analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Z46YIU3.exe

Full analysis: https://app.any.run/tasks/be5d56ce-258f-4bea-ab34-d261e771c73d
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: November 14, 2018, 18:48:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
rat
remcos
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

B256070C547BAEB34F2711758BA8D9C1

SHA1:

F9F16E204C43DABB42AB1C5E8C447AF92541F53B

SHA256:

59CEE63BE3C16FE135442B86CB4FB5A045D2025C1ACBC91CBCC95AAAE1B88673

SSDEEP:

6144:Bv6vk5kV0i+eUyyY/a4ceZeF1B6ssIiDHdb+Bj7GZOSwAflorq4rQEyAXOh/oPJD:x6vJVECda4nZrIiBbwzAf4yz8K71u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Detected logs from REMCOS RAT

      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 700)
    • Changes the autorun value in the registry

      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 1488)
  • SUSPICIOUS

    • Application launched itself

      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 1076)
      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 1488)
      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 1736)
      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 3916)
      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 2788)
    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3972)
    • Writes files like Keylogger logs

      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 700)
    • Connects to unusual port

      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 700)
    • Starts CMD.EXE for commands execution

      • Z46YIU3.exe (PID: 1364)
    • Creates files in the user directory

      • p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe (PID: 700)
  • INFO

    • Dropped object may contain Bitcoin addresses

      • cmd.exe (PID: 3972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

AssemblyVersion: 0.0.0.0
ProductVersion: 1.0.0.0
ProductName: Same as in FIleDescription
OriginalFileName: 14nov.exe
LegalCopyright: Copyright © 2008 - 2018. All rights reserved.
InternalName: 14nov.exe
FileVersion: 1.0.0.0
FileDescription: How is seen in task manager
CompanyName: Company name
Comments: Random comments
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x7600a
UninitializedDataSize: -
InitializedDataSize: 324608
CodeSize: 131072
LinkerVersion: 8
PEType: PE32
TimeStamp: 1987:05:13 23:40:53+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 13-May-1987 21:40:53
Comments: Random comments
CompanyName: Company name
FileDescription: How is seen in task manager
FileVersion: 1.0.0.0
InternalName: 14nov.exe
LegalCopyright: Copyright © 2008 - 2018. All rights reserved.
OriginalFilename: 14nov.exe
ProductName: Same as in FIleDescription
ProductVersion: 1.0.0.0
Assembly Version: 0.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 13-May-1987 21:40:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
b\x1dDP9\x07\x1c\x12\xa0\xe8\x04
0x00002000
0x0004E8A0
0x0004EA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99949
.text
0x00052000
0x0001FDE0
0x0001FE00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47855
.rsrc
0x00072000
0x00000620
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.48786
.reloc
0x00074000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.0980042
0x00076000
0x00000010
0x00000200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
0.142636

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
15
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start z46yiu3.exe cmd.exe cmd.exe no specs p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe #REMCOS p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe no specs p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe no specs p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe no specs p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe no specs p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe no specs p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1364"C:\Users\admin\AppData\Local\Temp\Z46YIU3.exe" C:\Users\admin\AppData\Local\Temp\Z46YIU3.exe
explorer.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Exit code:
0
Version:
1.0.0.0
3972"C:\Windows\System32\cmd.exe" /c copy "C:\Users\admin\AppData\Local\Temp\Z46YIU3.exe" "C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe"C:\Windows\System32\cmd.exe
Z46YIU3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2688"C:\Windows\System32\cmd.exe" /c, "C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe"C:\Windows\System32\cmd.exeZ46YIU3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1488"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
cmd.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Version:
1.0.0.0
1076"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe" C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Exit code:
0
Version:
1.0.0.0
700"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Version:
1.0.0.0
1736"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe" C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Exit code:
0
Version:
1.0.0.0
896"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exep.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Exit code:
1
Version:
1.0.0.0
3916"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe" C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Exit code:
0
Version:
1.0.0.0
1680"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe"C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exep.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
User:
admin
Company:
Company name
Integrity Level:
MEDIUM
Description:
How is seen in task manager
Exit code:
1
Version:
1.0.0.0
Total events
520
Read events
509
Write events
11
Delete events
0

