Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 20, 2024, 10:33 a.m.	Sept. 20, 2024, 10:36 a.m.

Size	3.4MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9dfbc6519520d53606f41e8532747b42`
SHA256	`1a540e531c521fd2d18ea3b8d4d4557428fa58c08a7cd7298d35f68549cee60f`
CRC32	`C20C2344`
ssdeep	`49152:H5/oVK6iOAbmIijYuh7riY6c1+PMW8qOPsdhZN90t:H5QVQmuc1+0WqsdJ90t`
PDB Path	MainNew_extraApp.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

66ebe621bc80b_ffile.exe#xin "C:\Users\test22\AppData\Local\Temp\66ebe621bc80b_ffile.exe#xin"
1932

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
95.216.107.53	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 20, 2024, 10:32 a.m.			0	0
IsDebuggerPresent Sept. 20, 2024, 10:32 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

MainNew_extraApp.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 20, 2024, 10:32 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sdata

The file contains an unknown PE resource name possibly indicative of a packer (3 events)

resource name	IMAGE
resource name	TYPELIB
resource name	None

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (29 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02350000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:32 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00691000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0033a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00698000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0069d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00356000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0035a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00357000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0034d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cfd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cfe000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cff000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x002ee600', u'virtual_address': u'0x00002000', u'entropy': 7.142623577289761, u'name': u'.text', u'virtual_size': u'0x002ee4c4'}

entropy

7.14262357729

description

A section with a high entropy has been found

entropy

0.880076235156

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 20, 2024, 10:33 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (10 events)

description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 20, 2024, 10:33 a.m.	status_code: 0xffffffff process_identifier: 2572 process_handle: 0x00000224		0	0
NtTerminateProcess Sept. 20, 2024, 10:33 a.m.	status_code: 0xffffffff process_identifier: 2572 process_handle: 0x00000224	1	0	0

One or more of the buffers contains an embedded PE file (3 events)

buffer	Buffer with sha1: 496453b90921b2f466df5740285cb4eb6ebe5186
buffer	Buffer with sha1: 000b69b448914aa818a442b522588fce1aabd29f
buffer	Buffer with sha1: e9acb03177cfaa3142cd25eff2df270f8a338647

Communicates with host for which no DNS query was performed (1 event)

host

95.216.107.53

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 2572 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000210		3221225496	0
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 2608 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000228	1	0	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 manipulating memory of non-child process 2572
Process injection	Process 1932 manipulating memory of non-child process 2608
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 2572 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000210		3221225496	0
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 2608 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000228	1	0	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 injected into non-child 2608
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELýÏà0$C `@ @@CK` H.text# $ `.rsrc `&@@.reloc2@B base_address: 0x00400000 process_identifier: 2608 process_handle: 0x00000228	1	1	0
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: 0H`x¨ÀØð 0að f4f4iê( Q "Ypprs"t '{ 0~3j!/~5r";u={/nB:uD-cYQr+Vs4of:yb'er3\|vT{Y276>');D+H/G1D0F0F0H1I4J6N8M;N8R :V¤>3NYFVAWBfMePZ§B[ F^ªF]¢HaJdªNf¯Oe¨Pe©Pf¬Pk®Wk¨Yg°Pg°Qr³^xµfw¸dx¸d{ºh}»j §'=¦!!°&&¹((¼$3¼%3¼)Jw"v=\|ÌÍÍÎÌÌ ÍÐÒØ,,Á--Ä#Î;;Æ00Ê12Í33Ï''Ø44Ò65Õ::Ú7æ?è!!ä//î89á>?à55ò@æCèEéGè]ëgîjîrïtïBBåAAçIIîLLòBBúFFüMMÿOOÿPPùQQûPPþ^^újoÿev÷ õ õ¨÷µø·úÂüËþFÞBøÝpÞf±6%X\|q\|±±TÞ#àw\|Þ±hÞ¨æwf±xÞæw±Þ¨SduÞDààßøI8õÀÀÞtàãw(÷YrFàw¤ccÀ8õIÚÓicons\_softiconsJÖÓor_publiXé!TSGrld èëHédéXµ÷¨és\eaÀÞepikTàõq wúÚ=ùwÁÞ-w\|ßXµ÷ß-wÑêDàTàßlß 39<4'"H* P-5?80&LJ;$1(+7@Nc^KD6!RQ2,Ozgb]BA/%_\|rpfa)F=* I\juoixe .E:#XTwh{m >CMdYXUsv~zOydYSVqtk\|G`l[WSZ\jn} ð4VS_VERSION_INFO½ïþM]QM]Q?DVarFileInfo$Translation°`StringFileInfo<000004b0* CommentsSnit App0CompanyNameChlorin8FileDescriptionChlorin2 FileVersion93.77.818InternalNameRavaged.exeJLegalCopyrightChlorin Corp. 2007@OriginalFilenameRavaged.exe"ProductName6 ProductVersion93.77.81< Assembly Version19.70.9.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00456000 process_identifier: 2608 process_handle: 0x00000228	1	1	0
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: @3 base_address: 0x00458000 process_identifier: 2608 process_handle: 0x00000228	1	1	0
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2608 process_handle: 0x00000228	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 injected into non-child 2608
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELýÏà0$C `@ @@CK` H.text# $ `.rsrc `&@@.reloc2@B base_address: 0x00400000 process_identifier: 2608 process_handle: 0x00000228	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 called NtSetContextThread to modify thread in remote process 2608
NtSetContextThread Sept. 20, 2024, 10:33 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4539278 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000224 process_identifier: 2608	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1932 resumed a thread in remote process 2608
NtResumeThread Sept. 20, 2024, 10:33 a.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2608	1	0	0

