buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ,®b à . 82 ¬V ä ð P2 @ Z yåV @ °W Y ÀW X è X Ìð ðW àÂW .text 72 82 ` ``.data ´é P2 ê <2 @ `À.rdata xk @4 l &4 @ `@.eh_fram
°T T @ 0@.bss °ã ÀT `À.edata Y °W T @ 0@.idata ÀW T @ 0À.CRT àW ´T @ 0À.tls ðW ¶T @ 0À.rsrc è X ¸T @ 0À.reloc Ìð X ò ¾T @ 0B base_address:0x00410000 process_identifier:2820 process_handle:0x0000063c
1
1
0
WriteProcessMemory
buffer: zR | à_«ÿ C V
G ( 8 da«ÿé AC bC L C j
d (b«ÿ? C@{ | Pb«ÿ C \b«ÿ C ¤ hb«ÿ ¸ db«ÿ zR | ¨\Ýÿw C A
D zR | T ô\Ýÿw AA AC0x
CÃ AÆAÇE T
AÃ AÆAÇA SAÃ AÆAÇ zR | ]Ýÿ$ C0` zR | < ]Ýÿ³ A A AAC
AÃAÆ AÇAÅC zR | P l]ÝÿÞ A A AAC0¥
CÃAÆ AÇAÅF _AÃAÆ CÇAÅ zR | , à]ÝÿQ A B
IR
ÃAÆAÇAÅ G zR | $ øaÝÿ ]H AÅ _Ã zR | ÈbÝÿ1 N\ 4 ðbÝÿR AC o
AÃD X ,cÝÿ zR | cÝÿC C U
H ` D < PcÝÿ¡ AA C d
FÃAÆH o
FÃAÆJ _ FÃAÆ ¸cÝÿ zR | 8 cÝÿ` AA C L I P C j C C AÃAÆ , X ÀcÝÿs QC s N O E C
AÃA 8 dÝÿ AC P
CÃI L H x E C
AÃK 0 Ä ddÝÿ¼ C Z
C [
E i C Z
J d C zR | ØdÝÿJ AA C d < eÝÿì A A CCEPXDCPm
AÃAÆ AÇAÅG d@CPB@CPC
AÃAÆ AÇAÅA H ¤ eÝÿê jA AC0
AÃ AÆAÇK û
AÃ AÆAÇB zR | < gÝÿ' A A AACP&
AÃAÆ AÇAÅG < \ jÝÿ' A C ACC@Ê
CÃAÆ AÇAÅE < ükÝÿ AD Ak
à AÆAÇE Y
à FÆAÇA D Ü \lÝÿ\ AA CE @
CÃ AÆAÇA CFÃ AÆAÇ ( $ tlÝÿI AC E o
AÃAÆF ( P lÝÿK AC C z
AÃAÆA < | ¼lÝÿ A B
FÉ
ÃAÆAÇAÅ K "
ÃAÆAÇAÅ K , ¼ uÝÿõ A B
FF
ÃAÆAÇAÅ F @ ì ìuÝÿW AA AC O
AÃ AÆAÇH oAÃ AÆAÇ zR | , ðuÝÿ A B
F´
ÃAÆAÇAÅ H zR | @ ÈyÝÿé AA HàPØCàW
CÃAÆH M
CÃAÆG L ` tzÝÿ¸ AA HàPØCàW
CÃAÆH M
CÃAÆG [ CÃAÆ T ° äzÝÿÿ A A AAFÀS
CÃAÆ AÇAÅE S
CÃAÆ AÇAÅG |ÝÿO ACv
CÃC ( , ¸|ÝÿB AC V C Q
AÃA , X Ü|Ýÿ_ AC V C R
AÃH eAÃ }Ýÿ' CQ
A 4 ¤ }Ýÿq AA C R
AÃAÆG N AÃAÆ base_address:0x0095b000 process_identifier:2820 process_handle:0x0000063c
buffer: 0 H X X <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!--The ID below indicates application support for Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!--The ID below indicates application support for Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
base_address:0x00990000 process_identifier:2820 process_handle:0x0000063c
1
1
0
WriteProcessMemory
buffer: A base_address:0xfffde008 process_identifier:2820 process_handle:0x0000063c
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ,®b à . 82 ¬V ä ð P2 @ Z yåV @ °W Y ÀW X è X Ìð ðW àÂW .text 72 82 ` ``.data ´é P2 ê <2 @ `À.rdata xk @4 l &4 @ `@.eh_fram
