Hello and welcome back.
So let's go to this location.
Copy this path and open your access if I need you to go on prom again.
We get to the spot.
And by calling the compound, which is here to stay, then you will see the New York fog.
Now, before you can run it, you need to make sure your Microsoft Paint is running because this malware
is going to inject into the threat of the Microsoft Paint.
So let's run Microsoft Paint.
So Microsoft Paint is now running, and now we shall run our chat injection to see.
You know, whatever happens, you're supposed to pop up message box.
So this there is some light.
And then finally, you find your shortcut is message boxes popped me to title Sharkawy and Victor in
a content saying hello from cracking license icon and the information icon, and all these few were
created using Metasploit on Kali Linux.
So how can we be sure that this shellcode is coming from here?
We can go an open process hacker.
And look at the spin, it has got
the idea for six for.
Microsoft Bing, and here you can see the malware has has printed out the video here have been.
And you can also use this to here, find Windows and Tray Jayegi drag over to this message box and release,
and you will see that the pattern for this message box is Microsoft Bin, and he has got the video 464.
Same is why we see here four six five six four.
You can also go to the memory and then look up the session on Eric's.
Go to this column protection hikes and look for an mock region of memory.
You have a click on them and you will see or shall you see the string here?
Hello from Greg Nielsen's dot com shortcut.
And you can double confirm that this is indeed Nishioka.
You can open the The Roche account here, which regenerated the Metasploit opening with Hex editor.
Then you can compare if the one in memory.
So drawing the circle here and you will see this is indeed identical to the one in memory.
Another we can confirm that this is indeed the shellcode that the malware has injected.
He used to compare with the source code described here and compare the Hex Value FC for anyone.
Has he for A1 and so on and so forth.
And you and you can convince yourself?
Yeah, and yet I see.
So this is the true practical work, true on direct contacts ingestion.
Thank you for watching.