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 20, 2024, 10:32 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1932	1	0
NtResumeThread Sept. 20, 2024, 10:32 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1932	1	0
NtResumeThread Sept. 20, 2024, 10:32 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 1932	1	0
CreateProcessInternalW Sept. 20, 2024, 10:33 a.m.	thread_identifier: 2576 thread_handle: 0x00000218 process_identifier: 2572 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000210	1	1
NtGetContextThread Sept. 20, 2024, 10:33 a.m.	thread_handle: 0x00000218	1	0
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 2572 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000210		3221225496
CreateProcessInternalW Sept. 20, 2024, 10:33 a.m.	thread_identifier: 2612 thread_handle: 0x00000224 process_identifier: 2608 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000228	1	1
NtGetContextThread Sept. 20, 2024, 10:33 a.m.	thread_handle: 0x00000224	1	0
NtAllocateVirtualMemory Sept. 20, 2024, 10:33 a.m.	process_identifier: 2608 region_size: 368640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000228	1	0
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELýÏà0$C `@ @@CK` H.text# $ `.rsrc `&@@.reloc2@B base_address: 0x00400000 process_identifier: 2608 process_handle: 0x00000228	1	1
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: base_address: 0x00402000 process_identifier: 2608 process_handle: 0x00000228	1	1
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: 0H`x¨ÀØð 0að f4f4iê( Q "Ypprs"t '{ 0~3j!/~5r";u={/nB:uD-cYQr+Vs4of:yb'er3\|vT{Y276>');D+H/G1D0F0F0H1I4J6N8M;N8R :V¤>3NYFVAWBfMePZ§B[ F^ªF]¢HaJdªNf¯Oe¨Pe©Pf¬Pk®Wk¨Yg°Pg°Qr³^xµfw¸dx¸d{ºh}»j §'=¦!!°&&¹((¼$3¼%3¼)Jw"v=\|ÌÍÍÎÌÌ ÍÐÒØ,,Á--Ä#Î;;Æ00Ê12Í33Ï''Ø44Ò65Õ::Ú7æ?è!!ä//î89á>?à55ò@æCèEéGè]ëgîjîrïtïBBåAAçIIîLLòBBúFFüMMÿOOÿPPùQQûPPþ^^újoÿev÷ õ õ¨÷µø·úÂüËþFÞBøÝpÞf±6%X\|q\|±±TÞ#àw\|Þ±hÞ¨æwf±xÞæw±Þ¨SduÞDààßøI8õÀÀÞtàãw(÷YrFàw¤ccÀ8õIÚÓicons\_softiconsJÖÓor_publiXé!TSGrld èëHédéXµ÷¨és\eaÀÞepikTàõq wúÚ=ùwÁÞ-w\|ßXµ÷ß-wÑêDàTàßlß 39<4'"H* P-5?80&LJ;$1(+7@Nc^KD6!RQ2,Ozgb]BA/%_\|rpfa)F=* I\juoixe .E:#XTwh{m >CMdYXUsv~zOydYSVqtk\|G`l[WSZ\jn} ð4VS_VERSION_INFO½ïþM]QM]Q?DVarFileInfo$Translation°`StringFileInfo<000004b0* CommentsSnit App0CompanyNameChlorin8FileDescriptionChlorin2 FileVersion93.77.818InternalNameRavaged.exeJLegalCopyrightChlorin Corp. 2007@OriginalFilenameRavaged.exe"ProductName6 ProductVersion93.77.81< Assembly Version19.70.9.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x00456000 process_identifier: 2608 process_handle: 0x00000228	1	1
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: @3 base_address: 0x00458000 process_identifier: 2608 process_handle: 0x00000228	1	1
WriteProcessMemory Sept. 20, 2024, 10:33 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2608 process_handle: 0x00000228	1	1
NtSetContextThread Sept. 20, 2024, 10:33 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4539278 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000224 process_identifier: 2608	1	0
NtResumeThread Sept. 20, 2024, 10:33 a.m.	thread_handle: 0x00000224 suspend_count: 1 process_identifier: 2608	1	0

66ebe621bc80b_ffile.exe#xin

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All