Rurik/Noriben issues and pull requests

#63 - noriben does not create the text file

Issue - State: closed - Opened by lupinlicious 4 months ago - 4 comments

#62 - v2.0.1 update

Pull Request - State: open - Opened by Rurik 10 months ago

#61 - CLosing Noriben

Issue - State: closed - Opened by oasec1 11 months ago - 2 comments

#60 - this issue is back. See below

Issue - State: open - Opened by oasec1 12 months ago - 4 comments

#58 - hashlist and csv creation issues

Issue - State: closed - Opened by phate1 over 1 year ago - 2 comments

#57 - Exiting with error code: 8: Error creating PML

Issue - State: open - Opened by oasec1 over 1 year ago - 3 comments

#56 - New issue - VM running Windows 11 Pro

Issue - State: closed - Opened by oasec1 over 1 year ago - 5 comments

#55 - Added attribution for hanging bug to Roman Hussy

Pull Request - State: closed - Opened by Rurik over 1 year ago

#54 - Ninja edit to 1.8.8 to add execution timeout for termination to stop …

Pull Request - State: closed - Opened by Rurik over 1 year ago

#53 - 1.8.8 - replaced calls to wait() with communicate()

Pull Request - State: closed - Opened by Rurik over 1 year ago

#52 - restore file that was accidentally removed, because I can't git

Pull Request - State: closed - Opened by Rurik about 2 years ago

#51 - V1.8.7 release

Pull Request - State: closed - Opened by Rurik about 2 years ago

#50 - Analysis

Pull Request - State: closed - Opened by jzuercher28 about 2 years ago - 1 comment

#49 - Update Noriben.py

Pull Request - State: closed - Opened by unk0unk0unk0 over 3 years ago - 1 comment

#48 - Logo addition, README.MD changes

Pull Request - State: closed - Opened by Rurik over 3 years ago

#47 - 1.8.6 release to fix binary registry key crash

Pull Request - State: closed - Opened by Rurik over 3 years ago

#46 - 1.8.5 Update

Pull Request - State: closed - Opened by Rurik over 3 years ago

#45 - I've been playing with this issue for awhile, and apologies for the lengthy delay. It's an issue of the backing file being encrypted, but Procmon does have the ability to use virtual memory for the live data. Do you have a sample that you can test against, or provide hash for so I can test?

Issue - State: open - Opened by oasec1 over 3 years ago - 10 comments

#44 - ValueError: could not convert string to float: '3\xa0256'

Issue - State: closed - Opened by lupinlicious over 3 years ago - 14 comments

#42 - PML file being encrypted by malware

Issue - State: open - Opened by oasec1 almost 4 years ago - 2 comments

#41 - procmon.exe path problem

Issue - State: closed - Opened by xrkk about 4 years ago - 3 comments

#40 - Removed pledgie link, service is no longer functional

Pull Request - State: closed - Opened by Rurik over 4 years ago

#39 - Fix to move files, add debugging output to Noriben, to troubleshoot #29

Pull Request - State: closed - Opened by Rurik over 4 years ago

#38 - Pledgie Link

Issue - State: closed - Opened by stryker2k2 over 4 years ago - 1 comment

#37 - Empty text and timeline file generated by Noriben

Issue - State: open - Opened by VikramKharvi over 4 years ago - 16 comments

#36 - Noriben can't load the CSVfile made by procmon

Issue - State: open - Opened by Noribentou over 4 years ago - 13 comments

#35 - Update Noriben.py

Pull Request - State: closed - Opened by moval0x1 about 5 years ago - 1 comment

#34 - Chinese characters in log

Issue - State: closed - Opened by oasec1 about 5 years ago - 2 comments

#33 - Malware - encrypting the.pml

Issue - State: closed - Opened by oasec1 about 5 years ago - 2 comments

#32 - I've kept the ProcmonConfiguration.PMC name because that's what SysInternals has always referred to it as. I don't want people to think that this is using an entirely new file format when they may already have PMC's lying around.

Issue - State: closed - Opened by oasec1 about 5 years ago - 3 comments

#31 - How to whitelist System:4 process?

