buffer:MZ ÿÿ ¸ @ ( º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ ®ôÓ,ê½ê½ê½¡í¾~罡í¸~*½3è¹~ñ½¡íº~ë½¥é@î½¥é¹~ø½¥é¾~ò½¥é¸~¿½¡í¹~ó½¡í»~뽡í¼~ó½ê¼ü½!é´~ö½!éBë½ê*ë½!é¿~ë½Richê½ PE L _6 e à " ¸ Þ . Ð @ Ð @ ÄÝ @ è P ¬~ (í 8 hì @ Ð .text H· ¸ `.rdata è! Ð " ¼ @ @.data ¨5 " Þ @ À.rsrc è @ @ @.reloc ¬~ P @ B base_address:0x00400000 process_identifier:2708 process_handle:0x00000248
1
1
0
WriteProcessMemory
buffer: 8 P h @ È hC } È4 V S _ V E R S I O N _ I N F O ½ïþ ? ( S t r i n g F i l e I n f o 0 4 1 8 0 4 b 0 4
C o m p a n y N a m e M i c r o s o f t ^ F i l e D e s c r i p t i o n M i c r o s o f t O f f i c e I n s t a l l e r 0 F i l e V e r s i o n 1 . 0 . 0 . 1 6 I n t e r n a l N a m e O f f i c e . e x e J L e g a l C o p y r i g h t C o p y r i g h t ( C ) 2 0 2 2 > O r i g i n a l F i l e n a m e O f f i c e . e x e . P r o d u c t N a m e O f f i c e 4 P r o d u c t V e r s i o n 1 . 0 . 0 . 1 D V a r F i l e I n f o $ T r a n s l a t i o n °<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00534000 process_identifier:2708 process_handle:0x00000248
buffer:MZ ÿÿ ¸ @ ( º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ ®ôÓ,ê½ê½ê½¡í¾~罡í¸~*½3è¹~ñ½¡íº~ë½¥é@î½¥é¹~ø½¥é¾~ò½¥é¸~¿½¡í¹~ó½¡í»~뽡í¼~ó½ê¼ü½!é´~ö½!éBë½ê*ë½!é¿~ë½Richê½ PE L _6 e à " ¸ Þ . Ð @ Ð @ ÄÝ @ è P ¬~ (í 8 hì @ Ð .text H· ¸ `.rdata è! Ð " ¼ @ @.data ¨5 " Þ @ À.rsrc è @ @ @.reloc ¬~ P @ B base_address:0x00400000 process_identifier:2708 process_handle:0x00000248
key_handle:0x00000460 regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Access MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExA
key_handle:0x0000043c regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Excel MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExA
key_handle:0x0000045c regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office PowerPoint MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExA
key_handle:0x0000045c regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Publisher MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExA
key_handle:0x0000045c regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Outlook MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
1
0
0
RegQueryValueExA
key_handle:0x0000043c regkey_r:DisplayName reg_type:1(REG_SZ) value:Microsoft Office Word MUI (Korean) 2007 regkey:HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
buffer:MZ ÿÿ ¸ @ ( º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ ®ôÓ,ê½ê½ê½¡í¾~罡í¸~*½3è¹~ñ½¡íº~ë½¥é@î½¥é¹~ø½¥é¾~ò½¥é¸~¿½¡í¹~ó½¡í»~뽡í¼~ó½ê¼ü½!é´~ö½!éBë½ê*ë½!é¿~ë½Richê½ PE L _6 e à " ¸ Þ . Ð @ Ð @ ÄÝ @ è P ¬~ (í 8 hì @ Ð .text H· ¸ `.rdata è! Ð " ¼ @ @.data ¨5 " Þ @ À.rsrc è @ @ @.reloc ¬~ P @ B base_address:0x00400000 process_identifier:2708 process_handle:0x00000248
buffer: 8 P h @ È hC } È4 V S _ V E R S I O N _ I N F O ½ïþ ? ( S t r i n g F i l e I n f o 0 4 1 8 0 4 b 0 4
C o m p a n y N a m e M i c r o s o f t ^ F i l e D e s c r i p t i o n M i c r o s o f t O f f i c e I n s t a l l e r 0 F i l e V e r s i o n 1 . 0 . 0 . 1 6 I n t e r n a l N a m e O f f i c e . e x e J L e g a l C o p y r i g h t C o p y r i g h t ( C ) 2 0 2 2 > O r i g i n a l F i l e n a m e O f f i c e . e x e . P r o d u c t N a m e O f f i c e 4 P r o d u c t V e r s i o n 1 . 0 . 0 . 1 D V a r F i l e I n f o $ T r a n s l a t i o n °<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00534000 process_identifier:2708 process_handle:0x00000248
ff2177c078dfed4b10a0214acefabf09b691a831479b06866e1d35e1a144cb3e.exe