°T T @ 0@.bss °ã ÀT `À.edata Y °W T @ 0@.idata ÀW T @ 0À.CRT àW ´T @ 0À.tls ðW ¶T @ 0À.rsrc è X ¸T @ 0À.reloc Ìð X ò ¾T @ 0B base_address:0x00400000 process_identifier:2856 process_handle:0x00000650
1
1
0
WriteProcessMemory
buffer: zR | à_«ÿ C V
G ( 8 da«ÿé AC bC L C j
d (b«ÿ? C@{ | Pb«ÿ C \b«ÿ C ¤ hb«ÿ ¸ db«ÿ zR | ¨\Ýÿw C A
D zR | T ô\Ýÿw AA AC0x
CÃ AÆAÇE T
AÃ AÆAÇA SAÃ AÆAÇ zR | ]Ýÿ$ C0` zR | < ]Ýÿ³ A A AAC
AÃAÆ AÇAÅC zR | P l]ÝÿÞ A A AAC0¥
CÃAÆ AÇAÅF _AÃAÆ CÇAÅ zR | , à]ÝÿQ A B
IR
ÃAÆAÇAÅ G zR | $ øaÝÿ ]H AÅ _Ã zR | ÈbÝÿ1 N\ 4 ðbÝÿR AC o
AÃD X ,cÝÿ zR | cÝÿC C U
H ` D < PcÝÿ¡ AA C d
FÃAÆH o
FÃAÆJ _ FÃAÆ ¸cÝÿ zR | 8 cÝÿ` AA C L I P C j C C AÃAÆ , X ÀcÝÿs QC s N O E C
AÃA 8 dÝÿ AC P
CÃI L H x E C
AÃK 0 Ä ddÝÿ¼ C Z
C [
E i C Z
J d C zR | ØdÝÿJ AA C d < eÝÿì A A CCEPXDCPm
AÃAÆ AÇAÅG d@CPB@CPC
AÃAÆ AÇAÅA H ¤ eÝÿê jA AC0
AÃ AÆAÇK û
AÃ AÆAÇB zR | < gÝÿ' A A AACP&
AÃAÆ AÇAÅG < \ jÝÿ' A C ACC@Ê
CÃAÆ AÇAÅE < ükÝÿ AD Ak
à AÆAÇE Y
à FÆAÇA D Ü \lÝÿ\ AA CE @
CÃ AÆAÇA CFÃ AÆAÇ ( $ tlÝÿI AC E o
AÃAÆF ( P lÝÿK AC C z
AÃAÆA < | ¼lÝÿ A B
FÉ
ÃAÆAÇAÅ K "
ÃAÆAÇAÅ K , ¼ uÝÿõ A B
FF
ÃAÆAÇAÅ F @ ì ìuÝÿW AA AC O
AÃ AÆAÇH oAÃ AÆAÇ zR | , ðuÝÿ A B
F´
ÃAÆAÇAÅ H zR | @ ÈyÝÿé AA HàPØCàW
CÃAÆH M
CÃAÆG L ` tzÝÿ¸ AA HàPØCàW
CÃAÆH M
CÃAÆG [ CÃAÆ T ° äzÝÿÿ A A AAFÀS
CÃAÆ AÇAÅE S
CÃAÆ AÇAÅG |ÝÿO ACv
CÃC ( , ¸|ÝÿB AC V C Q
AÃA , X Ü|Ýÿ_ AC V C R
AÃH eAÃ }Ýÿ' CQ
A 4 ¤ }Ýÿq AA C R
AÃAÆG N AÃAÆ base_address:0x0094b000 process_identifier:2856 process_handle:0x00000650
buffer: 0 H X X <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!--The ID below indicates application support for Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!--The ID below indicates application support for Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
base_address:0x00980000 process_identifier:2856 process_handle:0x00000650
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ,®b à . 82 ¬V ä ð P2 @ Z yåV @ °W Y ÀW X è X Ìð ðW àÂW .text 72 82 ` ``.data ´é P2 ê <2 @ `À.rdata xk @4 l &4 @ `@.eh_fram
°T T @ 0@.bss °ã ÀT `À.edata Y °W T @ 0@.idata ÀW T @ 0À.CRT àW ´T @ 0À.tls ðW ¶T @ 0À.rsrc è X ¸T @ 0À.reloc Ìð X ò ¾T @ 0B base_address:0x00410000 process_identifier:2820 process_handle:0x0000063c
1
1
0
WriteProcessMemory
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ,®b à . 82 ¬V ä ð P2 @ Z yåV @ °W Y ÀW X è X Ìð ðW àÂW .text 72 82 ` ``.data ´é P2 ê <2 @ `À.rdata xk @4 l &4 @ `@.eh_fram