Issue - State: closed - Opened by juliaebner about 5 years ago - 4 comments

#30 - question regarding procmon.pmc configuration file name and extenstion

Issue - State: closed - Opened by oasec1 about 5 years ago - 2 comments

#29 - Registry lenght exceeded

Issue - State: closed - Opened by Feldunost over 5 years ago - 14 comments

#28 - Non-PE File (e.g. Malicious Office Files) Support on Sandbox

Issue - State: closed - Opened by malwarehuntingisfun over 5 years ago - 3 comments

#27 - Procmon needs permisison to "make changes on this computer"

Issue - State: closed - Opened by malwarehuntingisfun over 5 years ago - 1 comment

#26 - Shutting down VM after analysis

Issue - State: closed - Opened by malwarehuntingisfun over 5 years ago - 2 comments

#25 - [!] Error trying to copy file from guest. Continuing. Error 0xff: Unexpected Error

Issue - State: closed - Opened by malwarehuntingisfun over 5 years ago - 11 comments

#24 - NoribenSandbox.py crashes if magic contains unicode

Issue - State: closed - Opened by Rurik over 5 years ago - 1 comment

#23 - More docs

Pull Request - State: closed - Opened by cmcramer over 5 years ago

#22 - Errors with Whitelist Hashes & Virus Total

Issue - State: closed - Opened by SeattleForensics almost 6 years ago - 1 comment

#21 - Noriben will crash with "--pml" option

Issue - State: closed - Opened by mnrkbys about 6 years ago - 3 comments

#20 - Procmon not found in Temp

Issue - State: closed - Opened by Rurik over 6 years ago - 1 comment
Labels: edgecase

#19 - Error: A file was not found

Issue - State: closed - Opened by guilhermebasalia over 6 years ago - 1 comment

#18 - output_dir not being honored

Issue - State: closed - Opened by Rurik over 6 years ago - 2 comments

#17 - Problem with VMX path

Issue - State: closed - Opened by najashark over 6 years ago - 5 comments

#16 - virtualbox integration

Issue - State: closed - Opened by d4n13l4 over 6 years ago - 1 comment

#15 - Not whitelisting changed Procmon binary

Issue - State: closed - Opened by Rurik over 6 years ago - 2 comments

#14 - Python "requests" module mussing, ProcMon cannot open pml file for reading and CSV file cannot be created.

Issue - State: closed - Opened by mikenav777 almost 7 years ago - 5 comments

#13 - Remove base directory from File Activity

Issue - State: open - Opened by Rurik over 7 years ago - 2 comments

#12 - request for clarification of documentation in the readme file

Issue - State: closed - Opened by sonofagl1tch over 7 years ago - 4 comments

#11 - Yara rules folder

Issue - State: closed - Opened by seifreed almost 8 years ago - 3 comments

#10 - Timeline CSV (parse_csv) does not work with commas in data

Issue - State: closed - Opened by keithjjones almost 8 years ago - 3 comments

#9 - Active?

Issue - State: closed - Opened by kholbrook1303 about 8 years ago - 4 comments

#8 - Abandon insecure MD5 hashes in favor of SHA256

Issue - State: closed - Opened by HomeSen over 8 years ago - 4 comments

#7 - [!] Python module "requests" not found. Internet functionality is now disabled.

Issue - State: closed - Opened by sanssg over 8 years ago - 2 comments

#6 - SSL error connecting to VirusTotal

Issue - State: closed - Opened by oasec1 over 9 years ago - 1 comment

#5 - Error: TypeError: can't multiply sequence by non-int of type 'float'

Issue - State: closed - Opened by dbosanzio over 9 years ago - 9 comments

#4 - Tex tfile doesnt contain any data

Issue - State: closed - Opened by oasec1 over 9 years ago - 18 comments

#3 - Another issue

Issue - State: closed - Opened by oasec1 over 10 years ago - 2 comments

#2 - error loading yara

Issue - State: closed - Opened by oasec1 over 10 years ago - 6 comments

#1 - Added /AcceptEula to procmon's parameters

Pull Request - State: closed - Opened by Pernat1y-zz almost 11 years ago - 1 comment

GitHub / Rurik/Noriben issues and pull requests