14002ac7c
14002ac7c string "[DEBUG::%s::%d] [INJECT] Allocated argument memory in the remote process: %p\n",0 ← 0x14001627b
14002acca
14002acca string "[INJECT] Failed to write argument into remote process",0 ← 0x1400162a6
14002ad00
14002ad00 string "[DEBUG::%s::%d] [INJECT] Wrote argument into remote process: %d written\n",0 ← 0x1400162dc
14002ad49
14002ad49 string "[DEBUG::%s::%d] [INJECT] Successful injected code into remote process: [Tid: %d]\n",0 ← 0x140016330
14002ad9b
14002ad9b string "[DEBUG::%s::%d] [INJECT] Failed to create a new thread: %d\n",0 ← 0x14001634d
14002add7
14002add7 string "[INJECT] End of function. Cleanup start now",0 ← 0x140016362
14002ae03
14002ae03 string "[DEBUG::%s::%d] DllInjectReflective( %x, %x, %d, %x )\n",0 ← 0x1400112bc
14002ae3a
14002ae3a string "Params == NULL",0 ← 0x1400112fe
14002ae49
14002ae49 string "[ERROR] trying to inject a x64 payload into a x86 process. ABORT",0 ← 0x140011343
14002ae8a
14002ae8a string "[ERROR] trying to inject a x86 payload into a x64 process. ABORT",0 ← 0x140011382
14002aecb
14002aecb string "The DLL has a Reflective Loader already defined",0 ← 0x1400113bc
14002aefb
14002aefb string "The DLL does not have a Reflective Loader defined, using KaynLdr",0 ← 0x1400113dc
14002af3c
14002af3c string "[DEBUG::%s::%d] Reflective Loader Offset => %x\n",0 ← 0x14001143c
14002af6c
14002af6c string "[DEBUG::%s::%d] Params: Size:[%d] Pointer:[%p]\n",0 ← 0x140011465
14002af9c
14002af9c string "[DEBUG::%s::%d] MemoryAlloc: Success allocated memory for parameters: ptr:[%p]\n",0 ← 0x1400114be
14002afec
14002afec string "NtWriteVirtualMemory: Failed to write memory for parameters",0 ← 0x140011502
14002b028
14002b028 string "Successful wrote params into remote library memory",0 ← 0x140011520
14002b05b
14002b05b string "NtAllocateVirtualMemory: Failed to allocate memory for parameters",0 ← 0x140011542
14002b09d
14002b09d string "[+] NtAllocateVirtualMemory: success",0 ← 0x1400115a8
14002b0c2
14002b0c2 string "[DEBUG::%s::%d] [+] NtWriteVirtualMemory: success: ptr[%p]\n",0 ← 0x140011603
14002b0fe
14002b0fe string "[DEBUG::%s::%d] ctx->Parameter: %p\n",0 ← 0x140011660
14002b122
14002b122 string "[DEBUG::%s::%d] [-] Failed to inject dll %d\n",0 ← 0x1400116b5
14002b14f
14002b14f string "[-] NtProtectVirtualMemory: failed",0 ← 0x1400116d5
14002b172
14002b172 string "[DEBUG::%s::%d] NtWriteVirtualMemory: Failed to write memory for library [%x]\n",0 ← 0x14001171b
14002b1c1
14002b1c1 string "[DEBUG::%s::%d] Failed to allocate memory: %d\n",0 ← 0x140011759
14002b1f0
14002b1f0 string "[DEBUG::%s::%d] Params( %x, %d, %x )\n",0 ← 0x1400117d8
14002b216
14002b216 string "Failed",0 ← 0x1400118ad
14002b21d
14002b21d 00 00 00 ...
14002b220
14002b220 string "[DEBUG::%s::%d] FunctionName => %s\n",0 ← 0x14001465b 0x140023352
14002b244
14002b244 00 00 00 00 00 00 00 00 00 00 00 00 ............
14002b250
14002b250 string "[DEBUG::%s::%d] Exception: %p\n",0 ← 0x1400221af
14002b26f
14002b26f uint8_t g_14002b26f ← CoffeeProcessSymbol
14002b26f 24 $
14002b270 00 .
14002b271
14002b271 string "[DEBUG::%s::%d] Failed to load library: Lib:[%s] Err:[%d]\n",0 ← 0x14000996f
14002b2ac
14002b2ac string "Finished",0 ← 0x1400090bb
14002b2b5
14002b2b5 string "[DEBUG::%s::%d] %s\n",0 ← 0x140008d72 0x140008e3f 0x14000904c 0x1400090cf 0x14000923e 0x1400092ab 0x140009459 0x140009526 0x14001ad6b
14002b2c9
14002b2c9 string "Register VEH handler...",0 ← 0x140008d5e
14002b2e1
14002b2e1 string "[DEBUG::%s::%d] Unknown protection: %x",0 ← 0x140008ec5
14002b308
14002b308 string "Failed to protect memory",0 ← 0x140008e2b 0x140008f02
14002b321
14002b321 string "[DEBUG::%s::%d] [!] Couldn't find function => %s\n",0 ← 0x140008f9d
14002b353
14002b353 string "[DEBUG::%s::%d] The entry point (%p) is not on executable memory\n",0 ← 0x140009033
14002b395
14002b395 string "[*] Execute coffee main\n",0 ← 0x140009053
14002b3ae
14002b3ae string "[DEBUG::%s::%d] [!] Failed to free memory: %p : %lu\n",0 ← 0x140008cb8
14002b3e3
14002b3e3 string "Process Sections",0 ← 0x140009502
14002b3f4
14002b3f4 string "[DEBUG::%s::%d] Symbol '%s' couldn't be resolved\n",0 ← 0x140009632
14002b426
14002b426 string "[DEBUG::%s::%d] [!] Relocation type %d for Symbol %s not supported\n",0 ← 0x140009772
14002b46a
14002b46a string "[DEBUG::%s::%d] [!] Relocation type not found: %d\n",0 ← 0x14000978d
14002b49d
14002b49d string "Coffe entry was not found",0 ← 0x14001ad57
14002b4b7
14002b4b7 string "[DEBUG::%s::%d] [EntryName: %s] [CoffeeData: %p] [ArgData: %p] [ArgSize: %ld]\n",0 ← 0x14000920c
14002b506
14002b506 string "[!] Coffee data is empty",0 ← 0x140009228
14002b51f
14002b51f string "The BOF is not AMD64",0 ← 0x140009297
14002b534
14002b534 string "Failed to allocate memory",0 ← 0x1400092ff
14002b54e
14002b54e string "Failed to allocate memory for the BOF",0 ← 0x14000935d
14002b574
14002b574 string "[DEBUG::%s::%d] Coffee->SecMap[ %d ].Ptr => %p\n",0 ← 0x1400093c2
14002b5a4
14002b5a4 string "[*] Failed to process relocation",0 ← 0x140009414
14002b5c5
14002b5c5 string "[*] Cleanup memory",0 ← 0x14000944c
14002b5d8
14002b5d8 string "[DEBUG::%s::%d] Failed to create new CoffeeRunnerThread thread: %d",0 ← 0x140009b20
14002b61b
14002b61b 00 00 00 00 00 .....
