Edit C:\Windows\System32\RmClient.exe
MZ? ?? ? @ ? ? ? ?!?L?!This program cannot be run in DOS mode. $ ????'??'??'" '??'" '??'" '??'" '??'??'??'" '??'" '??'" '??'Rich??' PE d? ?R ? " & " ?, @ ? i? `? ? d p 0 P ? ? $ @ P ? ` ? .text h$ & `.data 0 @ * @ ?.pdata ? P , @ @.idata ` . @ @.rsrc 0 p 8 @ @.reloc t ? B @ B l2 @ ?* @ ?) @ D- @ ?R % ? ? `@ @ A @ NULL < N U L L > N U L L R m C l i e n t . e x e p i p e n a m e wmain MsgLoop Receive Send OpenPipe SpawnProcess ??????,?$r$r??|a? =B?? ? @ @ @ RSDS9?g? K????8 RmClient.pdb H?8H?$ D?L?????+ ?? H?8????L?E? H?HI?? ? I? D?I?? L?????+ I??yM H?H??????fE? H?HI?? ? I? D?I?? L?o???+ I??0M H?H????H?HM?tI??I???< u???A? M?H?|??IE??$0 L?$(D?L????+ H?$ ?? H?H?????H?XM?tI??I???< u???A? M?H???IE??$@ L?$? H?$8 L?$0L?$(D?L?????+ H?$ ?TL H?X????@SH?PL?$? I??3??t#fA9uE?? I?H??A9 @u?? E ?A? M?tfA9H????LD?L????M?tI??8 u???A? H?$@L?$8L?$0M?L?$(H?6??IE??L?????+ H?$ ?? H?P[?????H?$WH?pH?$? A? I??3????t f9uE??I?H??9 Bu??E ?M?H?=???H?t f9HD?H????H?$? H?tf9tI??B9 @u?? E ?M?H?t f9HD?H????H?$`H?$X A? L?$? L?$PL?$HH?$@L?$8H?$0H????L????A? E?H?$( H?$ ?? H?$? H?p_????L?H?hI?? A?- I?0A???L?w??I???????(?+ I???'??I?? I??J H?h??????xM?tI??I???< u???A? M?A? H?Z??IE??$` L?$XL?$? L?$PL?$HL?$? L?$@L?$8L?$? L?$0L?$(D?L????A?'H?$ ?wI H?x?????hH?$? E3??H?t$fD9 uA?? H??H??D9Hu?? M ?? H?tfD9 H????HD?H????L?$PH?$HH?$@H?$8 ?0 H?$? H?$0H????D?L????+ I?H?$( H?$ ?? H?h?????H?xI?? A? I?????L????I???????(?+ ?$` I???G??I?? I??MH H?x??????$H?$WH? A? H??t??? ?3?3?2?!I??(H H?H??4H H?@?? H ?t H?H?HE??@?? 3??$0H?$8H? _?????H?H?H? UATAUAVAWH?8??H?? H??' H3??? E3???L?H?$XH?$P?A?E?H????H? +/ L?-4/ L?- / H?*/ L?53/ H?,/ H? =' M?H?L?$hH?$8H?$`L?$0L?$`H? ???A? H?L?$(M?H?$ L? ?%G H?H?u??E3?3??3?xG A;?? H? ?& I????=?& H?A?? ?f?-fA?t f?:\u5L??0???t$?ht I;?D? tH?D????H? m& A?H?I+???? M?? ?? L?$P?H??!F ?u(H?.& I;??5 D? ?+ ?? ? ? H?$PH?$DA? L?$pA?D?$DH?$ ?? ?u*H??% I;?? D? ? ?AF ? ? H?$p? L?$L?$L?$HH?$@H?$0H?$HL?p H?$(H?? 3??$ ?$@ ?? ?t=H? ^% I;?i? tc?$@H??$0H?p H?$(H?? H?$ ????8H?!% I;?,D? t&?? ? H? % L? ????$ H?? ??H?$XI?? H?$X?u,H? ?$ I;?D? tH?????H? ?$ ? ??/H?? ?H? ?$ I;?? tH?D????H? $ H??tH??E H? i$ I;?$?H?H?t ?sD L?H?H?u??=@$ ??4H? ???H??? H? ????? H??~E H??uE ? ?H?? H3?? L?$? I?0I?@I?HI?A_A^A]A\]??????H?H?H? UATAUAVAWH????H?P H??