Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 30, 2024, 10:40 a.m.	Oct. 30, 2024, 10:42 a.m.

Size	758.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8627fdb79837f2ed509fc091b75a7ba5`
SHA256	`d1458d4c7ecd0cc55ae9927830540bd459157d36023e0b41003a3518add76898`
CRC32	`A1BDD1BD`
ssdeep	`12288:y4GN9C0BO3qYA+bE9Md8KI9LZ7qTTe29gVb6GWBi8FmA+bjRN1K70OqP:r8vBO3bb8vrqTTxmVb6BF2xSkP`
PDB Path	oxra.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description)

rhcr.exe "C:\Users\test22\AppData\Local\Temp\rhcr.exe"
1188
- rhcr.exe "C:\Users\test22\AppData\Local\Temp\rhcr.exe"
  2440

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.125.50.70	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 30, 2024, 10:40 a.m.			0	0
IsDebuggerPresent Oct. 30, 2024, 10:40 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

oxra.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 30, 2024, 10:40 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02150000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00442000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00475000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00477000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02080000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02081000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00466000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02083000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02084000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02085000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02086000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02087000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02088000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02089000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0208f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 1188 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 61440 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778e6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4132864 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f8f000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000bd000', u'virtual_address': u'0x00002000', u'entropy': 7.981746696533681, u'name': u'.text', u'virtual_size': u'0x000bce48'}

entropy

7.98174669653

description

A section with a high entropy has been found

entropy

0.99801980198

description

Overall entropy of this PE file is high

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

185.125.50.70

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 2440 region_size: 446464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4	1	0	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $]ÇÍÊ¦£¦£¦£v¹§¦£º¦£v¹©¦£Ú©þ¦£¦¢,¦£ÀÒ§¦£¦£¦£ÀÒ\¦£ÀÒ¡¦£Rich¦£PEL_{_dàÎ @Ð@8x°èÀì¼ à.textË `.textbss à.rdataæ} ~@@.dataD @À.rsrcè°@@.relocìÀ@B base_address: 0x00400000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: base_address: 0x0046a000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: 0 H`°4VS_VERSION_INFO½ïþKKâStringFileInfo¾000004e4\|2CommentsTCP/IP Half Open Connection Limit Patch & Monitor.CompanyNamedeepxw,FileDescriptionTCP-Z, TCP/IP Connection Patch and Monitor.2 FileVersion2.6.2.752 InternalNameTCPZ.exer'LegalCopyright(c) 2009 deepxw. All rights reserved.: OriginalFilenameTCPZ.exe,ProductNameTCP-Z6 ProductVersion2.6.2.75DVarFileInfo$Translationä base_address: 0x0046b000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: ÄR8X8^8d8j8p8v8\|888888 8¦8¬8²8¸8¾8Ä8Ê8Ô8Ù8ý89999 9&9-949?9F9L9W9\9f9s99999Ô9ø9:(:_:f::::±:É:Ô:Ø:Þ:â:ó:;0;;²;è;$<I<Ú<á<=#=`=e=¬=¾=Ç=à=è=ð=>>%>+>7>Y>l>>Ú>i?u???¥?Æ?á?{00£0©0¯0µ0»0Á0Ç0´7¸7 base_address: 0x0046c000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2440 process_handle: 0x000002b4	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $]ÇÍÊ¦£¦£¦£v¹§¦£º¦£v¹©¦£Ú©þ¦£¦¢,¦£ÀÒ§¦£¦£¦£ÀÒ\¦£ÀÒ¡¦£Rich¦£PEL_{_dàÎ @Ð@8x°èÀì¼ à.textË `.textbss à.rdataæ} ~@@.dataD @À.rsrcè°@@.relocìÀ@B base_address: 0x00400000 process_identifier: 2440 process_handle: 0x000002b4	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1188 called NtSetContextThread to modify thread in remote process 2440
NtSetContextThread Oct. 30, 2024, 10:40 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4524238 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002b0 process_identifier: 2440	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1188 resumed a thread in remote process 2440
NtResumeThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x000002b0 suspend_count: 1 process_identifier: 2440	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