14002b620
14002b620 string "[DEBUG::%s::%d] ModuleString: %s : %lx\n",0 ← 0x140017c18
14002b648
14002b648 string "[DEBUG::%s::%d] Module:[%p] Function:[%s : %lx]\n",0 ← 0x140017675
14002b679
14002b679 string "[DEBUG::%s::%d] Found the RequestID for the calling BOF: %x\n",0 ← 0x14001471d
14002b6b6
14002b6b6 string "Failed to find the RequestID for the calling BOF",0 ← 0x14001473b
14002b6e7
14002b6e7 string "[DEBUG::%s::%d] %s\n",0 ← 0x14001474f
14002b6fb
14002b6fb string "[DEBUG::%s::%d] BeaconPrintf( %d, %x, ... )\n",0 ← 0x1400086de
14002b728
14002b728 string "[DEBUG::%s::%d] CallbackOutput[%d]: \n%s\n",0 ← 0x14000878f
14002b751
14002b751 string "[DEBUG::%s::%d] BeaconOutput( %d, %p, %d )\n",0 ← 0x140008606
14002b77d
14002b77d 00 00 00 ...
14002b780
14002b780 string "TRUE",0 ← 0x14000f7d4 0x14000fa26
14002b785
14002b785 string "FALSE",0 ← 0x14000f7e2 0x14000fa0a
14002b78b
14002b78b string "[DEBUG::%s::%d] Config Size: %d\n",0 ← 0x14000f63c
14002b7ac
14002b7ac string "[DEBUG::%s::%d] Sleep: %d (%d%%)\n",0 ← 0x14000f6aa
14002b7ce
14002b7ce string "[DEBUG::%s::%d] [CONFIG] Memory: \n - Allocate: %d \n - Execute : %d \n",0 ← 0x14000f6ee
14002b815
14002b815 string "[DEBUG::%s::%d] [CONFIG] Spawn: \n - [x64] => %ls \n - [x86] => %ls \n",0 ← 0x14000f76b
14002b85b
14002b85b string "[DEBUG::%s::%d] [CONFIG] Sleep Obfuscation: \n - Technique: %d \n - Stack Dup: %s \n[CONFIG] ProxyLoading: %d\n[CONFIG] SysIndirect : %s\n[CONFIG] AmsiEtwPatch: %d\n",0 ← 0x14000f815
14002b8fb
14002b8fb string "[DEBUG::%s::%d] KillDate: %d\n",0 ← 0x14000f860
14002b919
14002b919 string "[DEBUG::%s::%d] [CONFIG] Hosts [%d]\n:",0 ← 0x14000f935
14002b93f
14002b93f string "[DEBUG::%s::%d] - %ls:%ld\n",0 ← 0x14000f89e
14002b95b
14002b95b string "[DEBUG::%s::%d] Hosts added => %d\n",0 ← 0x14000f9ae
14002b97e
14002b97e string "[DEBUG::%s::%d] Host going to be used is => %ls:%ld\n",0 ← 0x14000f9dc
14002b9b3
14002b9b3 string "[DEBUG::%s::%d] [CONFIG] Secure: %s\n",0 ← 0x14000fa2d
14002b9d8
14002b9d8 string "[DEBUG::%s::%d] [CONFIG] UserAgent: %ls\n",0 ← 0x14000fa91
14002ba01
14002ba01 string "[DEBUG::%s::%d] [CONFIG] Headers [%d]:\n",0 ← 0x14000faec
14002ba29
14002ba29 string "[DEBUG::%s::%d] - %ls\n",0 ← 0x14000f9be 0x14000fbac
14002ba42
14002ba42 string "[DEBUG::%s::%d] [CONFIG] Uris [%d]:\n",0 ← 0x14000fbfa
14002ba67
14002ba67 string "[CONFIG] [PROXY] Enabled",0 ← 0x14000fcd6
14002ba80
14002ba80 string "[DEBUG::%s::%d] %s\n",0 ← 0x14000fcc1 0x14000fece
14002ba94
14002ba94 string "[DEBUG::%s::%d] [CONFIG] [PROXY] Url: %ls\n",0 ← 0x14000fd3e
14002babf
14002babf string "[DEBUG::%s::%d] [CONFIG] [PROXY] Username: %ls\n",0 ← 0x14000fda2
14002baef
14002baef string "[DEBUG::%s::%d] [CONFIG] [PROXY] Password: %ls\n",0 ← 0x14000fe11
14002bb1f
14002bb1f string "[CONFIG] [PROXY] Disabled",0 ← 0x14000fe2c
14002bb39
14002bb39 string "TRANSPORT_HTTP",0 ← 0x14000fedb
14002bb48
14002bb48 string "Failed to load ntdll from PEB",0 ← 0x1400104b4
14002bb66
14002bb66 string "[DEBUG::%s::%d] OSVersion: %d\n",0 ← 0x140010594
14002bb85
14002bb85 string "Failed to Initialize syscalls",0 ← 0x140010b8c
14002bba3
14002bba3 string "Failed to load a module",0 ← 0x140010bbc
14002bbbb
14002bbbb string "Adding required function module &addresses to the cfg list",0 ← 0x140010cac
14002bbf6
14002bbf6 string "[DEBUG::%s::%d] Instance DemonID => %x\n",0 ← 0x140010da5
14002bc1e
14002bc1e 00 00 ..
