqqTS?= z#42wuE)4sc@I-+GAO~mOaxDaKQJ)CObdg{tk za@8C-c>Z|bu1j~YX=}-^Zbe^KRC5OP(u>K$PY?-`*H7}}wY4u|Zk5fF{zm_!cFC#x z+axglc2JaF4|^>ogz)?l6$Z)1ggYvrYf@hl=u9!TcirH=+3x`?o&y0Me6|LNh;cox z?jAR5l`-^|TCa31rdEgb?wz(}ycYMlcfN$E*m52CKofF?CU7MaiK57oMI%$?8q8o;h-8<$WslC^weqj^U((iF0c%3rWWHz0gICe7$~K@!&dN%XMB z7JOQ~f4c=f*z&gLWf;F`XBj&N8v?Pt>sCsi>d{|Yc3jzAgBDsbNfI z)-H-ocHi-zZ94*K>&sZ3=C4az_3aC(Fn*Ozmq^!wF3&M}d;O#a#EpPZ{Aner$6k!GvQ#EAdzjwi&_`{_^1ayo~1{(pC> zSAOp!{%YW9uZISE{?#kXUkrUZdimQJ03Q7>Y9BB*^6LJv93Jal$w}dC|FMr4Lt4bi zxiWvU8$JHV^JpDqJb&z|JaKYD&_B$Y)>EgFH0W>5fNMX1wvhjrq$SmkbaV9IR`-8> zA6p8qlYZMk{!jY4?9;3lD!O;Qvmq|1=lv7w_-*_AylqQgpcCuOI(z)Qa@IPqT?f^6 zh>dbsoXtesH*NFZpLs8IqM=bl9G;w=b?cF8P1e)2jF)t!wL`W?Qov0!Za)k#OBbAH zZ|`Vd9m^ZVYaMa5)F(TwYCqOu9aKzuKlL5E%yG;B&11h1+S?KMlRkqE^?u|>l=z|9 z9`J+s(K3B@FBuW^R9)7CF0=pI2|>+FR7gW%C9^mfVHviTGbYj~I~~g957=(7IQ8Y+ zrvPx=C8yRDA%=o~6=QA&3M@f3*$FT6g@9MD(l^VYs6t^Hn1E=TWBf4_Oi=m7BgW~G_**BB_x zWF^0Xpxi8Zr|$LW_wexFg9ChsF?zXGI~Jc4`ezX1CQbg=P>hCRDw;ePr(S^c|I;Yo zBSRIE(++j#@4@*l1Kx@L%ig}+8gJ|5jKnhdJ@DCjqo0pg6%gC#a;$H6ZSBF$s9WNs zFPHE!nw6=bPpz;HY4lC~JixY7XRzkI4TWTG%=^uF9((4(4I(2ggc)Dimy@YJ2~kb! zFmSV4oR|}=xwW5vQQK{_7Y6mPXPG~~6uWP|ooxKGh#5-$#-BMd1YoTbQ8M{roFEr8FaXVeyZVgkAxk*E7cnb!pOar#`<_UJ8!Jl}kK^6l-lUcqXUf8_36-<$h0@G>@0 z^7)+OX!;#z{kL(@7w%;oF!ws{@oxJ)!w|>r{wr!PS)6Xw!8znvlrf8n9R#)+P0RHP zYF;HvxO_aq(TGS%zC}St<)dbIThBK$QJc_=N*vXeHj7?_SX1h0^-}6Uxy_Fsf zKOJp7zc8}(iz2$$?{f5}D=L?0+Pmz1#xv8^Q7b}jpaU@d{4J9g+;xx0k@w|L3(~*= zgdOm~%{}#H?>h zt2-{Cn1!KCa%-?KtXmOGleX8`MOIZgtV<>?9u%~7!pRq|Ykcaka=UaImit;f`+ir& z8hCk_Yx~PG@dS1D`K9;ep-Z$b=xAlC8_f<%| zoY!EEp)*GQ2F8{q4}iOm&s-WBP?|qJ308bE=@-y&lx7moumkDmv1iiJ(c8h5R`F4s zSmsD?=#E+<=sl$`F|TlJDR`VPs;%m!=Tm=4-#iIrO(R)DreP+&^!cA%_R zq%u}pn>K)(RC3=E+UM-{2H)n>s-V4*|_8Go!Wwi zNSrgyY)|*B718TvShLC5_6JdJO1$n-AFJ|KUQi& z{BJDov~AGPH!t-ao$0rxRj&gI7S3xpwQxn!ytppNc~P3*P%ibCG1T}$C9dzYq87% z+o0lyEgawbu4C73e3-5W)!c|@4l}TL9(yUCSudm~0$}|s>*kKMz^zAPKu9IG{;rlHwL`=*<}HQ@YEI;iQ{3}lG!MY3A! z>TpqyligWmE}k0>eY>zris766sF~j@IwzfUEt-U3B?Bsm5x-q;8>YAx61#*Oq zw)P-h{n==4q@2qVna((FTk#Rz7wbKh|CLCJe_8Q~R3XQaX5fz}-A#(UxZY z&|{kZ%upUs7OdU!h$L7o;5~=Ysk_Wvct^J0tMBxD*3aEJ%O)p22jvdbycJC=J*$kj zrZ7z|x#;T->R)_opj>yAdu^}nG1P31;GiQggcO3CAn71wM}aP$hhVf4@m4UwPg{IQ zq7+P;M2L`pkyoT7@X#MC9A6NjC*m!s4-?5!AN+)$L_=sW(8w48*Vy|1EsCi1B76W3zkKWU9f`~cKj3*&$BpR4Wb96)J8;+#-|ez$ z^?{rJz`oYF=Lfv9n5_nlL*D#22N7#X*C(P^Mg(EO=kcr4u?_{D^|*3u>TdFwt-hAR zKXgCoG>XeoY1~#MX2s%!s@1udj`TL5Wp=5LPIqiT38JKuWIdRmsn#Uaz^Y zOtsw;RpBiRVH&HHeA(fNa_1_E-OCS(8P4JjDs^fe<$d$mZk9_#?d?t9L{>^5-)U_F z*XF@Onk4Nd&2G(wKLrB5A~49Q2;`0m4oO3VzZnC@V1U+A-S?O+w^3lti= z*5rag=4R7op%=xJ)>iWBnr`ydNL97c)0ubp9BGUi)-c&Q&8i|VqV4s-7D_!o_pe8F zj-?9O*8Nf!p6;%fm-;92V1&zK?((Gt#aaV$2ro}F-pE$wQ>acvFuF%u9^aX7ZU18%0n0Hy@nd52Zz~?zJ{k7E6W4-?%igeh-j{cUfn+!P;Dft-$7KU zA3&`T4J-j_k6S< z%?0hKLL$V@M4@!Hx@Le$Y?jN5>_|yac$Zl4WH%e3vgbdtcL{Rn}2^Op>6fJU<*(4k=q%L(E zNu(2Gv!l6ENSx<5N48MuiOw{=MN5|S3yzLtPDnEw^vSF(8JI*M7p5_~%NL?3@*qVi zUm#F?hu^`1CnNKyte!XdId5LlXI&GaFpO5^qYH-C<}+=Xn?+;73ce^MPmWbb?)V45 zC%C&Df<4Z>Ros0@t=GuZCOc}GH#8q!8)W32Ehx=lV8rylz`aSJj2Wmw+Wk&@qAmxSUb#u3<;))DCT|s z?oB8DDTZDKSx{?_L?nrXLXMWB63a{TvOoUJ-ET?9hgZykN05)$kG_PjPIr1q#P73l zOh<{*iXf({?OWO?|2(}wDm;w1U{QUEgYRh8#&_)BkA7705URxP1!$F%=fzWJC%qLq z47el!Mz<41e+}QXsofCsOeOG<09Nu5Ytor0rx;eM5A3BQ_7ay46yn0Abje~0b= zR`IF-mU~=mYLvo7|44#JLe9MKNBIYDN*;V~!?$?{k0eInMJMyoFcsm34F2t)c})GYt1>wiB*3-!+T8fr2aLJu zS*f0q`0sI@SfartQJ)fe1@j6*+H?1;h4S6v*v*BiL0tjnFtP9)pNF`Ihwegq@7~^e zKk9;?jE;EJ~jb2Gh@HI0U{>{GC~&w_&$#?;+|n*5wPaDdb2_TkVAR!YV{b6TtY@t^37*d14nvQwtX3S zBOr1v7&(sN!E`yQl>5|*cqKQ%qA_FC0{%T6$p=qs<>NF4qJxVG5ETO+XW+{8x5;r^ z=1dXbAd`ABkrO`maikfJ^rsS%we01{I}YFrp_+4eF@-i)xlNhS-y$^-e^79NS^I2~ zvU&I};DF@r$df!}Cz|c}2{dfGS!pgFX@fb%=5x)!OTv zBJJpyBA;MG1L9Cy4I%Mu)qcVrCgQY*hZ8&2NCvjtLRm^VHKq@x!an%WYK7p>GAKB| z8;-8YFMxQKVZ^~5jbagq(9H|YyM33N6fMfYapp?eaCnFCRExxU;pHK<_?V!PLK(SX zqk}}tC=L5NLbYXDH9)Ge$t3}Iz8fhGSdpv@vh<}|PH3B<| z1P%_xtVJB9Oe5|@%8&>jEAGHL3>5J45&8}#o{usL378!QuPZOJY8{>D#RtyXh$H10 zN*YthCZ6FYD1 zLPOPkRBWrJHC_w}djLx+i|93k{GJ$GcCV33etyI^l~k4({mFUdt&srY7zTY_HvJ>& z5&~dAkRhv#37s81^0f$+u7R0*Z4`dFAbvFiQMS7%POehVPK&Al4Ik2Mzl8HNvvHxT zg6eAYfeO>Z`R%x@I8WvQ$M0awJgTOcoI6$ORVb4v84v>~GR5&B>6T|=JQ&z-YX#aK zW1!o>1e!b}x#f@v9-$yFizj>Z@_QaC0<(p`D-W?Bsend}QT)tPf-~gVxzy(wj+c@M znX5e#j5Ake1TDcz> ztX#S=IZM$w*kL(7bi(SPV2bRI+5wLo4P@#MMGoodzBt>~?g}afg zRvD@;-{hPR@;iJVnM7~Qm7E`|O3dqTWS5Z#B|*9V%*+*sodw#(NE9c` zcqr57+WTNpXE*oFrGa0L$PT*{kx4B&CdQ{TMKP~iTW2$D?jRI9EzvpKAJBytHesk^ z;5MW>_=t|F7|k!V4S9}B?1z-G&tl%L!Lvkp)tl*a;OWdgWS2>BH{%<{@8jeJ$XuRn zj|^dAQ6E7E8HRP{m~}NZH3u3&@1V6SBqV{&rvH; za}vkqYu}+}BbEcJV}R%NqKca{bPj3?S@t*cfPra<<{6K*(Gk~^wmAMzlP_h~zQj96 z`y~P`FP8g#QvwGkFIOkNuY|A7A4@g_h5?)>xvgfeZ-#Haa9Hes zW3KoSwstnU`qR1^f-3dwno@|@Wj@>3E#EsjdpnLBZTDnRem(RT( zEXi+nl+5}bD?CJvM=R21|FNmv^?-V2Sw!d<%cNJwDLNuRi&)+ZdG->1{#aSq&%_B6z^50 zFzc%+e-$h4I78MD`X43xK9LXA9vc2#∈tIn6(mFw{HEwK+r?{3+OBsdhb7{kKk9 zm9#vun%=Qiww?nyP+ax+!+z3~@d6O8;0RKpFTrLXsT+6DNjl9yUs~2JpCn4v108Ry z>Ni!y&Fq*2?;{mMBe$AOZf4MVT`uNEa9&FfOPiv(SlR=D2XfG+D!r>algis-{;#-~ zBX*hX8H6Z&oYz`>o?dPO*TthScFy+E0jyt37?7H#^0n3-Mee6xI^b&=X;mB*DO46` z*29ye6Iavt@I`P6wsS7|%<>dpH$&lJqq{gWE4iErvrnjO6CdOTR9SXcHd@&xq-5`( z!4t^y7jqDkFe|w#_`_+k1;^#bHF>6Z&AVQLpyCuMbBHzXdnO<3+M3kY*fMaLt={th z!PY4mLLLI?J#vav@UxYm)FgYE+ovZQ!&sUVW`einDQlMVgx}PaSc>;25fpmare6Sw| z%d+FgUn8%CSlZ4UrLWyg9Tr8hY6`8y#wg?wUE;DvGb?aK(|B}lX~z2}6c<14)W*A1 z@~83Xa4>I99yJyBnjIo*C|%Kv&rPtAhD{Xi>%L|3O0C8Gz~KNcbCsaBDy&Mcqfz2k zT+9zjS^U0iusA4ZdiZ3@WD)C2O`)RBbZdaQ>UmN3w5-hgQjfKcFGrUNHBH8B@;o@x zvKYLj9)^;KgW6`tVr+UGt5;Q@O@ zlic{3eHcA8n1iuQ3pJq}*rQzR1vY_ZulL*;ah6qg*+&@g-l+CAKSNhr=23)?;*P;< zT?vl)C-!xCjC|VE{V3>aR;M`}5)U6MeX|VF^iIb5qUng;3O{>D&-rYTtk^gR?w!qC z+nc3CaBcfRied;E{2(!7Jq_P;8uFroBtv16iqgn*tf8W%2~}^La0$Un*Z8%rqQVz5 zD!ra?;r>pi2JnTVJ<)BroYJq|LGUw>Geu#TFU;``E>Rp#4d_QvEP-&pO-f&4l0%d0 zUlx=ry2<<3%G*fn&bWT`am_%t^W?}K;rCh`X$Aqzl6|Xv37}IqEHEo=LA9GAZm3*G$m2qECEE}fBG%(74*8foQ|LZGwFue9ELm3hg~qthAHxzV_NGup%E z)W0ghZMv;GFf}B<>&}SpO}pzf z6+D_=>HeU%CEU->_jl`aH@&m)Fj$$}$H;F zFZYl*@9WV_f@_*gPwuY=8CPeLirca@IOyrq9_MWb4SpXO5f{VkS^*f0nO=eto@{@*D=nuVT!eDy`UTI8Tz! z8q)hjzOs*bHkeWGa|^^-31zskri}g>A5Xr=9CT^+{jTdK;3#vFf1kc%Hj?8A%j(6n z=Q4ly>KvZ1m8wk7@Z8Euz{_5}#iE$5w9}TgK>GGeF(4(%2!YcQI&_GDdAsn`yp~L4 z*0{`gDVZa;`29Lqsgm257O#qP{iu64bZYoA-QCO$B&^U8iH-Pix&7;Ej2{7-dmaE} zJCf*@EA19uJpYZkL&scWVh|BS=_k0U^4PzS^*Srdp2nuW@{-{o#nVoHMwa()u+!#I z>?;5J8d;t;wvy(&7X9A48WQxVfcQU9zV%TRl7eGEmN+5x74kj#-@@jPYkrogIiD8w z=&9y>Ty*Rocsdf-O}7L)D<2{|bSE^AYlCtc7f^I1C4PgqJlb=CjPpJCcDO8TFmi6v z=PSgt%|r`pFHJE))e#pw?d$%T>>G(`vhP4UA1LkqYGn?6F)WP8GY#$|Ly|A7?&00O zSJu|ufV3gpq?(Sa-E{4Lt@NRI_4GP2z-D)P2B{i$oywb`*D(-S+1)@F`7o}DYPgBro?yOkP^ z3)$sQ4KfIEpJ!U$fT1bqF_@HxzPr+B{nCDhD&b}iHb(n7xqNzIES#i7tXE6kY&g0x z@(57xbzxw7ee2xk7vQH|{o!i2=MfP;=5J4FkI~iHt?tI0pIiD2>-%04!MxG~PJC^p zxSk|5@M7J%ZVn^obNH9ADXOrac6JfFJ1BSvijIX2JU{L((DFbQ?8g;Ie3CGem4t#s zaWgvvL?aj_gb{&BET7PI*;DKa7`=FRbnkd66BjP&Zddhg zqi)>ouTJ$U&fD&pF!JK6Tp_0x!C~!ho4h(;UTNsCpWD#BNin5l71(heE$iMJ-C;r8 z-@zPgeLb%nKrIw{X#7C>c-Tujq~o-;vCS1z?Z+Ek(8VCVt)v^O-lMd|0vqmx&wh7t zhbi}A7D9U83M9Y&NQ-1>USDBmGRpBizy}YqCv4s= zrTIk#1Ov$)`mqu}wA6AFP=hzw;RKRN5eH0c3aUiqr58Gm1Rg9g+amUuN|J_eN06t< zm_3q3RxuyRB)Gv6N>V2Y4S5tMBm+|4J!DoUPq@-eB&2u<_@0l9Tpf^QB9gZn$NY`4 zWdG3}`(i@$gZalT58%i`ngu#02mD;mRwaGjy!`R)?O5CCRRnS@>sib9gF*`|lb*bO zz}D@j5JSwv+xnM}8;Dogq!U55t4I8hi39?nC0B8vphJkWNbwv|4=ice)>48nNQ;In`!*j`obVXClB0H0caT%#*7&V*v zDH=_`+6WuX+9ej&`3O_u8bN z_)C|sbzpN?nvu3?u%N59qIC(?p%R^1)#w24+&LZrYi)ZD-e{EuE)W$qgAB(Cn6DJB z7T)RTXO7M}+cQhHfj`2Dze4qPqLn3z5ZxR#EG z67k2l1fdwB?@KB~6?3Q*CspZ1ap^^WNAiA{^l|Xz%DB?cx4BvEBR3K9)^dheN?P%6 z0T6hUwfy`drZJ&-oB>%I`alffknHd9y8NmeIXwBkUm;?Nk?~K44f7;v@AvB{hcPSO zG#nzHgSa4nxI;RTOCmX01=#8-o1Y7iKrcxVWVo@3q|Pj9t9Z4#>k5X{q3ZIY$xj1Z z`&nCDx2-t@>|>*#%+%Ilc}`}+&Fa?WUr4o@N3QP&GZ^O=lQ#TbsXn}CKj1~ma<$sp z=$-Z&5J}Ud{n=r)I66_)?mX8%62z&_*OMoVmtR64i7rv>ht$44dO2few4WH;sL|OY zcHo;YYP`*T*=|?AT^nE&2);4(8f7?3J2yD?w9fUp=xry0fr4`NmRq?2=g_W7%HHG5 zcSonP+@yBJ8UH4)Eye59+!emVF}6IJ&slNK!lY z<@R=K(O+(L39Fwg!a9^g#S&MpTqhxe7)-G%wgtP&@c1<8?sQ*&DP^ ziUxJ}x;r`Fmz0fwCD(%^?^&YmeGwUlh@h57%dW1liJPvjZn+cJJ2R8x{#ID?T@;{L zV36;gaSBL%hySJvs;(B0BsTXK?;l-_n=3rGwD&OB&P^~nHr>rKo^{_B>ZJ}l2yl)? zht1V6T7%*n9@8Rw-iUY%&**2ocdD^(T=grDP0ipq9<+pS`sihG2EB5I@8g}4b}Ar5 zh2*ZToRIHhXsqhi?3`R;Ta@EZ5KZYUCMZ#V|iuz+K;OlTnW*_7;bpJ;vQZ>a=mAHi5g0X%GU7OAwlQ;ki9sFS!-4% zfnZNYMP1gKvmoSf(&zB=$6l5r>l260U~IK9Y|D+4f~m#)XZ3f}_&xyMYu24+qmkPV zU?b_)9V=l3WN{G8J~-^EJ@<1;FeCDj)8>Nain|#^=!fFU`314YCJO7o{u}8f$TgRC z?+AzG)!nEbxCsbR#rV0jH7di!$%*R{FH9%SgKLN#LNTeDl;0)Gs0*X&c2uzieg81-V;F?6=>78JgqV-U zX>Eu!BYC*)P7j78KD`1UaD8}#N&7L*Cu)+dA9jpLhF^x59`lkm$8l+-D=f@+V>`FQ z-n)FFRf+ptyjQP7y!YN{ zdU5y(vjvq(f(jq>9@WP7}JeQ>aIGLk^6dZrkqVVtUv?@qp{(mF=?VEAc^RJ&% zvgjU;awv@Sha_K``j;lmE%^-9oPLG{x1x_dgK4j@Nf4$I(jLM4lmZ7+>CNxi?}gf z``Vqa>hWLlqp2fPU`}43_QD5(ejV1G_5Qow#{1pHULpoTVc;nC04$gz;7ay%$B_xX zCg45WetRraqr@5sj8HpgI6KziF&XQ1{_f(=xb z5pVadTZ1be7|7<>uWYGXv0K0mxZCK>+(S0##N2znyhPx8-GAm-={0vN&$K1~d0>mB z&=-1sW?9ZUu`eusLlZCCAujY?K9<$Rt+<>UzMJStp109eOf`Nm#+n%hl1wlUrC(aK z6vktR$fJPJ{;r6{=vRISLADb@uZ^?u?dME1pL|zHz`0;TKB;MTk&GsPLQhJ93JiY; zNFhjC3ce)U`FfECJKVTG9lg>sY9Gg6?mIiQs9IcD0rh zvpbmsn78NN4D6^+>$tg>ZDHS+ zi#J2^diT)fpH$wUo7_uU{ZXHO-q+}l9jV49bH4cAAzj~Esst4AOP0_OUpH*$0vS?; z9cqM;bH9CIhYePH*@LXPw0!Osl$wcSHY?GVv%jQzCP{@K=meFOf(#)5y z`tEgP+=pW~>$Se#MnRoTf};C*7cax4^GG|NP~0P9kQhtJe8$MCiYPSqbrAI}X7+F6 zdtWAZy&P7<(ao8Rd z*i#`&D+gb!vu!d-@OgV6)7w*2K8jDE$ER6~(r?tIS(U zKLg476kM}QZuTb(EV^6QeG07ZbdA+5aL=Hzv{h%-iPqKz&!OFRJK*IZ#88{K=Je}S zoFcl-`u!JB`)+2`*|`4cWKTH3I}PPQyCqbFi(~r_pL<`girUC8=ho1jBWrY&ebi{u z^o<8tv%8|NZ9&;!CI`C8@tUyQ*R@z_zO!T+$Y6Jxe?z1)u^-t48d0#4C4Z2ukEQvQ z{4aW5KJ8$o6JXKYi}V+v-sAp6rT5sN&LB7xmYv>8rW|3TS*GT5I<>i583#P>Hnm&f8=aCU4{?!Wo2U~6ghH)s8u z!VZWAqDVCWL*bOx*8F$=)PnN(w~!*!xAWqDCQKEYlgnl48^eji=LBy z%g_Hg*%>goO)tO{oU9OzPy7$RztD+^k(O38$oUMX<7xAn&wujqzw0IiPddhChj(EE10lIVD=pnek+2=5wE=L`Nic=M357PfyK){(tO!byQSc|F4Q-APrIyA}LaW zbPCdfgrKB=Gy~ENBGTO*(ujc4k}A?AAstG0_b|*ogQ7Eo&wZbJ*YA(J)_vEWHFIXp zIeYJKeZH~JoKrVxa(+>Ow}vULw7#ho`<+hMNa{*m&+^i?2}zaX^`y6ur7$D=<&HtK z7vHJKA-W0!*Cb~JGE?F%aG8q1 z{?{YpojUjRIw~0tuC|>djpLg|Y!8Tm=Yrh?kIFE`YipeB4rd_VT5>_-{CXpk@wQ@P z3cOlSOY6OZx=wF#!K1Aid&NdYTlI0?)VgRg6xA|N9`y_I?FO@2JVNy>l&hO^`zql0 zc{j`?$a5WWz+$ysjiGjeTY*p=@mkAXA3X&Zy-`3a|oFIoPOcFI7acS+K@$NWpH%<#K zjzMe|UaeWPAGOs(EmpCi+gs#gZY!hK`Q9FKbt{i%tAse|Q`*lohm03N|1ELoqaC1P{NB)GjX_Wo>$U`zL;1 z-s@}`3wMIr?UO?k+@o9$wB86R?s0N?LEh(IVh${9)GA=USm(@@R7YDRcf5|%A~X^pRQZkFV}!Pz1zPxDwrUr{CIfTd(?m1>m0$($EYiM$FU6G2Qvds{F~JV7kA^YJZ7;) zE7bZA3=)%$^qfZe3k)2}YQ~98_un$gft$(Wd-pqhs+)Oab_*q&Iq_Lf{LI2?=Z5mR z#%Fa6!5zhkb)fmC-Z`?kon7q3nD#P~FcfiA>o&1QQ|mT;klIK#=|$%>Dl;CwqGyl$ ze-M!-S+vMdQw-qy#fg~$5Je{+K_>-37S4TN0I@(KFOI(rUGs~3`wZ;_{7;~HNdL@n z{iTEvtHiXd==e~}`?!8Etozx~bdZbeq%W{zI~~u)ZbSZWpbDZF<;S>C%4gS#AwPp^ zcKa~_o5{G8Vr3L@^(76?f!j@(1aH5hbF`+1n7!*l=XgwCtf|H8=<$H{{<0WtFDmo9 zeT)mEj-U_C(vAsXN#kHo7Ae6YTV^fORVhI!F+K+|-zO?G`XKFd!f6m50#>6vvr1j# zy}q@)A7EdvRdjW-6tvi;FX?Ep#7r?v&$>NjRtyz2nw0A3D?%g*?vxmL9RGOF*gfr| zJi#51=EnRz8WlM*;GLA;7@Ykgh-`i?G>9w@gpnoV|tpnY;4XU zdgVQNpewv@r3=`{Tt#4Vseh{Vjc`P7r?fbsddw*ht|%~!ywdO+@!vA}efAKOA23-Y zADicI0*J(z-^cO#6;p?mDAH6JjixOwe<<)QKkFMkW!4glWkYlKGQ;peS{?w+eMPba zcU*?uj%nrpu+{4+BPIA|D=mNTWsv7v3H|eAoMXn2I=~SMJ&GlsQ}5YeUT%r|Qra7uUtw4vrG>OmU@Fvn&*s zhLeoFhvW;O%>o<4HoFsBTeU$q!##8Cs-U;Hw|48=&V!8zuMgGMuonbC=pBDRcem!F z_Z`d+E9@M0^&iUV3)+uF>Ezj^G~j-iE8VTmP2gg@#f@I$ZvDElz^Ya6In}N5-1io5 zjZ_k+!SYqf3Cm8SkT1ivYyC@Z7GLu}1sj%u;-qB)ODP>MF)_S-V#%CKfELTQ)PFTW zh8*Lggn2S5CM}sg7Y(NO)9h`N21k8Yj_>W65n|3&-ivy!vB4X=b$o)a@J+`{*7nDn zX4|JWuhkknf9}W=q&Xm4wYn+}ZW!mJk?3yP#3@S7l#d_^rvb<2Dd5)A4DIrFf?0Sg z6`)Q})I=f!h-q@3_4ye@nvyylmL z33!$5lw^}soQW9q11=|deet}1atKpsuYYX^4+(4CnW!t021Rw3<{MI8XkYRge{q#x z_)6O)1>YZn7#GDctqA52#@Ahx$^Lz3Ih`EZ;3EsfW z0`6;)6Y(mb^DGfzGsR@u0!H&lVi@t;4{LlyL^0T5m+2_hNS54RIY zOf#nix`87(?VVfii@G@;xK7);};tl4p8i245~2Na#| z9Gv`~TyGgy^#m!=?+sz^2`f7YM z^C9G`oYqq9+UIA2d@`SP7b8{XyW%LR2LmJ=(q9KJPB!aLm2htb7furBL#G)S9*gi2 zFV#xqb@-u#rxye*bqW_IS@pCxEs7H#aLs1gOl`l+v4TuN-Z`0FEa~ZSE?wNNtE>yJ zD-#S1@=;>PI$`BC z#?-ME;=+a5m3|A-q^%>ii!