NtResumeThread
|
thread_handle:
0x00000000000000b0
suspend_count:
1
process_identifier:
880
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x00000000000000f4
suspend_count:
1
process_identifier:
880
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2120
thread_handle:
0x0000000000000114
process_identifier:
2116
current_directory:
filepath:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
track:
1
command_line:
filepath_r:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x0000000000000118
|
1
|
1 |
0
|
NtUnmapViewOfSection
|
base_address:
0x0000000000400000
region_size:
10747904
process_identifier:
2116
process_handle:
0x0000000000000118
|
|
-1073741799 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2116
region_size:
532480
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0000000000400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x0000000000000118
|
1
|
0 |
0
|
CreateProcessInternalW
|
thread_identifier:
2184
thread_handle:
0x0000000000000120
process_identifier:
2180
current_directory:
filepath:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
track:
1
command_line:
filepath_r:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x000000000000011c
|
1
|
1 |
0
|
NtUnmapViewOfSection
|
base_address:
0x0000000000400000
region_size:
1999372288
process_identifier:
2180
process_handle:
0x000000000000011c
|
|
-1073741799 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2180
region_size:
532480
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0000000000400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x000000000000011c
|
1
|
0 |
0
|
NtResumeThread
|
thread_handle:
0x0000000000000120
suspend_count:
1
process_identifier:
2180
|
1
|
0 |
0
|