AArgus50FairReverse-engineering evidence from a running Windows process, not the binary on disk.Registryr0ptik