$ODf?!skfrsLAH%MFsoUN=2 zH9O@zyaF7ZJLML$8ydm$UHr9urkjM7eGB{X$#VM2{DrgT&I3s%a={DxB;*AKsMsX8 z#Af{h&BA-g>Z{F^J)Mj5?MExmIuhkkKZuG{sR)SYMNhg~slr^D=4kMBuYw74Ankq; z>a9>v_?uOZVvF;6RjD>}@07o08McxyUl$XQW>|NAs8o_8Gewt1Tj*N7 zNz%pS3*Wow(7nz~qOg6Ai3tt4kuviM{A8HI$&sggeY@=QfEB z>JSg8X{GGzO@VDMXAzOw&ZO%AGyDn5}Pl*rUuhV1XFVxqMAYe3o8E zJo!y(!4mTfPs2OwHZ_};MFEN6UA(h$;JZPajCa%fj!2&R? zP(;e*h`EgBxh*=uepR!Z493AAhmxqwrl)lnKCbSxOp9tdGrOdv_E(9%y!Ocy;xSC+ zB-yUt>+Bzm?}~Tc(qlRQLoa;rUPkPK>4e#wQo{x!ui8v3`Py88ImL zqMV!ocn%1=SGZG^Bt65QPEc_jHPW!%=Lu(iZfPR2TiE>8y@${KB>K919(sE`Z)zt` zr_$PPyAH#>o#x!P(QlEFS(UlbBx%4~9PnmiXT$g__=0`e4%61KQ(0Uw&T2DVSy?Dy z?XmG0inzSo{gH;o*T$kyfG~6*47O?$Muqn$*K8sEohDi_$Y)mJa=G~&SqHj)TaUPd*{*~P?AUQ)Gr#^L3C1cEEx`&%BMU2mul`)!D@9G6cnHsFSS90|!0$QSMX-&^8<9&1q|}ydmL{A+8<}`Q7_?qm&Ys9v}j9 z-?A@iFu{;iWke#?7nD;uJj1s?Wivf&$ka}OQ?8Ss9>zI>fUg^2zX~nfGGelzS+<%| zU`cWWum6}yZ@RXlAJ9fgL_WTEEP2>?L2FSzr4zku6(_j0o{HNT6D03i_ z!WT|H|3jw$oBYCy6vwbXCV(|?6Mrz|XHN^>)8T^Jn|+vrdrC*nMMK)S+J;`_jpV|@?OeTkUis_N z9|4}4vJn*p+z(0IyFl>J*?wzM&OC@ykxo>d&e>~%{*s4$i2r@8hIb2ix_k?Pqpn6q z#)>tj(mJ(infD=xwopYI@ufVKZ zRI==j!2G+jL<72oQ6gA^TOo@QA5kt~N>mA4jlZ&zMnUSQO{f?LY8_hM+R`qKjW?+o zX=nG}Y@45#gUADStw{@d)SadY4R@I;Gs#tW-)1szvdHtD)3AAd-i=h822F9*9{R{~ zZq+;X@=gy6SFxLmktPvXaqBbGoPxCZ`T5D!Cv`Q1(ESQ0HplSbnyX%JVS6;U*ykeb zs$cuw1EPFXb8n9Vx9XEM-wNR)&G)KH2M2m~ zy%$z)Jnz7&VEuakJ>fOY8!5b(3trr!wzmV~xV$K@b!oh?08Y_VIRj(d@Ro#a;OeT) z;L+jMuDaS$esQdz;s0dxsY;8nci*l2xami36hec<^n@X;#xq;I7 zo|P5Zy6ZD>h=h1|ndW{lXdY4YGm~n9HDi_^9?cE3+PNsQ8$Se{c056g?qwdWV-C#8 zOQbRVsKKGP79oy6VYB2(>gJ4#L#?PbTm5v3Q&gyr1#-!r4htcvTYIOu_&#p`47t-b=i9uzVeVS(6KzycW_4+pNm@nMVawZ!I*m2UuT9(Dy^j`e&^l*i|gSPRBT7CFR{epW+ zX#1rlDwM$+I>fx^3uoN@4BT49y$N^m__P#+qKap zca@s6wZo+J^X!$I``$OYf#;_nm2O38KeqUSx0ip`=R1zrtrAEFQMD#mSj?B!w4vME z&2r4k>W7~@CkSW)ceSq9T*}LW)IkU=Y>QVNyuFhMUL8p@p9OOP7vBy&)_+njBpqwr z+I}%p0P5iIZR6g<{V(4duDxtxeKT|CV2_^FU z18(1Xt*Yyj#JO5wWuDF2DY_%$c>!O2=cS}!a%k%p3p{divK8?k>;8~6F4vOe8mTnM zTBP0Kts>*Gg*vDJe_}#EH_>Pksm9nA(>WCO{X_Y}pEZs)+j)qbj#UMAyrN03HevP1 zZt9$&pfh$nq>g|&9I~gkbg^+}Zf|YRkbgEV`+*4gtU9jwml?V{zVCfLkjJGFfNR{W ztCA0d*-<*z>iyX_`mM~~#YTZ8fFnn~uQL*0L+0nf>j#rJe6z4}W;(si;u(Ex4ztL( zuJd*|Za**?iEAuVFdWhyy6JImHOFs5(XA>#V9YE6vnvK`e>tW+s5z4{oV@3$Pwz$= zEeVz1eJ8=e>YhcngTb2Ru!z-lww*MYqxZwL<>`zw&0Y}~NPIoxQv? zsRV11J3ArFL7E55!QqoGn;V|B~7A|~) z0aYB{NAk9ZpO2)Ce+&TQh`)5E(rc5O)l@dXw zGDb{lEK)uGW{DyOsZZ``aBfVd_7L&9?UVArN*HNXL+u)ged=#aZRyo?ci+CQ8k)l+ zsQ84QA#S)*!5Jm({#ItA^2fq1UW~13BVkmKL$0jD=*9W&7E89XKnW@y;zh^Whb6 z1zWDd0E4GXq_b`Q)i16Y?^LdUdDc;=V;_e3qR)`XGl`X1vYI(5Sm-T~73hGN6w}%E z&(U%=*fPhr5p%VB^b=j>^;oQeh6t^7Zfws5>D^-;;#0%qwQos@U`SN?3Kh+dgZpqI!hl z{=6ta55j67a;tF0H4bdXm5o(ICF81cu2m!|a;luV3xT%i4xAMU zaTd`j`M^~H7V{r6GXBj~0S|ODf#(j=;|^uGKajy$oOlM@<>);%Ea9P+q=QTBd5`n1 zYz=R^S>;q9Za1Pv44+SO;$obV!2i}H{#%pyUCjD#P2zXP`rn$we`^x|R5&E5;lQAntiw?E&DDpU=N~dh-0M)Z^!0d0w}^HQZI_5uR!N z^+|VFW@j65&(gQV4%gXuknurN@uN{eL6GXj#L6g}-PNKQ8D~$nU+^Lb-6Y=J{{v7?b@I9 zklpQ=`Si}}=)*8HLhjagV}+O9J+q3HtLm&~L6cfCagXbhRB*-CHNOw~@~r7&<7RQJ zKDc6`60^RTn=tWF>`VJ4wq`W~6(Tw7W@2X12~FJ$d{ zfxj1tS2OV9Z}GAXJb!vF`&QS}+Z4;>7dvZim+h*B4j!fSRKM#SFrOCZQoa5S8Wr5| zd10+%Ckrj0Q*He~hl`D>_MP0fq8YW&!26$yIh(uI*=Hlkv?b8IdEeZc)@NVZ7JN`+ zynzz8!#RC%EH$^?Rp<4)mKfS-G(8V>EOfnG^$?6!=WlObJf6wCi|$zXJ<}vS5i9e? zt0yKKZX-{XoC@g~!~ASZgKeYY3(2mpO@Ln55i@Ukd3Tnae=VAH(s1>c-Zr822vN%Y zYMmFjr$779htdMAjF-|p3|s5>z5*A7eavVi)l&VQH>7_b@UxRuFs{Q*h3q$EOf zVJ4OnZ_F66wjK$@nV+*~NFSQ&ve1nhaj)un;!G-1Q5=-pT%~ykc zEH(@CN?jOVgC=_Y6s4yme>eP16lxrYlg89UPar1a%LlZoQEZ1NZ%DIFcF7{{%Bfwi z7Czbc=M&^#b^EJj-fy;8ws>MI9@AxRCz`|@Nc*eJzKXNd{u0p;4m2lYy>8dqXiF!@ z>6v>Rq|+BGpeY+D-0|deYL*`k#SGSMu3F@Q*c+%xWFHkfE5{%DKmN>B_enk%HjF?wFk!Iz3! zFkwCYIw}U07Al5`_9~~#$bC7BH1V3D(O$37*<*&ln8IgpU-O!&v%C_rsGP7Jh6283 zU-E)fXC9%4d3hxK;R$SOIsScRC?8}0tuUBE(1y->CBW!!GMR7E1D=8*f0w*tLGXI! zS$nI9J~u8jbbB_sWL9~Iw_a)Kq<2-~lg^>XMZk6#SCbekSXwJ|`^_u2u`|78Hm+A<$m}SHL2U>{ zyBbA2p*n2%P#omEZ>!i=RH#Gsf$Bp|C6~}!t``$${7~pHQefROgm*VEw|z_hHO2!e zHCB3hu4;U?K(yED7qajZYz4WN_k+%7MH6jkkj*}szbwfl$+X+pF&czodiZ5@H@ySz z;=}7gun9hpicgFnu73H&eeAeznvA~69~`n$!6XW_v3HFPh@^#>-Zc-l0{=^E?x2Zp zUZ{KE|J7bJBklY-glL1JSPda26k<6@V={+z>-F=|5I`Yr@gXC%tolA^VTAG z5_2^OQ|oAFC2O~lM2c|oLdv#hdQK`;0CqFRoRj{f|7!hUDX%p95Kv_*qOx6e1@}Lp ztRxTfr{Y1Y5bh7IVv!U`x?mKdXP~*eH1T?8ipdh^dH1|a#e=rNkO%61zDDv64 zSq`{w*7)urB>hl1u-*0N-wH`+Me>(K0P|6wbwE zipI!s#r2hDlfdLb!2r&{cZEA3xJr+u_o+{xr;~60A`yMNq|E{P|YsYyS zR#cN!5ZaQce#X6`H7UDIBH^DbWD!G<+ z(&?GcM>5M?)zB2%1fI&tUb*Xo78Pw+jfH!8p49Oh9smGN20c2Si@wujFG;egD6gL) zgKQpG$u9^V+ojyV%Zjp8Oc)Bpp_i?;vM?4581+$PzB|Pmpjfbl(1qG$Z@d;R{t}%` z9!tsR-fsJomS+r>YWev+^w1A>vj z0g&*6z3KYk^NO~RRg1d$TY@kkUwKRoxT;IqrFUhQ%@3b@JQdeA_RPW0j5>A>;SFF- z_N33f3T9UnE9EJHtAm+kNDqQu-S^(8wTcc{1S@!PoM_*IF#K-w0`z?fpek?8XF{MT431U85 zI7Up3uiDL=B0aa8|5|#xgE#4o48W^d=bw^3#%SS>iF^qKIh=;!lPdH&81Lu=MWwze83b&er3Z}9(L$mG=R z03Z`(AYM+ng7BJc>M(Phd;GR-$YjgvlWntcx$5esc(1DoIEr*E-#_M8XQ6Ak^zgRt ziR^BdJZ%UXZFc7DUE0@9lf=|0PcrC=taKnr8 ze_mx@tuM^5t-bq)l&(M=HtygWJEFCEruKHpBzQ79(hRHCM{DH06tEW?*!p>}N7}*4 zrZnM)Pt2`Ldl>tAktDF+?cU=2J_6`&;(K<@=AllZ^6KaO(z=qUu7R8=^t4{btapq3 zzQ@D;>~NXxCf}KF@%u0B?_Ux1mJl~cuzP@hON=pa7Pwa980-R#V`er6&TH4*%Y{Hrn0@w40giNwC&uZ0DB8(NV0-@H@GF! z<%nUe^TJ(NW^jB=85=S4I!R4`F$7!sc<0YUVDGDyJ@)an=Ol3CkXixAw`~1(U6?&` zW0bC9=`#B@F(W>>sf~3Q@(GUEzjQj8_OH*X)%%n5R(=t~UQI$}TX|0?N4xv4!ruenxvHPqKXT7%T$jU z2_v|_v_UaImDRXD8$Zo;O8?DMN#mkxI=#}%hNXI@6bTn;Am|^2VJgsgYrPdWAV7Pk zaX`){>F(rhvAfCJ9tW%2b=fuOlO;ZJov0R%p@Z*^io#p*O$2y9_-2-Nb`N#RhI#e5 zFlUz@+-2pys#58-*sprk*dAv&Z+W!Q@J#B*-&nr1bd2R5uj>4)ISy+RhsHQ2I@=6c z`_}Z?i$0+z9YI>X+AYq4&ljG1GAqoX9`^A){)bY^(DYUcHFM>`keeJ5!OJott@hd5 z&4xs{ppV(BE*b_d)g^r&f#COnfN#6o) z$)8{1!fRT&B`xOjVvN*%CT=n1l@~8s%zx}m@R4RNfoW@s-;jNXv&hGyLe2ED^s<^V zLZP(FN7v`B`kkdiO(7Io9DNA%ls;sV5vX}~Rmk9LLORg5!tu{(R$&v}F#N`W;#g4?Fv!;ilb-U?pcqk9A3jLfJNn$uhjmxhu zapCN=MzW4m3B7aFOBmLu?UJxxO2*L3EMy&feR!HP$}p5ev+Ii~yYNu(YG-aOlkS$F^cC<}v1)i%clt z9#Idb&(C69sVj!?mqf}15^quq!XA@3zPTH|q4t0iJpcXsvtClO>)|S;kY?+FYUhKA zq~I1v$MR!e+v|D#ctJES5J-28E=KFo52r4FzWOzl&2F>i9w#NM>K4cf@7n{A z^@R$^dr8g`{-Fm<*5rPoA!s1vH zwW)m?BX-??I!Wo4+^^P&&JV-GNLrwk@!sm>l&oun4v`n7Zy>fB!AJsqZHnXLV8_nB zOoFA*E#W{LCXFN@WDY&vhJCjZmixe>BQ-4vwB?`{w4#Uezk5sgs>l=&qu>B*m1!H! zxN}>cCq&^o!s->r6EpW#(u^^zS3a5LWw=?2++q&2-u{QPl6>#w@SQY*Etr2e?tW|~ zyXs5-%YUeiXvQ>1MZ?HCChZj>Y4&2j>kUYCrOx09I8I(bnxo6fG;;WmCc?tT<9y?9 zqfrA-3pr`CuYMLOVDcO$4V}FxeEZiaNZh{>8I9VKM)|k?NFxpSwBG;b2Q30W_yp1K z{C$cTIefTu8o!kdUM_Y@nsZqd2lxIa7~WgV7$uCqYjBql>TI3qzCi;&bwYBQ`!y_w z$vD;uTk+}r&=pRY;v6fF2%_>hPr}sbXZw(Xc$)i(<|rkR!08S!#|Z|tKh;6RG8p;& zmZ-mq8sKAtRQf;hv0Id(^rzY?ILOYy3U$Z4s~VMeaK)oN*`wgVgt$*zzgUOiZ=#`& zB=`r_w^K@5)l+>RdBTu;hzwz49FY2z407K|N4(;(BMRqrIf_{PxFYj2ekN?`Xed7LHFZd3MY4~ z6CMiym6N$iS`+d&UPZJh%0B!11gj`~B5|MmgAU68yM9@GCz1{mo^+SP$BAG|RsU$x zq>;1nR44O8!p4vmf0RExBJ!|`rRN{f3JYAZ|4$Yuqj>Y57)-D)=Bso9>qtO6!4mP? zi&zQE!tnc8$(Dnf*piYZ{%(R2(-(aI$Qd3c0Qe?m2=zPJ3BL=l&Z&&w*rJpKuO7g@ z7_pj@vyk^C6+HZH)Fg05?Jb(*`x8rG#K9BBo4(O4;m!Ovnt@$1>7utz3>V3yX&%_r z#-7XrarQ~%=TA;Lg#^OHCs1_?<2++^j-4LtTr)U~AXRW^md0tJe2&W zM|H#y2}kfml;KTCmWej;`1L9x05m2xVD+?IW5XAOVHPyf2`wn?$Nv)6GJZ8 zdIC2(oz&wme!Ni=f<_pNY#&M*Zm4usK*M&x!V;Qbh2=BO>pQrr|Un zsY@eYIAS`BI6fCjl69U~rqcmR%2-cu((<2veJV2)u^Q@nO+TICS-PT^VQRqPnPQwt z_loz+!F!$OpT?BQc?5;qXP*t5Ap1!! zLnvr)Wn;o5Z)~7He|r68DQH%bB`oHJ1oLpYJIYPw`{*p^T)JrscF^Z93oL{yYf)Yd z3(}p&BVy^fWFxh)@->9%x)^=j_vXV0`;^Fm9lu@%MJTqR(plDFZ(`H{;Gg!`xyz!G zEtf_JD460k#U78leF-zN+&a)@jd_{X94F*|&NJaUSuSuN!!K_1MsLw?`{9X90#B@l z$T`d!jNaTxbK%C7(Hs0t6VA6SFY4WXsh%k_>buGMzFFc;GoennF>XC=EIWu}YCs(e z+vr)QguQz@qxewFt~4?QmJohfUnz4-lyAgrzK@f5VKik?Jn0)NdFMG^I)gu} zBPzYC{_F>QZIuM$*19DZSzkx6w7Y(=8E?Dfa}VA0zOjyYKkjM_@yLK%shdox_o%>f ze)^wP5{$C`;p_JNAPe%$<<*=#=LHuJ_{4DcAX#6K^m;--MO{}W=Z}0-aCo`s?#8^o zlK^lB$1=N2m9i^*c!FEsm`h6i1Vm#|6IVQ48eAEYuP1R(aE#*w(P#ikW9*E@IukB? zT;`9uCr3H`S^{?k28FoIMaRZ0+{-w77UFGZRU-!ySZM`cmToEiN*^(>qpdmAq&p*d z2Y7Q`IEUNchKOrtVl986BH1{Mcu{Ho5by4TW?6JWkuEJ9T2>=JF1M=eL3IY^vNzY{ z7^_J%WS951X~;`QAmafEgr3*h4d0u&LML7cUTgn&G!R7iv1K)9d*vBN91pd>ypKT- zw!e79w9$oa&gz~3L2E)4ZwpRK!hVdqPVNK?booIOCvRxpni_)-b;MSBCusJf-z0s|&o$!NmvINsB0D>Nh3ii~zkpuZ zD7hOSiXBQm^7_ft6QjNYPyWR&35ML)PNu+(9y1wDpb#~oVciB$wup)iwYLE?)*^ky z&9pn4d=`|lU#^YC1T@+QL^s*5X7g$DHR%3+Rbh78qfD}r!Cs(yifZ<{cYtk8%E{PV zz2k$1UuBlAH9P~htJoVBnRjV_{;XToV`7YEE(7aITDM9Sqb8c;S2wWE#u|0_oU%fO z-NjI8$B4K2M@ru_9GvMCDj((FAFTgI5Z#%~x0kV;MU->2eYjC^gJ8B&Zn-~>pY~=0 z3CBL4Ay(~u-cnnG>mVhZ8eTJQI_|G_I)^81LwF|pBKN}io21+ero<6x`c=!te(Qw6 z>r>gy4}w&K96ijpx40L0#-E$5UAFAyES)U3YjDS{YXtKIXa#7Men*`o09rI3_rk>0 z7FajN+{Q3MhF`6ZG2>wt$R&@@78P`K3~v?{1Z53^i+YZdNhy;@Ytai@c6ZIp$Dy-9 z;N8{S9I%TZ*s{FF&S~5LUz2J^V1H$4u#8~W)qcCLe0OqsGdG?*cscl9js573BIcR= zc#F@WO|vTfpaHMf(DhCC_#)5rQub{Ydk8qTom`f;4VCOBf`T8~33lhgt{(~<>(S9-0)|sxAa>xJH#RZ=_w)H8a zP4x3=m|beCm~+)dzU$F-4M~Frf{?Yn3CmqU4e0dIN}&LEt^NAc#(Z#rg4eF#{=_E( z%vy)NU2nIeVHIF&YweSpD`c*=#?d|{cGg3%4I1QEv=|%V)XBW6F?*lf1+u$1GUwJd zYvrcix$tCOB!1RSAYWRezp-v`a&uFgD_Pco7wRafGOnSSkO-BhCF6~*0*_XXRhre! z<2E(Mbk^t!L8N_o*N?2rK22-YI`zu~T5*(Lgu(fxI`OufvrD7P=D|_rqVm}G8{cuw z{b=Z}&Mx?9>s#*Pc>T~~?Px7@`rF|2CoAREs$DHl_oCI+BgesBeoh>$L&!qTXUb)v`rs?1%-BXDV)$TeJ`75r{a78VW@LHmab zLc1%B(In7PeDAn;)fS6>BJ+tHw<4k+l?NV#+BKW~Rny{~i+e^yjXU!L!)vwiA}Vxl z@7(8oDyN6YcRDN%L}FXLRc2CUpxGAOkA?+wRBu--+Ix z&t#1LVCrCV1!id)Bn8EmQ(I_L!eqZ*i8VwayInWTS8yC))_(FD3@FRL$h>aw+vZ`m ztjOG?23X9W7jyi&6cJ;S2j8EUw0D*8w+nyz7uFP*3Iut=9pO=B+QfjrL4o<_)qSI& zgAMK+vMD{0F|OZpgl%Z@Ol^NsZVI{R@cT6wQkGr$6mEvn22~0wzDPrw!030B z9}&PG1I+L?GGA5vmKEVg-?&jAd*Kf&fL*|R=^LQ*y+gJp;teY6n5l(`!kl|mj zu(z*Uudk+yXw8j ziH85uo|11L{xj(W|3Z5_to}3U`8de(8xVvSGBfFhaz@E-YXdgs15^&U5a)bnim^x( zPIXx|IVK}@pm=|b&7;b?NiDJu=6z3IfPNF@;vkpc)gpbU~58#4XK}qQ&W!Uy9d`%hRE2P zg_rO^leli{20U>GUi73JeuZf89XmJWo&p*YM4QME(Tq(|#=4%2J@h=K?%C-iCJQ0bI(x8GP;n>t4*?vN@o9HWW^SkKK98yM?hYU3E zwskz6N8c{|Q36)Lc9xIy@58Ya2B7$Q2nAEQ&&CXFCtV9HPbGwjWaAS&~-CbhUz@cHQo*@@peWn0%65U2oXr>lhbLap9a zsw&9xvv`GIN!Cp!;T{M|2y>Bk$fj=lpZ$%IKO1tia>~`}Jyb&3>E_5XC7}Ef})acv`~a29aGYbEYZh^DhK$RsVQWCgV&Gb z+Hy1yh*-5==3Xb6GqiLn=&u|8ajkFbEG%hsJkr@swsRYSPR&*)>@NyB?;MT|?ys;_ zjvpw4&6o3z5VA=>2z)jP@zS-~hdfCvkekzft_cT~I1fz-|{&L9w0}f+_%dxPHZY z5#Rg}`mt^zIpxMldEt6Fj+!6C$CfZRu4+dCA6f%0x_trJMfcJm$`supw-8x>K(?7g zaDxH;FiM#qO&JMyy8-*RK~{N2M31Z|qWJ`oECA6J+7SW-Js_r8N`}W`KhNn zp28_OGJj}$7T&>NI+Vc2gvb8Z0v@nnVWP>mSbca(2SYe>PbE*{h;RgG92%U+kM-+K zX%tdOvxt!o?-T*&Uw=gZpZRqP^f~Mhcq$F_vxD5vzX%Zi6~B}ah61L1nqTezf?v6a z0mI*--{O`3k?2<{_ASDcVQKata+QPK7;BPFaAk5hGkjFsJYa8L5kN;PWI{!WEg1 zh6ajv0T$@~vop@iL+tsgLs7RXoJ3(snMXH5I0aM+9wDdi^rQbV z#271YLmUd-0V%!#d`tbmz{-n=z6GczL?BPc=(LYwI2E1$hs<~E^03te=hv>O9nAvo zvO30qd6aUHuFBS7{fgk~Q8~1^(}{bt-)(Pczq)91)WEiOJ8x%vNDWftpUcdYEa|KuuC2)xa*WTvbYBB8W8r_V;p*4!aHf07PdBO(JI{RUW0qQDgav< z0M-VSxEB=S{3s=jC5=x&7RV6eRnV}J^V3q)mvFHiU|AMSh+Mwvut*nrQjCQ;)97~l z44G3^CF_%Mj(dZ_@)N|cnq;E|(J9P_^dtS!{I^KpUrFnfrT-sG3s&Rn{uiFj>J(7p z!XYKu6bz^nkn1{=h}jH4xwz8}cvAAzGd8fp-o4S>_|l{{EU zUIqAv6MO;$#P`{!O6eWQzx4Z~FvFh(Ah*n^V^EO`@Fa*e0KoV(6EzUhaG>%tfsD$a z2n3S_LeD241aA#kgfIvx4mceF;UQMa_Cx-n1GkWM0LjnsOnuWswkr|?gz3SETJnTP zkiV9*Kp_Zc{f(%+Q$gI;>H4y1@@K?6Ib%Qoscb$YNeP!G69OwxElc zGhbA59uYkNjqHa9hKmjWo*+RzhC?+Ma#V2bR8%lTfgBYS4I$~)>6L(an^UET|HxwU z4WuLs;0%W}f>iGQpb}V4SBbVy9P5PO;0y`protVsyrB zjQRU*=EXySQ8um;g`K0dkzMGg#n$;;e!&viNaTGwL{T@n@L6%$pXl*q&W5{R8% z`eGs~W&lN=*3yBIqKLX1UnGU0&quxyt6$`r@A>RA6MfVhWPUG7BQ8pPG=q^wfbdRS)5Zs%s&GICu80 zfABpADHRJD^8V;CM0pTs&)C* zN$wQ~Q(4_iBBd0|!>$X&PAfe#F%!~{;-hvmy8oPy8l?v7`3jvtBYsQV`-bE(BSV3h zH+`3zT3I68g0}7lzA(RyZHtP<>1|3bG(w!}a>hbBox$tU@=a03(DX$tR%7%$N*}_K z3s{`u`2}KFoKZrr{I>3+`IuiGthq2i1f1Y3oic1&=8{tHo(q#)4DPxqI^$Iztda{) zIe=bY3=&T|zNq;_9yg3U*21M5#hJHsdantOV8s@^!LAQ34GI+W#8BK0MV@kJiDrOVyIHNmNcGo`;~ zaWmqr$oE$NOML7X@L3lKn*+U~Bt5Skc?0iZEur-*j49>ECxy^`**=`Wggj+5aJItfFfOIv!7z}yM6Am1OK~j{h-@3F&X$0qhlf9<9esfgm<>#(*TD>Y^)Zz^@QRwBeE-cek5BUvR;m z+zTEavNag|pl3lXwnE_ox$Ihibj*JKN0o zzDwvuUufi`*X|-hKGNyKQik-xq91h)8HKZ7u@!T0DAf_kYXJuH%18HEbvy6w-j!9E zomHo&{J$>=D)H~ECTC988m-c3-zmFrIAJp^SJFNlpJzX7s|+4H!<;t4TDDSYwyJEq zQW-uoV7Foo?if9y=XchXt=SzxC98`sW#NTg|5I&jg_;p9iW_mBT3GTSPQ>{P(D{t} zu#KPJIdCGPXy`6Wy$nmC0zT9(ONsMy8KTH}9Dk*CyLy3I*a*6nc>MMFAP@~*`>&&c zkK)J__A4i6zwB0i8Rm&`vKRQ)edp4jonkM$Z=Ve1k{~=E(q2AE0@3wjU$uc&^M4(2 zEX&{ZVI!$bon^L#I_x$=C~uTVTuEu~sQhj!