buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L #·^ à ¨
Ç à @ @ ÈÆ S à ÿ H .text $§ ¨ `.rsrc ÿ à ª @ @.reloc ² @ B base_address:0x00400000 process_identifier:4408 process_handle:0x00000364
1
1
0
WriteProcessMemory
buffer: P 8 h à Ì lã Ì4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °, S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 C o m m e n t s " C o m p a n y N a m e * F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 1 . 0 . 0 . 0 2 I n t e r n a l N a m e S t u b . e x e & L e g a l C o p y r i g h t * L e g a l T r a d e m a r k s : O r i g i n a l F i l e n a m e S t u b . e x e " P r o d u c t N a m e 4 P r o d u c t V e r s i o n 1 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 1 . 0 . 0 . 0 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly> base_address:0x0040e000 process_identifier:4408 process_handle:0x00000364
1
1
0
WriteProcessMemory
buffer: À 7 base_address:0x00410000 process_identifier:4408 process_handle:0x00000364
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L #·^ à ¨
Ç à @ @ ÈÆ S à ÿ H .text $§ ¨ `.rsrc ÿ à ª @ @.reloc ² @ B base_address:0x00400000 process_identifier:4408 process_handle:0x00000364
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L #·^ à ¨
Ç à @ @ ÈÆ S à ÿ H .text $§ ¨ `.rsrc ÿ à ª @ @.reloc ² @ B base_address:0x00400000 process_identifier:4408 process_handle:0x00000364
buffer: P 8 h à Ì lã Ì4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °, S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 C o m m e n t s " C o m p a n y N a m e * F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 1 . 0 . 0 . 0 2 I n t e r n a l N a m e S t u b . e x e & L e g a l C o p y r i g h t * L e g a l T r a d e m a r k s : O r i g i n a l F i l e n a m e S t u b . e x e " P r o d u c t N a m e 4 P r o d u c t V e r s i o n 1 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 1 . 0 . 0 . 0 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!-- Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!-- Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!-- Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!-- Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!-- Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
<asmv3:application xmlns:asmv3="urn:schemas-microsoft-com:asm.v3" >
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">
<dpiAware>true</dpiAware>
</asmv3:windowsSettings>
</asmv3:application>
</assembly> base_address:0x0040e000 process_identifier:4408 process_handle:0x00000364
1
1
0
WriteProcessMemory
buffer: À 7 base_address:0x00410000 process_identifier:4408 process_handle:0x00000364
EmmyCrypted.exe