Thank you very much. This is great help.

But nevertheless I'm not sure how to get it to run. I now set PAR_GLOBAL_DEBUG as follows in the script:

So I get a lot of output and I know a bit where it is unpacked.

But how can I get the values of PAR_0 (the most interesting value for me) and PAR_TEMP. Always after I start "counter.exe" and then I want to see the values of PAR_0 and PAR_TEMP they are undefined. Why?

I think I have to know where "counter.exe" is unpacked before executing it. So I could call the unpacked perl script with the unpacked perl interpreter in the Win32::Process::Create. But I have no idea how to do it.

I read the documentation you told me. But still I don't know how to do it.

And then still another question. Am I right if I say the extracted perl script in the temp directory is a child process of the "counter.exe"? If yes then I do not understand why it is not working. Because I call Win32::Process::Create with the parameter CREATE_NEW_PROCESS_GROUP. So if a kill or suspend is done it should also take into account the child processes.

As you can see I'm totally confused how to solve it. So I hope that you can help me and give me some more hints.

Thank you.