##Z&(HFFnJ$rsV_FH&QvUceea5{MFk zme`bMD9%6G1W?T;Z1kH==Q9EUwrQ0AWJ7l&QN-=r5DLonYf;*&j}I0Fi{Dx2qDe2J zr|=s_l;7tKax%E?%s9JVgEcmhC&F)7AX|B4y-H;|wX_?ZRksZJ5uLTO1pR?yBsN#) z&NipDe5DNPEkeL0>S{Sv7itck_8Ww#VIMr7%Z#T4VK~#SVlQ!A^GJeh)lK@hjzX;= z(O^aJR`{krfgDrv(cT7*E&2cUqO8My@7;}<#;>Erp#<$5W2Eu+LoyT%V&- zpaMc8kfZ3}DKjB^ht*~~gU*`j^4KF7YvYc<`&7Nffa-?tO&bY6?XpBEQ;lcR>NKKMdx$?1Po(yi`B`qNuQ zyLq3=m-c>%p)k^9i+(yeDPG;xsnc+wN^i7sErP&M$x~D6@o1dV+oqU=VZ-!pD}jCc)Ef^(8Cra9c1dRDowHmR8QnS4UTWeo+wRUJ`n7T^f7pwYyZE17V{XqnRl8KW)jnl@f+IWoFHNEnq1tClu6WC(!fu)Q%U9oA zCbxnX;`jCUWYfE~c%sUP3$p`7iv-7!(Z$*B5JqC~i|p>H?o!g1_=i=U_jn$-&9PmY zoH%%Z;YB2we`X>s-1&IH^_EAXiDa>Pr|~#r4&6(qrgk{ZS!No$r$x{_lzbnPouy$Q zW%;K-=W&j2Z;NQ=yOW!D4;Lpe?+PG)ds}TNeUKfXK^WBE#(r0ku=1Y#b+=XchuRa% z-v+~UY8r5|tc(Y)Jk&HuG`Yn0eY5~F{cfwEk{EFR<#$PZcFkZ2cH|Isf=kMs^_YPS zq&sP@o`_!l3iz(dqwIeQgO?u?j4u#F-r0}&JAh2)vwB*C8HDnD%@6QjiY6CUue-1^ zDMiBcUG0I`Bba%HXb|jPz)urY;LE=%z-0B5grv$gFSH=rEM|tU7FV0>pJm)5rmu*>GFg>I>n`$zgx@~mW+lb2VbNa>N znjya!Kb1F=Mf~17yk|~qJiGFGvE#{whw}8*^wr-dF@0B5>!JMjKfy2HO6^V`ENLjb z#Z`*`jP|9qN3jb-;VtIhF$)To9M4-{nIO0YKaS|tgAiMgv?LyDVCdedX~2(2ULeeZ zH3Nv`J%f22lDv{flES!quL~lDUsk}+>S03egJrG(>;o9bQXlhh#|@5j`pNrYM2Ip? znhD(F0TDl!hZ!U$+xLA~HKcHwPoFZxPrLaH{!1S36Wo&pu)Ia)Bi0IFRMIYiXma0q z-fb(4P7#nj3Cz0qE9NotnDt#!Fq6EPwOdkmx`TM_p-xD>hht5>vj#$mT@Sc|swzs04dq2|@_2Cb?SR2Od=X`TGmP&#yYM*vJ$WU9g9&0 zD!?l}R*T(e0DDV(TVSfPUb=A%dLC26g?oo*MBphTA#4|rR`T7=`f4!iOCeKdum>-Y z>w?lDGZsbe!#>Sdrv$gAK$q*J?h(XHWbn_!&gW< zdBd?%41$rDp}18Cw$A{G8&eT$D1tZ-R#@jIfLy^x`ul>?DLyo+IPbAOQgC95_NsPP((&1W_~F@#N7UB*SWksEsT-qG9*o zRfgbhtLJd^QD}mX%|IlE{}Kqs8DMezfu63z3(fT1^jSA->Svcg1h77Eq~mu7=J$Rm z7XZ96e>}hcToS3B8&5$>S_!^8O82#RUIB(<4|4OXu$N|s*I&Q^gA5Xo2z==CqlG{; zNct=*P8uI-HX{q1VEo;0$tqaPwtCAaFgY}1J3J+%eoZ|fpJ~e0T(;wadSLKaw0zPF z1)US5;xbFAiWV2&vDQs}uj%{l2+G$>)o5hNx(Fr(TIG5;K2wY4&|AgNOwtIsTO41+ zadBdkqfY~qqpfmJ-1??x7T0s091%U$bJmo9Y|w)vLRv02g2l1itmo6kXzyt6p*vhv z?mMb@UHs>I4sEqF>*1DV7fT9kh<(dZ!dKN4O_k`!wPozqx*Cn&_eCpSSeN6h6Pq`? zsrNPbn(QNWoq@37=mcMvQ7}aG!ane}=^59TZBcua*T0FZ0Df-mdtIw9?De;KPm&qe zuIh6AQz5lJzi+*&Ono+*gYAgR3CErcHrYYi@pmshhF)vX)i5}9$xfc}ZHYc$yI~~D ztFT;HX!pM8tS6od1x7s_m%wG3rsu-8bZO=K)v}ZC08zNAcz1|+(ROV+A|oNVyIE>9 zdR9WHod5YXOVb|lLa(Ig*QS2P2}klv7+ChFmH%~xdK{4Q4n3>2;#yzfsZHK2^ehIn z(LM;(zmea`6f>B#L>?nb6}b-|yqF^%+D z>PNtyk!@5;`8_caRg%%cg69XWnBHvwSGj_Dsr8N5`RRI>pYo4BJ_KgQ!m=d<+|Y}1 z!#^s{h12?7SLw+ZIN)5QwZ~(qmVxDPK=f=@fz}a^NH31Ck2F#={I+hBT1Tv+YT1tN zy6rI&`&N)4TAEo_wg-?_Sjb~v^o3k6uX3XvKFesXF(#HHleNy4m#EoUwx*Xqcv+;i z?(OYO(b9a;*M^u_dT67iA3tZVKW(-rSc_WfqLJx<_}k!Jo`p#}Y@@2mYwb2Ro#Gd| z$_~~zptRcyJWeK+uBl$5QNkK9S-=lRj7SH-zk}aod79|^UbC?D`bP&^Zt$}$DpyJ` z>asC9^pJAc#TYBB|IFzM2uUu z3Ff#Fshr47b;(u&L-Svr{L|SS5K>08+}Bj=>NmhhY;b)NS|qAF^06YxW%#d)Lq$&= z=H~h`U+X?L%DL0E>y4!T=B`1`%6!qT4$ph64jZkWbT4htMX;(}$!g)=dtHdCAb)UG zY2uYhjw>ek%Ef{L!^O7b?#Yj!FtKjFM(lz5RQ=Sz=S~}P$7=x#85)yCM^{4At(&7w z@e}5yxv?(yCtKt!CRJ(b>T|BhDS8gy(mmLxVYtzni=-Gr?Qp2g_X7Q|l-EDEAEg97 z61u4je))a(b>)95O#Z1jPPe-DRr~g(Ki_f69zS}rUS{`r42NjWwW7l(>4W4R-jVSF zU)buSe2Vht4)6*3AdxLWT1&qy{at_Tr1;dElPeb-TOJ9qk83p2NYXCdD`M`zRxr{Z zCtqB-{`J=2QSLtyO893RW<&$aDFMoJe0{nGALZoTI?H2TJb3)^dG(*$ z^jEOM?%B+Ud5BO|4*9QhlzUhz_t3JP9`o6Y_~);((BocyV2ho*RYmq~ULGlJOOVO( z7Xe9?PllfQbmRNft}BZW071UfG88jWiQ`9ezO4@+QpBV4#xF4>t4iGX{b|8H1_qZV zMfto1@9xLi*ah0TC;$6Q2IY3dFRYOEy7I);P0RNO!-UW9V&+l${U04ki`k13sf)uU z&Go~TC0nPyR4MmV+VoWNlY6B-r1fQ^3}mBd$6JNGq}iu;#~&ISJf_lf!88uH#f`j5poFXusm(cy+!zO~g6Tm&GpLflhj!gh1U6*YRGRbB6x= zqr^Y7SZ-e&eix^|+F)(jO$vC$@{T+QK(KI<$z~~CEOM5fEE<0r86=%TSm^F z440CY;q)5qy_-L8DA3!NRdO?VRA!(seez5#|6=ns^{aW#Bo~q&^{QU#i|Iz^1%|~W zroPrCI|Qwt@3l;}TAXRh^3QZ$7_*PCdwKtM!;X9`q=lXTT)Or`=VDIne6Ebkc;8Hv z^z6ip)#R`n!R{*I3v;A>^DI$e&xMwj`A+GKnR%P^!Hc=+E!*0(NAe=8qb5Tcrb)G< z%Z1Ov9Be~Z@69zxw3QJ##)+1`Lc^l#If`P2+D1y-Z(2o3XB`r1uDeN2_j~!W;S9OK z#ChcNIB9a`N^`%8q=8ZHoJy-fW`c?H{8(RB-hjd87R8vlHkPr>LjhN(qzEl@xqSAL zbkhxml9@9Lc1{ZupFfk|vX4$z?;L6p1)wIwU7Rvj|Hw37Qg|sN?HkxG;Z~;WHZfEb ze34l?G2gDxUNdyP@mgA`a+d(}3|;T}v%_rhGX8nnhhCR#5UXqWobD&qmNi;x;=E8v zcY)WJmoCZbapK-I30o&i;Ryh*kyqwA7ZuMavzX`RN*FOSZgdLx%XOB;bvja}i@JwX zhAJ#){-kf`jdTEvkTW?A>ZB3_nK2RKZ7 zi&PU6{BET^rI{i0R{|#|`MpMfqXW;1!?v`aI>JZXcLLXs13D`F6s7iUSgEB;E8kc= zJ9Uc$cbzmhK85>jjWmfXgkY5l(f&<0Kq|+Qj|d;~H1V zTtq%1wobIfJ6q6KjfmYKREf_v+p-Oltp!z>VFS_F(#H@wf+_)5*DBpnS{;fhgQrv_ zhix@jp)W@VC<7Lx!Ox0@kW-A=W2Mx7H#Zuu&=gb{f>LJvaC2;JFev8KyaSWeI2gV{ zfJ+wl06{hm`RL~b&AWzwHE_<+pmV* z1h^ZbO0YR@fGfSGCD@4=LRaqi;Rpfv8tS5Tw7t$^t1@D;FTGDt-3|5lqQZg24Op_XdOzWo*x^w)fN&^c{DLK{ z8awNMSC6(ZAN@c$PzuAV`xC;EqVw;<(M}D!T8!|VQYC62fsZ>3udV_ts_82rR zMRwL#aS|`yaZ2|QW zIrW{!VS@c=PJ+lPAWvg%{}lGK;5nrueAJ(&fmKn!JCDo6IUtCfWmTGRaWKaDbGEoRTQFYw9?cYeU- z0MqN;%&o@D_9f-MbY57>0+wnF5W7Q2G#O$oE@pW(1BciWMu!!RsAxW?n-*Oe_Wh!5 zod8;wGha^?Oc_fg3W5p@%Ij!IY$O$>bs5vV40^^Jet}irZZ>aB&<4o&5M3xStlI}7 zKXd!NSYra94Nk!e^)t+O{$H6-l!ypa3SLqHszQtr4p9kslVz|oF8T!aFCX5+T>nG`^AS-%;>Z4;f7jI~kS9iTb?PBFBtl$=pAZ+#blCnN#yTtn zG1jGcYe-8lzXB^+KO|0JM&`7!G!R!%*?U(s5l)9`Bf-D9Fy7G85@O(>-HI7;cIx0b zuOQF3Ca}4={^v=B8E5n7@k}-gi36;^pcHdKv^FNoDp9U4Hpw&tz~r* zPpqGcZiIhAD?sL&m0Z6Iwtkhr!&gfBVAk(P!kaE6ri{b)>jRC+{}Cs@K+hhBy?TE4 zf7drP2xI>j9UA)Y93UBhZ~#6r3(yW|{o&NfaX1z%MbfZAXKg!hwPWI)r#f-r!t||l z2G~nxMP#Z8&bes^L2h2N4lgd80nOX*VDCnBUmRrHhz&=u#sWa`*5ef<$Ob^sHIN|K z#cY-oh3|b4&cfod=Voi*JImvGV_6{xSpu{$s0X~5U zBC@_nHA|*Y3tk->2$) z%w;8!_;s-K-{XoL(-7R6#f9y*dZ=k|iU1|?`w{%i7$kEE zZ$l6_R`;f2)8f5%wJrX^2AqHrcch@qDsc~-P|o-h*6enOw{#TI$fIzEgoLb17%#k1 zVR#T~Al5Hv@g$`ojACc71o7eph>T&2Y_KJRWN{I%(CQ?9f8Yn3Q9;qju0r)rD8>^- zTn!{^78VBE3{k|tGqyyg3EK>9uh;h>2TJ=C9QMCJBQKbhjG5Rk;d->d7N83*p(Ndr zxMG$qM`ebYFBdj1Od2Z=j<-!%znjYC+$Rf=D{S>w$v8S5YDpdTc3S7`V0leMJ#d3w z7hkzA-Hbd@wYJeUG8t20FO6HR!=vJ)RaFscfChgh`g90*~%9SWi#bA%8ksVY^t6 zk0K9kI8TZ$Pf9}c;UjCz`9+j`B%cK~_i#-r?z`-7ngV`aKV#uEPcI-M=;C)sD|Zg75zQpNT9l2tG+%VTx0y zmOm~g?_384ked=#bk0zi5~cx5px|h9{j^2WW)h09Wr^0Id6zA3 z8C!nNV^e!K^>v;t$E1R<`QH-zr;!89>h8`+9y(=@vduMqTx7-5q;nksK4KNDQWdQH z*4H%OCW7a*@vsBGn0wes2{H;(=EZc`|EaPL&ssLwjsT`-p2eJJ_5H>a=mKR@6!!d0 z8THVcOuo-G!f!GU#7qpW5d1n(~t;V@10(-Uz20*~9&reC@d7S@(Imyf-#SzQpP-zdVoSXGh?6A7VG(AZj3dt9B*Y} z*)GR0kis;>6JQ_P??^o#y+eERmdWzl3Dg5|)HWpQfkMEM(QiCA&G0;9{l09THS6W} zU8d#tqUQhS#(w*C4=>2>Njmb7I#5`_T<)6DBhe#4)LdhVXG9eoV-y`@8kZTy{My4Jkj8g zd@~3hr1(axaLRcuAvx-rSOv?h^1ry>ygE=}FI8bLT*0nsT6zR5mOo(8Ey`Co)%>~@JrJHPX=`ltsu`DS&u$# zp10vf;|bAvS31^{d=3;T*{3Mk4_Gc1CvNS{=1Xzru3)#3ixn1}6lQ zHu~LX{Pf!TlQ&M}Ez0sO+7Bc$G;bbindDe0+cTStb&@fV&dVf(Js7kqnkwi|i*n?B z+iwznS*5UynAGqr$YK*+WB6p|Vsox{OCo2?WbGR(d^MiMp(!l3G>hA*h%c!lbp<8e z9q-%?>s>?j58>KRJklbEwYad*#GDS& zL_v}Q*}?uy{mc2rBYI9Yu8{#5(Iaa)ykp28I7+5h)wZ$PkX?dBzc7Kqv5JM`7auRz z?JX70*;eHnihL3Cp%j(bl8ZDzRo*IQ$>o}}-gaN*V6yY3K$8s{4EJ_Uk8|q0Pp*3? znR@9wUzsY+p`n~BU#br(&MDv8kRg4-+T!5m{YTd*f!ES_pf>M3U%>aWvxrA2-)qK>U#ATM{|d(IK;*m#(Vu{-DWx;>s(W(qIGo3 z*)ZQ6<(d(8zEx2@THSjexl?-6wSCO8G7@9GA^ml$DgWP5)AC&1+p;#Kz4ldE?rTQg zf-|SjmbuQfjTCeaxn(Yt%s+OSc{g2flQ%@&&6%(+E5LcAHQBpGa&9(XW^ph9{N^~- zDwF3rW@soS$@EEt?8T%qu;8ELoXwTZMSI@QZSqUfuL4n75pGCf*{Y)d@o*%*+t|9Y z$=Y`Dij}IeT-|{Ef?|cg^!rooU#uT<71f#TwWOlPm6VSQ<5SUM+lelJ#wq9WJA@ap7OSJWW?HG8 zu9Uj57vJi}WO5c;JAVrwuo!7j2;aXZx6ZfBZKiF&HoE)uIQzEy>~s0lV})5=l@dw3%D-0EzXfYSBL(!MWG-@wBYm2O8(rJvmreVVb)|%Mk<$R z4wD_ly)CMu{J+(mOHi9@&VIa9H+De{BpzwKvtuG@lRX(3K67y_znh=?*z4X8U&!E1 z&kAW^h`-#NZvpUb=q?MF4-UO6+h-8GPwFcasRj<##>ro^sLiX%>}#0im$)^n`dNp@ z{26K^>f{J5=A}5x`O%+!+IA@l5}Y%pijg{zEZ=rxIv&3plnrcPc#%o2B3Ff#X@-bf z@u<5P$x6SG9G94Vy{T}M3D^$sIDmQ8wd&3rF}>NS%lxLX{8oT9^{Bt=e(>)UAp9ku z1nH`WB8pO5tv3if4LJMMD7y5zK_o-{_OBCdHo2~C_N{U(oBuN9=r>C6mb~?>%HX@* z>HNnUb#I*Ed(#!d?OQ^_Q|+!W(jau+e6sLU;SMT;Z6gbcv1{_S$}&N(dx<&KqjYDL z+0zerWIX5M>@@4MA9MecN%r1g%KJ@S`o(`iTl!q2$M(=vgUmy3s}JvtGp`kW+1bkW;5esKq{u}LaR;uX zWr(D)!)qSOinM!d@nL;g5WsRVZGVW-)%OEcRQn}T1C3HGFBN+WN~9X<9XhGLozdE2 zvFW}9-Q}uP^)!++-G=H0B%3p@)k51MQddrBqU$kUKKUjEzKv-isCyLu|*JIt%KiIVV0ppDb^fC+kn@ zi++Ap?-Fpv&9||VJ*>lUR}0O4*USd4&OF!2q!@q#Jghn8UNX?@p*ev zVs`(=ZY$zk$)eNqSr@mNzUuK|J)8OT*~z?Y@hnNP(=CMIy!C6awYRqSUe69%dIC*Z z1J0AHYOK529ahBHBJFb3CR^et&px#f+qusL{lt#(gN~mCx=QjceO_=#W;T?`nHdtu z>Ry;N^%2)|HxTXqq?W=v9M&S*>A^hu1NB(4rQ5CHhWo=X+PwRvVFzhe^rM15(2v7& zb)yOFBPC;bVU;I$9ej4}VnkNyny-41jobcj6EV3Vzsc$72Ah&{HpwfUgRiGU0KSmT zp*|5UDk&>V*2hdYOVy_7?LKJPvP_H-PZeFtu@|+NzL&^W%eIWq%8Fjo+flTnZ4Y*98ZE*s;5kj=X7IfI3e4AZn zlox-#&`6sxd?Cng&n9fmoMTPXdZ5a{kaKH>t2mn_p{y=DIqtPBE?)q4!b%Z>sv6V=A&*g$@C5KiYI6@*Zd9#jxg;m4i6B`Pt3 zEA{+AIb+z9Ex77Mu&a(T1!#1`=JPqy2C^z1|WhSiLNQKi>m?&ws?nX6LK?XF9y^~Ak=wShu?ET zYK7HmBe&#T^WT|1=_r-WZh2Of^A*Lh#sEo{+|OIczfd+D5iu;CJez2hx>(cP7p1S~ za%Fn%YuFxLYgi^gWVODMJ6q+NSZ5=q)kmIft34buWx-X?E4p>{n{>F8^#nmQL4lje%V;EH!4m%$dq7wiA zvI1hLaAo7eFMSA6MXrYL?q1b<_rI~d!uUeU9bl#K+luVunOOJ=?k;p>puAZi*mqh& zDP9?X)kIm@05QFdh^lrGft91mbG(HFf>eqK60|)I`fLzE%7u3hnol5iuRM>}ML^g} zZ(&Pmz}z`haXYi1oc}Y-O9@En1!P9K$Xa-N1Gb5I@#SFvM;$4>5E6&gawzh6Iu@|K z$w3r;Mgwf0XU@SBM_s?LP*g%-+Z%?E6xD-BF)ysCHxX{a8%iW(i%A>VRzHapM?+2< zV9HYb$^hdhjZz2k+GY^8=rcp;^%^e$6qg$*-Rg(0G^d2ZwI4r_5~Lo@r2e+S z%NxvRez9z*-6rMse6}o0X2^{^YVdJxoKxD#b$Gye@_v(*OTv8mgx2D~=f0Z&CzxZd zVxn?m!2-6)Ju?6KNSyc-Hh0uE+a8>MTh@ioYyZkCgItw-=YHp7^{&GNv*HG|gs+v4 z6ff1R2&>e9<9Hlzo#_ZU_1hr}{vL-8&c(7Bkjho|D7@*+A7qEp)MI7c*Bv>HY!zM_Sh#wk=*!=Ez%k`5hVf`7`%L@W?Bw9AZi@I~MIljq*p4%!7 zt`c=bnmmwJk+8K$fRT(RyL5-@9fU0s@$3br$$^;2oG{o15YXTOT2T-x;Ij?D-iXfP z5>KGGvWCDw#KPf;SNf}w=TyHBs4 zmy{p!W9iL2WNRgtX?eYoRk(uH;zqW7kBgBRZ6D1Jh!ipDcsaM!^wTXm{z{Fcu%?)M{Tj6kVoW@Qp$}lFNlFw z`^l&Ixo%ESJ8|1L>2Zsm=wOHlQS$I>EK|9;rnIlc3cL}pCrFF zKuXZzX<$+qw|fx-i=>xVMc{>Jij+Y%s)0dnHYzO*B3i-5OgB-ipDwpHKodL+k3E2f zzql{3?S!ALK0iNsw~wS&V4z8WuaJ3ce_Zji6!{s#jg2Z!=TD0(dOeg9+^f&+8hIqY zqFBkse+@# zdq~h>AnU0I6VOj+lqqAnyLetw(el#{Ay4++Oom=RhS0c;G!;C6 zkP4yv6?U5EW9xXzTESc=z@uOH6^hqL;}vuWr%+YIlRZNoeA271DSEHm`PdAPAwMv* zLhfA#Wg75xDIukRvC*x}l4(jZ>VdC~0vhdXzyr#Po;V+S$n%9%U|<&;v*f<$cOy!q zR4|S5ml9wpq93jTgapj8l{q-A_?fLgpyDp=O7Zzi8$#ihU^GYZYme-Tpzi?^#`3p3rvK(1!` z&|!bQGaG0ecw*96Ldyd-j_AaS#uYn!iP$FJCjQ8c_>!;!*kjWA6|l#EEpMLtt$;!L z{7HFZtF+G%1qWxPO^c+0W=9kHCoCVTeNhXIc|T}-$}-(enXcvD9qmku)&tp(&-DG` zH&eT(9h|3uJwId1UH{Dd`n8d3m$p;X7MRv6v(hMgUn*QTxw+vLziXA!sKI1Q!|Kw+ z*3rUzcQh4Tqyxd$pZF}YAJb%8rF)vR5V)vfcceS zzb_%yDhljRc)^Z++Tzf$2&&VHgkLDHrDp+0dwk#HIjRBnfph{K^hmlH6`$e>L2)c%D<}SYzDswv*LC!lMIa5_wD= zN0I{g>7J>5-5(?WLOFOO@IlJ=vqh+smG=gYehw*So+N(sX_(9>esrvz<;`ofb6qr% zlg?hN_KzWVQB7Wb_4&o9Y;elP&AEQtXEp6-%j3IJg`>7Uh6OrBie9oFCPg)H(E8PUzkrmiga+#aJ(B@jNgz$d9V&Y%R*ntGoHy#7btHQNde2 z!+)%--oMjU37_(GtR(wY=4n~!k1KIfc(HfL^n%n8=oOD>-Lf)3qHgASDPTQN=q-@8IKH zkTHS*L58cJmt(V!w?a1jsP6Vt8(d$E6r}1PeL#=lo-;wAcoG(ZnNt6ZN9q7&%5b%F zKT_d4gd`83OdTgVn1DsCS*p3m_c;KUUT`C=2)4u=0NFet6=Y%>0l??g>ncM%uA)Qvh_=*}t| zaP8L}%u7w5xxlDxs3+}4ZVgF`GTA#p8ZGJf(hDD!PBk>2U=OHf4KCvly3rEHRg@$8 z#_)Zj*ADMKDo`G=RQXT{3OEWk?bQD#vz}Wia^}%8ic7ZY*NxG{f^%!I`C}0FUs{df zpj)6myp$G7Lu-3!;gLMU$bH;FR4aT(DSN+Tu^kGA(W-J?I4^Mr9}I((L$Eui)Nh!P zsR;23&64;-Q^h-i&R%xJfmDOG7#Jug{V6O!q?1tXv;ngMRTvg%_^0>~#S2OL2|j#` zpToaH@=%ES1H2++kD7qpA)xF&?vcHcggZ;%M?FKdKS7+rAQ(*L-|>p<;AQwZyrTa? z93*h#hq8HqPXxuuIN1FNawx1;_Q(cegcckw^aB{Hev#wY)*TSb#pOcn;_o%^NAnnK zHeZ6#uo9A|;rfLEd~TYK0O8620S&_o3AlnZnF~Tqs5Ar{Y=1U|D|EHJaano_hzQ)+ zUxGBatHQx?P_!7y7sD0+)%OWZ(SD>Y1u+1G6gc6q6W+f}AH$;$)q!vxqq@F=hyYH< zMEIbkoFCg_zH}xupL^3Stoo|pvx5a|?#n;^Bl4)4aDs{{B_74CCtki%_* zf{f%0P98yi9c>E3@BIN!AQM}^vxNGA_y%1lN)l4c6oxd+^P|18_y$%`EU*us-Ba<- zHb(USL$Pe!;b=hV!FXVM^0x=!jvxC$N08k()M!eo!f6n&&-WDHtjI}5r8oue>H;Z7 z(QS0Fo&%*fKNt%g@wMTr8t!>Sta)=Lj0tFP3U2t)hnqixPK3kwbfs{^*AIAWr$i?f z8lY3wz@iIjjpf5-@j+`W+!Zd`05`4g#P1h?f~gcl3!?OcPDiF8lwd0h{=d`jCmQB- z72uY1D=pYMnGfUR6B>fbO64D@z@oT5`JX>*c#mOUA*mWX+$j^OK3_XXDGyARk^BR>z`<(~<<=DHuU& zDut_6tt{ZogVkf0Hpcgm{!vvJLN*aeG4R7F2DHyuaIYE>f{;a+U-tr>_CWp1yJul1 z#~kt45olE;R7v0Z6H2HbPaL3x@CgQr5*ong0c_v@K!%Vc2_i#+Pf=EaqmG@hA4EdZ zF@gvH6&iIH!8|||faAmTt?)AJk+p||@KSeJ*(R#OydI1fB2d-iRR=e%qn?KNJB**d zUCyWXtiUe=htXKm;NNvlKax~pM(RTm@Xy3l7+Qv(2Yx)}Om`T!6^VjUe_~QU z5IwkcTNR17e!xo+n4pbC%4y zNFW@?dnZ4_2rj|9dv&1F7q2^L3C5;~{zEd4HM`-gSqXLy6z`4%M=b`-JCOuy@^xq} z6OnKOHMjXEu-L=91j5Lna8zY=0&%io+fbT-I41}kLh4gIaexyGBgtrcb-{`?0TJIs zSaBg55fJA;I47v0h(u~tP(>k&Hx8GIe}IRCcs)PBUxPtyn@`|D+W<~VdAK=@@c^$w zB62I#@yHj#0+TGo+W*1v=&FOu-B3_>aa)}81OSJiTsZVbCAc@z_|Yj5)SXkx+M+bOSblsuM7p5Q5kJQ{?