14002bc20
14002bc20 string "[DEBUG::%s::%d] WinMain: hInstance:[%p] hPrevInstance:[%p] lpCmdLine:[%s] nShowCmd:[%d]\n",0 ← 0x1400222cc 0x1400233a2
14002bc79
14002bc79 00 00 00 00 00 00 00 .......
14002bc80
14002bc80 uint8_t g_14002bc80 ← main
14002bc80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002bc90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002bca0 b0 15 00 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002bcb0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002bcc0
14002bcc0 struct IMAGE_TLS_DIRECTORY64
14002bcc0 StartAddressOfRawData uint64 0x140033000
14002bcc8 EndAddressOfRawData uint64 0x140033008
14002bcd0 AddressOfIndex uint64 0x14003007c
14002bcd8 AddressOfCallBacks uint64 0x140032038
14002bce0 SizeOfZeroFill int 0
14002bce4 Characteristics uint32 0x00000000
14002bce8
14002bce8 00 00 00 00 00 00 00 00 ........
14002bcf0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002bd00
14002bd00 string "Argument domain error (DOMAIN)",0 ← 0x1400016f0
14002bd1f
14002bd1f string "Argument singularity (SIGN)",0 ← 0x140001688
14002bd3b
14002bd3b 00 00 00 00 00 .....
14002bd40
14002bd40 string "Overflow range error (OVERFLOW)",0 ← 0x140001710
14002bd60
14002bd60 string "Partial loss of significance (PLOSS)",0 ← 0x140001700
14002bd85
14002bd85 00 00 00 ...
14002bd88
14002bd88 string "Total loss of significance (TLOSS)",0 ← 0x140001730
14002bdab
14002bdab 00 00 00 00 00 .....
14002bdb0
14002bdb0 string "The result is too small to be represented (UNDERFLOW)",0 ← 0x140001720
14002bde6
14002bde6 string "Unknown error",0 ← 0x14000173c
14002bdf4
14002bdf4 00 00 00 00 ....
14002bdf8
14002bdf8 string "_matherr(): %s in %s(%g, %g) (retval=%g)\n",0 ← 0x1400016b7
14002be23
14002be23 00 .
14002be24
14002be24 uint8_t g_14002be24 ← _matherr
14002be24 18 59 fd ff cc 58 fd ff 64 58 fd ff .Y...X..dX..
14002be30 ec 58 fd ff fc 58 fd ff 0c 59 fd ff dc 58 fd ff .X...X...Y...X..
14002be40
14002be40 string "Mingw-w64 runtime failure:\n",0 ← 0x140001797
14002be5c
14002be5c 00 00 00 00 ....
14002be60
14002be60 string "Address %p has no image-section",0 ← 0x140001925
14002be80
14002be80 string " VirtualQuery failed for %d bytes at address %p",0 ← 0x140001911
14002beb1
14002beb1 00 00 00 00 00 00 00 .......
14002beb8
14002beb8 string " VirtualProtect failed with code 0x%x",0 ← 0x1400018ee
14002bedf
14002bedf 00 .
14002bee0
14002bee0 string " Unknown pseudo relocation protocol version %d.\n",0 ← 0x140001c8e
14002bf12
14002bf12 00 00 00 00 00 00 ......
14002bf18
14002bf18 string " Unknown pseudo relocation bit size %d.\n",0 ← 0x140001c82
14002bf42
14002bf42 00 00 00 00 00 00 ......
14002bf48
14002bf48 string "%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.\n",0 ← 0x140001ba7
14002bf9b
14002bf9b 00 00 00 00 00 .....
14002bfa0
14002bfa0 uint8_t g_14002bfa0 ← _gnu_exception_handler
14002bfa0 30 5e fd ff 30 5e fd ff 30 5e fd ff 30 5e fd ff 0^..0^..0^..0^..
14002bfb0 30 5e fd ff dd 5d fd ff 30 5e fd ff 58 5e fd ff 0^...]..0^..X^..
14002bfc0 dd 5d fd ff bb 5d fd ff 00 00 00 00 00 00 00 00 .]...]..........
14002bfd0
14002bfd0 string "(null)",0 ← 0x140002986
14002bfd7
14002bfd7 00 .
14002bfd8
14002bfd8 wstring "(null)",0 ← 0x1400048be
14002bfe6
14002bfe6 string "NaN",0 ← 0x140004920
14002bfea
14002bfea string "Inf",0 ← 0x140004689 0x140004b00
14002bfee
14002bfee 00 00 ..
14002bff0
14002bff0 uint8_t g_14002bff0 ← __mingw_pformat
14002bff0 98 85 fd ff b8 81 fd ff b8 81 fd ff 62 88 fd ff ............b...
14002c000 b8 81 fd ff 7a 87 fd ff b8 81 fd ff 91 87 fd ff ....z...........
14002c010 b8 81 fd ff b8 81 fd ff 0a 88 fd ff 45 88 fd ff ............E...
14002c020 b8 81 fd ff b2 85 fd ff cf 85 fd ff b8 81 fd ff ................
14002c030 eb 85 fd ff b8 81 fd ff b8 81 fd ff b8 81 fd ff ................
14002c040 b8 81 fd ff b8 81 fd ff b8 81 fd ff b8 81 fd ff ................
*
14002c070 b8 81 fd ff 08 86 fd ff b8 81 fd ff b0 86 fd ff ................
14002c080 b8 81 fd ff e7 86 fd ff 18 87 fd ff 49 87 fd ff ............I...
14002c090 b8 81 fd ff b9 83 fd ff b8 81 fd ff b8 81 fd ff ................
14002c0a0 f0 83 fd ff b8 81 fd ff b8 81 fd ff b8 81 fd ff ................
14002c0b0 b8 81 fd ff b8 81 fd ff b8 81 fd ff c6 88 fd ff ................
14002c0c0 b8 81 fd ff b8 81 fd ff b8 81 fd ff b8 81 fd ff ................
14002c0d0 30 82 fd ff b8 81 fd ff b8 81 fd ff b8 81 fd ff 0...............
14002c0e0 b8 81 fd ff b8 81 fd ff b8 81 fd ff b8 81 fd ff ................
14002c0f0 b8 81 fd ff 07 84 fd ff b8 81 fd ff 95 84 fd ff ................
