CreateProcessInternalW
Oct. 23, 2023, 4:48 p.m.
thread_identifier:
2676
thread_handle:
0x00000060
process_identifier:
2672
current_directory:
filepath:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track:
1
command_line:
filepath_r:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x00000064
1
1
0
NtGetContextThread
Oct. 23, 2023, 4:48 p.m.
thread_handle:
0x00000060
1
0
0
NtAllocateVirtualMemory
Oct. 23, 2023, 4:48 p.m.
process_identifier:
2672
region_size:
204800
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000064
3221225496
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
base_address:
0x00000000
process_identifier:
2672
process_handle:
0x00000064
0
0
CreateProcessInternalW
Oct. 23, 2023, 4:48 p.m.
thread_identifier:
2712
thread_handle:
0x0000006c
process_identifier:
2708
current_directory:
filepath:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track:
1
command_line:
filepath_r:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x00000068
1
1
0
NtGetContextThread
Oct. 23, 2023, 4:48 p.m.
thread_handle:
0x0000006c
1
0
0
NtAllocateVirtualMemory
Oct. 23, 2023, 4:48 p.m.
process_identifier:
2708
region_size:
204800
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x00000068
1
0
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ à
¤ÿmY¤ÿmY¤ÿmYwnX¨ÿmYwhX2ÿmYwiX°ÿmY Y¦ÿmY hXÿmY iXµÿmY nX°ÿmYwlX§ÿmY¤ÿlYðÿmY°dX´ÿmY°Y¥ÿmY°oX¥ÿmYRich¤ÿmY PE L ÖT5e à $ * ¸ A @ @ @ L ( à à ð Ð/ à @ @ .text ) * `.rdata xa @ b . @ @.data h# ° @ À.rsrc à à @ @.reloc Ð/ ð 0 @ B
base_address:
0x00400000
process_identifier:
2708
process_handle:
0x00000068
1
1
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
base_address:
0x00401000
process_identifier:
2708
process_handle:
0x00000068
1
1
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
base_address:
0x00424000
process_identifier:
2708
process_handle:
0x00000068
1
1
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
ÿÿÿÿ ±¿DNæ@» ÿÿÿÿ ÿÿÿÿ abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ ¤ `y! ¦ß ¡¥ àü @~ü ¨ Á£Ú£ þ @þ µ Á£Ú£ þ Aþ ¶ Ï¢ä¢ å¢è¢[ þ @~¡þ Q QÚ^Ú _ÚjÚ2 ÓØÞàù 1~þ ZB @¶B @¶B @¶B @¶B @¶B H¶B ]B ^B ÈTB µB `°B C ¶B HÇB HÇB HÇB HÇB HÇB HÇB HÇB HÇB HÇB ¶B LÇB LÇB LÇB LÇB LÇB LÇB LÇB . . þÿÿÿ þÿÿÿ u Ðù¾c yåú¦eÍiL Å ?þ DVÐü !Êû×6}¼ $Áªaк;ë Zèy ©Ä*@éã ¶ú æô; ;¥¹ Ò3 [
1à©ÜÞ Ù#,ss3WI LȽy+ qP økú¢ ¼ÇmµúÂ Æ âs 5}àO£ tdïôfGj}ɬ :ø÷¹â&÷c& ÀÇ@ zÞcÅg ÓÑëGïNn3 g |ÔZز¤G> b&}Lº F wXÍ |[x ¦ D@q#4m $ >äÂö>/ö8I å¸7 ÐGñ D¨íò Dñ ¥Ñ&\q ÀÒJ²Z $ \Ò Vi×´v8·´Æ &À ÿ> Ì <[Ïl EfMdý|î oK¡JnÜ nÔϯ
ïµÃ FòÜ xAayÛOw(ì ³Ö-ÆÆõA5« V¥0½ RE A ãý ñ bG-¨¦ ¥ [ Êþ dã0[ ok ûhn¤ÛB ±± !S ^¥4 \Áéj8ªJÛ®!2É )C
¨ñgÕ{ @ÜMZ ¶ß?
þ÷}M¯ ,ëïõ* Û³ OS*÷=B 9 À c\ #Ã\ 9§ 0b;( Ïÿ ©(Î Zï¨ðóe ^4 >Ø xúI"WÂB° %/í ¯¼ áy?Ó(
Öü MÝð·7¢
L{éü = ·Ë¡ gÇmPv l| Sâ DÄ êq¯o ù¾Ì ! s ì© M7 <wòÂ, - <L1Ò ¿ü / wÌ ð¹ DPÐò°= þoÊÐðÒ¶eÆ zoaª d> aù r) 0Þ sÉz dÎD8@¸Þ¿åK@X¥³jj&å" ª¯L ¤E ©ÊæpÏ _é Kr¢O Ý T mªÛªu ZE)J2 ^D{ð R¤%£ §õ
¼wX
" Æ® ë"~"ê<äP u¶ç 5G}¹ ~ó³P r<LÌu
ít uuDæ
Ô úäf î4 Ñ@#j-ÂÒ£ ÑɺgÍZê· í2 >[Ììg u½C*PHçëhºö- áN($q $ã eË°þm*â k3² Jd ¼ I? Ó#J 0ÊDê Qâ Zb&'Ô ¦g¡ Æ^_/ |B .?AVbad_exception@std@@ |B .?AVexception@std@@ |B .?AVtype_info@@
base_address:
0x0042b000
process_identifier:
2708
process_handle:
0x00000068
1
1
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
0 H `à } <?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:
0x0042e000
process_identifier:
2708
process_handle:
0x00000068
1
1
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
base_address:
0x0042f000
process_identifier:
2708
process_handle:
0x00000068
1
1
0
WriteProcessMemory
Oct. 23, 2023, 4:48 p.m.
buffer:
@
base_address:
0xfffde008
process_identifier:
2708
process_handle:
0x00000068
1
1
0
NtSetContextThread
Oct. 23, 2023, 4:48 p.m.
registers.eip:
1995571652
registers.esp:
1440024
registers.edi:
0
registers.eax:
4198977
registers.ebp:
0
registers.edx:
0
registers.ebx:
-139264
registers.esi:
0
registers.ecx:
0
thread_handle:
0x0000006c
process_identifier:
2708
1
0
0
NtResumeThread
Oct. 23, 2023, 4:48 p.m.
thread_handle:
0x0000006c
suspend_count:
1
process_identifier:
2708
1
0
0
nalo.exe