&p3&<#HN&CkB9Tw%^y>~%d zL_q$__DtlzTT*^=Y+iL~dxjCm6(GSOxD|eyW+4?^_zi3q66yCN74BVlCkJHxeg-Y4 zAAvp7hs7!=+8z$!p8N+#O%eg!K^?Uk{E~xgiU6J~fKB-U*bDr`7_gUbO#^6#2qSt; zU2e?>KUamMx<(C6xAk`39&wRrRB6q((Vbkp%nBe}o?MH{{$SI(stA-L#e@GGTk}im zSC^h%#knt^>E$6afb~ERa9ON9jZLp*#VE`e-LO>*&}(btv9|@tD2HtCtd-XD;`-uA zD&Drwyp=b-c-xR=Z*k5^p7ay3qc!vy!`$pm+%D-(r@7Uq=n3BP;+cw>Mni$Owq?9B zzV7k#(3iHReEOFX;65S3^x{0)FDajNh?R*0@Djz_J__63QCKy&HS_3dP6JXoJNwi- z6%YGSwyDd^+_?$SLq1bU6ucQlMUMO>yqO+=H^cLH1OQo)D;81I$W$oSl9i)dmnK(S z!`<{eYmq1VUcd4(_*)eDYpyByI5lH-|c)AtSWEqZ352hKa$2$;U;&9 zKW>q_&Ma2KQE8Df?9QcO--;+6%T#!q=5b7in>s9BNyFc^h^4JbEUh@1{*9YQ?18zE z;?*3zJskON9kc%B4ito$=dEm?hFG4Tp{bLRYo~vH=B90tB^&c```A&(*ioHWnJy*! zV*reY+xn7uv2@@s9Lht%K391x!*%6)HjD1t+&DP2P#m!}<4w~bC*cjx{3r0{o<9KS z_-*jlVDMJ@PffJ!o0|bS{7yep$c*ter40D|BP;jcetvtn<>*qGAXn9gZFCQfe7jvfmqROb=!wTk<Y^RziWqtW_$t_i1y_@dcy1Q2irpc!ah>WAg(-GU2A_77{=41hUHqwzif3tgj~^0w z;j>9Z=*6yRdHLw^i(pEDd-S;PMgjyKFNRZcf2H?#D>1F7Vc>q%|NQk4IS2jo^7Jx;Eck}Vyp zE9W3=?P`7XG>NW0o34VVjgydF zpfeUSiVdJ9%Fh_B2iNu5*mU|>GhPYbJx!CyvmxlTT-^Jb(`w=!AE>{W9UI$xp-_(V zfbIr9)U@dp%+0)}9&~EPIocHa|OYMm<-;X=1P-htt5~vh8qDNw>D>a7Xey|CT(5rU^}p zYm+8>nlma%x%PkD_je2~=+-9DG`~;tvaeusB1c%N=Qha1Q9uADI~!gZIaE$qQkhm2 zLUlvta}>kt@J01kMo4Z`1K$sR zGSDHsAr)R=6o|UROXqrV_Tv6oT&2P9gSA%0$!wSktS{`=<_he6HxKXYnCYSaRiFEh zuP=bV0?r8A+xh))Gm$MpamQCsS-_u}%M%(quCPOeAWZ=-@DvCp&&|;Bch(J@h#c`6 zSUjBncB!|ny*1&2|5OlwLvV@hs6WsBKm~_9BgBuvxe0nyg+ZD*c>JPuz5CaDRa}d^ zY#4QIzIP#tmd$u^=EKWZ@w$(8$o5of_EZMibQlh9OCOFmw0NpYdZhvmS!kU&uMJ8r8qrdEmR^M~u=Wg<=0eA+#zQN%c+_%XZnF$~czqB%F zakFoFpT$wQIPpGjE{`#*Wip;TQWXNns-(*=++QC4E zu$J9r)7{zuGuomGp_8k}UUCQ*OvA^8iRnv~G71>Dxez(Kb8_Fd3j=I}HA4@x%nC{B z#N64Ep=~2BLZR$QhlydMrrs@gCQFCItlyk_24Nf2zs;F7IjA<(G}qp(I#v``N4DK=Tr3*T+O;mHv9V#VKNt%pk6XROrPRWn;LRXW{z4M%dcD4 z{?5H$*KAM!uW8khWyFQqfuco%BZp&wFy=X;w96YY=%)C5kZfP$CP?TOJT1=J@Z#e&c2Jz{ojL|NDNxO0{2xE+c5gk zb^itoybIfbsl1jF)3P&_!EN`(xpf_kT{gx;x;Us z9|vmtJBl|kG@te@a`^sc2*2HMwIj{5^FBlP0uW2Frh&gJGcC`*?p39kW?~G_P2i-U zy`)v{{szTzuOX#7_~KmaXzm5Jq#~)v6BwA8v~u5U^UZzd4!rS>s=)3~&Wd)hJBQI1 z8cD9aB~nM~|FLFUN-SAz39o;{x`pyPc{|b8>5s3EZt=IKu7eTfcLVMY;cwGxSQDT2 zrEqC0yC7B9OkFF(;;bn9?CSX$xrul1Ki34=Dva-_e=dU$?qNB6{HCznh`oNye zTJ*w+*Ew_8oAhGQ+mPKYYZ&}Ad`bD~o@{^6u{BvhRD)7DdX-SO$SZJ-&Rcw672`Dn z*C5m8#hGT_w+cS99a+g2S_~Rz+p5EQzt$4Ft`R+!+aJEFE zkX|U~V%`;Dxl3E;yG6~(vXw!`EVk~=#=D1vZOp==G+9ZReuq+7S;^5K9uG2V(^hXO z_S9=|vyc0@`WRKz)WSX6opjsjwo^)WE6(1jROIide^vSQPjHmy;fpbck6O>T`v~bO zbtWLdrCUCCQ(2L?`QIS$X)75))s5xNjS6)$la=)MOuvA{QeU4{S3~|vl$FJ#sgyEV_n;pNMl$(_; zCb5`rAUToi_Dv77iCK(s^ogx)9%52ld~Z4U`&4Dq=XS$9C(`kdvZ#fmWLi`|vY-pfhbXfs6N5q1n+pwJ3|3g?A&9Z=`T(_pkyquRWC9f1Y zyV^Z)nhd5gT1eYQ6_$QcQU8zmfGE+C+Ppg7FBbD>ec4*3otnp!XZJgc8^r%2V*FUc z;LPd-o*@zY@ukY!%con`g$54Db@hvu#;0TcwDgI%v zxP|kK{hj;|%~@e-&iCqqlRbR8B~7dwd>hlmGPQpld0jexKJl+9<8U1_XU|HfxcN7w zwYADm+9L|G?FE>!nX)g%pIR$Gd2yP!W>)Q!nQsfQ?uhS<-%K~MY3c2%k{x4No#si} z*7_^Q@;mZ3>W(yapfNI=SFPEwNhI%=XbYoX-_Vp!Q8RAOj$zzru+aeMI(J6!3ZXkF zktn(EHIw31ovSQgexX}>5BupIk(k=|#K+rV*ALBGJ~ZSE>d-zHFG?bHD+9)z#}t&9*+QV!axjJ^Q-EuXL)%#GtuugUPqagv8`A z8b+L$>x~o$xUv{9;Ubecw0N)~m$PZ{wt?2Jq1pb)g`R}zK`EKc0hi;$jIX&Jv!yK; z#y|BwUkWY*7aKGihthqHa{Fbs1}7;Q?Ell?vR)j2$8T1b3cYVLHVVYC z#c`h5ke0Ss^FeY!#^KZ3qFBLpw{|zKqe}F*X_;^PXHJ)`jr?utPfBye(IXX+T#q@& zKeW?GZa8xL*6+VlH0EuOSQo{kG2pLtN5RFh<6ggSuwQaHjrTDOQC!Z(x~?}7I+n#V zoI*<3ZU@t@8nS)TpfZ%Vz4z&(L>@!!-~6?IC(@L!NjqcSUc1|3%dA#Qt#82PpfQQr z!zSOJudYHh?cSvWb=;J@REQiovH7;g?_VD@(AOb#OGR#jxvG zavB=E8R9XNoEm5orCVJ1Qsy?>*CrakAw5+_X&7_T(E4d#2A;XMN1Fd~+>%VR-Z7fL|je))wULYe8=0M*)&smfK=ULUM_F0QC|s)+#J6R?1&TKQuJ0cXJ(o z>Sky3C?lD%Of*0s*JWm)%fbG(f?l}gNCCxt+(C@`w8ia!;ezp&N#OlW&Gc5=yVXfe zwkXP0eLHA2^6Npfyn2VmdirKbgVPN+ZXm1%DkRPB(+OzJubRWE0yrdZ1cj<_)?gT~e$jJ+; zckn⪕96O5k7;e0MA80LLFN0gwQYjSzF>yjxZnxWPad!8d^5%K$zTFG5p&WadH$ zaD$F0+$CNKwFlc4!{9Z}z;I%_3sVVnfyJU8tum@`leC*)iiBEK50x(MtDAU)xZ zHgFeoHPT<5itMAdBj=a6Tt>$E1ovr=zcVSu=G;L6gEqpJehA814IU%~?31TJ4e|gI z2m-O7BOn#+st~LUXmVzR838>Q!wgw<3j}ftInl`+ZE41HcL~6b3y1f??GU&c&F3&! zKq`V25?2SK$-($zlx}W#q6Se2$DhRSZUOLuRQT@WP;o9N`3DE6;P>3=2$~3op{R7o z88y{NCpn68hzJP@RhFmlG7GRMkb@>6;59Js-FRFHAT~7!wS*A-q#1PE3<4nm`T+%o zdV=pS1IGyxGo9E zl`usFBx@M%4>E{AY6l=(i61UkO6^AMVK4ye>qpB4!`}2K!&*1&|H*Oz3Ehp;)IdLo zAdHG0VuqY)MMM_RiUonRK^0i#c|6VqKrllv1H%*%9Wo4ai`8y?K>;YjM$j9(5TRg& zoP!@AP?qBHeE@kf@dTqRIv(N*mdj!%kLUU9-{#(0pa{sC2-5?rpyIuf=9X8rLv&_=1FviRfaB4M8<# zMIZ-YR+O$IVGv?**T1F8zrC56Y9C3unRIsU+}w-bM49rwzMR+W+5Ch?ZO7w)zQfB| z&t*KpI0%hM#}MwKP{>-n@^l;>od7Fp&+-J9YT}JS+XBq}M1hHEY{nMwq!wZ~su08$ z3&iZ(ASiX?Cg0IczEvHd$0PsXR7O+_SHnJ8X*KMVkq}oiOaWiO3hKEL=LHFsAaGxR zlmkT$v;+$Tfd_SA0}vOs9u^1#Lj;*75f3#4R^l-NQ-?v2`9{+&1fjSeK?hX*33R{= z#64BOi#6aU$T9g5OdWE19(t;(G=i;);42c#5Fn;Z#DYIYqMdpKrmhe|4FX6^h=-55 zZ8Lo^pdlK#s5Zgclf;0;1&FV1U3crgJjXGj#MnT}8g3d=$04x!Wm zU@Ckc9k9hv7z}y=5lm@2=!`$mBZBYEbuMOwG$S3M8lN9o7nr^a=Os~$KC%v<@Zk^$ z_iw`JU?{%Y%q6_50BDTN@-c#F9*RG&7_b|t2*Eb(fj;z{@3NNNFjqFaHavB4xWvD{ zKVQ>ua`B5~&Ag0cu3lWquy_9^Q=5oY7M8*lT>t^djyB~`g`LX{+a`L`LZP)Y8RLH( zjN4Iemm`-uRP0yPT`bC!(I3Y!wN@8EFnPZct>u}t326LB6F?jBh*mK5X0r79iBr`# zn#Gm|Hk+Ea_9q1<^=roVbCiJ7hIECN|CvhYOnTa#1)#uInCDZn$*>`(|* zdC(7zVyfXF9Pke`k=yr-Kadp^b>+zaQ_YqU_k(v5GbNqr|t*OlBGzyl)N< zU5kw5yRqhA^}|8s_a{yTTMHfDzUv>kReOIqrd-`L+EB#v%f9V@l*_F8)o`lnajep- z{QSnbgUOSr!Y4C%5>K)7xgXumY)37SK&{akSi$~0O_1Ks`1e~cl%%x-|9HalJW$@6 zhwe|^4`+Go{e4bzyz>*}K1b-GQILD;bNB9U?sLX+Z~J^y?{40lz-@U-zH#@>4h0Uu z(*MQTmB&N*eg9S}N{WO~5-ORJC3}%QYa!dnz8l%cS}BU`%ak=CJK48kijaNZ8Ogpg zmNAC$dr*DN%;&G)KVF{u+~?kN&pqdT-sjxM<1HsOrA|FF#Z$?_8-c~Dw9nI-6O-a` z{wKf}C@CAR8ht&JWBQ{XCH+>7(&8rbvbF?O_WNU=3~fnVDk^ExOX|VS&CDgiK5n;J z;K8IE%)T%Q+l2QU&lsBF%*WNUS=$L<)`2J5Rnbh{lmW=FgHUFaPB-T;?XDVaE!Up|oev$^uWc}O93CcIOuAb6*NLA?j)sa%USKw8P zk+j}bHOe#qwiJQ_iHv+3%!r1x)) zDX(8w{lVb(RYJs2ZDhtoOQHA!H=a={!#P46j2Y>Dz~$n z?Tg!fn=a`gu!27gNqXF}YuX2{zjMom?=5k^gSc7P`|E!m4Usgv?caW|^Gj}7|9_oD zS|sb*mz49l#h*%BnQcT-Xwr%FCXI|Af9RUo^h5O=SAK8rWhou3z}l>BY+%L3pT|o? z@;qL!maGrai?9iFP~0wGmlJ&fjMusNHuc}I+_GL~VX}YpzAKb>8#~Xtqng0#c6Vbs z(i_ra0v=v)dw#yS_?jI zJBkAc%bkXGFT_^yb_03<&4gRshKXA1s`Gu{NDJgpbtli-ylCrh!xP~g=QOaW8=e;d zp)e6tq`@LMO@?TpBTQU0lSaHdZt)xoiA85Wq}^B)nO{$3?o-2+*Dk& zr`EQY^Fmj*#!aEUb~SExLT`J8quw(PH|gr0W)^K`y&BCldb>8zqeW^_STS$FEF#wa z9l7rpG2x>}pXxj3U0VM>*!Rf8(nA`Dn>oA*u7oQ*40M?6Gjv-)VLsQckKxRuPaDB^ zN;~YXp)nI1v(KT<6Y7;@v)x$~fE;mmR9Ws0$(Lt{xsg>6UgDlyiJL)j_D zm~4o!fkaUAFfG$T9Nv)TDd$!`5Tx;xxUp&(L}cMy3H z8uI|@W(~iv-*TUE_cp{f2xeSTK(jx~pD{ZU;Bc;+d-MKjVTZVc!8BZ7?$7y0qzCmk zCobrI5(@j=dQsKvD)qsR@M&eR zvF862zdt7kbSj7xwXd>0jq>sQycwfMhSwzgQ|>XDrSidNS*4*+qxs`_D;Q(Xb}Xem zus8RStCvAdmI<%$R2!(3T#~-Xt89Z`U>!2#((+|K#^wfk+k$sZK4~h$U z6{g;K`k)>e>!U7>k5dyhQ5TpU+~cFrP{6Wo60hC2#Qh2W;-#RfzX!?iB&mAF^A9xW;_!p!6N# ze3@Brp`uD+r|kygd)}_LGw`*&Ysv)1ckFt$X=8)<|3uhRWB3^&$KdG(zYsd03wa7u zJDeBnhi9Y0_30sm?(UB=m+E~*_^5ss5uT_U5u0~C)xk~Q!xJuI8+`{oD8D%Ld?GyU zYt4m&k3ww2_#pP>@LW*njGwc+miuR0^sQPc*4I z_a^=fK)3P1-$ZVvX`(FM|FFu)83hy1yCcL{At3hM9v1W&(TNTFuoGY3W6LlJ5-l7n)PqP~zo&CCg4@z`}xP9?spz6yg8 ziuRzs0S_pF@d3|D>cZzKz{a#+AqsTd^5n!}vyzBLfEtL=IVDCPUq!nX@*moj#n&#_ zb9%ajr2k@xyULmkfAO2=n{>ri&lK%#I&sC@2D9Di3elJeFDz+ZwY94}HWQY+(`vpZ zdMgkiDAc=`brtvGWnD}Slap3+n)J&z6Aki$DLt;KhlE(vli(_Ky+dyRKR3ucKY~FH z{6&@jY5zyk2L^vrT1-Uf{)4k)}4 z1REcK0w@$wEc)C{;E{mUKlUMb6d_%GQ+_e24;|ZCKBk zF;Re;Fgio*L*bDG0`u2L4cz<-JbNev0SK6}Bf&OY9v}ZmfS|yh>b*Re80_IzT2uW2 zn*oUNrLh9fi`n?mf^nSMh&Wm#SrKCcc!~fU0DJJKF8pVwyE+7X*W6ml5YI3Hwx!uw ziXScjYUN-~%s*xEsM{{SfeJQ`;4uJ~Fm+=>UUO+Isf0K@SJD!JNIfM{6L;P>LflfP zI&+ZD?Q^L&hw%w6u&T&O;#C%0z}+%~AbMUJZ@QI3 z7-f(0?62Rk$?;W`H2GY9;6a0(jkqQH(kSXmpwArcMG2~0)bPLAYcJ`uU#1t zsVwF#$O_mj%A}0r&(Y+j#l_(ve&sKRzhiZaPxre~KV7gKnMDA)=bO_5{U&vCE)L zy0U|#?blfbi6~8W#u`C4AOP|<;6pp$$`VP$D8NP-JO4xDfIZuh>f)z`XHXM`#9)zX zMUY!dLmiBX!J?moD2TE067YK5jRnnRO7S5-JK_PQVmT5e2NDc;3;Ahpd*dO zV?*)*D04Z>2Ya#hkIcI)Sf2oS06vgGT*Ok5Bf>0)-xrBe8-0RG6yRyb1Wkb78oeV7 z-yr#01mF*FYQ_)7&m;g&3c$80AhPtuthjIGObRgM3;P%~}utMH|8 z+jnK`=z3tLR<^+Ni71K%rp60p^E~rK;Ch^Rde=_A5N=`V*(7c@A3dtCJI@%)YFIJ= z?z+XJvEmSyHe@mDRDja#vcM{={2km1kxOy z{4a(9)|QJGH})vbpjr@-$_r%99z?R;tWJSA?h}?h0F7hdcr5rR^f8bl77!&<>WN>7 zP@tXz4+Qof1*%F1JMNa)E)dr6fL&;h_=&d$AT!PXNn8&|>nEW1fURoa`OscQ0sa_) zUr6N#s;0y-y-S;b_5i7kX*5B>6?pVKHU&RW1fl9{h=37PKy2m;gk><`Gj)U*7=%(G z%!Z|*66Qbf^#+v2qln5hH~mf>R4xG7{wO*>5K$f-JbTa>0QSW=u3B)k8IRrqd;jhl zag1pvm~=NQkRpo0UkH=4%j2pmptuMy3YZgWph(2e|EpBnPh6^HA*@aYpk#@G zz}%G>8ydm*5fKQcTtMVJsHELAxBfIiUI*0n^6xw&f_AQ>2lY0mXQcMTrT821=Y@c%GkmnH1h(^Y|g zlyqR%_ah3WVB~c7A2Ja?k z|LDvvI5o}_*cpJ5Mq&oi^@2F;1L;7oYNeLhZC~p&= zQ30zI{6$WnvmP9t{Zov|pGLKJir`a1z@*Hr3CIXA8XuvfTpFid!K?c157!v+^Phfp zl?5O_R~;TRxW8K(mcL05sepdWgrzTF-k6x(g#X8Bh5vt~-T7w` z06~5bt0cFRXq)8-c?AHG5_q-7{Tg2vfz{UmMTVk-)z`h6Q)HhM{*exlpaZ8o1Um@( zQb=6Iup=PdtWwZ|a{N?fmyP{Ls`9a)U{XNiMkM$|4#;x+|6{aZ;sS{3n_Izni6wxN zMgc?x3kkeD(+36g`j4bf)rf%H0cz6`BsftPz&K%EFefaVE_(5`POIPo8@k8MuRA7G~6Pp&nKlGKNv{%&Ya+d>-dla z*cLZ&`6KBgaWZ72PgK$Z-6BlhfD&X$1ySl6u0^!Z4Rr4RgY3VM)Is3RKq=cY5zl$~ zfCFp4Cj`m_&USB{CqQ@Li~%pw?H{IR5GzUbKahZMrMpm0U`YTF2>iG}1O$Y~gTM*r ze{f7=Vpn)Xn85&s^j~HC|EN!d4@l#K)NW`dCRGt1iG5O4lOX5{*Ec*O2)cl`eIepJ zvdK{gB0mshfE1~-A5Y`Eg?CkYqVf`T_*n)e^YF z7yKeES2`ffETi)nBbQvq{iK-MdV>@(zfa2a{lV#eCvHUq)Aap_%{ilY|F!t6(p#!4 z`59uDRKHv?J@MV~oSf6^I}`G63$JQ~Oy+c7Wu{V1dAKVlPrPC6Pp)GsMknGzKPkUP zy0Q;JPmJX$$@-r7#+_s6Q(QpKCG+;()iAAQ;C)jm(;WW=C9+H3s|8NO*P(M=KWx~J z-KL~sXATw){I37L@v1cN!N0^)n5P$xq%v3b8?j?iXDwiq-PUA~u^9m|6?yiZv=j8y z@h@b>`9ogYvQXq0T{!yfgcU6QvP`JbA@BPlWWi4;zt6LVc|u>8p`a=6B~nB~dR9K& zl>obBr1QLkDoL}qOXI@hIqD3y>*5V*C}*<8>8NJR<;C4ISCj&%u1LIHE0|DCq37cM zq%5&|m7+X~xiUkZ@%p?G;|&8!F|u)o3n4{9uY4s~#M6{kje^N##AAy01dV`El4pul zQqBIz6u(G41C#FvqOOtjVy@$4zH{!99GQ_cWm_Z{l~NApFqi%fvkSD1Rt--x+Q{C? zA8VYv15FpdKo#E#NG`LxNR11@rZGOqM|3J*Si<_CCop+IJydsc$)WPJm6K0to>PB^ zv4&lfVVA3a>-mFZxLpa?btND>M2Uy#RW*0WH6zQ`E2toe#Myjbf2G&C*>69{Go0%e zdKF>yj-03G%ApMLtxL1V6ul%b)PI*Q_50~c;Xj*X_TJX3_~PgHCyq3WXA5_#>v((j z8wd|TP3iPg@?01n=eCm93j7!_GW0fJe20LtW7|K3NZ90%8#$hFp}}x zosuMnFm#U z!16YFj~}TRJa+f8p{<+`I%yPdU+dB=9y4N=!3QT-)}fPiqW=7wWi?F0)KPn^y2T*x zt~f^h&4ld)rT+WO`9|jKFOQg4+}c|Yxu>X$6rSZKGjgOoyudo)8n02PY8k2VXhUoW zWyT_>fAc~5iKOZXf8*dSKmVjJ@pEKr^*vXH8}wZtzhK~U+{L`g)%Dqf>;}K zp_bIob7?2Q-SN;Pz-PkE=vJD~9%0Ra)(3OE%X}seY?YKYd*Le{zbp2ZV9mw{%-?i; zP@v8xM*8H_Yj0{L!Fkf&ue)msjW{~5QMZNn_V;oWCP@CYYHx+NKW%|hbNO;`D_`z( zK>irJ&5ORra?;pS`|F?m~IVvozwuyzw#*bKWFe(Me^7KlMRn zzn_-1eC#isD=udy?iFH2=UQ_j~wk<)+zZbgSg&`uOsu8 z!^3zp2m&w{bzbda$zoL7WaNzdgn8fl$t7yg0wo#Av;Y)E}^w?eR>Dt+f zT*q+^dv4TMPn|DhV(dN7aH&AldZ)K^Ev>_`4kA+Qd0T6)uqS_*E<4R7gBO>t9UdBk z&F(<9MEpKjT#KQPT6LRktF_LfVKvOlq4c=UG$>K3Rc5Qh|J;8-7u|7ACqLe9alTC= zNzx^cPi4|8!H}#-B#+_iCwW1%Iy+Rq15YpG+QnAW1dtUuWRRVA-@74dX6%_NNq@U1wdASht}U@^MqaV( zw3r>?W6ED!dRD{;W}q%@GyZ+!B(0{UWl%zvJJXm&Xl!8l-rLHEfJ2X=_Q$49v{HWB zU1G9ospFH5|IIM{SSx9>KTzeLNFi#|p*s8e*i#YD>oS46YmQF0*qPPUKPsl+l@Oi`0mQ5Ei> zFr(vo*z^vBrE2xOR#`(rOjS8ex|Ashvw({$^z6gI=1Dy<&#|z@qD9fIX)MTdu%a-) z>;A`<_HP4q?N60bT}4_-O@4LNb$uIiceXzN^+w_?4yIERTm>_h50$u+y_;*rIQ1}QKvz(P05rk^15 zR}k1S(XHp59>YUSJuSoaUDLybg&z07m%y%pT~Y>~@)CX~d^^R0wUZ4)U(0SaJwm7? zPkA{g?<`kFOmvtE%JI6~p8^HK5DW9VgWSlc5*Tadi0xYyn1!jawHT^N1<-T5cbJiu zmrqMm4Y%^0wpLrLsFykVBXx9NDTJ)JlOf6{n=py1#kO*RaPg!9=P zS6*7-iYP<{-9wLPdC7aCHF^O|*x2rQ$abkvEJNl^Odk>#>Qyy4+c3=V-u&(o2IZWy zxrqCXxp9SQr*VEQNeXm9Fnua`|?(G-WtL>TooJ+6^Zj~Go)a=Ac13V3YjMz2xR1e7PyOM&rIko z|5A<=iS`VJP1ERhLUp<^UUPbn)%x5j!na~C$b=Ybgl5FfSbCa8rI@$|4pV(CPtfgu zlAX5+tAbfspf_n+Xc}TdRiLv|zs5&4<+C|^H=&-qS`v+$puD~t=L(IP{67}aWLFtm ztjDMDmn?DHC?E`Y%kE;IZNbaO+%Cp!EwBV32WMF#3z6^JD{vUIhgLC;anY<}8ykqZ zt#t(fBz#eAne&}@A0l&jb67!SV{@&-E^gMXA-ybC?QJ&VcXLM5XQzsVU#1r8Gehb* zxRH^lo858FIYm5JD`+voEyBbJIKU8regh4|!zr}a<*{>~x?tO7zS^Ch23|!Z_<5vG z3}_IyJ(z^8Eo+G#veNkV>X_Tqx~F^B9R{XSoA7|1A*v`*e9Sg3N z{Rv-V-%Tp=bl+WEb%dJjVEQaTOpE-k^O8m4<)7fIJUKJs)!Qyeg*I&g({)@meeCqURi73;50Mu){9PBSr6oB>wNS%l^?4Bf`}l?)^l@a(VVw< zT|Up+M@6FZastLMUnn>_J59}b`#TfOLI*iRAIjbR7%{PSvpfdOOFuW4#AFqM)Yh=H z&klLVcNb!pQ(_4ocJ1jdkTm}0u=(p8ccP>*L$z7n=P&T~pW5PA?Z!{7Yo@7nZB?tH zKRP2~Sev|C#8sTq%lK5CdRDre9n=P!>t9`dBzCqL-ag>qp`lybXOXv>+eNlG#5e0P zTzX=VFHqaHum3%|V_>^Kzoao7*^=k)NTCC{S^6=;)aGP6w>e$*1B+bM9a%N*qK?n) zyb7PKgs=(_-TrR4=e(pMO1UL{vTH@SXXREaZ9v>pVT4O^I=^_#jm=QMhK8CaNW_Lp zrt{8kIrYuBvU?