CreateProcessInternalW
Aug. 16, 2025, 8:45 a.m.
thread_identifier:
2804
thread_handle:
0x00000088
process_identifier:
984
current_directory:
filepath:
C:\Users\Administrator\AppData\Local\Temp\c4cd302acef1cc16abc10c84e86abbbab2c9133db00b20aa589d13c1af8db088.exe
track:
1
command_line:
filepath_r:
C:\Users\Administrator\AppData\Local\Temp\c4cd302acef1cc16abc10c84e86abbbab2c9133db00b20aa589d13c1af8db088.exe
stack_pivoted:
0
creation_flags:
4
(CREATE_SUSPENDED)
inherit_handles:
0
process_handle:
0x0000008c
1
1
0
NtGetContextThread
Aug. 16, 2025, 8:45 a.m.
thread_handle:
0x00000088
1
0
0
NtUnmapViewOfSection
Aug. 16, 2025, 8:45 a.m.
base_address:
0x00400000
region_size:
4096
process_identifier:
984
process_handle:
0x0000008c
1
0
0
NtAllocateVirtualMemory
Aug. 16, 2025, 8:45 a.m.
process_identifier:
984
region_size:
77824
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00400000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0x0000008c
1
0
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L èL^ Å à 8 ` Ð P @ 0 Ae ° d .text `6 8 ` P`.data P < @ 0À.rdata ø ` > @ 0@/4 p F @ 0@.bss `À.idata R @ 0À.CRT ` @ 0À.tls ° b @ 0À/14 8 À d @ @B/29 B Ð f @ B/41 I ð @ B/55 È @ B/67 8 @ 0B/80 @ B
base_address:
0x00400000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
base_address:
0x00401000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
ýÿÿÿ @ F@ ÿÿÿÿ
base_address:
0x00405000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
libgcc_s_dw2-1.dll __register_frame_info __deregister_frame_info APPDATA \WPDNSE\ \a.exe a.exe SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Atapi x86_64 Driver <CAPSLOCK> <SHIFT> <LCTRL> <RCTRL> <INSERT> <END> <PRINT> <DEL> <BK> <LEFT> <RIGHT> <UP> <DOWN> <SPACE> <TAB> <ENTER> <ESC> 0 1 2 3 4 5 6 7 8 9 ´@ J@ @ @ @ c@ @ @ @ @ @ @ ì@ @ @ @ @ @ @ |@ @ @ @ @ 1@ @ @ i@ @ Í@ ÿ@ æ@ @ @ @ @ @ P@ @ @ @ ¨@ Á@ Ú@ ó@ @ %@ >@ T@ j@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ ®@ Ç@ à@ ù@ @ +@ D@ ]@ v@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ 7@ Information Press OK to stop logging. keys.txt £ @ â @ â @ â @ â @ ` @ â @ â @ 0 @ â @ 0 @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ 0 @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ à @ p @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ â @ 0 @ â @ 0 @ â @ 0 @ P"@ Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
. glob-1.0-mingw32 . GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (MinGW.org GCC-8.2.0-5) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0 GCC: (GNU) 8.2.0
base_address:
0x00406000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
zR | àÿÿ C q
L 8 d¡ÿÿì A
B
D T 8¢ÿÿ? C@{ l `¢ÿÿ C l¢ÿÿ C x¢ÿÿ ¨ t¢ÿÿ zR | ( X¢ÿÿ¡ A
B
E{
ÃAÆAÅ K H Ü¢ÿÿ. A
B
jÅ zR | Ô¢ÿÿW A
B
SÅ zPLR | L @ $ $ ë¢ÿÿ_ F@ A
B
GTÅÃ $ L "¤ÿÿñ +F@ A
B
GæÅà ¬ ë¤ÿÿA A
B
;Å Ì ©ÿÿx A
B
rÅ ì d©ÿÿ A
B
NÅ V©ÿÿ A