14002c100 a8 82 fd ff 6a 85 fd ff 3c 85 fd ff 04 85 fd ff ....j...<.......
14002c110 24 83 fd ff a8 82 fd ff 90 82 fd ff b8 81 fd ff $...............
14002c120 99 83 fd ff 44 83 fd ff 62 83 fd ff 30 82 fd ff ....D...b...0...
14002c130 f3 82 fd ff b8 81 fd ff b8 81 fd ff d9 84 fd ff ................
14002c140 90 82 fd ff 30 82 fd ff b8 81 fd ff b8 81 fd ff ....0...........
14002c150 30 82 fd ff b8 81 fd ff 90 82 fd ff 00 00 00 00 0...............
14002c160
14002c160 string "Infinity",0 ← 0x1400050e8
14002c169
14002c169 string "NaN",0 ← 0x140005067
14002c16d
14002c16d uint8_t g_14002c16d ← __gdtoa
14002c16d 30 00 00 0..
14002c170
14002c170 uint8_t g_14002c170 ← __gdtoa
14002c170 00 00 00 00 00 00 f8 3f .......?
14002c178
14002c178 uint8_t g_14002c178 ← __gdtoa
14002c178 61 43 6f 63 a7 87 d2 3f aCoc...?
14002c180
14002c180 uint8_t g_14002c180 ← __gdtoa
14002c180 b3 c8 60 8b 28 8a c6 3f ..`.(..?
14002c188
14002c188 uint8_t g_14002c188 ← __gdtoa
14002c188 fb 79 9f 50 13 44 d3 3f .y.P.D.?
14002c190
14002c190 uint8_t g_14002c190 ← __gdtoa
14002c190 04 fa 7d 9d 16 2d 94 3c ..}..-.<
14002c198
14002c198 uint8_t g_14002c198 ← __gdtoa
14002c198 32 5a 47 55 13 44 d3 3f 2ZGU.D.?
14002c1a0
14002c1a0 uint8_t g_14002c1a0 ← __gdtoa
14002c1a0 00 00 00 00 00 00 f0 3f .......?
14002c1a8
14002c1a8 uint8_t g_14002c1a8 ← __gdtoa
14002c1a8 00 00 00 00 00 00 24 40 ......$@
14002c1b0
14002c1b0 uint8_t g_14002c1b0 ← __gdtoa
14002c1b0 00 00 00 00 00 00 08 40 .......@
14002c1b8
14002c1b8 uint8_t g_14002c1b8 ← __gdtoa
14002c1b8 00 00 00 00 00 00 1c 40 .......@
14002c1c0
14002c1c0 uint8_t g_14002c1c0 ← __gdtoa
14002c1c0 00 00 00 00 00 00 14 40 00 00 00 00 00 00 00 00 .......@........
14002c1d0
14002c1d0 uint8_t g_14002c1d0 ← __gdtoa
14002c1d0 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 ................
14002c1e0
14002c1e0 uint8_t g_14002c1e0 ← __gdtoa
14002c1e0 00 00 00 00 00 00 e0 3f 00 00 00 00 00 00 00 00 .......?........
14002c1f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002c200
14002c200 uint8_t g_14002c200 ← __pow5mult_D2A
14002c200 05 00 00 00 19 00 00 00 7d 00 00 00 00 00 00 00 ........}.......
14002c210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002c220 00 00 00 00 00 00 f0 3f 00 00 00 00 00 00 24 40 .......?......$@
14002c230 00 00 00 00 00 00 59 40 00 00 00 00 00 40 8f 40 ......Y@.....@.@
14002c240 00 00 00 00 00 88 c3 40 00 00 00 00 00 6a f8 40 .......@.....j.@
14002c250 00 00 00 00 80 84 2e 41 00 00 00 00 d0 12 63 41 .......A......cA
14002c260 00 00 00 00 84 d7 97 41 00 00 00 00 65 cd cd 41 .......A....e..A
14002c270 00 00 00 20 5f a0 02 42 00 00 00 e8 76 48 37 42 ... _..B....vH7B
14002c280 00 00 00 a2 94 1a 6d 42 00 00 40 e5 9c 30 a2 42 ......mB..@..0.B
14002c290 00 00 90 1e c4 bc d6 42 00 00 34 26 f5 6b 0c 43 .......B..4&.k.C
14002c2a0 00 80 e0 37 79 c3 41 43 00 a0 d8 85 57 34 76 43 ...7y.AC....W4vC
14002c2b0 00 c8 4e 67 6d c1 ab 43 00 3d 91 60 e4 58 e1 43 ..Ngm..C.=.`.X.C
14002c2c0 40 8c b5 78 1d af 15 44 50 ef e2 d6 e4 1a 4b 44 @..x...DP.....KD
14002c2d0 92 d5 4d 06 cf f0 80 44 00 00 00 00 00 00 00 00 ..M....D........
14002c2e0 bc 89 d8 97 b2 d2 9c 3c 33 a7 a8 d5 23 f6 49 39 .......<3...#.I9
14002c2f0 3d a7 f4 44 fd 0f a5 32 9d 97 8c cf 08 ba 5b 25 =..D...2......[%
14002c300 43 6f ac 64 28 06 c8 0a 00 00 00 00 00 00 00 00 Co.d(...........
14002c310 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002c320 00 80 e0 37 79 c3 41 43 17 6e 05 b5 b5 b8 93 46 ...7y.AC.n.....F
14002c330 f5 f9 3f e9 03 4f 38 4d 32 1d 30 f9 48 77 82 5a ..?..O8M2.0.Hw.Z
14002c340 3c bf 73 7f dd 4f 15 75 <.s..O.u
14002c348
14002c348 uint8_t g_14002c348 ← __i2b_D2A
14002c348 01 00 00 00 02 00 00 00 ........
14002c350
14002c350 uint8_t g_14002c350 ← __i2b_D2A
14002c350 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
14002c360
14002c360 uint8_t g_14002c360 ← CoffeeProcessSymbol
14002c360 c0 4d 02 40 01 00 00 00 00 00 00 00 00 00 00 00 .M.@............
