theoryabilitypro.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | July 19, 2023, 7:14 a.m. | July 19, 2023, 7:16 a.m. |
-
-
theoryability.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\theoryability.exe
2624
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| files.catbox.moe | 108.181.20.35 |
Suricata Alerts
Suricata TLS
No Suricata TLS
| pdb_path | wextract.pdb |
| resource name | AVI |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\theoryabiility.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\theoryability.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\theoryability.exe |
| section | {u'size_of_data': u'0x0002a200', u'virtual_address': u'0x0000f000', u'entropy': 7.433539078686315, u'name': u'.rsrc', u'virtual_size': u'0x0002b000'} | entropy | 7.43353907869 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.796690307329 | description | Overall entropy of this PE file is high | |||||||||||
| description | theoryability.exe tried to sleep 5456486 seconds, actually delayed analysis time by 5456486 seconds | |||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\" | ||||||