#Da_T(@r{}@PLzG!y@(nJFzd258M^D1$d2JSw>@Ct1Ib%tY&n}eQ zL)eG(V`*q!_Wqm*?v)0GE~1B@349(A8hfQp67%UnaDxl^=gj7TSFu-MWRV z^HrS}`xjs#ec!K1hklYN&SH%Rcag}ObJaL-pJX*4cj2n}_(C^(S;dK>Fzu4|D{plt zzD&6Kgnmk?XlNRi8_5SRlxfPGK;Co6E_<$w4inG^BRU3P3VN=K{c<$paHn}mif7R- z1Iz34+%J3bz_`>@TFWMp;$x??QZ;VTHr%UxO&8h0x4A5`)k6aoSi{WS;wx25uket6 z`Q;Pr%dc$)HXf2u2su);CgEgsWQbAlc`MXU4StQOXECiYM{D~GVZL1@en)F(3^9_m zr@2GuWcs~_J$Y(<}tP5 z`RQN_!nrtxRhMdd%Okv?%X)>~eKiFs>j4VkmI+xWLuf6|52%IZWz)2PZ=HeVVX=ND zo|onsnkqDfVy{idBo+^dph0X*vP{CJqV_uUqhHX7V$a6|Oipg2le`Zqe#Lm2?u-V) zx6>Ex-M%wc#|*Cx1pd&)%(mdF>LMz75aOsCXE_J2U}EM2TdZMj){wE40Y*=Uuf5y2 z#+%qy2SJ36?GW(FAi9TV5@XTN5*<5XXC~HfJU;6+#LK0qknW6b_xvENyLCsfw+{-v zH!u)aZaQ3pTaJ2GEG($WX(FRat;@24l`j}F9!%IANtoxYn!q^rQ=vPg(0N-U329C9 z>(qlg%yC71{2u9QG6Qwc;V6-{xpIN^QYpAgbTG=gski4ovacUgT5t2rV%^+hnl^n=7vA=9 zVX{A8L~a{9KXDp{&AKi;V5qBpNXNx?8A}7PZ-{VuFzPMnmu*CWu=QYYue&#y7Hzj4 zKBxc^uE&=9<&EVsya)WS-72p6nnA){wX;;O#FUo%M^J46c19cRbw?M~uf6o^XmGl> z>!^IUc7G;I!s90V3zt%|*=7XMk)Rk;jK|57$CNZl7oxlAho0$;32Dso(qB|4gd|eO z`!}ERdVc#%%^Nu*-bKlWY(3ViKTo{x5FCw$kNeN8|LkLymvdLGdgTX1K%GWEIX-ql zR|g&4($xMwzYgQPe1GjAGFwa{^RWC!ML)M9&dDALkG$L?4x5rOJy$xdI)8J&F7@|; zpNaQZSYqUtGHRMun7U`qeyPCaTG6Eccis#y2k$C@mX23!yyhC5|LWJ_$5)nk`2Fg!tBZ&Ue+5G(w)fiT zLRZtVdTv|C^nx{%Ulul3r{dJuwjUqaWb5(L`!L1pOE3K|rcbmh|3-rJ-F?<8p$ckJlGtmaWM@bjq=g-3w23&TU>BrZ;ztWBpF9I_xFo4uu`J%0p+Hmgc zhKqfh8pwh0aW7cxkhjs~FU$%I>&iCl3SlcNDxGLv9?{>KszWVxe`L^zWy(iy{h=-w0uA~469z@FiPa)s48AH*O8f|=`^!!0ZzWxV*Y3roLxs;W2rC>VFJwk8E_O0FwT zqHE3=`(<=_;mQ8eIg%oE%=+pxbhk@(Sb3KxLOO&)7ZUB*S93el-~vSlwrP7FUJ<8` zE^4>|4JuOZ7y8g61NAH)k@7%n{P5SqIabGL_wQsOreW(%oSwq>wi3##^CYlhv7Cx@ z<7WooZtSm{=Vxu9XJfQ0WP8dx9u7fcQZoByx!p~fK2X#Qb~(K;GgycLxttf!(qcLT z1K5GrD1>QH?2FwKZ3nWC9kO%t3!IDAQ|-nB=8%BQz7DU1Q9)O1ZNr*V{-W`=en2-? zen<;}4D=kU9{HXIE-&hs7y zF{fayd%40bD^mKP>Y{i1sMc&$Z zgd5H|6PfJUCmUL-`ZmAL7oD`EI52GKxijvi>#>PzU@C&-2gS)5u6y(|x?{T5WhyW^mzNETs6<@N>%ZiE+tUzW|tjD)2-k(iB zUT9-rGWR|vCr@Ng2r_xAau(G?5P3R+~9U(?&` zeb;eaqqpyCO*6{hH#ld%)3dp`%FQ#JiZ#tM7P?F=&AqgOz|eDfU+)^2EEc88=k{e5 z{%I3eJ*^$<8#Auj++4$CJ!kps&bQs}*hljmZ=Z zn6rF(m%hV47G-FBb$58n+m4QU?xe60E^Y4y8(L0JOZ}}&oK;4}z4%@j{{9G`7V*r}G8==@5`sMRPl84?O{0DAElq6Kx8kdkUK z6$46{iYMl&+mVUCWV0M3YNsMk$HH-wV4ysqGfZ-r$e>U0q@Yf_3N z!=|;pQq6anl-c?eU9sunGp-9)unR0$7rAN*MOaI0CThee@Xg}T!_{61#|i&I(M=#V z(_UQ*jfh(hi1Tn*ntkAT#D$YzlyR#&fg(<(8J6BZ_3FF}B&$SJruhcAlzK9t$)juV z=fmlW^iSyaHVY=qZQHSOd-BUtrM2r5?I_^SQ%6`PR$114T>W&>S}gqo{H3muiJ6&9 z0W>~6gBpCMlSftVpORiXrlKweQyfXja=*~$PyYT){H;T~?T4>lKA!l3DyS43lon|r z%76G@%Mq3G(1suP>syhv@z$|A*a(jU-RZ<^Uvy49NUO6R`!H9LetCb8BfBHY8<|34 ztybS&7I*#oKo&xW{P~kflIIC*kp@{U1uK8%wZ4!jl1Zrz!p_5E6fX2y84HK!1AqT~ z{nSt>W$!!F%<>^n#i5fTk&7@(SWbmQcgD`Wq46p6{IcF*e{0w08gLK$TK}#94X1$a zV7J9e9XXQsi^<2A8X${Vj!}L6nh+tooxVH}?jCp@d`mkz4J+k2hn}QolI>S_#U5?^ z>X7FBQBRc9Gq8JsFEmBZsAro76oD=CBKw+GM`s#w`o@puMDw?_yq^X)ZFlOv^IWqy zaqRiOKgKBE9`aI;N!Fa(e<|#y7y_s8eXS;G@)k~Zan=2)=1QxJVq4#L++1>KEduSV zob2~oCRCUcCb7<9=D1?)1ipo0tz!gDC|Ym2GnKo!<=ZXkuSv7*2*3HIXBTZ{C(1%u zlv<2rQDrVxYdtwqh7P6J)MaO3$s2+&Qc3W2!{rqFmqE&Qto&K6D zTg?2`8QmhQz-@~8>Xp>GkKJIQqkYnw+X3k%?upoo{WF46bNzP8nj(`rt|UWD{s}fz z0WQ2p_+!THBRZ_Un*6jaP3KG&9C&P725!!d}>Kjz;@ z*{bmoZ{VUqro{8J0GZvz!FWf$A{EhsB&&fs_HRs*OcCScJG#cMV48P@( zup+q&u4!fC~$Oti7m%IfHM9qnd0n+COr=X<;{t4$rgpfyIs)R<5hAkuBt-Xkql9DV_a;WeD2{#rWm)`Bqm+m2J{r;sTb}*T`@r<11yk8FTo$+` zETZx^(%?ci^11wA+}9d~H^Fu-cn)mYTkx z&L_c8>;MjXnLb%9Wa|*}Fqb88(AAySr6*nSjQ5<&T3zZrootc5bMVMZS9eXZrk zq{ME6ju>%8!CvOJMxgIo4SG9$n)o<5&6QHqq4v!g*_$Nt9ke z-(zDmB`Lg&0(}9oQ1mFj$j%%7-K~y1PDo0sU>13{?J{bFX_SbQl zE7w`xBnEXBbILHi@akiK$4$@E+(Trc%Xv{cf|Uf&<0{b`h9vvnBY-H!?t!{Z7;iOaoJ~33yL* zTuaT5HUXMWUy<@Y1p0fg=C zcsu^?S&ve%J691;&_ZwdRZ`B3A-+0%W*XCEKF67~2Q!Lw`Iq3>~ z{-nXgDXwDB(`9L_PE;U~7u8q}ZyQ*XKM8A~oB_@!ghZfCC8msGC$)h7+*Ej@- zV#id}PVm2fMO9(5&oWKs=|>iizXD2P-USF<~l~<`bg6G7Dh`^ zj!E4_)za`SaN>$oVB|V(1(YjAG4Qrw=J$iPh?g^drEVKbexUmGQHRGp^95!hED~!H zxh`pWwf=>1o`vWQ`GP{HRXOaT*{$vIukM}@k7c(u*_KjHxP$!?%4T~(oyKw-E*h1o zZ?X;Rv!tfi%A=5M8Sv{qoX;~$CCU~ja5}yN6xp=U$my3@r0&l0Nr6-7WGWw8xZ{a?!1LCEXJneE(R6 zh<*RVa$LJ$o>x_-Q=SF73DJ$v_No8fCn)N+co!mq(T7;9Yx#9Gm_Qw!9F#_;J9Irp zyi7=?8bph9v6j#YSBhb5OLa%$q zFwC`7Z0mJb3?=X;8@pm53tt5U(bdYX9b^?rk7oqGY*app^$a(OTNv|(uA43{IZ&3( z!WcibKfZtTT4yb zixs%_5#5UZimj_=wrwV;xvO!dOHsx<=?yW>5^ItCo>PU7@)~o*NV2g9NS(@v!9XeuZ<=zLztem>t zJ$X8FU|LQ=q(1aQZ>~KO7krKFtm|k@BvYADR6$R_@}_{DI+c@4s8(_xYC;_**g8#L zrYu@!o(2jCd+G2_7nhdZneF(60rLZwpO=(G9TS)-2#=u3j?ABxwQ=Z!x=m&^>#OU2 ziJi=@n7j1dPJI%VI*D=Bb^JWC`;%%4lMd=wwo|8pIgm#qHgh?BSJZV`7bmkSR#|FR z)P0c6No+N-2!U0{_SPG%*OS{c%YP0`ruC-Y>1Sj6;;` zI<{j2+v$`Y{$W_Oa@C8$1RY|u&C(J9RZ%rsF80V}XX2aAy^g9?E!XPoatKWG;1C2m zokt4H2e@x*z6$EQTI3-uoPAo4@7x=h#B)4`HWJ;&H&s;S<)10YBgt8Wg^e3uAlp8HTUC+G-k$CygNT@c-<-J;c>sXrg=%{xo0`&V})Q2 zFh|BXIT;4%JEK~RRq}L2{@oSr(sU(RPKJehun@U2k(Q*y(Z-sd>dPS^sP^x{E7iYp z7wYWL74|k`+OaIb%n?q}q)-=!TKN?;RsL2L5_G_>+7h^!x@h-P7c*&$pr;9nL()sqvk=|~G{r)*n z2V%$)i3?GRwvQg!E~WA@kCXFBZ-HT?pMx3kXb|iQ+ewTOEvkX}30?hDH(ddS zQMc=7BvgN1T)DC8C|2{qXVchMsYngzA=JtDxKVuVSqfY7i9S=>+&1`VT1QXPy)l+6 z^tZ%$BU{9uoSm_{E_N;R{YUGJL>+wxfS>H55Mvvns+EEs3%u8S>1`fR%U29-rz zacUCZ7O58M9;NYJ44RI(($N&9WOib0j4HlesRn+pbMbLaeRI;|h!$N2y9K2uZ{Wb; z&^Z)llcn2-M*nRP4eSc2S=?O~nxdF`;-fV!*N{+W@{`xQ(*B6J13I&Y{WH*?bxmX4 zWXKA#fN8{pl_Y-pH3ZR2#xtfck5xlcNYje#KUM-mKe6z3`Gk5(@#N2aTpDwy+>_U` z;*;~wD!HH^M!+JiCA`P<}j4a>Zc|yUP6I}jumTorO&p-K1FI#8m;~&OXUSGOR zu~tZRhm^b=!!`Cof?c6LsEayYB!G*G4Qe{b1JO@-dPU?Uu=}Wdq0Xx+uZ1$np_;T@ z*?Sj_=_fv_|GD_lc#|r}s1Yu9=Yvm;pq4T!PY$Or{UqnJNgIzHS+?C| zm!)i_uB-WyD*5_#4Jrezc6*n~zE+veZw8fp!+#$R`<-#WQ~f7H($njVV%NbgYUNk62+SNWe4qP=Y>kNs!LJU{>5t*ZF;lP zf4xNbj;@^gJ9*M}N_NQKM|f)fKL1uFBXILyC(K~vmz#ejp?P=r{QqWYTC>)%GDhu_X`;> zWX255Mcxs#SrZBgfwCj~luE@Z%aHunZ5*bW)Z_W$suvhs>IFi)X2S(yvN^rhWY`f= z(y%uuDC!bDSOP z+(mC?!kEpXgOL)e5M2&5@a>VO!!xY>^Y2-O1n+6$O5CrsM3kp?`~o+Mj`uk>d`(`Q z08SHOEfL%0pUEEQZDa4ZcNo-=PcfXHIj%E4Z@J!MRpnp-*%^ij*5-{S`!rN9%$x-N zn;A{|&H^YlJ9cbt5t8lcwyK|#w>k9hw4w?i?s5y|_n?igY)qQt-x@}fNqy2m5Ur2Z zE7c>&-`3d4Wh4$I>M87u3v3xkvxek&x;ah$g1SOct{-Xq){|XZ7@4*_(7%>?w5&b{ zI-UV%gu=6&*B#ZMz`yI-_MbO#+%bi~aU*7Q13sGjti9&}s2`%`xdXgUGLCDrE!;*| zx7D#J>ekOSIG8JXtdDLo=FJ1^0I7>cZbKJ`2ejtrvme{SU7EYpV-S7Iwv*F1q-Tca zHW|ci6}4Oj(?$u;3-;;g1hX1J`D9R9=}+NfcPey6poN=}2#^Uy|A`oP;I!612`%n) z4>nU|mYzG-eWM~)6v_WCqiUVLKM1K2E7^}iSFg~tbnlq27{mlr=k@jYnPgw^Y3SRI zIE}m4FBs`w;4CDUCn)3Mguw#LWDMQy6Y3*_mFTN-!;W}ySS_@KO3B1>uaHuN#X_BnAZc)LvHp(?NEEpjF z%&5)Da(A7K`NiP_^W4eN|RAW1$rA&e~nLN5uLtO?in$Po~9uiYE=&Lo*4-BdhaaJz%@Q z1ld17v#D-V9yJ3A=$Xb%mRF6!{7hon%Yn~Uu64aQ*D=xfJw5GS+~>4j_DJyKr`jdl zv8l|E{EOC~A;xFZJoby!>2I>OVSKY1|NGQt!L)U7*7!oT%#Ur`bDn%L_3{rjdf0YG z0u$D;3$gbN$7@z>IlcAl*R0AK}eDDK! z8DsAiwoq@Ttmh{TW1<(e*yn{I&1^}v)?yOz2D{v+i6a6bw z8%y^2m@$xWcRY-3+}ol(@Y;m$+Oz}9R7YBue6sloo(TzPmqj^LdH>^_6+fIu4dCe^ zGCSjpB|}0br}gYd_rCMA+UMW1Wd?;uPTTG{^keUIWjj(Rp3fb$%ASdcwEi5KM6+sT z{UwhxHsGa0kB*FN)^&Q|3r@5OX~54B(AFEo5)F>)o2EMo7cxOZp1<}BMDt~IWd#;! zd=$7}B}4tMSEVk=({#mQU0*T<_-vIfr);gs6o{z-@5@koBa(kri-RLF(3hEBAhbUO z#7orFs1<1E$?9~JP6t+;-~Wab&@+jN>y-NaA6sHX=67~)>_5WS?g8h9td36C?zNnL`NdnwK!0~A)+%QQO@lv!(jSpO9bfZf_aS-j z<*c0(m*0{uUuOK_<$RXn_XDA~J$%1)u$)!<7k}?$oBX(Gp0_W?MaWrhp4W8ecg5tR zt&#Jy82-h0K<0~!c6vgB$(M^PxQ-^T>MXyDZtw9+^(ZKLyqWegy4^`n!21Gi#_MqM zLD{Skc&-2Z7ssO}A}AU_W0K>bszJ=1qLl;@bMCh!Qu1D#DSIn)zZ)xJ?%uhXvZn0$ z+c0hGRc4dRR6@mVhA98{7E{e++?zdNr-5xIXH(r8Co!+l#}%oHIF#^e&FgnA_j50L z4Ck|#CF}8AXj|@w-ze49vPU?&7wgwr^su$rH|Kp>DVUWPFGKPz^_L>vt?3sxLyECl z=|>>WLjwc+PNHuPGasv1vCr9=wOx19acTx%V!WiQEkpi6S}}cRQK21K^gE6|n>-FTn{J`dd^SJu=efS`ewNR_lLVCi>X+gTxs?0U(Ly!r`qiv9My#1PCn_FE zpWqigMR#tkByd(crYP&lbCOYbLaHkL&{?ZPZ}bujjcuhBt5iSl&jQBRWl zS*$|#t~NOaShm{}OwGJo{nB+c5v#4(q!oLSw;t1E9e477_Fk6Iab?5soNSRACPP+g z#c45pljPf=zpvLy`ibH`)BVM2C1A`MA+^%BtG`Hd#-9GHyIE=P7O;{e8cFF)204xR9c|C_tsvWUBl_nfrWYcI_5`!fv}!L< zWNKwK3*8$rgm?P4L*En(|gh zr=g;+ewM6Hzw}geVzwn+pO>0U0dF!mmZFEyqT3DAI4AVXP^nuq2qmG(Dxo6^jpoC+ z;qGY&A&2BchSFNhSDLOehze_SI*Nw9qep_4Dz^liDh|Kz9lp)ve%pz&IY?gMy+1?k zwb#6K%&%Vuojq4+5y|7A>@Q$@vZVJxR*x`m>p6)J%ixcttm3Ax_taRtD$*j zk;&fH-E^gn&(;ezC?_nO-16bUfZ?r$%gc3ZsT&xt<@SN3Zf=q8EOPq^TI{nu&uqf_^yFDAU8 zvdK90w39VUdGEmc*JZ>1Bkj!tq3quO@ux+!3Lyz)UsLw16|#kh7;9OxSJtsjS_oxN z*|W>O@9QJUo^@=4EQzs%X2h78-?=S4d4K!-_4}vH+-JGY>v~<+IrlyHc^w-vVRn)Q z*#n|q&fKZ5J@ey;5j)BG5c#Nbi^*XQ?K43-!jJ4UCru}#{cUO<|9m0LZMK-q_B0#n z?QBUob_Tm~vuo(=4W?L)<3H^Cl3X8(THlAP?ht9Z$+xMwGZL{YHxF=4=u+paiHh3` z9Dbh&e#Sqz{hPjD_7nOC0bKWtkGUP<4?lQ{;}hovlJi*y)2I)bJvk9_K%o9&`M_!G zTSo@lE=-h^eLS4ce_(X0Y8r7!lk@mnUW3gPcjhdSOyfhkSMGo9u}qbsxdbckPk zO=cdD)?@x`{rTUJ7Z(FIBb!gW^;K5_V^m*V zIc`exiB|-5hQ9c_$^nN7bItk#un3Lg$utRrI>j0X=&!kc&Or7DaNT*gg>AYnHyZa5bfI!lQm4RE8%hm8M5lFbBzPFqW!u}Z#{i( z`Mc_>jVQaPeoaS-J|=z#D;vjdq`Ka=DP>Ap9D7NV(R?q`;Ro>Q!F$%ejs%sU|MDDqU$9tmE7son6eH(@uMI zCg@*{sp$-!(6;n@S~@OD4o?mDexL@wT>q;fc1*!gP{Gcv_sdry67bnLSG7>3fla*nT+%N=q%$oYg45@jC;V~GUIPS3f`P3qNVj~d@{E-A~K{y zKFL$6kD}^cw4=rNst0ZTG#HUPfcrjWA zI(#E`omgGrn3*f=*hSp5YYj>$)!tf?u+rz?u^T>YF|(C2RQk)Dl5DwZ_y=s7U{i-8OpScTTRR^roU}69DCJGn|k(+7Paa8Jlz8= zTKahS)%VvZ`x8{OMBx`R9qajdRppynP^t3zNhYb*A1zyt*=WJyzh*T z<_VZ@k;kOzXpwV<$YCrg`>kO1zar8Okc4Fr43fmvMXLj6pBz-uLa=MZrPJlo^iu`S z7iT*y_|N;xJIDWX8fr#u&9;%g=)`UVe0Kw_HKYnM>lBmS;ddW%6!083UxunH)6z&L$mC z-pA|Srd3s|ku5t(>f!=M?>S0_Q8_1E0D-z8?2s`+M;Y+n5WP z=`{UK26gf8di_+U*H1t z2kZ_VXci1qh=-5vG-%)2F-8t_FV6D_n5(CyF9?dA?RVLr?hg-~&lVsz8`i-4`xHnI z6I^Dqbeg}o)Vh0}aa_-Owtgzb!;94v8HiLsIoJG}CMy6x7>8OKFu{BAsO%uhIq>^1 z#Yxm1O%j2JHK}gvW_cndCt1Pcj+TKW)Up)$D9((hy1pNN0fo*1+rDbXC^;TFUr-;= z7jyFdjOqDR-|urm64pvr?)rW@`z@n$omk+RR$fi1?DPw+h)?30X9n(kt2Ac#kREV5 z$3?(t>?#}jV#^Z7hT8qA`FqZk#CPIzt4BvAG-;w0?Y18MJWhpPYg*~-#fowe?Wi6O z8WqMe$k-99=;fz)8n8{a*aH1aSbmk6bkrJE7#v2!w71pG)`2*)EE@ zsrMtwM|H6u$5qoGQ)vufS`gsZUVLqpOl|_gfr#v_v$MlLtQM23y;1C`N8wdaiJ2Vg zkXhVZ zD;lviv$Be;!3V~CqR-+SSN*tZK_BiKzJls*K}&FT#u-h116d{EP=V8(mS0xOzvdD~ zxF=!7!c~-Aas2nj`4gB79In`qTsr(w{=_2|u>yklD{)_JmFA(;JUO=)P{1L$B2lxlBDXULkHU z)pwYT;cAZAy(n>Sp8@NZ(%q#gUY#i5;r-Q3ja*kc1Ug;8z|r+nl{wn!%mO%L!JTJf znLVj_e#us#7QW%xO}h>bNg)a)F;AtTaG9b3v%pW>f%WFVNd`~V{^hEr*8?XJL_F_)Wq{3>tz4ZKUTmDg; ze8$T=LZ?0Ob-be3Us{sXxBI*&K$3^}voY$me_eJ}Awa?e>JNjx^kn&A76ybV8L>o#ym&SB+T;>Q2>fbsn7A@OfKr z?BqeH{cVY*v_o+DJ42U%0urQX@ka-}iPe%V*BEyz9Qd<>6-;4?IQ^etpD5=J-jE$LVx&AuzPy;&eqt^ zr5UTpJyo9l-sw5NXVK+-7NxuF3Po05pMbCkAzi&T<^&Y?RQ9wd{~W@N2&9&X<_?Xk zum1<06DPloHOsD4%Kz}rTzgLnYrjPSaEreX?@m(n==`n-#{Uf2%>FOs0gp_8suP44 z>FN<5h%VcrOuatUPVv7x-iKWP+-OgQX1_(PLaqV3lCpnL9uN#>vL}f~e^?Dre*3Tn zRnpZ}-hw@ax&0NaB7cig{z2jJr0Ttc4#rOJ^8&}7^6vk5!REI}>V8IcN9-x~{plUe z2upP{h|G+w`=MK{F60n^I7mLT-%k18T5tOYR=B4WH@2TG?Sgy9GVJHCN|Ct2Ue-DM zU)DK2qrE5Jx}Pn1@91}BWd3Ksd72!%N6Y*1l$`_!o2 zpjmcDpbD;BiWc7(;ZCmT1w&d#2uJJxZXUCJ;qvUe!mks5^45v|fokjfvbv_;n zg%WKn>aaeah+@R?>Q*N&T^KS84a8bhsauv#Mk;>#JG{Klj^J9Ia`&O|2_G9Ad(#sAwdAE;h+u=$Lsli9kO0!2(oi zxKA`|8_W0pBd!+?wWS;-xktwtZZ$n%MZ~@< zbs?u&T-h{?!VK5p9Pz1A`We28ej(x2(OVg!j?a`S(e2eo+jL{q*xoUm?^Js|g-amJ z^ocL^S2=Hp8BYfm-_i?$uZlVF%xp}Vt+=_0D!F7yEA)*^_N??a&X}w}8*+o6@;#Y) z=SciFFoUqw~~06lc{VB_t%^-NjbQ=q9zOX;>(-DST#% zp6`mzsiVw_hdtCknaTe!Lmj4IeJU41M%h4k13iVLSdc#~+I^O)VNC7^yAcP)d9?_N z>&#+$6q2x$@`wE|K&A5$GvMYy>97YygR0OcxqMNIYJa5CVLvK!&`{9b!|Eb*EZc2f zXCAD33|1?wPw}=-D}6q_Bg3*k6fkil-T(IPo%TJ(a zIQjQxi#YzL*_xLV00QR07_zaCXx68V{sN#K1)is9$5uCJu??1FSO)_D7yKSSW4TZ1 zyCc{%AJHEou!)CHUy&5nck4~G9Ox4YIns0OoZ=xIEo6XDenJt8$d|Kg^<$EMLSRJE zZUb81hTz%l9aEVoMz5LPI*g-gpm&Rtdnl%H^RWNK1Nr=0(a(3r6bS=;-AKGsB+38)VzSaX@ zN#=`^@25afS`-!JQ-Id_r@It5f4<;v6u37Qu?GNY;w}JGvZ7!9!a?5Fw2Qk85IelX zL0r_izYuFB;9ex4?N0yCcl&?2sl*Z*$^*c|?Q|2?0+QtT8KBirqt zZifOMR1GnIQsA-;ceBFjZ4)Lg>{7rA`33Fp%Kx4Nvl~@jIN2$V)|UXD95Nc!sGX93 zfc1*Z{;w3^;M$?}YW>As4s^{?AjfHX>&JwC92sLjeqJr4;2MpX-tk*DmSlz3Xg(i= zO7eKrnxgtK-aktk9k=Diz1R)_tBDKGp^_&T6b=CZ*6In8;HQW`l0bV= z;f4Rl0n~qSKz9IO3kdQ309eMn`)g$P!qs+D%fr*H5M9Zzg2GORUSFYDP(8e#t^yql z=dbS%LRyMZIS_>Zj|Wt2>2{a9&n`o3mCR2FpU$iMOT4_ZRFd7{wa`Pd-FPX!(~c4S z3$uI0KkQ_|5VBL(D?q?dHpB;=t|t5?x!wEr+pRBmIe6=Y^UH~d|4FUc0b#pKn2FP` zApFS}ngITP@oD>N>`tos&r_CS4*^jBZ(LVrLb-6;RN38Zl@MnF^4kBK+Hb`~{BQr3 z$?wn(fmZh%&bb|O2q!tk@mcr6@$)$(-{3Rn;UHClByj%uLy+22eDEhg61wuurv?tP zRp-jfiS(KKk-}?rIjh+*@Gc#}M^#2~I#&Joc@v{)9}ml{8j~s`!!