# H3??@ L?H?$A3?? ?$@ ? 3?3??D?H?=l# L?$0H?$@E?I????$0? ?? D?$@?$4?E3?3??E?? ?tw??A? ? H? # H;?? ? ? H?A?L? ???D?$ ???? H? ?" H;?? ? ? H?L? ???A????? H? ?" H;?? tH?? ???eH? %` D?$PL?$HH?0? ??D H?H?u??7 D?$PL?$0H?I?D?$0? ?u H? 7" H?0" H;?j? td? ??$P9D$0t H? " H?" H;?@? t:? ?#??t5H? ?! H??! H;?? t? H?L? ??????? ?eH? %` D??H?0?9C L?H?u??:?D?H?H?? ? ?H?$4H??H?$(?$TM??$ ? ?eH? %` L?3??0?? M?teH? %` M?3??0?? I??? H?$@3?? ? ?$4A? ?$@ ?$LD?$8?$H?t ?? ?L?$8H?$@E?I?? ?uUH? ? H?=? H;?? tH??L? v?????? ??)H? ? H;? ? tH?? ????H?=i 3????H? [ H;?? tH??$ ???H? < ????E?tPH;?? tH?L? ???? ???? ??H? H;?A? t;H?L? ???? ????$H;? ? tH?L? ???? ?$ ????H?@ H3?q L?$P I?8I?@I?HI?A_A^A]A\]??????I?I?VWATAVAWH?`A? I?? 3?3????????A?H?L?? E?t H?t ?rH??u5H? ! H? H;?? tH?L? ???? ???3?? E3???3?s? H?H?u?H?? H? ? H;??? t?<? H? ? ? H?L? ????$ ????H??? H?$@L?$? D?H?I?H?$ H?$X??> ?u>??> =? t1H?U H? N H;?? @? ? ??> ? ? H? $ D?? H?D?`> ??tpH? H;?<? t6?r> H? ? L? ???H??$0? ?$(D?$ ???H? ? A?r?;?r@? tlH?L? ????! ????L?$? H?$@E3????= ?u<H?v H;?,@? t&??= ?" H? Y L? 2???$ H????3??=D?$? M?tE?$H? ) H;? ? tH?L? ????# D?$ ?4??H???= ?L?$`I?0I?8I?A_A^A\_^??????I?I?VWATAVAWH?`A? I?? 3?3????????A?H?L?? E?t H?t ?rH??u5H? y H? r H;?? tH?L? D???$ ? ??3?? E3???3??< H?H?u?H?, H? % H;??? t??< H? ?%H?L? ????$ ?&???H??s< H?$@L?$? D?H?I?H?$ H?$X? < ?u>?;< =? t1H?? H? ? H;?? @? ? ? < ?& ? H? | D?? H?D??; ??tpH? [ H;?<? t6??; H? C L? $??H??$0?' ?$(D?$ ? ??H? A?r?;?r@? tlH?L? ????( ????L?$? H?$@E3???Q; ?u<H?? H;?,@? t&?=; ?) H? ? L? ????$ H????3??=D?$? M?tE?$H? ? H;? ? tH?L? S???* D?$ ???H???: ?L?$`I?0I?8I?A_A^A\_^??????$H?$VWATAVAWH?@E3?H?H?E?H?? fD99? H?? H? ? H? ? H;? ? tH?A?,L? ???H?$ ???I??L?$0E3?3? ???$( @?$ A?? : H?I;?H?? H;?%? t ??9 H? i H??$(D?$ ???? ??9 A?r?? ? H;? ? tH?L? ???. D?$ ???I???9 L?'? H?$pE3?3???$p ??9 ?u=H?? H;?,? t&?Q9 H? ? L? ???H??/ ?$ ???H??H?/? ?0H? ? H? ? H;?? tH?L? n???+ ???3??$@I?8I?@I?A_A^A\_^?????H?H?H?H?L? UAVAWH??? 3??H??? L??]??? H?? L?M?? I??H??? ?hH??3??? 3?9 ? H???????.?????-l H???=? uH? I???7 ?u6H? ? H;?V? t+??7 H? v ?1H?L? h???$ ???H? X H;? ? tH?L? B???2 H?$ ???H?????H?$PH??3??$H?wL?$@H?$8?$0I??$(H?$ ??6 ?u;?k7 ??t/H? ? H;? ? tH?L? ????3 ?$ ????????H??N7 H??D7 ??0H? ? H?=? H;?? tH?H?$(?$ ???? L?$ I? I?(I?0M?8I?A_A^]????H?(?Z f9??t3?OHc G??H???H?9PE u??