B
NÅ $ ô H©ÿÿ MF@ A
B
DÅà T ¹©ÿÿ A
B
XÅ zPLR | L @ $ $ ÒÿÿG =F@ A
B
DÅÃ zR | < Ü©ÿÿf A
B
FR
ÃAÆAÇAÅ B æ
ÃAÆAÇAÅ G zR | $ ô¬ÿÿ ]H
AÅ _Ã zR | 8 ÑÿÿÂ D Gu Eutu|ux«Á AÃAÆAÅC zR | pÿÿ1 N\ 4 ÿÿF AC j
AÃA X Äÿÿ zR | ¸ÿÿC C U
H ` D < èÿÿ AA C d
FÃAÆC t
FÃAÆC _ FÃAÆ @®ÿÿ zR | 8 $®ÿÿ` AA C L I P C j C C AÃAÆ D X H®ÿÿ AC C L
CÃAÆI s N O E C
AÃAÆA < ®ÿÿ AC P
CÃI L I g C C
CÃK Z C 0 à ð®ÿÿ± C c
J i C _
E ^
B L C zR | d¯ÿÿJ AA C d < ¯ÿÿì A
A CCEPXDCPm
AÃAÆ AÇAÅG d@CPB@CPC
AÃAÆ AÇAÅA T ¤ °ÿÿÚ j
A AAC@
AÃAÆ AÇAÅA ò
AÃAÆ AÇAÅJ zR | ܱÿÿw C A
A zR | < (²ÿÿ) A
C ACCP
AÃAÆ AÇAÅF T \ µÿÿ A
A CAC@
CÃAÆ AÇAÅA C
CÃCÆ AÇAÅC 0 ´ жÿÿ AF E
ÃAÆC v
ÃAÆC 4 è ,·ÿÿO AC C x
CÃAÆA C FÃAÆ D D·ÿÿ\ AA CE @
CÃ AÆAÇA CFÃ AÆAÇ ( h \·ÿÿI AC E o
AÃAÆF < ·ÿÿx A
B
F
ÃAÆAÇAÅ A Ç
ÃAÆAÇAÅ H , Ô À¿ÿÿ× A
B
FF
ÃAÆAÇAÅ A @ pÀÿÿW AA AC O
AÃ AÆAÇH oAÃ AÆAÇ zR | , tÀÿÿå A
B
F´
ÃAÆAÇAÅ A zR | @ ÄÿÿÓ AA HàPØCàH
CÃAÆG M
CÃAÆA L ` ¸Äÿÿ¢ AA HàPØCàG
CÃAÆH M
CÃAÆA [ CÃAÆ T ° Åÿÿñ A
A AAFÀS
CÃAÆ AÇAÅA O
CÃAÆ AÇAÅG ÀÆÿÿO ACv
CÃC ( , ìÆÿÿB AC V C Q
AÃA , X ÇÿÿX AC V C R
AÃA eAÃ @Çÿÿ' CQ
A 4 ¤ TÇÿÿq AA C R
AÃAÆG N AÃAÆ zR | `Êÿÿ
base_address:
0x00407000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
base_address:
0x00408000
process_identifier:
984
process_handle:
0x0000008c
0
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
ä ° P h t ð ° $ À x $ h v ¤ ¸ Ð è ö $ 2 D ^ n ª ¼ Ø ð , > N X d t ¢ ´ ¾ È Ô à è ô þ & 0 8 B L X b l x ª ¶ Â Ô è ö < T ¨ ¸ ð X Ð T Ì L À h v ¤ ¸ Ð è ö $ 2 D ^ n ª ¼ Ø ð , > N X d t ¢ ´ ¾ È Ô à è ô þ & 0 8 B L X b l x ª ¶ Â Ô è ö < T ¨ ¸ ð X Ð T Ì L À RegCloseKey ¯RegOpenKeyExA ËRegSetValueExA q CopyFileA | CreateDirectoryA Ð DeleteCriticalSection í EnterCriticalSection ExitProcess -FindClose 1FindFirstFileA BFindNextFileA aFreeLibrary
GetCommandLineA ÚGetEnvironmentVariableA ÿGetLastError GetModuleFileNameA GetModuleHandleA BGetProcAddress _GetStartupInfoA ßInitializeCriticalSection /LeaveCriticalSection 2LoadLibraryA lSetUnhandledExceptionFilter TlsGetValue µVirtualProtect ·VirtualQuery Q _strdup S _stricoll Y __getmainargs x __mb_cur_max __p__environ __p__fmode __set_app_type × _cexit _errno @_fpreset Z_fullpath _iob ¢_isctype _onexit ¶_pctype í_setmode 7abort ?atexit Fcalloc gfree rfwrite malloc ¦mbstowcs «memcpy Àrealloc Çsetlocale Ésignal Östrcoll ×strcpy Ýstrlen ùtolower vfprintf )wcstombs CallNextHookEx à GetAsyncKeyState ³MessageBoxA CSetWindowsHookExA _Unwind_Resume % __deregister_frame_info k __register_frame_info á_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5c_strEv å_ZNSaIcEC1Ev è_ZNSaIcED1Ev ¢_ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEv ¦_ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode ¯_ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev ö _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc 6
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EPKcRKS3_ 9