+0gS60$@??;g- zKF`hI3`#CNtUf1fTZMjbo0ft1f7x4@^P~c&jj4_ztGN#8(3N{cW3#22QN2`BH`ajoV_@F%C;pxo3Wd8nE=@sg7SN#tpxtDsuS_~~{f5=(yLW-J8 z+o{7!6Bm&@%T-9Lf}4rQK4L4g%GPrDr+r?B_nmu0({*Hwd_#IrQc6s`wx|qIEoqRw z@zW?UGs|Oqy}1Dc+6`aVFSNY9M5*&_plM@-jR#4{~Tyo(+(9sJl1!l2<#4nvxgw zG&MuBBjn!PIo>FHUwfDv?EODoAlAh+>YD1>T3B;CnD35I-jN{i+9;TrCWI& zi?~TtbS$`>T8~Bsq40CoJhYHeeY{plq&oRdIWPg0I1&|PG+X~O9^J|#Drt8>E9dDm zg=L?nI;I;a?Oa5Hi{eLAObx5=%^fRuzNC9t#nR%+JTDlXN}>e?uVGB$4Od|8@Cj{~ z(bLdJ%?{9uh-_-XMF@!&XV86T$L-YZvKKuz$Rax%Ogz9quILt4cXM%ot^+$f533;W zaZx_mHssht5|!p90(0Z`C^hNnDS6{;X#Ad%MdmhWo`XKcBo6CYHuRKObffrn#gV+P z@XsWW zdvET6taD-lC}!u&Z3=9(5u7e}Yv`$=>)An)?+oa!AaS%1e0f!uSMdz5pz5;LoP*OKndedaCE0EkAxPOu&WMFV~0K%*9kfKY&EFf=a& zXbJT;U_v|iJ@R~|JNJtB1;oh`ldm^SQf-NoTZz4#cQJ2!YtTO5qJ z>>gKZ#m?~9IiOYr`vzm=vz@YaGv)HZ;2XmFHa8(QHf@2b)G$iJ$4^r|1kKD8^PRF` zJs+b1nMy1kZI#`dGbl=l%smFU5C&O%MK?eX!i9!+Ly{UASVzzI2r3A!(G=zFXgN0l zjY#Ew5-4R*^c}<*xYz>?dJtti+Xu^cvh_We{%$*xmWlyxB^E8;Hn;th`cMzh{v5Bl zG6;rd3r=+?mO48^pn=%=E&wlq(1?VE0=@~VWL5zeXTz)^w+K$8y#r-P3?PmPPUxKl zG!;}ahdMhRnFOG_H`mUKHKFB=i((U$zn<@89yvVC0gdJuiWeZs6A_bmLAP=>hvho( zXLM>Gg6FPy&{a{0RhDL4udae*)1di5_oFiMu3|74nB?UM3Me9Qcbk~+ir?i;P0a#P z%oE`V1tGPvH5G^j!1;-sZI48P`kgtqO}Rm)(=B3sqXE244daH$Eh6g}vy)Zq&T8yn z4|xO_*3Jx#R$BcqsH9iaCq4sN#l@nlet zS$x1iNlI9S8`KA+=!Wt(wrG0bEx<#nyyR#(aCwJG6i7hlc~hM)JWbWl*CMH<=3xj; zee4?reH)ZY$!mz4UJZZ4obL@HxmG_&hn-vLZMeC zV|S~88carP9p|J#KY|m`oJjp}c8BI3&mqht$|&Uk=|?M|z$~FFOa=`MpD^zX03ipC z>)D<)26)wWs1gnOToMk1QXD{(IuIhJFcj`Ny0?(q7+zx4t-Q;tlnABHTv$2q2Mw=$ zcqWKUkk$K!_@NXT1!Y~E$X0j2U}0Tr6+kIuC&2)kKWTX3Q|%HE#9U76+qkjp;3gyj z8Xn+v1hb(yX&^LBmC$8EDKbd7O>);A)7aa9T+dST{hmSzAQdtb%)GZ`fLqS;%A2>D zLH+d@K%e!B1_eN1FIu+nK=Y!A?7%jhA+J?QRAwzQ2B6Hm`=zi-GBo#|i0r`vx1$Gd zL_R?$OPqb0mwiS6+PrX+w*knQBVZQYYVU`Nv!+?DmsEGcAEkX-~-D9 zI~K}#&zjB{fbcpbT4GsvZ*KJ1j4vQhb98DxR8e^LlU4N7)U2zb{!sEVkNo$XAT&Kk zSwf*@=c@@V4Zx%=3?|ZKah(s)|6o;e6gU}V*!EFC)dD(e6by>*o!Ozl!ipQJbVS7t z%B<&jUqf>Sa3!?*Feqw&4K0WoG&`Z?M6$SO)N5!qF1QFy%FXwb1e?KSKso#7lMs-{ zpggIce@43#*gP984`p<{qBD@?C%_BTkd4`}^P(WA){D+SsDSJ{!val8K|8Ah9GF3K z5BbA$c9u50#(>uz4|}29A2e_97Mij^#2f(31*4jS)>;S3axVkto#QPPq2`TymRg|t z?%o_(xl$T5yXL^YL4D@H9z%wK@MPWjcq|Yi*gY;j0V-&oQ-o3vn26>&2GDmv=$wJ!tfazDHx<_ zK5I}76%@q>p`}Gbm^gNOp`pA6MNc%FIka@>(2Pm~lMIPU^cx7$6OrPg&=j_?l%TUi zyz^>ox|KoVW!(_lMCmi*YPliEQ+HxcbH_|_&X#^as8^4N=h2OOH#q3Rj;P+MJqhc&z6M?I55uzO}iT9Zbpcwv+ApwFMBV; zC+2yx4mn82Cwd7fE_4FT*iCd0i56w_6x+bifVl@rj_bjG3v$AbepP0Ui)L|w!8G!TBrNZvlDcRQeXZAS92 zviU@Zr7ER=CcB)r_V*@HAG5LzTBR1ro_Qhp_qh%mmwG65tfp%?E@~x^hN0M5A3IZC z#Lx(_9C*hL4mqk`7cxoWd-~$XrOBMd8rgp+9#6t4I4$|KNXE>MOZ)t=Z{X;&Rd`rQ zl5pBy?pl$mQi@Pt;xQ5O{wR1#W@})G&~)fIW`35iNLq>}#WkVR+As$HhUybadJO)V z*s;X4i(2Hlvr8oP9IM}0ibKuir)T7*tL4KL6JQiKmc_${VANJ;TNOEUyX7i5i`aXV zZnK4Eg_G5n%AHnnp@fUtDKl$?-DJ%)4?k@u7m;N*#X^!!=HDsVBNah?u{)}{PjWSa z&+c%5n#c0(S;Ooq=HQ3wRFm zGWtaF1_n-N@|w3NZmc%;tf=p1wXB`mxevkmlqWFbtclW*r=`q7k5#ZW+$O4~B;QTO;uuWMIq9|2qBU>*XJLSd{TbU-x>&>Sl70hd7dbTHg?oCY6 z9F{FT9aS32mUyW_k$O<%-%x#y&{H3=W1&GQ>`D4|a`MM+P{q)mR#H;YN_0|~&SuMe z*D60|PNgxM6!cos?`NsMo5=$`9gPBk=3V(bnqy%LzALd_g5DU=;|(>gqI@kY)= z&Rab%52nD(?%LxbLJ99A1xoVS8ovCjBWozFrZ<_pEf_1$S!CX$JFfSj@SbhhtrQ($ z9_As`^RzU%)`!E-2gUrIKBlTZxT#1rcc&waEVPuB%0G;?ry`OqlrcY>>@}TGqI3?k zfKF2X*V{!5g-Pr}v+w=enIAN8Xs)-*qO?>$cSYY0wxfzZ7W2X)MysGy_-VDBi^A}L zq|k}@oAcq3qRflNj8XFgVd^i7ICZR7ka*k zXC?*xa5|@_pxu{PaX={p<$tD4^5oZ>lzP*5A=#O6LaRa zBG=7$B~_VAyhaXwDm_Gok`VA0;Aei^SDKqRrxTi+Q_6Qr^}wqPEt>fe>yeGyZ4BIR z6La$;kKK^1NOaao3@VDeXkvpkMbEQ1Yg1lKWfoaveI3%%vXOqkmuyDKOlq!$0_-RN zyI?D*=?+O=CE@zg*?c$FPjBh-YD{?e>4RFQ;cuN^lFA;pR&$X(by+UM`Sr;TzfWCj zFX3^v{={R znjaAhey_Pp-1NrzEiMz`xaiV*5t*cHQ0EF*ZWjI=eo67dr<#*2L3xaQeFJgNp; zStUW*9z+OWiEH(@5Gpw`4H|}hG%)wryZEg;X8y~p8V)DqXnh@mI z#?gjPHjg1ddkuk>p-F+Om;}B_0~hY+p%B>I6^Z^LF^KY5ZC+@8_RLZtORiW{a$|mN z{py}JwtnqIyaGQ{okxRT?Iae6s$r2bY36UhOa4Cx=Ix{r)oTTQZnNHt^wG_!l%2gfS- zq9xj#ZzM1>)rk#Px-QQUz+nK`4WN|5FzyjfzV3n??>q7(ZiYK{>3qWT-Z+uirE2k` z=@M;II_txEaIbXZb?~0=^`1{3Yx2mKx6Ebmd_x`N%P8WeAOEr~@mFu$^4)Iu@=DRO z=Jj}fEOt33+1WWwP3F41V0wlg}g)s>M{dTEfO&77Bu`gLQLpv{g8 z3}ry+g#HLxj4<R_H`LendP%eHkP2ZoFbfxasEx zz0s9ob^Bl9<>N{}oIm}V&rN^5iOwtU{nWoCVZ847COc=Sv$u(m*Cyhgz;vE)MWQ3q z_285m?%0^8HKr?hs!=4N)Iw%l&kw7Pp#j@a}uGZ|@ne8t<|iw%NSA+^bh*d2iZDU`ArttL!2z{rL5{-NrD^>c0Wx5*z6h>r9?Q1H(y0~{&2#Hq9uaZI=iNt(-F|Ikp$FDn-#iXSpBZEu%kUx!b zS!hYWoQ+fOD-lwn$78+(kb*r%ZpR(I=8%`AuN_xQUOZ5CN%@n-)a391OVhlm%Iir; z5i(nhy)eT~4pALe^{UHxCI5QY#noi+JKa(cGL-HAS&GK#Wu^w*$=7-7Vo+Qd^ojm< zg<#`9QaaqTzO3$QT_Y5MV=+$}SZ7d=V((A4&RzR*d3C0j(y_@nFD<*8?o}Lq1Gpvz zKl1?YHcQCMy8Z*HBq^#rlgxBgLjJeh?Ob`;xkxDqnHi=8rm?GpE}l;LjS-TytBlpS zrp1#3AEa=Nb#Za^D+G?QsM<#je*EtWRxT)oErik0=NZ*h;tD(Rnz*ZimZXhqC61b6 z+H}-MJeZ`2Q!Dp*e1MXFJ|>TU9VBBAx|fzEZS<>wj%=3xC~SOc40ne=%-u*znJHyt zJsf8hDrHT?%Ez&<;pA7|e_-@100Km;@`Ufvv)WsY*{Z5IgXT8WP+M~UsJ}=bP0`FU ze>}taOXNsFu3Aqw#6Zt@7mg|Z`AWeTanX%Q&xc+QzBP5F`(WKC*0}}wIy-&EsHpYz zXIad#4(Rgl0{E|VFMjy7X0K1QZj>exW%cdrZEEdse$`H8YMLHD~rv$Y1e&J>i)wYf%Hs}sMY4ab_s_L@`$d9UZoo8|f z`#z&?>jZmMp{?gIO=#5{ z=vgZzGZOW1;)cQ2V3FDVrsHbi{gsrd@>X*OdWF6HehDxuD<+(a-Z!LoWO0wcT+iyJ z?%S^H;^JU0iMYIh4sJeW6=Y9Xt#tIv8aH27b8TD>x#%6eh{(>=)DJSvrRJEyvbExy zCdw-Bi?tHW?|-;!&StzQ`aYYJCoU(Iz%3z`W3 zaK5U|vTbT+p=GSdS#vC=WM#>rOYMuB`$H#BFrm7^%XP`U#`O&yXCL5$mg77Z7GAxc zCH3=YCc@Vr7PwVQRwaI3)bCmco3bOjmZZHZh(9M#giR9~r|-Mhjnx{bnhUElN-OvNB)Aw!WvpRBJltjYMr_)+ z^I9bny6PSjl9C59BO)wXu+J8ONLKYQkZX2c%Xj1{T9kJXC8zu-upCkHZw%~7S9gMTTS;Y+rvc|tkQvHM+C#+$U`Rj&_*uD|!2&-=$ zyth`fjBCdUlOqm@>R+--xI_oSYQK&pqDpOQ;|IYHY5v1bKu4_4QiP-y5xybVu%Y76 zHjlZb*ILP_;riIQ|B>k&a($^3Gc(uEP^KbTQMpteGCe&HZ$61N9_e0R^O)VZyUItU@Szc8oqdsqN_~^l<&f#v*${fwL0n+- zSm;v^)i}$I)kl?g*qyH+G-bT2^&{KjIIN0vzbz7vgn!{!6Ve}0r&&w#)D)6vGAZMX zX3xu#%%e4bT;%-4{AfqOLQ6H5Yo?_BnLwwpKIgR*`L)uXuDfvYch4`m(grf~gfZ(& zas{BwLTARf1%ItaC857>Up%`Yp^I)xiNUKuh9 zry&o<4pWxa6;-cq%2v4=8E>dLC~fOg+?8LCmy-U4UuyW8hb&v3cXgoZ_MZ1cw!Fg+ zvQLc>#oRoX{48DcrEqhuqM9{7)Ryf^H^*L&FBC*aY@k@V#)nKXEO8tdPfORROEk{W zm)3Z_4BFS=;Sp7^8e5X}l~p;@z{yXg2k{S2#G*UPS&vEgy?!LkD3XtvmB@3kL2r$C z5-qb%%BYWz_~H1(>(ZA-VDada;)VvE4(VQ{u2Q%fL%yy+BwC(r-KZ|p!-J`OVm3j2 zS=wVg%=OYQ?+r9J`qXlDOR_UfPVSOwjY##gR)w*~msrG>6(piqn!nz3k9>d*i&Da3 z6rS#>B`1h&sxiBdhR(IqS0IYdy+3#J_hz}-GMzO7pE;n3&MrG}b{Vo$`Dt(gDS#T)SL-E!u; zyXCAyH_H2SuPnMg+fh*j0)-tx;up8o6CqVaMeA%Ve{BUh!T-ryS#!I_m zhaY*M5|Ccul@P7F`?V1j=ff4ba|&(7!_F%G*IZ5V@vusYFz)%E!@)PM?+PWpND0we z{w{DOOkiqjO6#o-=Jn5Dj3McNwLlk!GD_6WdMsS5!q3ms9jw0a+rWma`ZE|N%&rLJ zwlNo3Ei>0r3JYr~-05zZK7j^yj#SCZ+HOFu(?M_97>St=$D34+R~oZ!~reQD$G`c=O*9zWQ<9!RCV-NjjeB zS$*AT2p3u6;QD!`_uW`9l(2z^UhK-@7^@fo@tB4 z7}4oOJaZIot@6u!m8kYXw&T;rqI@5hR3BIC8ruv!`GR+DHR8vsl-HWSDvZlEoErS? z0)o8@4pnLzWJ@TCEaT8;j~nHd2?d`|AXxpqgE&=5R~FQIQ}iaU>yR=Yr&GyB%E%>44T zvZfX1^D|iSQ=4M-pzRUakwS8&VHdk)>qCB(HCG?mJ=#KSMhkr-gIUc2}BRT6%C!Wx6c2a^(9?j0YevJ%;pY909r!vSZ`smchO&TRd#tdZ>w?3Md zYXwK+-3Fh3xp-#8`DN0YBI=6~!v|OCudy}PlyBs~=&U;CZ##9dv{OxOyn_{M-^+-7 zQxMG&#?c}9ueCFce>j{n*{}Xi=i0S*5lWO+vh$y7^e_99J-9WUDRkHJ?rf(8{<}uH z%q1NeJTWeQ7{0Y7?|NUqOm=bI%j-viM^`-G618ji5V2r0a$t*5MxRhNgp~2Dkg{1~ zC)&BV-=15DVY2K;730^-WVD+QF?hG~vZ_%TBd^uE4)0&{4bK+pI+nbP@KXy7I^$i1 zRV^q1E5n7jgc;YiDmboaBPxL{4}rxzc6GSok#FFP>a6wn;;plaI1Rn(V9P3Vy&{iylLy4pdQVGQU3mYwUanUI2Yb8hgA zGhDCJ^=g}6R*%mnJQyg$`w^SxWwPqh=VH>0a*0@`tSa*?*L(xpocM=vF)dTh?qS+4 zrHkK)diYvcEx~!!EH1xk-XpvjE$U+VCNmCWsbgHL-#!2jA)tvin1sm$B6`y$%Qzij z>;YY>em@KOdRJJ8YPJFb_7f z>N%@gn;Vv|Pe35AmsPGSO=K@sRz8HUl3-+9_)ntmE{R)5Eg93H?T@=$_x-%~oK5uV z&y}(fq~ph}g)#L5&yQigek`eM%RMi#cdR%yo-W?oNNsJ5rZVaP-OoW>Ce%V<3UBHN~ym}u1} zbgJ0OlYvH}g((lQ?nYog(1gCH+wMwOCO0D5i+Xq=;S8CgnXYGUY|!i z7#Ag_jLzd-epUv_TutzDS^obscWZrVoEoahtJ|```tXl|v;Rgt9(k@NdW`53Yk%P; zrxnojo_enWodi{a-N+r5X!2q6*!K;(j zb@69@D8XwDQR>m$9!?zm^Q&rC5Fuk$rDcHlEi)V}GkL^P-#o8mVv}*@`%EA$sb8~eLS3z-QDSqNQ4>3t5VB9P)@wp1&j@As z_RBBFo8RD`ts&o?rDoIn77ON1ByJdUm=-cH*>_8iuJwlucge`Omx{TI@sPr{Kn)a0+ZWGqH<*rRmIV#Skg zUO}%T2{%F{{7M<7H+tz}AHP&HGyc{OVe91-w1iQ6Ad~P4KeODdqtetr%S+r^v!{2g zLW&q~^lqV1-Ee|OFM;0h^rIytLjOf)%gCT{Z8W}g%M`obAN#CP#_0U`_(t$s55G22 zQg8s#I5Kr>=lDr){krV1!Nq4~NF-B@?n1V7UnxVNL>Dd2gWpJ6KOH^x7-5O|fX!P> z4Sd_IPJT+q%1(B3rh$;>>N+ArD8OISmsn!Tn{U=%ymKDX<33ucEnHky#4X9c?yBZc zh*QA5Ml&(W*!7lsWO=oMn@N+|G7QeG+qYwrp7Bxw?|N`#(V_^qn)Jrv6bFCs@Rr_E z=UwW#Zm|sYzgCWe? z=Z&FzpP^iPeq2y0w21R<#9kb+Hn*%$tM8qfqE*meUs_~bIA1eU*{@`kcVCZrTcqX2qCbKS*J+|?SJsCZ%Z`6#GFdn|zewXR0U8FIB(3$Nex;&bt z+C5-ffLq7b!Cls$H563-1loYJcZs9h8cPptBDcoc3AlxZb>b!}xX!Z(-wRY6(Bwe= z-}AnE!pXF&U}JA^=vSV%QGb-(i6u!xB)P*#f3G+})^27zH>hM$zxKIJ zUb!O9^BJ5^Qiqml=)>~n0hw3|jw=NRpNH4k3NIt4mtV99n|EONjbzqYVJo2u75N!s z83VB@j-gJfYeSof<61}50IWUdi={b!CIZ-#XzR)XV=4-$+ zJqnbBxIJR{-!CMOe-x<4mOM=-RcLm_-ldA8wehW3-yAMd{&J(Cw`p|m0NL)6+Uiw_O9@=(IrsL8PJa{_v80cCchguG9Vp*0) zmltRaJ`!j>2@C|p>|KY?#HSv$&OX(ZF|0FiCb!_hKzRIJjLRK+T0X5A@^JVSekOL+ z&{81K!ok^Z6j5A8Nb>B9ATNw8TN>wIP7ki-T$16A;l(FyCRG!gwgNFFus1@Y^6O0g zNJm{_!%O_>USpc7n2AkfcSQ+itO{S|JYh)oW4XCwU;wQiSJh^dBIEzM&MPEOg0yKQ z*eU4sDMj!6py;L|!Qz^<&!RVwwQC~d>-=sg+9#W^j}DHeRVUvf+;Ki_xkChePu2ik zwLlKG2REC$h0ek(^KWL>)ed_z6w%^0W2VTxS7WABWGaT0r{^BemLd7^NjBcU*8CEd z{AB8Iw`jLEg}|e*Mp6X++YwshwX|nTOX@rv)i^cfvQk2^B;o7K6gDr5@FRK9awIID z*fjb5U)zoEq;N%P%J8AIZ)R-} zu^o%$NZ&?oGQyl^l7sbBei_%V?~%$3ud+_Ij0|P^4^DXBw+m3mN>=LS8XAL#D}nPr z7p2_bgWfBT@q8LCn=usXV&nN_y_#UYRyZjoxL7ww!fy=e>M3# z86Mq)s+>DU8TPw&qtf{M#p$BA8R~a@!Wk$lZHYJ+w%f?8S;OE1aEZd+jR9J^_Hw>8 zCy5woieKOXkW}VU6zXNJ-Ix5S>#XT)NmGer(7#r+9QR{vHLJ&$`ukX@YpaUx1YaKT zP>V%PW$GMuci_)qtoR{r{Vpr*E9zXDv7C1iDXgwVtO_}Fxngc1-n#J?%gv>s7rC2g zH4l_ITwUK|WWMuVryujGiyrGIr&n`ld#|LK-fDgqbcMlG{FBqC`755zTD8_D2FpK3 z@=h8kusqU^Tex)7@I@iF2yetbfS?ZV^tz{{N^XELR;-Wj7 z%YM;}PwIQxoUJwA?)+l9!xxtuNs4_ZRr=D>^D*P`A-^54)0glQv#^Y@IoGY;jU#33 z+<7AIVW%Ol0@MF1X-&zZ0kdLl-8YI&*MA@;^gUqBENHs=XPv%(&Od>w3!n3E&H3{J zpum$u+ZNnp(U9Mz(Oy@3?dh^|CpfqZz95WH?J;ey$dQm+l)}{h%5A=XS{ERPS>6UT zqgzo+d;b742n>6sDBC?!+l6d@YBx}QnyjopipMFW0Sl(Omnz&h=c#?7Q$6^^Pv4V}d7!js3@_9L*3 z?a7N2+x`W8KB%`4%9!(nS&K9IpJO)&hfo(0Cp<>cs|bliPUw3EI;`;33ZEVq*hV{~ zSM-6zMGe;Zn{1h%MWtTk5V6nqgAtl>fHhoB^=6U)y~;i?PSzjT9>jp$6&8z+uK>MF zZa&kedNVQ^D|hltt`Zc}$-rgwEE+qVHkJ8))!&KS$D2p&H~?6v47t=7!u#oQ=;00# zbXhYwMJk7Q{xV)w)gh{0pgzjLu)DNhQSAW`K{m-du+ez}Z zT)#-4ZOVwskT&^mo54{2v~WPZH3N-Dc}vWMEDrA%|pKQPR@0+k7(g z*8pzsQ0hzna4l2|p)ci87MR8S@KKn;l7VZTnCc-{HMG#>2#`DqMlIL zE5(;-p{F};z+5#%$I7ep%GQmgmn)DzgpT5|bOd95aG&K_L7aZC+Ja}KM#KeqnYIYOW)n$V+$PWnf=bi=b#Z5)uz4$$>x@emv!1<}MTV-~dNW3jLdS~c5F4Dp; zec28>vhh~fmN~wD`kCNGcoiOb6aH!8P!V~%^krQA&L8EElmu}Tx8C{=k-l;kYY}?k z!A+x`7Ik%W-xAy2Tn~b743KjdW&w1m6+ht7)GLjy= z+HcCqYrn7YW_|mk5@;b4ar7S44#@Pl5+C#f*4+7UR8vN>MkM@>!yqRNTIuYok<1jx zJwK{8`)Owtv~x}PpPg1-Hzly!5Kuhp>XYn<_KwSzhIYx)4r=-=Um^~xk6kRL(DH8HN{=|Ui%vID>{=`LeIN0 zgwrkZoURLh`x2yi98upNM}b`v#!qoHO5a5}vPcX6>KJFD--6%K&VLxbx7dzfA8O!K zNO@1`nu&DmN^t(r@+xe3;|r%eP@zJ|eF#e(aB5Mm(DbSu&qsUyQ+7;nR_eZM?y<7F z5uvC4pl!mfP5z7IS{h?^mDlbR?9!y$YqrQ$Bc(aNz34P(W&`nFyK$m;UKA$Zq)v$m zrQA^uD?rxmovm`EARS@|ovFdZdWUppfc^H*lx|Pqxk5~&E~6jO^In`*y%&Sri;kz{ zS@iGQ|0`Z8eLDY<-ke{AR3!U4VAx3vj&K5hmEsK#n^3MELgK?(tHLBvc=Hy*PPW#h z6e}4dlXs!da_xmzeLqK8XsmnE{BTp}HFAr^&Br8jtlGbQT<879{KWi9Q<=hs-mXI7 za?sOry(jMnVMVNX0x}3jP9a_gFfO&CeeDqL!*`K)*x`Q9LyeyE=T`TH@9Ei1xFFe{ zKvEJF`;kHu(H2m~Q^p?N1h!ydkVn)?SR;%kM4*@ht)jB9AHLUHS$^VWoOIA`zc*6K zIC8WxPjCN-R~Zy?|F^k9QtZRZ9+(o!Fvf4|JRkd#IA_D~T|XBS$233_76 z_^+^c3uZS@QNeey99e`Y7`I*Tk&7I2lvILtJA2>;{Jg6Z@XJ>m?gvd}!1oY7c47Bl z^s6o&(<$5{dWlzuuv>`pirE$bHb5wm!^OY*`*4h`)-3?PwV0*ICJaH+imh3la|P$n z6h?)j?2FIvR*TVz+OoH9Pl*dL0f>=#J>Yxn3u4wez_|vllhRQS?-6Zc3Y^8b9*+zd z-}q*(!wU^#{Ic3gyvxQ|jI3i12q>jw3f>^FO24obCr&KzIYAh?%lIFABi%)uxA?Q zanm3y$DUJVM~tLVSi4pLdxKCR;Cx6)6i8+$8varHQwPr7VU>P}heM-S94ieO2ci=4 z6nzD-krhBmgxqTl)IuB2w%`C!04ZpT=kbR)b;4MLe$EjPG>u!7;$x%&S58Sy)*UlR za=W?>m#)7BXeoP5q-zdc1~L=0W8D^jd7zY>YW4s?`^EzF2lCQq2VZt$?!2IVA5 z$|3v>03VT5dPH`y;{BiU1DY>1=se&6ndEhqb zt+6(&nnTO$KXw)OwwR#vurmPb&?M*oc&m0a)1(T#v&P`-0pIFBs=oY4qAr9YJaSq^ z-vlbdm>kM0VUz5XHH^{_!?!|PtF^7;rA0GY+eV1gi;usYM9rvzWNbIQ8L9VDSZJY#|B6an)Amu1p?s$ zrHi6pr({8xdtRmBR0&7)WM_gKo2XC2iv^33Y9ioGpSTRt2^9B_WJlp$D~5U<;s6j3LHKPN_}5eH`Ue?plC<~nS#7M+z4bQSmq8x9tpRw3OQGN> zR&2_JqgaLY5)fm~_WejAaH0~#J#52|P(xRb;1Gjmk^=L|7aDjN47U~5w?9gtvNwMO z)n|5oB$DR9S=nsPHV|wH2Yf+*L)lJ>d5m*@nC;Ma|AKhG5u)O;MW6%{Yl`s>Tmd-b zM3yf%0E|2`Yn-c9dYrrOi|To(sIHSj%{hK#<#&hiaUQ(}?RB}NwkesRg;hPp)2VZ4 z=gTFwi>Krj^2=&6QdqY5SD zk7Qh;kEjCo?xNO7n1b zr*v$;VEK(sNI>?2f?i7VhQ(U#Vh!9nMe?UZr@_9di6 zZ)+LKV5YD;^b(unVY_WzOM#A+^C+({x|Wvqj#W|!caDm>V|h5itt22 z^~K03wx#gENS-A-K=>%r7@4v~@9Hy$(H4EAXx3Z1i#Q9MT2yk#M&Z^b3GW=`ar1e( zq@rombR*8tFgSYg;vxJ+iWfpc%73*S6kx@a>N|FyPt{Jz1u*+uz`Hm_63T*jPB0v5 zsKyUKG*hwg1l|_kZx|vectL=IpeS5e1+dI=53mp?GHg+MHal0T!