Figure 4: Searching the VMWare process for known memory in the guest.