= t= u?3?? v9? ?3?ytv 9? ?? ?? ? ??7 H? ?6 H??H?? H?? ?? ?H? ?6 ?? ?? ?=o u H? R ??6 3??(?????H?8?? D? ? L?p ?v H?o H?T H? E H?$ ??6 ?8 H?8????H?$H?$H?$AWH?0eH?%0 H?3?3?H? ? tH;? ? ??? ?.5 ?? ?? ;? ? ? ??? ?uM? ? L?=???H?=???H?$(?$ I;?s ?u H?H?t??D$ H?H?$(??t? ? ? ` ?V ;? H?C??H? ,??? ?5 ?u 3?? H?=( t"H? ? ?tE3??3?? ??? H?? ? ? ????? ?=? u?? 5 ?=? u ??4 ?? ?-?? ?=? u ???4 ?=? u ??4 ?? H?$@H?$HH?$PH?0A_?????(? H?(?:??????????ff ? H; ! uH?f???u??? ???H?(H??8csm?#?u ? ??l??v? @?u?4 ?3??(????H?(H? ?????3 3??(????% 4 ????H?3???H??<?Z f9u*9Q<|%?< s HcA<H??$?8PE HE??H?$?3??$H?H??????SH? ?3??2 H?t(H?????H?t? f9H\u??f?\? t?H? [?????%Z3 ?????????LcA<E3??L??E?H?I??t ? L;? ??;?A???(E;??3???????H?$WH? H?H?=l??H?? ?t"H+??H?????H?t?$? ???3??$0H? _??????????H??Z f9t3?HcH<H?3?9PE u ? f9Q??????$ UH?H? H?? H? H?2?-?+ H;?? H???1 H?H??x1 ?H1E??1 ?H1E??1 ?H?H1E?x1 H??H3EH3?? H??-1 ? H? H?????? H3E H3EH#??3?-?+ H;?D??9 H?$HH?H?2 H? ]?????3?????% 1 ????%1 ????@SH? H?3??0 H???0 ?(0 ? ??H? [H?%?0 ????H?$H?? H? ? ?C1 H?? H?$HE3??$PH?$H? 1 H?$@H?$@ tBH?$8 H?$XH?$0H?$`H?$(H?K H?$ L?$@L?$HH?$P3??0 ?#H?? H? H? H?? H?H?? H?? H?l H?$? H?m ?C ?= ?G ? Hk? H? ? H? ? Hk?H? ' H?? H?? Hk?H? H?? H?? Hk? H? y H?h? Hk?H? l H?hH? ??????H?? ????H?(M?8H?I?? ? H?(????@SH? E?H?L?A??? L?tA?McP?L?c?#?c??H??HK?t ?????3??H? [???????%?. ????%,/ ????? ????UH? H?H?H??????? ]???????@UH? H?H?3?8 ???H? ]? b ? ? ? ? ?0 4 ?p ? ? ? ? d 4 2 p7 &t? &d? &4? &? ????P ?1 ? 7 &t? &d? &4? &? ????P ?1 @ T 4 ???? p ` T 4 r??? p `# #?' #t& #d% #4$ # ??P t d 4 R?0 + k, v2 k, 2P " 0 ?- ?- ?- 4 2p0 ?. ?. ?2 ?. 4 2P 20 B 2?-?+ ? ???@ @ ( M ?2 T ? ?2 ? ? ?2 ? ? ?2 H ? ?2 ? { ?2 ? ? ?2 ? ? ?2 ? 3 ? V 3 \ ? 3 ? F 3 L @ ,3 H ? T3 ? 8# |3 @# ?% |3 ?% ?' ?3 ?' ?) ?3 ?) ?* `4 ?* ?* ?2 + ?, ?3 ?, ?, `4 - =- `4 D- \- `4 p- ?- 4 ?- . X4 ?. ?. 4 / ?/ D4 0 D0 X4 L0 ?1 P4 ?1 ?1 `4 ?1 K2 X4 v2 ?2 ?3 ?2 ?2 ?3 d d ,d Bd Xd pd ? ? ? ? ? e e 8e De Le Xe fe |e ? ? ? ? ? fg ?g Rg 4g ? ? ? ? ? nf zf ? ? ? h Zf Pf Hf @f .f f f ? f h ? ? ? ? g 8b ? ` ? ? X` Pc ? a ? *g ? d d ,d Bd Xd pd ? ? ? ? ? e e 8e De Le Xe fe |e ? ? ? ? ? fg ?g Rg 4g ? ? ? ? ? nf zf ? ? ? h Zf Pf Hf @f .f f f ? f h ? ? ? ? g OpenProcessToken TraceMessage oGetTokenInformation pGetTraceEnableFlags ? CreateProcessAsUserW rGetTraceLoggerHandle ?LookupAccountSidW ,UnregisterTraceGuids qGetTraceEnableLevel ?RegisterTraceGuidsW ADVAPI32.dll GetCurrentProcess ?GetSystemWindowsDirectoryW ?WaitForSingleObjectEx ?WriteFile _Sleep SReadFile ? CreateFileW ?GetOverlappedResult VGetLastError ?ResetEvent ? CreateEventW !SetNamedPipeHandleState @HeapSetInformation CloseHandle KERNEL32.dll !wprintf V _XcptFilter ? _amsg_exit ? __wgetmainargs ? __set_app_type 3exit _exit ? _cexit ? __setusermatherr ~_initterm X __C_specific_handler (_fmode ? _commode msvcrt.dll 0 ?terminate@@YAXXZ ?RtlFreeHeap ?RtlAllocateHeap ?RtlCaptureContext ]RtlLookupFunctionEntry iRtlVirtualUnwind ntdll.dll PSetUnhandledExceptionFilter mGetModuleHandleW 0QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId ?GetSystemTimeAsFileTime ?GetTickCount ?UnhandledExceptionFilter nTerminateProcess ?memcpy ?memset ? ?( ? @ ? X ? p ? ? ? ? ? ? ? ? hw ? ? ? ? ? M U I <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <!-- Copyright (c) Microsoft Corporation --> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="5.1.0.0" processorArchitecture="amd64" name="Microsoft.Windows.RestartManager.RMClient" type="win32" /> <description>Restart Manager Restart Client</description> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="asInvoker" uiAccess="false" /> </requestedPrivileges> </security> </trustInfo> </assembly> ?4 V S _ V E R S I O N _ I N F O ?? @?% @?%? S t r i n g F i l e I n f o ? 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n n # F i l e D e s c r i p t i o n R e s t a r t M a n a g e r L U A R e s t a r t C l i e n t r ) F i l e V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 3 8 4 ( w i n b l u e _ r t m . 1 3 0 8 2 1 - 1 6 2 3 ) : I n t e r n a l N a m e R m C l i e n t . e x e ? . L e g a l C o p y r i g h t ? M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . B O r i g i n a l F i l e n a m e R m C l i e n t . e x e j % P r o d u c t N a m e M i c r o s o f t ? W i n d o w s ? O p e r a t i n g S y s t e m B P r o d u c t V e r s i o n 6 . 3 . 9 6 0 0 . 1 6 3 8 4 D V a r F i l e I n f o $ T r a n s l a t i o n ? ??? ?*L?]?4?&?9???tnL ??H} ? ? ? ? ? M U I M U I e n - U S ??(?0???±? @ ?
Ms-Dos/Windows
Unix
Write backup
jsp File Browser version 1.2 by
www.vonloesch.de