14002c370
14002c370 uint8_t g_14002c370 ← AnonPipesInit AnonPipesRead BeaconFormatAlloc BeaconFormatFree BeaconFormatPrintf BeaconGetSpawnTo BeaconPrintf BeaconSpawnTemporaryProcess BeaconUseToken CanTokenBeImpersonated ClrCreateInstance CoffeeCleanup CoffeeExecuteFunction CoffeeLdr CoffeeProcessSymbol CoffeeRunner CoffeeRunnerThread CommandAssemblyInlineExecute CommandAssemblyListVersion CommandConfig CommandDispatcher CommandExit CommandFS CommandInjectDLL CommandInjectShellcode CommandInlineExecute CommandJob CommandKerberos CommandNet CommandPivot CommandProc CommandProcList CommandSleep CommandSocket CommandToken CommandTransfer CopySessionInfo DllInjectReflective DllSpawnReflective DnsQueryIPv4 DnsQueryIPv6 DotnetClose DotnetExecute DotnetPush DotnetPushPipe DownloadAdd DownloadFree DownloadPush DownloadRemove ElevateToSystem EventSet ExceptionHandler ExtractTicket FoliageObf GetAllHandles GetLUID GetLogonSessionData GetLsaHandle GetMemFile GetProcessIdByName GetProcessesFromHandleTable GetRequestIDForCallingObjectFile GetSyscallSize GetSystemFileTime GetTokenInfo GetTypeIndexToken HostAdd HostCheckup HostCount HostFailure HostRandom HostRotation HttpQueryStatus HttpSend HwBpEngineAdd HwBpEngineDestroy HwBpEngineInit HwBpEngineSetBp ImpersonateTokenInStore InWorkingHours InitWSA Inject IsHighIntegrity IsImpersonationToken IsSystem JobAdd JobCheckList JobKill JobRemove JobResume JobSuspend Klist LdrFreeLibrary LdrFunctionAddr LdrLocalFree LdrModuleLoad LdrModulePeb LdrModulePebByString LdrModulePebString LdrModuleSearch ListTokens MemFileFree MemFileIsNew MemoryAlloc MemoryProtect NewMemFile PackageAddBool PackageAddBytes PackageAddInt32 PackageAddInt64 PackageAddPad PackageCreate PackageCreateWithMetaData PackageDestroy PackageTransmit PackageTransmitAll PackageTransmitNow ParserDestroy ParserNew PipeWrite PivotAdd PivotGet PivotPush PivotRemove ProcessCreate ProcessIsWow ProcessOpen ProcessSnapShot ProcessTerminate ProcessUserToken Ptt Purge QueryObjectTypesInfo RandomBool RandomNumber32 ReachedKillDate ReadLocalFile RecvAll RemoveCoffeeFromInstance RemoveMemFile RtAdvapi32 RtAmsi RtGdi32 RtIphlpapi RtMscoree RtMsvcrt RtNetApi32 RtOleaut32 RtShell32 RtSspicli RtUser32 RtWinHttp RtWs2_32 SleepObf SleepTime SocketCleanDead SocketClients SocketFree SocketNew SocketRead SysDuplicateTokenEx SysImpersonateLoggedOnUser SysInitialize SysNtAlertResumeThread SysNtAllocateVirtualMemory SysNtClose SysNtCreateEvent SysNtCreateThreadEx SysNtDuplicateObject SysNtDuplicateToken SysNtFreeVirtualMemory SysNtGetContextThread SysNtGetNextThread SysNtOpenProcess SysNtOpenProcessToken SysNtOpenThread SysNtOpenThreadToken SysNtProtectVirtualMemory SysNtQueryInformationProcess SysNtQueryInformationThread SysNtQueryInformationToken SysNtQueryObject SysNtQuerySystemInformation SysNtQueryVirtualMemory SysNtQueueApcThread SysNtReadVirtualMemory SysNtResumeThread SysNtSetContextThread SysNtSetInformationThread SysNtSetInformationVirtualMemory SysNtSignalAndWaitForSingleObject SysNtSuspendThread SysNtTerminateProcess SysNtTerminateThread SysNtUnmapViewOfSection SysNtWaitForSingleObject SysNtWriteVirtualMemory ThreadCreate ThreadQueryTib TimerObf TokenAdd TokenClear TokenCurrentHandle TokenDuplicate TokenGet TokenImpersonate TokenMake TokenQueryOwner TokenRemove TokenRevSelf TokenSetPrivilege TokenSteal TransportInit WinScreenshot listDir
14002c370 00 44 02 40 01 00 00 00 00 00 00 00 00 00 00 00 .D.@............
14002c380
14002c380 uint8_t g_14002c380 ← CoffeeProcessSymbol
14002c380 60 4f 02 40 01 00 00 00 00 00 00 00 00 00 00 00 `O.@............
14002c390
14002c390 uint8_t g_14002c390 ← __dyn_tls_init
14002c390 50 4d 02 40 01 00 00 00 00 00 00 00 00 00 00 00 PM.@............
14002c3a0
14002c3a0 uint8_t g_14002c3a0 ← pre_c_init
14002c3a0 60 4d 02 40 01 00 00 00 00 00 00 00 00 00 00 00 `M.@............
14002c3b0
14002c3b0 uint8_t g_14002c3b0 ← __do_global_ctors
14002c3b0 e0 34 02 40 01 00 00 00 00 00 00 00 00 00 00 00 .4.@............
14002c3c0
14002c3c0 uint8_t g_14002c3c0 ← _pei386_runtime_relocator
14002c3c0 00 d6 02 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c3d0
14002c3d0 uint8_t g_14002c3d0 ← _pei386_runtime_relocator
14002c3d0 00 d6 02 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c3e0
14002c3e0 uint8_t g_14002c3e0 ← __tmainCRTStartup
14002c3e0 a0 bc 02 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c3f0
14002c3f0 uint8_t g_14002c3f0 ← pre_c_init _pei386_runtime_relocator _FindPESectionByName __mingw_GetSectionForAddress __mingw_GetSectionCount _FindPESectionExec _GetPEImageBase _IsNonwritableInCurrentImage __mingw_enum_import_library_names main
14002c3f0 00 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c400
14002c400 uint8_t g_14002c400 ← __tmainCRTStartup
14002c400 78 12 03 40 01 00 00 00 00 00 00 00 00 00 00 00 x..@............