Modification events

(PID) Process:(1364) Z46YIU3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1364) Z46YIU3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1488) p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1488) p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(700) p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeKey:HKEY_CURRENT_USER\Software\07NOV-INNZSC
Operation:writeName:exepath
Value:
43D0C3D026DB659BA8367009A7CA746C5ACC652461F9EC2B0ED7946C4FD8C4AAA12DF50911612C5E101946552DA3D786D1164687D0D15DA71A54814B8D07056B9B8C5CE5F1DDB82E452660B549ED9C2F3365184B656E57D05B3F820D5CEEA1C7941D2FC6747B0901E8C8754AF51ED53601391EA8DF25A3FA5765BF69FF99A8A96F2BB36B3A7CFB410F3D0C3C7479CE285120F0C286BEF86979C810891450AE2FCA75179734666CB14D78A714CDA3B4E1C382EF2846E015B08F7176BDA9257823E0BBA7D3B8DD8166D4DFFDE0127F025600C4
(PID) Process:(700) p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeKey:HKEY_CURRENT_USER\Software\07NOV-INNZSC
Operation:writeName:licence
Value:
38848DFD7EC95AF819AB43A89EB0182E
(PID) Process:(1488) p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Application'+6´pyi8muíyn4ñ5wpe´smr0´7'i¿5r'+tb.0´pw{r´npyu´w´69'ñrtdpiu´nhrpsou´{úm0eiotyj.ú0ph5.w4ir´tifupnj6hw,´rsp{0ipybj45´wps0rd5'9lwt0i7j'y0'´45ow,ru'yipkn4.5´r0spiyu´65.e0tñpy´w0ftp8k.éj{tñd0i7pku´{t7f0{.punkw´{d6ti
Value:
C:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe -boot
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3972cmd.exeC:\Users\admin\AppData\Local\p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeexecutable
MD5:B256070C547BAEB34F2711758BA8D9C1
SHA256:59CEE63BE3C16FE135442B86CB4FB5A045D2025C1ACBC91CBCC95AAAE1B88673
700p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exeC:\Users\admin\AppData\Roaming\STHHshjo\logs.dattext
MD5:18A89E0CB6EDB3238EFAF7329B9074FE
SHA256:696C4FC29FB1B5F3BAFF451AAF379A4A76E19C5DE0641AFC42B85694DD6EE97C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
700
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
187.155.140.134:2404
casillas.hicam.net
Uninet S.A. de C.V.
MX
unknown
700
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
187.155.129.146:2404
du4alr0ute.sendsmtp.com
Uninet S.A. de C.V.
MX
unknown
700
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
187.155.43.162:2404
wifi.con-ip.com
Uninet S.A. de C.V.
MX
unknown
700
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
187.155.35.93:2404
casillas45.hopto.org
Uninet S.A. de C.V.
MX
unknown

DNS requests

Domain
IP
Reputation
casillas.hicam.net
  • 187.155.140.134
malicious
dns.msftncsi.com
  • 131.107.255.255
shared
casillasmx.chickenkiller.com
unknown
casillas45.hopto.org
  • 187.155.35.93
malicious
casillas.libfoobar.so
malicious
du4alr0ute.sendsmtp.com
  • 187.155.129.146
malicious
settings.wifizone.org
unknown
wifi.con-ip.com
  • 187.155.43.162
malicious

Threats

No threats detected
Process
Message
Z46YIU3.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
Z46YIU3.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
Z46YIU3.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
Z46YIU3.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
Z46YIU3.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
Z46YIU3.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
Z46YIU3.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
Z46YIU3.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1391
p.´prtyil'u´6e5lti+p'úi0+o´,p78,y+lu.}'o,-67´typ+lj7}6y-pfim5j6é{r0dmpf.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\identityauthority.cpp, line 278