°T T @ 0@.bss °ã ÀT `À.edata Y °W T @ 0@.idata ÀW T @ 0À.CRT àW ´T @ 0À.tls ðW ¶T @ 0À.rsrc è X ¸T @ 0À.reloc Ìð X ò ¾T @ 0B base_address:0x00400000 process_identifier:2856 process_handle:0x00000650
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ,®b à . 82 ¬V ä ð P2 @ Z yåV @ °W Y ÀW X è X Ìð ðW àÂW .text 72 82 ` ``.data ´é P2 ê <2 @ `À.rdata xk @4 l &4 @ `@.eh_fram
°T T @ 0@.bss °ã ÀT `À.edata Y °W T @ 0@.idata ÀW T @ 0À.CRT àW ´T @ 0À.tls ðW ¶T @ 0À.rsrc è X ¸T @ 0À.reloc Ìð X ò ¾T @ 0B base_address:0x00410000 process_identifier:2820 process_handle:0x0000063c
buffer: zR | à_«ÿ C V
G ( 8 da«ÿé AC bC L C j
d (b«ÿ? C@{ | Pb«ÿ C \b«ÿ C ¤ hb«ÿ ¸ db«ÿ zR | ¨\Ýÿw C A
D zR | T ô\Ýÿw AA AC0x
CÃ AÆAÇE T
AÃ AÆAÇA SAÃ AÆAÇ zR | ]Ýÿ$ C0` zR | < ]Ýÿ³ A A AAC
AÃAÆ AÇAÅC zR | P l]ÝÿÞ A A AAC0¥
CÃAÆ AÇAÅF _AÃAÆ CÇAÅ zR | , à]ÝÿQ A B
IR
ÃAÆAÇAÅ G zR | $ øaÝÿ ]H AÅ _Ã zR | ÈbÝÿ1 N\ 4 ðbÝÿR AC o
AÃD X ,cÝÿ zR | cÝÿC C U
H ` D < PcÝÿ¡ AA C d
FÃAÆH o
FÃAÆJ _ FÃAÆ ¸cÝÿ zR | 8 cÝÿ` AA C L I P C j C C AÃAÆ , X ÀcÝÿs QC s N O E C
AÃA 8 dÝÿ AC P
CÃI L H x E C
AÃK 0 Ä ddÝÿ¼ C Z
C [
E i C Z
J d C zR | ØdÝÿJ AA C d < eÝÿì A A CCEPXDCPm
AÃAÆ AÇAÅG d@CPB@CPC
AÃAÆ AÇAÅA H ¤ eÝÿê jA AC0
AÃ AÆAÇK û
AÃ AÆAÇB zR | < gÝÿ' A A AACP&
AÃAÆ AÇAÅG < \ jÝÿ' A C ACC@Ê
CÃAÆ AÇAÅE < ükÝÿ AD Ak
à AÆAÇE Y
à FÆAÇA D Ü \lÝÿ\ AA CE @
CÃ AÆAÇA CFÃ AÆAÇ ( $ tlÝÿI AC E o
AÃAÆF ( P lÝÿK AC C z
AÃAÆA < | ¼lÝÿ A B
FÉ
ÃAÆAÇAÅ K "
ÃAÆAÇAÅ K , ¼ uÝÿõ A B
FF
ÃAÆAÇAÅ F @ ì ìuÝÿW AA AC O
AÃ AÆAÇH oAÃ AÆAÇ zR | , ðuÝÿ A B
F´
ÃAÆAÇAÅ H zR | @ ÈyÝÿé AA HàPØCàW
CÃAÆH M
CÃAÆG L ` tzÝÿ¸ AA HàPØCàW
CÃAÆH M
CÃAÆG [ CÃAÆ T ° äzÝÿÿ A A AAFÀS
CÃAÆ AÇAÅE S
CÃAÆ AÇAÅG |ÝÿO ACv
CÃC ( , ¸|ÝÿB AC V C Q
AÃA , X Ü|Ýÿ_ AC V C R
AÃH eAÃ }Ýÿ' CQ
A 4 ¤ }Ýÿq AA C R
AÃAÆG N AÃAÆ base_address:0x0095b000 process_identifier:2820 process_handle:0x0000063c
buffer: 0 H X X <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!--The ID below indicates application support for Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!--The ID below indicates application support for Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
base_address:0x00990000 process_identifier:2820 process_handle:0x0000063c
buffer:MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode.