14002c410
14002c410 uint8_t g_14002c410 ← __p__acmdln
14002c410 98 12 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c420
14002c420 uint8_t g_14002c420 ← __p__commode
14002c420 b0 12 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c430
14002c430 uint8_t g_14002c430 ← __p__fmode
14002c430 c0 12 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c440
14002c440 uint8_t g_14002c440 ← pre_c_init WinMainCRTStartup mainCRTStartup
14002c440 90 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c450
14002c450 uint8_t g_14002c450 ← pre_c_init
14002c450 78 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 x..@............
14002c460
14002c460 uint8_t g_14002c460 ← pre_c_init
14002c460 74 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 t..@............
14002c470
14002c470 uint8_t g_14002c470 ← pre_c_init
14002c470 70 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 p..@............
14002c480
14002c480 uint8_t g_14002c480 ← __tmainCRTStartup
14002c480 d0 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c490
14002c490 uint8_t g_14002c490 ← __tmainCRTStartup
14002c490 40 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 @..@............
14002c4a0
14002c4a0 uint8_t g_14002c4a0 ← __tmainCRTStartup
14002c4a0 48 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 H..@............
14002c4b0
14002c4b0 uint8_t g_14002c4b0 ← __gdtoa
14002c4b0 20 c2 02 40 01 00 00 00 00 00 00 00 00 00 00 00 ..@............
14002c4c0
14002c4c0 uint8_t g_14002c4c0 ← __tmainCRTStartup
14002c4c0 00 20 03 40 01 00 00 00 00 00 00 00 00 00 00 00 . .@............
14002c4d0
14002c4d0 uint8_t g_14002c4d0 ← __tmainCRTStartup
14002c4d0 10 20 03 40 01 00 00 00 00 00 00 00 00 00 00 00 . .@............
14002c4e0
14002c4e0 uint8_t g_14002c4e0 ← __tmainCRTStartup
14002c4e0 18 20 03 40 01 00 00 00 00 00 00 00 00 00 00 00 . .@............
14002c4f0
14002c4f0 uint8_t g_14002c4f0 ← __tmainCRTStartup
14002c4f0 28 20 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ( .@............
14002c500
14002c500 uint8_t g_14002c500 ← pre_c_init
14002c500 80 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c510
14002c510 uint8_t g_14002c510 ← pre_cpp_init
14002c510 50 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 P..@............
14002c520
14002c520 uint8_t g_14002c520 ← pre_c_init
14002c520 c0 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c530
14002c530 uint8_t g_14002c530 ← __tmainCRTStartup
14002c530 f0 1c 00 40 01 00 00 00 00 00 00 00 00 00 00 00 ...@............
14002c540
14002c540 uint8_t g_14002c540 ← pre_c_init
14002c540 50 16 00 40 01 00 00 00 00 00 00 00 00 00 00 00 P..@............
14002c550
14002c550 uint8_t g_14002c550 ← pre_cpp_init
14002c550 60 00 03 40 01 00 00 00 00 00 00 00 00 00 00 00 `..@............
14002c560
14002c560 uint8_t g_14002c560 ← CommandAssemblyListVersion
14002c560 e0 4f 02 40 01 00 00 00 00 00 00 00 00 00 00 00 .O.@............
14002c570
14002c570 uint8_t g_14002c570 ← CommandAssemblyListVersion
14002c570 10 50 02 40 01 00 00 00 00 00 00 00 00 00 00 00 .P.@............
14002c580
14002c580 uint8_t g_14002c580 ← KeyExpansion
14002c580 8d 01 02 04 08 10 20 40 80 1b 36 00 00 00 00 00 ...... @..6.....
14002c590
14002c590 string "CommandExit",0 ← 0x14000aa1e
14002c59c
14002c59c 00 00 00 00 ....
14002c5a0
14002c5a0 string "ClrCreateInstance",0 ← 0x140008b9f 0x140008bb8 0x140008bd8 0x140008bf1
14002c5b2
14002c5b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
14002c5c0
14002c5c0 string "RemoveMemFile",0 ← 0x14001ae12
14002c5ce
14002c5ce 00 00 ..
14002c5d0
14002c5d0 string "ExceptionHandler",0 ← 0x140013031
14002c5e1
14002c5e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...............
14002c5f0
14002c5f0 string "JobRemove",0 ← 0x140016c11
14002c5fa
14002c5fa 00 00 00 00 00 00 ......
14002c600
14002c600 string "Klist",0 ← 0x140017128 0x140017174 0x1400171b5 0x1400171f2 0x140017310 0x140017340
14002c606
14002c606 00 00 00 00 00 00 00 00 00 00 ..........
14002c610
14002c610 string "MemoryProtect",0 ← 0x140018547
14002c61e
14002c61e 00 00 ..
14002c620
14002c620 string "PackageTransmitError",0 ← 0x140018dd6
14002c635
14002c635 00 00 00 00 00 00 00 00 00 00 00 ...........
14002c640
14002c640 string "PivotParseDemonID",0 ← 0x140019519
14002c652
14002c652 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
14002c660
14002c660 string "RtWinHttp",0 ← 0x14001c21b
14002c66a
14002c66a 00 00 00 00 00 00 ......
14002c670
14002c670 string "SleepObf",0 ← 0x14001c835
14002c679
14002c679 00 00 00 00 00 00 00 .......
14002c680
14002c680 string "DnsQueryIPv6",0 ← 0x140011a37
14002c68d
14002c68d 00 00 00 ...
14002c690
14002c690 string "SysNtGetNextThread",0 ← 0x14001f0ba
14002c6a3
14002c6a3 00 00 00 00 00 00 00 00 00 00 00 00 00 .............
14002c6b0
14002c6b0 string "FindSsnOfHookedSyscall",0 ← 0x1400132f0
14002c6c7
14002c6c7 00 00 00 00 00 00 00 00 00 .........
14002c6d0
14002c6d0 string "ThreadCreate",0 ← 0x1400202dd 0x1400203c8
14002c6dd
14002c6dd 00 00 00 ...
14002c6e0
14002c6e0 string "ImpersonateTokenInStore",0 ← 0x140015dc0 0x140015df3
14002c6f8
14002c6f8 00 00 00 00 00 00 00 00 ........
14002c700
14002c700 string "TransportInit",0 ← 0x140022077
14002c70e
14002c70e 00 00 ..