185.125.50.70:1731

Executed a process and injected code into it, probably while unpacking (16 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1188	1	0
NtResumeThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1188	1	0
NtResumeThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 1188	1	0
NtResumeThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 1188	1	0
CreateProcessInternalW Oct. 30, 2024, 10:40 a.m.	thread_identifier: 2444 thread_handle: 0x000002b0 process_identifier: 2440 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\rhcr.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\rhcr.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002b4	1	1
NtGetContextThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x000002b0	1	0
NtAllocateVirtualMemory Oct. 30, 2024, 10:40 a.m.	process_identifier: 2440 region_size: 446464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002b4	1	0
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $]ÇÍÊ¦£¦£¦£v¹§¦£º¦£v¹©¦£Ú©þ¦£¦¢,¦£ÀÒ§¦£¦£¦£ÀÒ\¦£ÀÒ¡¦£Rich¦£PEL_{_dàÎ @Ð@8x°èÀì¼ à.textË `.textbss à.rdataæ} ~@@.dataD @À.rsrcè°@@.relocìÀ@B base_address: 0x00400000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: base_address: 0x00401000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: base_address: 0x00462000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: base_address: 0x0046a000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: 0 H`°4VS_VERSION_INFO½ïþKKâStringFileInfo¾000004e4\|2CommentsTCP/IP Half Open Connection Limit Patch & Monitor.CompanyNamedeepxw,FileDescriptionTCP-Z, TCP/IP Connection Patch and Monitor.2 FileVersion2.6.2.752 InternalNameTCPZ.exer'LegalCopyright(c) 2009 deepxw. All rights reserved.: OriginalFilenameTCPZ.exe,ProductNameTCP-Z6 ProductVersion2.6.2.75DVarFileInfo$Translationä base_address: 0x0046b000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: ÄR8X8^8d8j8p8v8\|888888 8¦8¬8²8¸8¾8Ä8Ê8Ô8Ù8ý89999 9&9-949?9F9L9W9\9f9s99999Ô9ø9:(:_:f::::±:É:Ô:Ø:Þ:â:ó:;0;;²;è;$<I<Ú<á<=#=`=e=¬=¾=Ç=à=è=ð=>>%>+>7>Y>l>>Ú>i?u???¥?Æ?á?{00£0©0¯0µ0»0Á0Ç0´7¸7 base_address: 0x0046c000 process_identifier: 2440 process_handle: 0x000002b4	1	1
WriteProcessMemory Oct. 30, 2024, 10:40 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2440 process_handle: 0x000002b4	1	1
NtSetContextThread Oct. 30, 2024, 10:40 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4524238 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002b0 process_identifier: 2440	1	0
NtResumeThread Oct. 30, 2024, 10:40 a.m.	thread_handle: 0x000002b0 suspend_count: 1 process_identifier: 2440	1	0

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Agensla.i!c
Skyhigh	BehavesLike.Win32.Generic.bc
ALYac	Gen:Variant.Jalapeno.1091
Cylance	Unsafe
VIPRE	Gen:Variant.Jalapeno.1091
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jalapeno.1091
K7GW	Trojan ( 005b26be1 )
K7AntiVirus	Trojan ( 005b26be1 )
Arcabit	Trojan.Jalapeno.D443
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn33
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.ALBL
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba	Trojan:MSIL/Formbook.9f2067be
NANO-Antivirus	Trojan.Win32.Packed2.kkhzzz
MicroWorld-eScan	Gen:Variant.Jalapeno.1091
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:9tJDQAleClCODr6QPqC/SA)
Emsisoft	Gen:Variant.Jalapeno.1091 (B)
F-Secure	Trojan.TR/Kryptik.rzdar
DrWeb	Trojan.Packed2.46320
Zillya	Trojan.Kryptik.Win32.4640004
McAfeeD	ti!D1458D4C7ECD
CTX	exe.trojan.msil
Sophos	Troj/Krypt-ABH
SentinelOne	Static AI - Malicious PE
FireEye	Gen:Variant.Jalapeno.1091
Google	Detected
Avira	TR/Kryptik.rzdar
Kingsoft	MSIL.Trojan-PSW.Agensla.gen
Gridinsoft	Trojan.Win32.Formbook.st!n
Microsoft	Trojan:MSIL/Formbook.RDR!MTB
ViRobot	Trojan.Win.Z.Kryptik.776192.L
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
GData	Gen:Variant.Jalapeno.1091
Varist	W32/MSIL_Kryptik.KRT.gen!Eldorado
AhnLab-V3	Trojan/Win.PowerShell.C5597045
McAfee	Artemis!8627FDB79837
DeepInstinct	MALICIOUS
VBA32	TrojanLoader.MSIL.DaVinci.Heur
Malwarebytes	Trojan.MalPack.PNG.Generic
Ikarus	Trojan.MSIL.Inject
Panda	Trj/GdSda.A
Tencent	Msil.Trojan-QQPass.QQRob.Rimw
huorong	TrojanSpy/MSIL.Stealer.ek
Fortinet	MSIL/GenericKDS.61009645!tr

rhcr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All