*4ySvQvO^C;~v| z$Ql>7!(5fuM+)rv&45BCF$SVG!X8dKwTy(_`0*)etRj@6cVC&;4^rhq4xHn%EgXi&_BhhYT{a7vCI$3Gw5V*7e&;Nt|*&jLSubh9zPH@p}Qt z@7;7z@fTO-NgarHP z%qjPLFO}we*+(i913Wz5!3A%|R?t|597r%BsE-C;M8qzoa!OGTi$6XRpJg(bRFsmv zra(qTF#@UYtqfSTeG6cIs-(;n+&@MDTpXydz*`xvqS^kD^7!2NDgFjS+jmXC6-_}F zjvrDodkALNSOT37DU8Bw!ag!|1jVbcG@VA_f4Ogj-~Z=Z^G}*sTl~lEfBP-jq`9Nv z@magAPc4?(@jdiiy{im8k2^W<(yM**YIDH1$D8V!`Vyxj! zTQlnMwe9QGZa6G@bUxQs+u^fB>I}|`3bJuxJ{kK@`l4FmU)1ZLQH}X;ZrVTOe>2SR z2-R}L{&k}A6Qiq*S2l&+7Be*&9+-clzgZX$(>++ZjrQ38_86V@rTq6gvb4xIWhLgG z5}p74PrjsR4_3BAml0+a`Mdt7SVr;mgSch)87Qs^Tts_Ld`;Ct=o70MLf~$`3x!v( z5>l+d!6VcM`xLU&?qBlXrSlnXz7BdA33RH@eD|VU|8?gcdSXTMkAKR4>q^QWw?2va zfAn9vich$$-I$wcGDhED6S0;Gyr@wjBpgzM0C>@|iMOkKzY68{q&gFBPmKqw6k1xl z^&HHGk}*oc(J4v7uAuLqe~WD{V}NrME9mzEoy!oiHb2Iy4n_n4&~u_pAmN0zLc$4* zD8z25Wb*SL(eILDX?y#*zgb!zeEQ_xou$@01Ivo`Z1%wJqkM6!r;#2UpUsc6F|Vi8 z%Rr@;%Br_NuoU%czAhEWQ32bubS(8c3^2mu8 z>3gc;)U3+!AM)RyYb+9AICDe_&nipS}Bg$-|-icAw88J+LpRu&=p{E{i4awN(Ct(pDmLF9S>E`lWtM zmerZr@7F5-;hi@@Dy~}!2&^#F1z3fP$FVfb-K0yMLx@@0iq!Adcr+bG>_vGkfF#wxm^ce=@cwKJwTkD74xawC9}*DDI@tcpJF7W zbWPICjYZfMD0DwilO5rSdmZj)e_O>iO0bCG-MH`S5_GY0dq&&7x;$`^Nm zaz_Se(2f|nLq5lB;QDCf!v60mPZ(7w^kh!>EQFFQ&cERm{NVKy51gTLKE=QYO*TWR0S zYAJ^sx+9kR^7A*g3@0d}qEXSq-2YF%a!hc}k!_;)y+P{Oh1yDqrLzSm<)>nXz5 zMj|QDagZ!l|jM(?dy<#bmIw6RCk`#L;@Yu=Bf$QwsI9-&x90aXxOHWjjBQdY13}3Qz zwly{uDm`5ni%k?yrE?jDp+|8$h4E8(H=*?P6t~{8bJ*3t^Akw$)H1?2812z{_6nqM z!$0|91+J-ZAxrDFH@ZdRrg1eQ{bBcnAQxkLz-~*EK z+kZ;NJYR{OQu2p?f{cJeEcoS#A}KaS%!dWCv6xsO!ielC9_1b6M&KfK8PRJu-ybnM zX68OoJ~V*c3;ECTcplypfHST4m`Ivwgwccd&QEURp%tcB(JS!HUX(8n-x{^i#D0kU zpw7{Sj97A_i?JG^Ad~WkSCjyscp^3ihX#3JO6cm0aZs_|s$fRKqJ1cWFH z_4wl`X6qG77N|)p>i{;G(qn;zjF_-QF=_#XIKVRn1n*)DT7`sro5k&ux27yGDr6rBR?Xyz(GaQLI7W5oXY{*e$ z3n+#PZSh8~%&~YB2+?zLa5qzKs4(L6h$+UHm2p>kF9YYZFrhjWhgsf-P_sm-F&M$3 znhE8Zl<$(`jS(j{Wi|0DxcO2}bBh_+}W4kcn>cta>Q`_ET?BJ2sr`9P)I*a^;% z8u(TaCXG6=kNdqpIdjdq_T-`&3D>^MU(@mJ1Dyl7eL;ed$Auk%#Bl}zxdaCESignD znuOe_#Uen$Q9fw_9%7KQDei=9P0ImFs%Us*prleZoO`INe(V!Q_MrHBR2Ig&ptW&# zC-(LFvvg0r!sWM0WuyqJ0RTjyuiQ0f{R{Q@DR=zrxU)yA>pCWK39IibKqz;rB7t42xwt~#I)+s{$lt=F_oK<1g-?AC7 z1L3eWPOb_@03j7Hyihn!fG=o2>jR)>StK5fC@fLV>kuMN1QM)4Cy|b2QLrSnCy9dD z4Q%3X>yFnjWy;uU3g`%c3WVlT`oclp3KWL;Csx2lq+C2`W8lFypke}evqCNMOp8vv&a19 z+n_YO*Hl`-E{w#&XC(-fc?ANYtMDib%2_>$iHM~92p2pLs!W5pBtpr{Gt)srEP~i5 zZ$i=wT~ezKIa|MWh;uU84{c+02}GTDiHQ?nlx4a?ViVS0A+*?({LIY(*iSH;e3b)+ z+h)Sd6d|axAdIpg&-o7b%HtkXrJ@Kc2_pldB!>z205K>T<%E|YpA`u~VkwUWKw@Fz z0-P}`Js_n6_g7GWZ|&WSGe9MXv?zsqlWqq@%N9s+fd{j3Y9Qa@zYY(V zFPV~v&te~UhT2>?;1j+V7uQmoOLRxzlu3fwqRTeU2~LAm`p$S$iRm@Wy+p1vJ`N{E-lxd zI&p~s@qUj^3C4#U$###xcBweTunaMyQ zR2i%SsZZN72qwz>iFbZJLv4hx+JwXg2FDD1X+@c%30;X97KG7wgdrHIiYo}u2Z`|( zswHYe_2eo%Ev3{|p)K(aICxBOp^%W906`k9NWfJK$B9!>gana7VQoT*Ta3&Ip$6(^ z$$(fXUJleo;-d8*K+~$WKn~C&3d+CLXQH=A~RYG(a7y0 z$ig`~AMIlb^@H@E=e+ACRy8pOzyjNHzQSk0?;P55hQozjH|^ebJ-T1~x+egqS8u`M z_DGK~W2hZO=8A9XQ9uJ^@`KS2OioYg;0r4ro$6~3<*(Fa6pEmXc1QLoM9mnP5r#bE zc)*Hkt1HeRm8gn62wsx{Au)EsHGEi5_9~EE0j*>*uXIHO5AoFK*oV zBRZB&J0@jH+JPF)R?Vf|3pbTv%cDxXlR<1#$g70lvSmeJdr}|~WkMYZSB?=vU__L# zkBxPQJuaNmS@pLe%tj}Xq}rKbTdv-Ia5MOEVfq%WSZtv{iCzZ$*5Ncw;dC54tWFR? z2YHiL%O*k;ii#^E;kdU|nC1Jv2yRXVQG#)6Fux(xd@cujTV;n^0HmO-#-K5a{`2@= z8`LxSOQ>gOLcU~2G1$_R8MKZSLWmBf&+e~FIlunowXCd&2M-)@vXSEs#6o3mv>;q6 za-dq7kTW#xB~)01isXax>+rz>MXt%?lAKmX7gctD8P*7u3_v%`%KuhuYzJlyTFY3DxYFBM%IpXw9VT%k8qZE*A35W1h;9NpJ z0^tlWYg6+8gJ%VC-8LoPvz)M+h+v}#!c#^@geyagXk{v7vYvy4xEV1rh0geZstg5z zU~@iaE%8>P{u2?Do>JEkqy3b8nTQC^pt|jV(N)4YnUsHeAJoo38G*bjyM?&h56Pev zbOuI4gkTQ^rWJ>iunt6tUEoHC;iW7MI3-R?^VUeYlhuC zg+vgO%C=r*UpPU3U7+RH^i%-#&wlq*K1qdZ+kO06} zE>TdibUYomG{r_Cj6VT$`(W>`2+CdiS3wQ!!fJ@?9qW}Xaco)^IpWi=I`k!sb z4t=}99d!xN8CGUbn(}c4B)O@~_}Y}43-v|_J8A*mRT^py_6X=D=C@}+6zhPPP;r%g zv)$%+M)#dHgqu>_cHN|5v6_O>73O=coP6m@+_0dRoS%p<&MPiEl;6O>gC!;RWsF~g zg4Vv!^d7w4x!#K}0?6Ip8-JEBDmma7y?0Y#sL4o7>~m0jBOc1=W;{7#%Jok@|A{%e zIqsjlU189Zc-s(JZ34#F%h8<|PIhP_uX| zSW0TIAygy8+Z}@X%XyT>TL#5oeB>O4#uHPLAkB!-B4iv9-nQt0VruhULV6#S(u=@u z$l^m_&tnTzx;qIr3Bw64je~6hc|S&k-iOr#WC_wvs5gOD1{T>fj^lxavH>U%d{aNf zOk#ty5{z)13B4Z5$96!DcUTIk+(~>p5hnNUUqxg$@+Q*4>x3{5`D1WU^R6{}8uiCM&?e6A^Rx{FF`Fm9ukVh#5_Izyaf7rxS}gp^c6 zh;y*IO1SkXZK{QOX{0bVD&LH8%-DWcjxJ=)TlazWMps>|g1vXmXztXOc(+j0=)MH` z<`PhqEBkQ0WS9o?(;Kj&#&DW`;N%@ogyrjT4R`@i>d2c%Tt!159nUjjR^X4PP?Si# zs{(?qLMk+)9qJDzTVC~|Q9vj{z#oR|bUyd6C5f^z}Zgv})=+H5_5A5T%>#BG{vuphFr z6RL<916_{}9=VrxP!Q{7`e%WD4@@q?FChp5{QTHkUS~GkOQ&CYY3eO z!Y`ib_!%Q*sIt9^t>3)QjD{H=v|xOCp=?$iUjZ?&91(G8Z+Rlgf%pg#2aiH%tGldE z;PMNlFOuhiEV+rhxGCZ2;z&<35%A<4vISnQ;84iu93duf)AUJ+WO2#*C)(? zPRON+q!BzORSqYr9|9UDSfnhd;H4EzNM*~pA(x>ufq&Ev-nkxDkBis{_r0B|E@_6C z(x}6P^cXVi;(LUi8evdsFAkY0d@B-15pgjDU9(gKfQ&Bu$sWp^2?xRPsiJ}FHm#?} z@F_ZSO5cbypNPp6cYH}!soNi!LI_;~IYrw-Lj6GjJr!~JSR|^nhe|MmXqZAHDd{%P zoW+>T|9x!%x#b-?5Du)q3>K2|3407t;r}Sqv%?}0C!94NtN=nd@j=D?uL}Ivz932eAsfi!}quWVZ*JgMITC;xyDc_ zT*xaXd^@zigwqlk!y2#HSxuZNpcC=9qia2EjwHFXtT+Npn@R6IyWUmT4^_j2Ll#5= zkT;HiB@a>$8jQ!NEhg%lo`9IL;^~AQ0}(1lkhvP2gjyqVi5uKL7*6W0)IB$BgYy$e zW~e!+%Cs9l!L6)A8-t@)R>uir4RY81i!kEAQU-L!=o@2+IizrLZ5#NjCt}VJ zqPDI*kHaoVQ2V2V+=#H6y$^}E<^D&1FG#0M70ubFQV{E zq1Or3f%sl4aNf2V3TaTkh>I_AO9Tpp#~^uT z5KjclhX}#*WS!Yi?yoxp#!s(w(LeNfi!dn zAU9O304MTY5R$_76DYmOc;#h4-DE3>DN=?MS%<@SGB=JMmtj^cDo}3FcTYf;pbbg|~82*BKxU$%)cp z$S(|t!3ixAv@O<~@kFz-A;5|_Q9_|>qbDKpf{vTP&w*h&dEAHt2cnMf_ric(W8yCId|(H0KUGq`CmUBH!#qZ-h%gU8EAxfM>c-QdPuhXJ7%BNuB2`8sa?)l9 zUHgNM*>^5p0?JJb%_Rg$h$OTvAnde87==Wv)*rBUCB?cn=kPZ{;afg}9reStU~Iip zxgM(}P#(Y`;Ubli*QJ%=U9y62b5C@cQp-}dkln3;lBsHMY?Q&G0?*X*AE6dJWs7l9 zUg^kePeLNL#xDZnY=BsTGJ`BzLcKs|pA=sK{4zHeS{gMCFFFM@K~9bMNTB73loN#b z@Pp02%vrIkPz{6D-Xb?NZ$xR00_Tl%hX`#8>0CBA5fGXS#djg`shsb7U(HhP0=;%z z8F;8xF+98r@r1GwXwX4=j|%v7SqE67_ktR&DN%MGivun^=y03?8Z_4-gWI6NBd$6A zszjC`Php@|^pp|soS8tdLRWbiN}_zFgw)g27VV*d_7yt5891v!E0<4Ih+Hh8nK_cW2 zulXVM`;EOK#e|k#oo?>lcEi7|($RkFhUDnXS z9uy-toI)$}Bu^4VJqt(o0oRPzLfM9Fip45pYw=}h8)ZKb1|sAcs78S0@U#dIHA6le z-~LrG_y^I105aw51bC_^otRihr5)ZpLbIIDXblCrHiZ03&>29sLP9ft885Dq#(O_;!fR$kr*bON(M+t>L7bVbJ4E1XO*u$jv1o=zln>ZmTTIx2goqL1v%t`IJ-IX!x*fEm z8J<8JoN#DL>Y%KCBE!SYr6@nq?ErWl>2zX(6y=P?coSAi!0IZ#i$DR*5fzd)oM$2!~2O?0^bP%ejd^z7MVM)m26*oC1g@07~rb zX_*+CRkFXV+$pCpC<{5(;E_h{HBb|KAv#Ur={CaC6o%1RTh_kVni1ycXqQNkZHK?q z=qqR>j+O%2({!jH?FoJ`N;h zXhlTdx&Zn#aAb#P0(nRd@lh{RvOIKLH$VD;bPVSh-(`7MlJLj0DPu52jkv7%?&~nB z@ogli>d}{zKWRC)>IyglFSFK(d0hzZO=tjNgAAG!y%6P5*d4U44|f6@Qe(;Mq5O!c zUl8>7akGEp!vPLD4-^;S-^xJe=(RIbzRMBa4FShG&f_jl=Cwsw;`9BfHJuTUbGE=e zQXNqLn#*0n_A&WUU;Lmk0X*NoV@YG#!<%4Lr?T^-PWmj=ULga&*r)3#MACYe<0|Hu ze!8Q_34uMLoLfPbfC^WVe}bMv-3*-~aC9!@3@nJ7FHr`b3njCt0hN&3_<-D7GjcSI z*sXS!)Wi{`tcWWh?k+&<3ETp?$Ete};_f2sY>_wRRjK1lU77!mSAZ?U=!+jeLhVM# zAOe?qlF;QNbYGqftb&`3<5DmgQzl_!BYGuSF{I5dfrMrJsZ+(89MVwGSk8ye;K@IY zx&HVA#^jzwev+?NY_)o0?!M65;wirF{TK4M5}%ZVlAeqys748qb4Q@OZw;&-Q%;jo zV&p3Kfx4c1h_GOTQoku(0gCd|e8vF&E2S0F*r@dbJhe&) zewT2l=q=_}=(~bEMm><8jyNq<(&e0=a3hbHfLl2S!lQ*!+|U-Llw1hrv5mwhdVVks zURbn~`1^;AXPkn%Qn=2LhDB6BVV*^7g=nj&sf4Tt+V~}SAE$JVp;{2bWo3k~0Vo|- zyAN@l0v(e<_+6H7o8X~YF<~&&DG&;NhlQ}b1ZT*~=*{(mM#~2_5^ES@Fu<51Z)?RU zABIaH;Sce`oK8GMe1;0L3TOnD3l@Z`06li_;1PfMAFA(m_~Vd+(vXBxPE=MJvKrJd z$MPc%Kp&{SRTj}HM)KoGtWjcy9jjJ&3HeIFQC0XD*{bQl#>;?nZqXN1S^`Xrtb_Qg z;*rl0K|ZID`1=o$?d`~hFo7R9-pYce6uJK05J{+x$bPI0l&zoXb1}M#9i9jcB+MFz z5$lV0GME^W49+cOfhUJp8$wNo?ciYpMpwa^0Uq%;oPD5twARM5bszADXo6CR4vYdC zNTSFPH&r~HkcURdDjlNQYT@4P+EnabVWzLfkK#Ru!WvPFXeHE$RhSO7Th*FEVT21# z?~a3K2^4|nsC)VmI+ytjw$itn_e53V z!Z~`+&WD;+r>Z5^-o)q=1#Lg#CKA*T2cJHE2#Q#(AZoBRC2sFQl>$G)#PzMW1IK9! zp)^$HPk7CTX{fZ2xYFHu)&wNZB8(wQxoaa6SNvDz((J)rXgD(k`Wil2NA!c5onRLw zX-XEVY$EJhfXy)w75LA8$+3kLom#DDhIax<0z9Gh>yu)m0 ztcBHp2aC!BpsoorB%psBi8k-uxpFgJb7t#y})bexh@nH1)2J02+uDtRzPc5J zZBqzMaGqpp& zhWwoE8VJ>~8VC`Z`~+wsw(VAc$5_aB8_D}>UXFjJ6VRBUzN#i8)cWQ94AZ9@tpB>d zAYvh}M7-UX-*m?RUwJw09Npi32~N+l`etFIy8kcM-9~@*UiAN@C&u_Yn++{9|9W8I zZWS@q(^PlV^|yxwJ3haW;~#M^uq^C1)lBWsa$aKPbx(t>O9!m}^e^J6`H!U=EU~;w zzo%C2@Nm!CupiZmjCT$-w&mn`{`TdxKMK)roU(gtRziIGDr*F|7FUk6ux82UU zAjc%Kz9{|*XHmI2J60wG5KWOPl4?2m3!)E)qEeBYHM?mq-D2Oe9p^rbA36j z_vhJbtj5bo4F{;h+SLog3fNnN?ls-t5wp}_cd%OJAyWFbV!@mvJx=pWIBEfhjJ_FK zKF2XPXEaX`$UV5H#hTwBiVP{STK$l7(AI{Ntsi?)o43m)u|C#P<p|?2)8E5ooNlNq5>Q`hsouIfPL22>~vdlG}HU|}`ZOdUb z{SU3hPrv+@h;H6t-YG3|imOT$lReZKUp11dzc@m`~d-ROeH zWr_7C+O>Ik84DuJT1W@)Y*n+2_;-TS>X?|k)mLmRZZo^B+W(W~WYa9}J!o#Z{|Ei2 z5&mcsMoj6Zrh>(Xi<+`K&8ewN1oHxO4cz-Cw@iC-Nzn9-N-HNr9C4we<5xtZW|9iL>In_4q_nB52ZYB#{w~mb+nD1#gCzJ0~e==2^ zokkM1G#N*jWihp_8uh24CuGw-hJN^`SBh=uU8J9$srB7wj(kDd=a|bc{cL)xspF=N zRjW5`LJ3ksSgX!3uoaqvZ_ z#=!&OV`FVE*OK>o(yMMRM^mc)8|*ympv3X4OnhYN{+QRPfags;~sEIz1{su z!yc_?nZ_D7UFi2}BSRV%mI}Ou5r$*s{0f^hw`dV{jZQYb(Z$SrCh0xv8=7)%N2mWl z)fb#9^@!hc$$(cBnp}CPbo=L*V)aKikL=PPJ-2$(NT>>f?`rte@~YAJqzb2_NF%g- zz1eJDB0al?gFZUm6!XoEM)6z4XK?6ee2SUm~*cT zST^L0H+6BF(jp~l-A)!e{PnMmm*&mzrFj3_AYy1_rgYs;ag>$G;>&M*0=K8yPS6%U zCh<%o)fs1sn6!f$i5>}C*yHn>U6zO+Tw&39okpyiU#Hxg-t)swSMs@2)5X#Mrjxtp zd+j8o&Kauykfn{-KzTTR|(_44mPbnb+7F~y|(P&jDequm{GS&KTEDXvB|1L zT+*p6Teie1J!U=Kx0t8ewJgBix5t<@W4mgXrVqXPpjU{|KJwxye}mC;{P8tmO%v<) zX_0osRTz31{)@)v{&UFOlJYrQ>SI5v+uUNeh2y3oTEUwgDy_UFNaxT-51MO?xQVSA z+-eqV;OGD7RpR$8l7>a&VS9GOgoWcun*{1HSIORRRmMxt`>I9EBpo^}kiN_F7>XBt%B=oMD%q_HP@R(hH#$E zl-^kyS24M1#|tZs9+UFRHO8!8%w??24XY*QUI)(GyeX=(FWR@t{Q^XWXV2JPr| zDaglcVy~w2(yT0P1oTITG!wrsE05j3Y4+!v&ONCw`qYD?X7DuTtzKGo18s%$0`{7`lXvEy-+%k*T>ZK?& zP3B}e4TcztB{#G~Z__lZu0OAABgHWXe$zm;!CNWZF`rBt7}U8RXDE`28T19iq^S_?|09PZZB%nwW3S%cZY0$VG&p6Os1E1 zx0$wzZw`B*J6Od1F7h%tWvbbHaNy_?vFKR&^eS_WW2TXYlRoyRe2h+?i7lz%9%Msb zbI6Qt=Bw*JBz0)^8SGW5yWkaabDyN>q2=$NkCx9A?MKctlj+Tsin+$FO7X+gw;SPfBmw*APE zYsjlT;jgI)-E+;vDC&SpuA94}Mf7v^@e%xvc?b6m8G8#CRN8o|v(Nhm`92iORK%hh zD@(d%J@uHu_S1d_R*#G_Hr77z6j$G8=ENIUp6DPYPVZ^z_(?}wE8A3Xd_nw{rgqKj z9I|oc`ES)m56qDzuQl#GpVjsvMxCu5NMHOreOXLl9G7Y;n5=tcP}yi7o>1nLxmjee zy;Vat=l1iKHYel9OXz~5rMuPG|54#o&k)#bu-Cdt(>&4}-P5#wnZ-Weh>+P&v=5f{ zX!do5sfpxthFauRr}%PMBf$db&q`=};=W zLXFeS*s_RAPCxbJhS;`{Is3l0$XSQJ#8T7Cg~qzJS!J|(c9MpgU{|{R6G@{_{2x}8 z>tj_$PtQ3rJ1;0|wZ8j~wc_C}W6iXjO~Tvs*&FFQ@w|SxqYm6%05u+V9@0&TdvSww@vW zYd2D6e*>$FReb7*=RMU_vGqlxjA70nr?b|?!?;cFpGU-CrJRHT!pi9$egvHIL_P8M11rPa~n?`*@qRf52tIq z!tjo`VS}{t#Kr|zkGJ^;_|l)accajuU45&np1WeTe(?GWU-(VT>f5>`;mSF_{v&g7 z;}%f^^Y+rl+)AcJIe(nyN?sPNZf9epsb^9?{qFT-H>9#E1C2$@x?4NYZVBmKTfE4Y z%Mv0ek&$~C-^bq`a*HEwzy=(lWz4W423^!(K8?WQJVy=>KbGQT1z!!rZc|CVussgIM$_XvAB_lP~|gkj%)a_e~Oc?YpnQRLQ~F3 z1aL+4#jA_1s|N_4RhoOB*`rqHUevT~Lu1?YUedw(w6KuT)hV_%cS+f5GNZ>9CgPfx z#_4WH8rl-$NwP=t>0O?gZPwo*-*aa9dh*2u2+=Wj1(%AyeK50TVI+CwS^n=L@#Pvn zdz$uO6RkMNFd~zS61=7j7{-a;4`P_gZr}>w~ z$vsEy5!}>UAJkro>~Hd#xZIsAI&43?2xSJL)4RNl#on`JBW^+Wb!_7D&lp=wcpxmL zoyamRxB9NF=FRoXjheD3l85Y3x1i+v(m% z)Hoe{{b2D?*{IsAz7~tqi#M2@T&}s;NxY(ermW|v{??@lrdcR0^c9r&JKVYr+VNA0w~dS%|h zcp=G8tRu>ih<(1&MYv=^`}syAWMwMsgz2q^?zLTR?B2kS{uv>K!)-y?$B-dJsa^`A z58jIIVWy-rqnb1mv#*F(jBAGO4+?omzQo;mQXJh`{_;A~`W5jJISB}DOJYw7UjE`o zkK*?*qeRB6M=Ro`Ur!gziz*XWJzMZ<`?2qtc7@D2f6kNs*NgtbshfG(B0m30q@-vY zdD^$hUDt9As((DPlWsE{M_F{Q?Hnbe_(%eC<+$d-h1+8NLK-E^`t6@{J{@f9dugnB zZLN5*kG?>rDP4B7k;(ail(=sOT1{KoTGx=9A@UUt?&gwDo~a*4Z!5K82{(Q|@O`S_ zMk&d2XK8t?$bRJ0A}96Ev;0Zj>0STQr9X*|RJ#=IO6Cd>w6XI1?#I+}3B#~rsi`1% zQK209kIthdNI#t}{x)2tG}=V06=$Vcr$fJ1Z^iQZT74jFklBU6w2i?2k(BxRYgsv| zp`3KHJfKp)RLZYVb0zQlW_~u``{<=jb>h!QG<}b3*mTOr3*EmAMZA-On-|(OL@hp> zUYw7oCLeEed95jpnSbJ;4PSqntK{L<#Clb3>gs{Leb-I2 zXKTD9x={yjw6v-TmiN!((F?Sr2ao$~*=gvRZQtb{Mm`=9GoxWx7Qe-izDuoj4`LzO zLhLGoI<@__>d79t8fo5CZC#$Bkw`ZY(|W8lgQsyux5^Iqk1=&`HRLdFtkn2-s~5RQ zGksgLfL+%gvlQV-PBaQ|o?HoOh?Llf@}meIGj&2Nm9LY{9Oa< z5wuUaw8GQy>1jl5aHe+^1<(b5p_FW7X8&Rn*11TP(QR`P{lJ<_b-t%2*uTuOysKQS zbIm2>KN}CCXv=8vLNp#ikYSp0J5@Ysx4Q4?+0}mGYK)hs zJ-!OjYi2U8FR=7Xtdv^BNxyU#JpI~_K9ME99^^-_$_gV#&p)xWZuP@~?y=Rk*tDHy zSxq;ajVt^8LQJjQ%5QetSFtnOWSQojYm1n-qEknAYsyAi#m6_MUfvVFJ+E!;m*Uzd z3o0`$9i_VqtTNne7+cuG^A3)0-+tPswC->%;@6ma!