buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3016 process_handle:0x00000214
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:3016 process_handle:0x00000214
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:3016 process_handle:0x00000214
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1120 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:1120 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:1120 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2576 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2576 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2576 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2612 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2612 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2612 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1896 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:1896 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:1896 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2312 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2312 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2312 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2020 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2020 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2020 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1892 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:1892 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:1892 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2492 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2492 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2492 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3208 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:3208 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:3208 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3616 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:3616 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:3616 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3780 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:3780 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:3780 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3924 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:3924 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3016 process_handle:0x00000214
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1120 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2576 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2612 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1896 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2312 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2020 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1892 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2492 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3208 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3616 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3780 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3924 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3416 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3564 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3264 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3876 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:4052 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2056 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1684 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3540 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3848 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3356 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:4032 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3824 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2300 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1188 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3484 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2600 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3988 process_handle:0x00000258
key_handle:0x00000414 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Access MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000414 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Excel MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000414 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office PowerPoint MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000414 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Publisher MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000414 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Outlook MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000414 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Word MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
key_handle:0x00000208 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Access MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000208 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Excel MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000208 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office PowerPoint MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000208 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Publisher MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000208 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Outlook MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExW
key_handle:0x00000208 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Word MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:3016 process_handle:0x00000214
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:3016 process_handle:0x00000214
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:3016 process_handle:0x00000214
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:1120 process_handle:0x00000258
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:1120 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:1120 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2576 process_handle:0x00000258
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2576 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2576 process_handle:0x00000258
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ùÝ« à 0 ¸ ÆÅ à @ ʺ @ tÅ O à ä È Ø XÅ H .text Ô· ¸ `.rsrc ä à ¼ @ @.reloc Ä @ B base_address:0x00400000 process_identifier:2612 process_handle:0x00000258
buffer: P 8 h ä à T T4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °´ S t r i n g F i l e I n f o 0 0 0 0 0 4 b 0 , F i l e D e s c r i p t i o n 0 F i l e V e r s i o n 0 . 0 . 0 . 0 > I n t e r n a l N a m e E m b r a n g l e s . e x e ( L e g a l C o p y r i g h t F O r i g i n a l F i l e n a m e E m b r a n g l e s . e x e 4 P r o d u c t V e r s i o n 0 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 0 . 0 . 0 . 0 ôâ ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly> base_address:0x0041e000 process_identifier:2612 process_handle:0x00000258
1
1
0
WriteProcessMemory
buffer: À È5 base_address:0x00420000 process_identifier:2612 process_handle:0x00000258
Garland.exe