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS4_ @
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev T
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev W
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEaSEPKc \
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc ø_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc û_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_c Z__gxx_personality_v0 ADVAPI32.DLL KERNEL32.dll ( ( msvcrt.dll < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < < msvcrt.dll P P P P USER32.dll d d d libgcc_s_dw2-1.dll x x x x x x x x x x x x x x x x libstdc++-6.dll
base_address:
0x00409000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
P"@ "@
base_address:
0x0040a000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
°@ °@ X@ @
base_address:
0x0040b000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
(@ * &
base_address:
0x0040c000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
base_address:
0x0040d000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
% % $ > & I : ; 9
: ; 9 I8 I : ; 9 I I !
4 : ; 9 I?< 4 : ;9 I?< ! I/
'I I & > I: ; 9 ( : ; 9
: ;9 I8
: ;9 I8 > I: ;9 < ' 4 G: ;9
base_address:
0x0040f000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
m I û
../../../src/gcc-8.2.0/libgcc/config/i386 cygwin.S (@ ""YK0g=YY0/>"" S M û
/home/keith/mingw32-gcc-8.2.0/include ../../../src/gcc-8.2.0/libgcc/../include ../.././gcc ../../../src/gcc-8.2.0/libgcc/../gcc/config/i386 ../../../src/gcc-8.2.0/libgcc stdio.h stdlib.h getopt.h time.h hashtab.h insn-constants.h i386.h i386-opts.h libgcc2.h gbl-ctors.h libgcc2.c
base_address:
0x00410000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
ÿÿÿÿ | (@ * AA fÀAÁ
base_address:
0x00411000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
WriteProcessMemory
Aug. 16, 2025, 8:45 a.m.
buffer:
../../../src/gcc-8.2.0/libgcc/config/i386/cygwin.S /home/keith/src/mingw/gcc-build/gcc-8.2.0-mingw32-cross-native-sandbox/mingw32/libgcc GNU AS 2.31.1
base_address:
0x00412000
process_identifier:
984
process_handle:
0x0000008c
1
1
0
NtSetContextThread
Aug. 16, 2025, 8:45 a.m.
registers.eip:
1995637172
registers.esp:
2686960
registers.edi:
0
registers.eax:
4199120
registers.ebp:
0
registers.edx:
0
registers.ebx:
2130567168
registers.esi:
0
registers.ecx:
0
thread_handle:
0x00000088
process_identifier:
984
1
0
0
NtResumeThread
Aug. 16, 2025, 8:45 a.m.
thread_handle:
0x00000088
suspend_count:
1
process_identifier:
984
1
0
0
CreateProcessInternalW
Aug. 16, 2025, 8:45 a.m.
thread_identifier:
1772
thread_handle:
0x0000008c
process_identifier:
3020
current_directory:
filepath:
track:
1
command_line:
C:\Users\Administrator\AppData\Local\Temp\c4cd302acef1cc16abc10c84e86abbbab2c9133db00b20aa589d13c1af8db088.exe delete
filepath_r:
stack_pivoted:
0
creation_flags:
0
()
inherit_handles:
0
process_handle:
0x000000c8
1
1
0
