buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ß·a à X ¾w @ À @ hw S H .text ÄW X `.rsrc Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2144 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer: 8 P h l ê l4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °Ì S t r i n g F i l e I n f o ¨ 0 0 0 0 0 4 b 0 0 C o m m e n t s F o x m a i l 7 . 2 <
C o m p a n y N a m e T e n c e n t I n c . 8 F i l e D e s c r i p t i o n F o x m a i l 0 F i l e V e r s i o n 7 . 2 . 2 2 ` I n t e r n a l N a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e L L e g a l C o p y r i g h t C o p y r i g h t ( C ) 2 0 1 7 h O r i g i n a l F i l e n a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e 8 P r o d u c t N a m e F o x m a i l 7 . 2 4 P r o d u c t V e r s i o n 7 . 2 . 2 2 < A s s e m b l y V e r s i o n 7 . 2 . 2 2 . 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00438000 process_identifier:2144 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer: p À7 base_address:0x0043a000 process_identifier:2144 process_handle:0x00000394
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ß·a à X ¾w @ À @ hw S H .text ÄW X `.rsrc Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2840 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer: 8 P h l ê l4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °Ì S t r i n g F i l e I n f o ¨ 0 0 0 0 0 4 b 0 0 C o m m e n t s F o x m a i l 7 . 2 <
C o m p a n y N a m e T e n c e n t I n c . 8 F i l e D e s c r i p t i o n F o x m a i l 0 F i l e V e r s i o n 7 . 2 . 2 2 ` I n t e r n a l N a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e L L e g a l C o p y r i g h t C o p y r i g h t ( C ) 2 0 1 7 h O r i g i n a l F i l e n a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e 8 P r o d u c t N a m e F o x m a i l 7 . 2 4 P r o d u c t V e r s i o n 7 . 2 . 2 2 < A s s e m b l y V e r s i o n 7 . 2 . 2 2 . 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00438000 process_identifier:2840 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer: p À7 base_address:0x0043a000 process_identifier:2840 process_handle:0x00000394
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ß·a à X ¾w @ À @ hw S H .text ÄW X `.rsrc Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2144 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ß·a à X ¾w @ À @ hw S H .text ÄW X `.rsrc Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2840 process_handle:0x00000394
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ß·a à X ¾w @ À @ hw S H .text ÄW X `.rsrc Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2144 process_handle:0x00000394
buffer: 8 P h l ê l4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °Ì S t r i n g F i l e I n f o ¨ 0 0 0 0 0 4 b 0 0 C o m m e n t s F o x m a i l 7 . 2 <
C o m p a n y N a m e T e n c e n t I n c . 8 F i l e D e s c r i p t i o n F o x m a i l 0 F i l e V e r s i o n 7 . 2 . 2 2 ` I n t e r n a l N a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e L L e g a l C o p y r i g h t C o p y r i g h t ( C ) 2 0 1 7 h O r i g i n a l F i l e n a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e 8 P r o d u c t N a m e F o x m a i l 7 . 2 4 P r o d u c t V e r s i o n 7 . 2 . 2 2 < A s s e m b l y V e r s i o n 7 . 2 . 2 2 . 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00438000 process_identifier:2144 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer: p À7 base_address:0x0043a000 process_identifier:2144 process_handle:0x00000394
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ß·a à X ¾w @ À @ hw S H .text ÄW X `.rsrc Z @ @.reloc ` @ B base_address:0x00400000 process_identifier:2840 process_handle:0x00000394
buffer: 8 P h l ê l4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °Ì S t r i n g F i l e I n f o ¨ 0 0 0 0 0 4 b 0 0 C o m m e n t s F o x m a i l 7 . 2 <
C o m p a n y N a m e T e n c e n t I n c . 8 F i l e D e s c r i p t i o n F o x m a i l 0 F i l e V e r s i o n 7 . 2 . 2 2 ` I n t e r n a l N a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e L L e g a l C o p y r i g h t C o p y r i g h t ( C ) 2 0 1 7 h O r i g i n a l F i l e n a m e e E W r o W V v w O U I G v c g F Y P u d B W C V f . e x e 8 P r o d u c t N a m e F o x m a i l 7 . 2 4 P r o d u c t V e r s i o n 7 . 2 . 2 2 < A s s e m b l y V e r s i o n 7 . 2 . 2 2 . 0 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
base_address:0x00438000 process_identifier:2840 process_handle:0x00000394
1
1
0
WriteProcessMemory
buffer: p À7 base_address:0x0043a000 process_identifier:2840 process_handle:0x00000394
wpx.exe