^Z$E$L>F$v3rBoY1CJM_3FX_r9s@1?t>H0B^ z@lt=8Ua0Em_wz(art|`tYboL&Xsl+-jHn#`b?d`Em!3OiT!?#|=P4P=rF$TK&YmT$ z$?0Y;j5awIqtdnBUEJ3qPJZY~7u@k_y>Fzcl}oQ$xhX2gHDqr60`%5S_d}<*{v%=V zby(94T7tfCLF93b;_p4)=J2uzJ^S5nnOVzz1l{N<10Fq2pHkwbFS<4Q^p?h#?N)33 zZ+%3iYk1nJ>(S{x+j#eN*3+xc1d+dx$H%%8_Ow8QSpt!M^^d#*U2oL8?3=`XdSYok zPn|KqcRKxTD#xscxwTK*Z}H0b?qBK$3;E3MsE{J#Ar$7AD%=d@_y?asbfF`)BjYQcV=Tm zOBU1ZJ0y!-gRS2fd`;e_hX72+zJsM~6}GKBAc3cW$j=iu6v0Ld?>*y%J zNM%bIxjE^Gz%#CFi2c0FODcZGUr@PsZ;EZ!`c-;~cj7nId4&`*RP8PyR8b;WRGKPw zX$=ceU&!G0W@z?JGfSWd(ol*-(^zubLA#tQLkmZNe(N5MzB@*hF+qq`BCQWKPvB-G zi)9?~v)|2GU)1rv>76L3+kSe&IAQX{G{*J>pMWGJhSY)ag#4FYA+Oe^bRAJ?P2q2` ziB#(%t8fCgZ@-6LF65HEiHk+tLyqM2ZuM5DqPFDCy7Un$m;A;iBdxaXGrIc@LybJw z@Xuygomdau42yVZMabc5c8m)}f2a-5-i>-Nf* ze~j&U{MX}0y}N^F=x)F8S8rb4t5+A3(oVZSyML=^==QA(D`I|nm3Suh_jSR?vo7p= zQM+hg^yKd2xAV5Yc{QH5d)4!yQy2C;`YmDX^^0Eg95u7p5?~(+bi5yiSlk?;C*Gs%Y zy8OczWw%i#NPVM5@w;NQ=+Bs;$t7P=#5tQ?Lh52tM!V`(H{>8A_>Y;`$0cM*tm?py zt;dRdaxS*5Y!-YQs8UM3&3`7|u9ZDeR$k|_DeRBP%|}<6io-8opSQSjeDD0-4U>k` zy8fM7pT#97S~hgIC+xD(3mRz{YKv|rozR)%mo?jOL1xgz2C;CKv3JZui}jgdo4bt* znJ;wpWBuI9oxTh?o}xi2P4Est4yD@DzAJ{`mixK*Xsw2klWzIm^N%floCMJ+CA)ki72~8Mx79{n zbL@8PSWs{`mSe1vUf#%S%X>g==AOEZ>u z6-c`Wb9@5g+ODt6=(lW;HrEdh)1RbeGVSh~7rbc`-L#Igs9Ak$Wl)LtYI0dMZ;^M@ zs&RkQ1&89Ieroz3Dt19x;;++2opSACzRlF=8(P%;$rW*ck-g2+0_F@Kmy%8ER==UeOK-+U zWV(c0IZ@CiJ8kuNGJDgDuj1FF(_@0;b~Rn`x_{-WSn4N!ve~H8yEJag?QzY%`3vJs zX7@kam{R*00*~GGs~gH`@xz|;i@$v!VlKG4;PiWrSQ40(lg|5QKO>u(T?xTQVDV&97zq7$y=iDu&S zD-w3SToV>z_f6tGl)+sM*i;p~Nf2+v+ORxheeU3aeAn>2*0w!8A={1 z*Znq+WRO6O8kspONQLpzMe_Z~AfMTFmO1+`ql}wYaa&e;l7q!@-hUOf-E#E094g+; zCiB{ZrHTxQ(f}u7(~pYj~#lZ}TD_Y4}|-cW@|*I`9YCVs3!_$Z$l+%K-h^rd}zR z3o^~Uix)nAP`^dQZ#!hkm!2$S-b~Z(GYd{+?@Fo~YrFL?u~x-V`qi}|Pkvi?xQTaC z{FifTX_o5ffwT49|44}bSwm(yy|rt=>Rt}*UL|uN&d)&B6e-!_5aRxHhZ_4;GN+dR zyrrUn(iPX|tU4Mov#-Y@KDtL!8j`VTcFLwlzi6iS%uGBzU7T3$<)kH!b@K|jaLSh9 z-P+l9zQ~BxY@NXM%CcfTTX@=lC&`l05IB)`7Y;DrqudtNI@6?cis z1E$fV4o095-sMyD5Y^; z^e(Y)*QmA$lAPX{jkuR=1H0X7rM<4=*oR@relnOLDOj%iDOIiZuwqW_&Nlhn>UBIZEog&GVg=toj4F5UR2kLDp$oTj!^iGl zKkq`96d{6b!rEfFwW+{A$=adMnM5B6=wZ^%EXbHv!=L;#bu{Ei(35ETtF;mmQBj*pg*nUQ2Zx|12!L=TFW4XDc*($wrkk zHcGZVD@tx#rq}n2iDlS4>7i5A3#gu|t)wE7v|pp8E~Tp?+w5fX5zCNg!;kwN&y?rM z=I)DaNu@a29enfbV(+Efdtdx^BB4KfPv3*pub;ZF8+tT(latC*&3bzG!S9bB`L=ZY zb@T4vy5D!F?cQPZ`q`s1d9ks(#*UNG+=9{SmuV9*b7$z;y&Qg&v(Ikd4;?u}eh+S*do%jrk>1|FB3|4bTYI5@?}X{q zM|tO0#r!$a;pnFK^i1w=tMX!>{`si)q5H)1EuUQ-i+%IFw=68}!ub_8b#MB1xXG4R z#$2!)T&s5@Z5#Dz_tuf~7hZCY-@Y|C7N& zG{^tOjWdU~2iEyI-i#lsa}3W)dGIRte@}0I{^#KITYYoS$4X**4OiusWp-#sWxVL^ zYTa%v;ypC%Oa04i>{jq9|L_ZcJ-T3P9aC8Ry8U=XK-#LnqbtAN89nx>cd=RKhUc42 z&6R&$G@uE9AzVgIVZp`Aq4JoG=MQF93wNA0Cw@5Y6+BE7?($o5A-j>+y z!JaIp2Y%>G(bJNaZ<@rw9|0EjDf<1U-|Kt7%vtfxA9o@r%o6loSqDE(`Q?b_v&>Jr zCVii0c4}{QZjJf3ih7_&PA%dHLa-FDo|IHEh;DiLfFHSgzMWzL+L zIWwO#_a@RWbbgOTwlp47y4J9760OaSXN@%{c{ruHZ~4r{F}tw~;pUiK^!d}RU#GNg zr=Wa->)&oEIaU9)WK3w|xAki^od+QXeknJ^Xa+>yR&6?*d7D|lK`ya^T9OL@C&N+Z zER^t|IZVqd5_yXPOee%d5jrsnt!26?RTBduXpKUswB6-}Nz}+2Gg=N$4HKm)FdP<@ z!XGs^Lu$pPc-<(X#Bdykb4x^qsFf}2%{AiTQMi{#lZc+krKcN`9Z883SA<(!Y87I2 zDJ1GlzBDD*o||rO1BbtgV1pql8^EN>Ai7WENXEn#W}YN^0`V_Z1D#w+BwssJY5oK4Zx z8$%}tvf4lnw|^mM+g_Yy1@CL>_6hOxt41Wm8qjpfDwcv1sAYQ4eMXb>#B-1C$%rWAs!8j*Tn(6Yu{ zpWI2BF%+3HDT9!mU5NC@jIDSpONvx`aZ#b!yM`wJ9;I%jJNy zD+cTQz<6B1BI4P6%L~^m5sE<$md$_$U|wZAD|<`KknRx7;Ls)MARhv$*Ye#)xlMFT zjjBaN6Ja%Rx;{;P_kc46C7v2Pt#0IH@NcE+!~~Bl8ks013ac@$YRQlchb(;Cfy1HV zRgHwKAgIjHFFSEOym#v&lsZ>A#!Sy@)14wN;6#QfJ6eCCl^XCoM^6*#HPnGa^fMO( zqsup9j7Lx7MEQZSA8|TgK>S-RlMV7R<48>O2%lF}b2q(-lsMu;oTFckdJdATlA=N9NOuv3u{ zBq|E1%d%p&x0=}n?hD)}QtZmB%c{#_i%>QJk#!IWV&{h_gzRztR~@+SKGmfkw-H?a z^Q%kgUl$J6E;o2C^Y~(C9eEk~X%O6K^xUz~yR6&&$(K+kU3GTFi7f}Hk;z^`R}+F3 z9kuhF9Q^bAa5JJkn=y4xos%p%+vJufA7pG?`|^Snanr)PmW*uku0vlXhrZ6TikM_WtQoAjKU9bLRoT08n6}Wksmu$s(jpxSn z9`&K$%MCwf`sk=7BA}%$?^}KA1CM}S$eSk5*5vAh&n)vD$7@~s|IDIO1p~htb~bAd zW$tes8t6H?BO+&gN& z(TY+kQsZ@>XdYMq)nz#wmz2P;q~iqjKtPUM*T`d#L$?r)b*L{Hq8{8vpu=~FV89S# z6dxW)^`>f+VgcL@m#fS;qmwa4#rcml#h}M^8hZSOR&q)$7SR3aA<7J2%5gXC@92r7 zKqzotBR7^#ZaS=#pV=Xpkob7RG^d*=u+Sd~KPlAwyw1q|sZh@6*rT7(ps*D#QB2&H zjp!*BCSu1#x-kN_d7;i4-T@>`PT>ed0x7ty0V)<0QCzDPz22@q&ouXA6FoyEEyjv7 z1T77+ay#_im83x*e|9+mxSE@(>BmEXGOVWe%m7)6=NqCYbL({N7*>zEn_rUU4Vzkx zUzvhwC8%q%G4%P)3B^l|}sq(I#wuU@2FlxA7sSVSCBLidKU908qA2@{ei8x9Lzp?y2xF8UhjmS+k}j%T-- z9!PSl{7Te${SNzLE9$cwk>Nqt(4Q=Y$R`Q0KkR?`7_}yI_1(lXTV)xNWQ=LMlrhvf z5m=!EcoTyWh>IQ>;dUl%B&U;+DD~15TXWls@%IF`nBD#LZ`p5kpM1@PMHodzSz_Yj z7DcRx5f>j~tXWz2%WzERC_poBv(im64PdSs8_Cnigqul%rq!w|1vvCyu>s*@>&w@V z16mkkGLIQHd%`9@QuQ)E)B|vyRdONl} z@|7gV7v|hZ-zNOOPrV@luL<{s+%K1cw=J(-IF_C2?(hbhUas){!Jvyu>AtfuF3u?m z-;-Yi`?-W{lpZ+s2rPoDpMW6c<@!XMfr=`%Q4MA{c?{TL^e!9f;ggZmM zxa{=;hnmuzuLYI+5cXls8@;jxzYdm1wvLstTJxz%X?GX{X7rH}4A1A(9F}nRzckmXSh~y_!g{Q6kdc@4#K7We$Y~@vE zM>>z}+Wn3A(Qm5O4&Jfi%UI_QL{odL&rrY)S-(&6#k)y$*5!?bHupT;8;KiVx*|eD zhpSg7KiPElW?r&%#@f&TV3OGgXkUO!5m zPY-wBx^#Da(C}GEC*fMSqA4H80ahFjtlk&@>e%G}Eq?TW`?D$Ry?beUb8kbhc~c+XuOA+piJ8 z$0FVkpQc_bRkOXJnNHR>IMGeQn-{>`zP5z9)>UtgN9g(>jI>0Jcu+Q|PR}B!W6>&M z^W+}0>3BHNF%cHV#`qeF`C*|tf9)%R%^x8K?z@nA*)3lhM%$PqZ3uLkQVXDd8G2JzzL) zAwxHwzi1qz8B@Sj>+C(WEquILr^FXs*`mrxd0W}XEfPZEK()HVa{wBr0Zyi5_fj^W zo9b9rwW0c`u+DBU?p4`>-P`wUCuW`eGpr}&isw-}1MPm)laqY&h%GDDV8dHW@KVHL zP}Sp+3STqC@x=Xn>BS5tuC3+qHHy?&ZG8=PDFQuVJbbWI`{VzG@<(*Key$?KI15Nn zUaV8z$cha7)*Bf4Os3vjwKK`2 z01%2W01c2)F)C>S93HAUk&EaS?38VLo=a&m*9j^B9UrQhz)_}T7@2h2>lRKwoug3_ zDC+(!Ps;bsOHAL;s)#6|mt6b&GSu})Oq-w$^P{pTm+6;!vvqM%7Zj;VuL=)mhytIoU=>v0iU)vkR!SBOwSVm3DvBmmY5hrQNNgk_r8{A=%KlE! zPX0=Gdb3Hkqebk2p|O&V+pmSgxpHvJ=VrOJ9qD#-0|_s=5t>)|3L^G5~XGZ@7pi5+!k*Psf{{4 z0_pj`GqDTSEL-&ShUP;#NW7K@63hCTDU#*r{Du0U)y(i-*Zm*hM<&B z&@NqZZ=W03d+^&k9$d~O-|`#?)I36D1iLt^5t+d*pcmY;vp6}VKw4PS`@;Yd;XD}d z@hVzm+IP=yezGbz*QrGQ?7Qdk>ze{1?xJGb3?lEMP_8R4TqD5lDZ8ZopY8l~`pW$3 zMYZJ7cY8jJ&b|uKfF*7>p0i9RgZeZVES02!`BeKm=cDuaP;kh3~&`NYSnYn_1=xbY+W&~Bb znRY{-z=A0YRxex~KUuuo=G~Qyq8ou9dVI3Bo!c;d$q=_SJ9AFm&`2(0eI*$VmmQuP zm{6;cpP&oE+|E-NmLBHEawms|li#Y+^NU)_9`+}V@8;NMPW0YNVmLg{fC+vu2{IF1 z8;!DDB51pP8L{QGy7&Hy7Y>o%42&GgjdytX*J$<{X-@EPz-K$L1=3UDQmlU#<67cp zI|J+XwIq*j{qn`k<>2+rKu_bxtIE7RCNsv2yCJ{t{e5pC>A~*n?_agUPxj1K=*;M_ z9PmFh6F@#*_3 z4Z|Ok9BsspJ}!EQIF!fP0ZRGh)oCfC9^?{k#KCU=rqfrU;pU%%*RavD z+zNvbyC`!Nt!Wqji%!LD;@v^Z=t=?yi$f#$EoDZ% zfnUII&?!9AyB7)t565k!Qtvtkib5`E(mF#63!%xfepn<&+CfU^z_RKgFe|>oO2jlY z91qY{2}49cgfp%bNTdf6Mx#_y69N*v9RC^tV-v&PaBzVxWT!$Jh=8;M>6jV^t!|VO z0R=c%R*IMvDBS?h2P23jyQoz% zs#JIsq4-Z$ua%BrD1xWEDaW#)P81D;c6se}#O1ZHGmrcWQ1J=TN+Tb>Hh2&XaA80d ztIV01OHxd6i<}K1I!Ut@?^XjH@;1{7J9xL0(ijmf%S;y)EgEZMWKoDFi7v`+2n98j z>&!HSx&f2AVWhKcCh}o%F_O}3LZvLkK!;4FxDC}d zL$!mW2^hs-^O9r<2i~J&WseqPv^c`&K<_43&X15!Ho(u{L5SFu)ND*j&vGD6dxF-} zA8W2_^OSUEIaHqs1ctM#l)cTL<_$MvoVrzGA<*Qg6c$?CF_0l0T^U6`OeGpT<+R zj2xt_w~2Y>TQ`IfE$C2e3pq%3Np}1#pm{ONCtCv#$--bJ#OxC9Hf?T()D5!|NCf(a zcDIegJxmkq;D$(l@-jEG^i5<^T!`WCXVo9sF_qvuj+v=qceCHz7x@C3Bno3A#mvm# z_DL!9FXz_-Sarwgz`LPOLQ+d%HWw#eCb^h43OC10Jm*1tmYnoD6TXPbQN8{0^_PcW zbyD)wCHn^IXn2D8_W!&&hhUwfa&KvtmmMo*C6%^L99Vk&SWyJ?T*=f*uhnIHnN=NK z4?Dst3vGKCyzOC?tA*ujgrjzlH|K170_=ODzu8e%ML6c1)EQPuvh6{R8fn2nDYA(R z$4WaVyTUl9?*6g2w8Jj*%}ZG4xs>qAJAc{qjIS1!Q9?OF7b~MSv>R7to8*>mrWrEL z4J_<*lf7+e{wtMs$_;$;EN<;On3cF*d3|GQVB_zplz_gp(KWGR7)oJ=9E%WbkNfMq zmf(F7SYD$N!8%6zj%eMP9f<{&VN2>h3N$jD8m7|#MhOLo@Is8kq1{|U(qmVxDgOHL z%iMtn{*>+nXP3t|4X>{h+BO>|{DqY6nwpAVk^HT9J}Wjq;1a#EyRGNEZFg~NLf6^s z8oP+93cD>UJo1HQtuI5{&!&V|l*YUCoDYex`#CV=$o@oyU9K04-)p~3m>*x ztoTk(VQg#UZ+Z$od%~v)%CVhiox>{xT|S~Z=9j$dOcD8)&e*=Ya^WTwjdsdBarmRs zPqDbijhWLFiRMoX3)$Gy+Pde4t``WF$Dzj1X1ZmO8yI4(;F!&p=VThgXeD#$k;(8i+33r z!eJ{_=>{;UW~7wan<}X(vxGu9ZhUG*MvHbG9`?N@kQlqiD^LMusdbV@0jv$HCJK+3 z!O%r59J$8Z#f_+tr%D0-lg~&K+2&d?Z*(b2Zp=ErPf3kl-BNh!Yy9UI7%8DT!TrKb zfUN)6O**_wPM38*$&qy9(`EUbd%OxE1vS~kkJrj4qkZxPWy*?{>+7I?)H8RWu;K}+ zoPo>r9^F}TqzmSKMk5ayg?F_Cr9ajUNnw#iFMNEvwxsMLlOnXex*PDYGa|~wKv%yG zqaY`ZGh9je2$Al5e&VDLzVZU-dy*A^tb%A|h9uyazew8ibv>RdaUA=JOWTZbk+oBe zMHLxBSITt?pl;PpQA^h-v-nwN=16h9fi5!qYg!?#l)06y(b$I=8@7>2y0jLiSlA6W zN6N*8c8BY3k-p;8-yv*2k_2bE65|L=gs`9zUp08_35plYj{j>4nWA&JPWQ|Cf+N{j zhdhtrcF@+CjVF1UX9;31g_BNf5^*P^6zV8SI~HnI!YI3`RHsxM)2c$$jY(Cxr5?mO z3-A%(P=^`)(UQ}LPE=vu41xm?x+u!q-v|@R{4K{xi87m4@Pg$@ykYz2-^1K$>!ME& z@`^bA%_Fz0lLlljGCUaZKL=#DcPMSU!!TKR`cBr~AJ*Ux62v^f5ZTd-oLs~I3+5!Ujgi?LxLd?=;RCNb2E@;UFZ#3%UN;iqdkZNc#l;(! z#sVdgGT4XARiJvIcmW}^jGsnJf6 zh6;m;C}>2xIlibwEjfJ;>2B^#C{ep7)6oa{ui>AB-Bj~YdV^tSaj0PH?SoGXMB}7(Nc_Q`l%Pv?n>>SlJ1|vz4mL7UOXwy zP3swu9`DIx@G>+_PRQh2{M(nKr#5E$!5EcnELU}CK-I13!iAruElqm*RJ-nHJUn!B z?t^l_>?x%U0}=W$4Xx_S5%*kU@MHYpF+UL2DD{aiv$`9}D&*-g`g($bQ=%X+I=Y*R zM&sxq7yx{jWLD@(PI*!&#;0ck;o(LYolNSD0jLn2l19<8;5tDYoI*MAG@*OcMNJ4X zpTJc;mxoz=n9)zasLnpj?W3^Us<&&TJJuN9;mwEkHFKDdo#{~QPj!Dv~zp~F%+zZ-9PQiz`A}`@#!MUIOH45!D4UD|v z4a+9PKjt`;P4?HryVavSZ*-8?i~TqkQnZ!$ek%2aB@KSSE@`6A{}Y4UuatxKBI)Go zdbpQOlCrN660kbFFTpUpZ*eA^?IgTkwc~TI_4n)lj)d>KaB_bha9V@%t|C}KMJ53GBFsc|)MbA((dNl97o3Bmcz z4R%4xGdV|d zzxQ+I#`dXndq^4P0UgP*V~SREBhS2$y?m?vJdI#|@+G`2I$6NntGc#aP%DXJ-nR`T zWhz6g2Ay-?CMuf^m$<@7RVa_9z7 z7nLfX?hM7kG&~tM748K=*Yq0zGJ0x7hPRFQu%S7}?2;RpGT{V$t<5OtD2Dwl*lpah#JZ(UYSej{nks`C&}ZHtf_|Ga@x z-WqTzi||+&jv2qTGA3ST_bG~TQW`$4xez^Ic?NA2{-r-U)i~VP-xS2mZQ5 zNW9lT2{o&nCW8S}>ELSt2_3p9?Lshud<4T;gaOcfXT1mF1#Y`P-zw^ z(iL=)Nl7$wK-eaNw3+uh13DSg*OLoz)cQP-NH47iFVCT>c!$ThQC^TfPF5D|1&vD6cq zf<|{dleMH6Q6?j_&D|t*NlA%R@az7~E!w1Qu@7LVTNK|P16oKBMB>YVTC0+c+YYZ1 z<4;n`|B(ko*dF8!XDtt*29xRjz^RV>QBp zpY2IGfp0}xcg!|YU5)l}?%|XzN#I2q^%E3Z4RD(F3qsGd1ceMIZPZ^{&9s3!r>J(wwjo$XvEy1(h0enCPjCO+Bd^wi)82dx>;Hm9gN zwH4G5?*=68k`V@_o9cj~fHZNpBm1B}pX!4E(#Y;=5IW}b!p0uezaT%tv zY4_<;wr#)1zlfrtI=mqeF`he zN2@#WM9o$G)9n@tFtK^LQfjW|wPH|{5is?ds=YFKV+%z55?`x4O)hyC(ojMS4gU)@5M&pqC52nA&0)KYHY)jepys;-r*2nX#(j`#1PnWhp*q zq7*+=6A3AYj7CATN)*p4;(t`+r0{gzf`n(P&MxahY%yeiEe6nSZ>2~1mOO}LsGZEJ zegJZ>rjdD$DH|8T?I@daW7s~ zlc16z$USx#cy@2Jaf<-(&crl4@r5C(k=FULnueuJEp_Y`c>$^pmhJrlzRh6hgEK@` z%cEY+Yn=IEH_~zDDl+rysaq;{gO%87H&v?dFSdVhy>zwho1hf8Vb(M4PQfY z{DFJR`sX)xwO1oPb#sm*aSFbayzICDKQX$x*5c-d~YERx}lFg2L^M?*zxuv{nGajAjdH;@ktO3~xm>e4f5ow8a7&O~i z4Enid(`wBHm}~8mR!bioVru2W>yicNSmg==Cq|-FHrX9XOq?L}$+T;reb=p(N_ndK zMYk(78KdK4*OXIu8f@lUTtT<7H*L)G!DpO83_{l`7yuHTe)gxlXoT3ELq{-?DXM2J zWm1;?iF4Q=#l^(rLem>C=Qy{i_2k6y^?}yEptM>HRk$*8yq~u~F1e>;$SLHyp0RD| zZY?_!lb&m&QaZ)uZBK)e@7dEK*u;^FK#$Z$Y9(z(`b0gMkS`; z5~fd*XLdf7iH&vMd*?#X-dC_%G{HJwadu~2;(518odMn@x~%cp1ErVFA#VIw7 zb*+S#9mhP$;$yYKnB^(SS0J#91lczfR4FyYQ1UoL3{(Hf>GX=E47!YPVm+jB)K`u6 zA8(^tMgN)K(K>vVE!feP4u74G=63Wib-vRQ^)`FzS+h4ki{e&;i6%dl=@ahWXtg&^ zJ7EqpGEQkRtlRiq0!p+0)MH$LpHy{)5xYtTU!1HJUeI>KvBZzyU-Z>AHeB<8$Sy3lc7v)XG;9!YqbJ4n0~zTYyEyekU;zY0 zWv;qSNeUHZP<5CwRzUU|#A%)Y-_Xv^iTGxsy!0S*oP4~S{@8lQn#ZHp7gp_KUKOk~ z{VJuC?M?Ysyl3Q?ZS(Tzoj`h`)q&CnzhC+D#|_x*OXiPK`h+zeznrJ$>P$C4U4CYh z6zWgp+W^UWGwCN8fJCC`YRP+%>UE-BH^ zWlDIWvR`csBr7lKSW=O0D2oHI4DmQB0s!pk929`#pri<>i*~Y;Q%4F$W867951mkR zTTJBy=)??2pqrX+jK>1veqJe<_@|_()D$HQjD2c8M1;FHL8Pb~>DGfV-5>%`6EIVg zM2vbwA_sJ$zyKYCgO-{D6S*|YWQC=UkIPgeEQf@GsA`N<02887y;^N0klyG66Ow%a zl@Ak-COLbJ!i1Qo>Jgt37zur}3Wj+KjArHFMYnvCA89gDm2@Tv*}9P_R2sCym%wx+p) z!D?c(33xAV3ZbvfJ{q4$;yCs^Ca;QAT4bnfuhp*%R@j26zDI zj7~!nkviUmM9edtjw#YjmEeF$C5?=n5LOtPQ#rt`Mnx7}*97BE!pLzG2?PrB;W(}+ zrWP}Lp;9@NQr~n3mM>{?{Uop#O3+EJ7b@b{a6l}diS6A(SxfGMvOdZ!LOmXRjL~ew zXd7}*;x)dvp=L<9*+po=Rg|J%*kX%WmUyeBcbS5-(zT!cTkvBFaKYmRkGvAff3pvk z%cJbaaDT6lY`X}TMYe&*Q` z<^iQK@P5N=H-QJr&+}+$D5@7OTKbOed#pBj(EY&qQTd_He>4A2HyhfyS_Yx>$kRN# zQmG;$R{ZLj!B`Gv~DFXJ~y2Rv+d?I+Y16h|Q5t^2gpQ z@}FSOEi6t!Gd-^pL+46xmTZWg zY|;F}FVYLY_~|^2|BwxzpWARf+0=PPf;vsrleOD2k8scScq%ki`KuB1=ktiKCIPG- z>Ge#RXC$bW6yk$ud()+8_FO~K+sdoRS}`+ngy~6D+i$JlooW(2)*K5qXZ`@YYb?U@IX9RtZ$&K3L&S+Lp(L7(gIz_G>P)@qI%>Gm9zN5>QV z%Es+d;GFk;wcc}s_Jka&5YXfiw(_##RD1aQJ43%u^x8dZYg&gm%ny@v&9zp&PZmD3 z5cR&P$*YT=Ysr2lZFzC%T*ZL=gV2(+-82dc$QM*Q zv46;W--&{Kitig@^WPqTizBS#BZ@-_6z8`G?6O;ft-IeVe&tMeSaH5skf^KjEa@DH ztZ)K;5Bbm~Ke+?iw;QKb7CQ~PKEzV`PkQqY0Zk~PG_uCCW9rB3cr|;v%X~;Dl;?99~22Nh#8$n`M&*@S*RUf;!XgcVS zTPr7be)$hlo5r5{-PwAr_$lMUIX_Q6tc^ps^#NF$bpX8$=T$dB2*Zu^70u_?W}p)o zkFtHt=K7#%`Ph2~rqspSM_A4i!)K%aA_To{@r}7Ye!sa3p&~ya@IqaXeHnw=$x=yJ z`QyOfyW$_i1b<9X