Lukken, in the previous lesson, you gave her the encrypted below and also put it in.
Yes, he inside here and he built it.
So in this lesson, we are going to run examinee CBG.
So do we just take the name of the father and ABC here, Peter, in your memory?
So now we can find IBG and 64 being Wishon.
As you should open the options, preferences and make sure the only entry break point is to nameable
now open and attach to the running process, go to Symbol's select, he so could double click and run
to synchronize.
Scenario here, let's go and examine this location, the progress.
So we copy this and come down to here down the one Reichling and go to expression, click and paste
and you click, OK.
So this is the encrypted bill.
You can examine it in memory to see race located.
Right click follow in memory.
You see here in the state 644 ceasefire's in hexadecimal.
So you can compare it to the Soviet access for falling here.
So ethical coalition is process one six zero four.
We go to ABC one six zero four.
So this is on the stack, because here the bureau is declining inside their function.
Every function is carried out on the state.
That is why we also find this bill on the state.
Let's examine the output here again.
So noisy waiting for you to hear it.
Let's go and take a look at the allocated memi region.
So let's call Petey's and go to allocate a new region in them to rankly and then go to expression.
And then here Rackley piece and enter.
OK, so this at the moment is empty and you waiting for us to unpack it here.
So now if you enter.
Come back here in.
You had decrypted and populate his memory.
So this original memory directly and following memory meant he Hedy's who are here and he's nice private.
And it is also executable and readable.
So now it's ready to run.
So he has already done it by day and in decrypted as well in those ready to run.
So he's waiting for us to press enter.
So he presidenta.
And now our Schuckert launches and then we call them exits.
So this is the analysis, the next TVG.
In the next video, I will show you how to reverse engineer this malware in a string and the criminals
track the bill.
Thank you for watching.