14002c710
14002c710 string "HostRotation",0 ← 0x140014f46
14002c71d
14002c71d 00 00 00 ...
14002c720
14002c720 string "listDir",0 ← 0x14002265b 0x140022775
14002c728
14002c728 00 00 00 00 00 00 00 00 ........
14002c730
14002c730 string "DllSpawnReflective",0 ← 0x1400117c4
14002c743
14002c743 00 00 00 00 00 00 00 00 00 00 00 00 00 .............
14002c750
14002c750 string "GetReflectiveLoaderOffset",0 ← 0x140014654
14002c76a
14002c76a 00 00 00 00 00 00 ......
14002c770
14002c770 string "CoffeeRunner",0 ← 0x140009b19
14002c77d
14002c77d 00 00 00 ...
14002c780
14002c780 string "BeaconOutput",0 ← 0x14000862a
14002c78d
14002c78d 00 00 00 ...
14002c790
14002c790 string "DemonConfig",0 ← 0x14000f61a 0x14000f69f 0x14000f6e3 0x14000f758 0x14000f833 0x14000f859 0x14000f92e 0x14000f965 0x14000f9a7 0x14000f9f4 0x14000fa17 0x14000fa7e 0x14000fae5 0x14000fb6d 0x14000fbf3 0x14000fc7f 0x14000fce3 0x14000fd2b 0x14000fd8f 0x14000fdfe 0x14000fe39
14002c79c
14002c79c 00 00 00 00 ....
14002c7a0
14002c7a0 string "WinMain",0 ← 0x1400222e3
14002c7a8
14002c7a8 00 00 00 00 00 00 00 00 ........
14002c7b0
14002c7b0 string "KillDate",0 ← 0x140016f91
14002c7b9
14002c7b9 00 00 00 00 00 00 00 .......
14002c7c0
14002c7c0 string "DotnetClose",0 ← 0x140011ccf
14002c7cc
14002c7cc 00 00 00 00 ....
14002c7d0
14002c7d0 string "MemFileReadChunk",0 ← 0x1400181c1
14002c7e1
14002c7e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...............
14002c7f0
14002c7f0 string "HwBpEngineAdd",0 ← 0x140015835 0x1400158de 0x140015921
14002c7fe
14002c7fe 00 00 ..
14002c800
14002c800 string "JobKill",0 ← 0x1400169b2
14002c808
14002c808 00 00 00 00 00 00 00 00 ........
14002c810
14002c810 string "Purge",0 ← 0x14001a823 0x14001a861 0x14001a897 0x14001a96c
14002c816
14002c816 00 00 00 00 00 00 00 00 00 00 ..........
14002c820
14002c820 string "MemoryAlloc",0 ← 0x140018252
14002c82c
14002c82c 00 00 00 00 ....
14002c830
14002c830 string "PackageTransmitAll",0 ← 0x140018cb1 0x140018d68
14002c843
14002c843 00 00 00 00 00 00 00 00 00 00 00 00 00 .............
14002c850
14002c850 string "PivotPush",0 ← 0x140019563
14002c85a
14002c85a 00 00 00 00 00 00 ......
14002c860
14002c860 string "RtAmsi",0 ← 0x14001b238
14002c867
14002c867 00 00 00 00 00 00 00 00 00 .........
14002c870
14002c870 string "TimerObf",0 ← 0x140020856 0x1400209d5 0x140020a29 0x140020a79 0x140020d19 0x140020ec4 0x140020edd
14002c879
14002c879 00 00 00 00 00 00 00 .......
14002c880
14002c880 string "DnsQueryIPv4",0 ← 0x14001195b 0x14001199f
14002c88d
14002c88d 00 00 00 ...
14002c890 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002c8a0
14002c8a0 string "SysNtSetInformationVirtualMemory",0 ← 0x14001fd98
14002c8c1
14002c8c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...............
14002c8d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
14002c8e0
14002c8e0 string "SysExtract",0 ← 0x14001d928 0x14001d958 0x14001d9f8 0x14001da2d
14002c8eb
14002c8eb 00 00 00 00 00 .....
14002c8f0
14002c8f0 string "SysImpersonateLoggedOnUser",0 ← 0x14001dad4 0x14001dbd8
14002c90b
14002c90b 00 00 00 00 00 .....
14002c910
14002c910 string "HostRandom",0 ← 0x140014e4d 0x140014e69
14002c91b
14002c91b 00 00 00 00 00 .....
14002c920
14002c920 string "CfgAddressAdd",0 ← 0x140008a00
14002c92e
14002c92e 00 00 ..
14002c930
14002c930 string "DllInjectReflective",0 ← 0x140011291 0x140011312 0x140011350 0x14001138f 0x1400113ce 0x1400113e9 0x140011435 0x14001145e 0x1400114b7 0x14001150f 0x14001152d 0x14001153b 0x1400115b5 0x1400115fc 0x140011659 0x1400116ae 0x1400116e2 0x140011714 0x140011752
14002c944
14002c944 00 00 00 00 00 00 00 00 00 00 00 00 ............
14002c950
14002c950 string "CoffeeLdr",0 ← 0x140009200 0x140009235 0x1400092a4 0x1400093da 0x140009445
14002c95a
14002c95a 00 00 00 00 00 00 ......
14002c960
14002c960 string "BeaconPrintf",0 ← 0x1400086a2
14002c96d
14002c96d 00 00 00 ...
14002c970
14002c970 string "DemonInit",0 ← 0x14000fec7
14002c97a
14002c97a 00 00 00 00 00 00 ......
14002c980
14002c980 string "CommandAssemblyListVersion",0 ← 0x14000a028 0x14000a0b8 0x14000a13e
14002c99b
14002c99b 00 00 00 00 00 .....
14002c9a0
14002c9a0 string "RtOleaut32",0 ← 0x14001bb48
14002c9ab
14002c9ab 00 00 00 00 00 .....
14002c9b0
14002c9b0 string "SysNtTerminateThread",0 ← 0x140020041
14002c9c5
14002c9c5 00 00 00 00 00 00 00 00 00 00 00 ...........
14002c9d0
14002c9d0 string "TokenSetPrivilege",0 ← 0x140021b4c 0x140021bd4 0x140021bfd
14002c9e2
14002c9e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ..............