$ PE L ,®b à . 82 ¬V ä ð P2 @ Z yåV @ °W Y ÀW X è X Ìð ðW àÂW .text 72 82 ` ``.data ´é P2 ê <2 @ `À.rdata xk @4 l &4 @ `@.eh_fram
°T T @ 0@.bss °ã ÀT `À.edata Y °W T @ 0@.idata ÀW T @ 0À.CRT àW ´T @ 0À.tls ðW ¶T @ 0À.rsrc è X ¸T @ 0À.reloc Ìð X ò ¾T @ 0B base_address:0x00400000 process_identifier:2856 process_handle:0x00000650
buffer: zR | à_«ÿ C V
G ( 8 da«ÿé AC bC L C j
d (b«ÿ? C@{ | Pb«ÿ C \b«ÿ C ¤ hb«ÿ ¸ db«ÿ zR | ¨\Ýÿw C A
D zR | T ô\Ýÿw AA AC0x
CÃ AÆAÇE T
AÃ AÆAÇA SAÃ AÆAÇ zR | ]Ýÿ$ C0` zR | < ]Ýÿ³ A A AAC
AÃAÆ AÇAÅC zR | P l]ÝÿÞ A A AAC0¥
CÃAÆ AÇAÅF _AÃAÆ CÇAÅ zR | , à]ÝÿQ A B
IR
ÃAÆAÇAÅ G zR | $ øaÝÿ ]H AÅ _Ã zR | ÈbÝÿ1 N\ 4 ðbÝÿR AC o
AÃD X ,cÝÿ zR | cÝÿC C U
H ` D < PcÝÿ¡ AA C d
FÃAÆH o
FÃAÆJ _ FÃAÆ ¸cÝÿ zR | 8 cÝÿ` AA C L I P C j C C AÃAÆ , X ÀcÝÿs QC s N O E C
AÃA 8 dÝÿ AC P
CÃI L H x E C
AÃK 0 Ä ddÝÿ¼ C Z
C [
E i C Z
J d C zR | ØdÝÿJ AA C d < eÝÿì A A CCEPXDCPm
AÃAÆ AÇAÅG d@CPB@CPC
AÃAÆ AÇAÅA H ¤ eÝÿê jA AC0
AÃ AÆAÇK û
AÃ AÆAÇB zR | < gÝÿ' A A AACP&
AÃAÆ AÇAÅG < \ jÝÿ' A C ACC@Ê
CÃAÆ AÇAÅE < ükÝÿ AD Ak
à AÆAÇE Y
à FÆAÇA D Ü \lÝÿ\ AA CE @
CÃ AÆAÇA CFÃ AÆAÇ ( $ tlÝÿI AC E o
AÃAÆF ( P lÝÿK AC C z
AÃAÆA < | ¼lÝÿ A B
FÉ
ÃAÆAÇAÅ K "
ÃAÆAÇAÅ K , ¼ uÝÿõ A B
FF
ÃAÆAÇAÅ F @ ì ìuÝÿW AA AC O
AÃ AÆAÇH oAÃ AÆAÇ zR | , ðuÝÿ A B
F´
ÃAÆAÇAÅ H zR | @ ÈyÝÿé AA HàPØCàW
CÃAÆH M
CÃAÆG L ` tzÝÿ¸ AA HàPØCàW
CÃAÆH M
CÃAÆG [ CÃAÆ T ° äzÝÿÿ A A AAFÀS
CÃAÆ AÇAÅE S
CÃAÆ AÇAÅG |ÝÿO ACv
CÃC ( , ¸|ÝÿB AC V C Q
AÃA , X Ü|Ýÿ_ AC V C R
AÃH eAÃ }Ýÿ' CQ
A 4 ¤ }Ýÿq AA C R
AÃAÆG N AÃAÆ base_address:0x0094b000 process_identifier:2856 process_handle:0x00000650
buffer: 0 H X X <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker"/>
</requestedPrivileges>
</security>
</trustInfo>
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
<!--The ID below indicates application support for Windows 8.1 -->
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
<!--The ID below indicates application support for Windows 10 -->
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
</application>
</compatibility>
</assembly>
base_address:0x00980000 process_identifier:2856 process_handle:0x00000650
KDSIE.exe