14002c9f0
14002c9f0 string "ProcessIsWow",0 ← 0x14001a08f
14002c9fd
14002c9fd 00 00 00 ...
14002ca00
14002ca00 string "CommandAssemblyInlineExecute",0 ← 0x140009e53 0x140009e69 0x140009edd 0x140009f62 0x140009f94
14002ca1d
14002ca1d 00 00 00 ...
14002ca20
14002ca20 string "RtMscoree",0 ← 0x14001b6ab
14002ca2a
14002ca2a 00 00 00 00 00 00 ......
14002ca30
14002ca30 string "SysNtReadVirtualMemory",0 ← 0x14001faca
14002ca47
14002ca47 00 00 00 00 00 00 00 00 00 .........
14002ca50
14002ca50 string "TokenQueryOwner",0 ← 0x14002165d 0x14002169c 0x1400216be
14002ca60
14002ca60 string "ProcessOpen",0 ← 0x14001a12b
14002ca6c
14002ca6c 00 00 00 00 ....
14002ca70
14002ca70 string "CommandToken",0 ← 0x14000e843 0x14000e896 0x14000e8e6 0x14000e92a 0x14000e9d8 0x14000ea06 0x14000ea58 0x14000ea92 0x14000eb28 0x14000eb82 0x14000ec95 0x14000ecec 0x14000ed78 0x14000ee8f 0x14000eec4 0x14000ef21 0x14000efc6 0x14000f029 0x14000f073 0x14000f09c
14002ca7d
14002ca7d 00 00 00 ...
14002ca80
14002ca80 string "RtAdvapi32",0 ← 0x14001ae38
14002ca8b
14002ca8b 00 00 00 00 00 .....
14002ca90
14002ca90 string "SysNtProtectVirtualMemory",0 ← 0x14001f45a
14002caaa
14002caaa 00 00 00 00 00 00 ......
14002cab0
14002cab0 string "TokenDuplicate",0 ← 0x140021274
14002cabf
14002cabf 00 .
14002cac0
14002cac0 string "LdrFunctionAddr",0 ← 0x140017617
14002cad0
14002cad0 string "CommandInjectShellcode",0 ← 0x14000bae7 0x14000bb12 0x14000bb36 0x14000bb5d 0x14000bbc4 0x14000bc5c 0x14000bc80 0x14000bcd0
14002cae7
14002cae7 00 00 00 00 00 00 00 00 00 .........
14002caf0
14002caf0 string "SysNtUnmapViewOfSection",0 ← 0x1400200e3
14002cb08
14002cb08 00 00 00 00 00 00 00 00 ........
14002cb10
14002cb10 string "LdrModuleLoad",0 ← 0x140017751
14002cb1e
14002cb1e 00 00 ..
14002cb20
14002cb20 string "CommandInjectDLL",0 ← 0x14000b8b5
14002cb31
14002cb31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...............
14002cb40
14002cb40 string "SysNtFreeVirtualMemory",0 ← 0x14001ef37
14002cb57
14002cb57 00 00 00 00 00 00 00 00 00 .........
14002cb60
14002cb60 string "CommandInlineExecute",0 ← 0x14000bdb1 0x14000bdf9 0x14000be50
14002cb75
14002cb75 00 00 00 00 00 00 00 00 00 00 00 ...........
14002cb80
14002cb80 string "SysNtWriteVirtualMemory",0 ← 0x14002025a
14002cb98
14002cb98 00 00 00 00 00 00 00 00 ........
14002cba0
14002cba0 string "CommandFS",0 ← 0x14000ad4c 0x14000ae32 0x14000aeb2 0x14000b09d 0x14000b114 0x14000b193 0x14000b1d1 0x14000b258 0x14000b2b8 0x14000b31e 0x14000b379 0x14000b38f 0x14000b3a7 0x14000b415 0x14000b478 0x14000b4cb 0x14000b551 0x14000b5b5 0x14000b5fe 0x14000b66d 0x14000b6cc 0x14000b71b 0x14000b762 0x14000b7ec
14002cbaa
14002cbaa 00 00 00 00 00 00 ......
14002cbb0
14002cbb0 string "SysNtAllocateVirtualMemory",0 ← 0x14001e9c7
14002cbcb
14002cbcb 00 00 00 00 00 .....
14002cbd0
14002cbd0 string "CommandProcList",0 ← 0x14000dd16
14002cbe0
14002cbe0 string "SysNtWaitForSingleObject",0 ← 0x14002018e
14002cbf9
14002cbf9 00 00 00 00 00 00 00 .......
14002cc00
14002cc00 string "CommandProc",0 ← 0x14000d3b2 0x14000d5d8 0x14000d87c 0x14000d917 0x14000d948 0x14000d976 0x14000d9a2 0x14000d9c5 0x14000da87 0x14000da9f 0x14000dc1d
14002cc0c
14002cc0c 00 00 00 00 ....
14002cc10
14002cc10 string "SysNtQuerySystemInformation",0 ← 0x14001f854
14002cc2c
14002cc2c 00 00 00 00 ....
14002cc30
14002cc30 string "CommandJob",0 ← 0x14000befe
14002cc3b
14002cc3b 00 00 00 00 00 .....
14002cc40
14002cc40 string "SysNtQueryInformationProcess",0 ← 0x14001f528
14002cc5d
14002cc5d 00 00 00 ...
14002cc60
14002cc60 string "CommandMemFile",0 ← 0x14000c5be
14002cc6f
14002cc6f 00 .
14002cc70
14002cc70 string "DotnetPush",0 ← 0x1400126f7
14002cc7b
14002cc7b 00 00 00 00 00 .....
14002cc80
14002cc80 string "NewMemFile",0 ← 0x14001871f 0x1400187a7
14002cc8b
14002cc8b 00 00 00 00 00 .....
14002cc90
14002cc90 string "HwBpEngineSetBp",0 ← 0x140015bee
14002cca0
14002cca0 string "JobResume",0 ← 0x140016d39
14002ccaa
14002ccaa 00 00 00 00 00 00 ......
14002ccb0
14002ccb0 string "Ptt",0 ← 0x14001a58c 0x14001a5c5 0x14001a5fd 0x14001a695
14002ccb4
14002ccb4 00 00 00 00 00 00 00 00 00 00 00 00 ............