Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 20, 2024, 9:06 a.m.	Oct. 20, 2024, 10:05 a.m.

Size	5.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2be4dfa98a31a874af90e0835951420d`
SHA256	`f69edcadbd85090b512acd60ae374ef0ede3af6302f0fe0e4e082629c003e5a8`
CRC32	`F4123684`
ssdeep	`98304:QxWYC6Av+V8FSrciFtXaswUdX+G8FJBAUZL7:gVgYE2aFJVf`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer ASPack_Zero - ASPack packed file DllRegisterServer_Zero - execute regsvr32.exe anti_vm_detect - Possibly employs anti-virtualization techniques Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

%E9%AD%94%E6%99%B6.exe "C:\Users\test22\AppData\Local\Temp\%E9%AD%94%E6%99%B6.exe"
1188

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
112.74.185.5	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable uses a known packer (1 event)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

TEXTINCLUDE

Allocates read-write-execute memory (usually to unpack itself) (50 out of 65 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10001000 process_handle: 0xffffffff		3221225713
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 86016 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10028000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7576d000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75768000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755fd000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75606000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f8000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f6000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75601000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75601000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f7000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f8000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755f7000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75601000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75604000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75604000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75609000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75603000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 20, 2024, 9:06 a.m.	process_identifier: 1188 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x10009000 process_handle: 0xffffffff	1	0

Foreign language identified in PE resource (50 out of 52 events)

name

TEXTINCLUDE

language

LANG_CHINESE

filetype

C source, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00552c18

size

0x00000151

name

TEXTINCLUDE

language

LANG_CHINESE

filetype

C source, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00552c18

size

0x00000151

name

TEXTINCLUDE

language

LANG_CHINESE

filetype

C source, ASCII text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00552c18

size

0x00000151

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00553108

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00553108

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00553108

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00553108

size

0x000000b4

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055497c

size

0x00000144

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00559104

size

0x00000284

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00559104

size

0x00000284

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055a34c

size

0x0000018c

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ad94

size

0x00000024

name

RT_GROUP_CURSOR

language

LANG_CHINESE

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ade0

size

0x00000022

name

RT_GROUP_CURSOR

language

LANG_CHINESE

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ade0

size

0x00000022

name

RT_GROUP_CURSOR

language

LANG_CHINESE

filetype

Lotus unknown worksheet or configuration, revision 0x2

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ade0

size

0x00000022

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ae2c

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0055ae2c

size

0x00000014

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (34 events)

Time & API	Arguments	Status	Return
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: smss.exe process_identifier: 232	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: services.exe process_identifier: 436	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: mobsync.exe process_identifier: 1664	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: pw.exe process_identifier: 288	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: taskhost.exe process_identifier: 1904	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: wsqmcons.exe process_identifier: 804	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: sdclt.exe process_identifier: 2004	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: cmd.exe process_identifier: 1648	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: SearchProtocolHost.exe process_identifier: 1200	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: conhost.exe process_identifier: 156	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: SearchFilterHost.exe process_identifier: 1608	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: pw.exe process_identifier: 840	1	1
Process32NextW Oct. 20, 2024, 9:06 a.m.	snapshot_handle: 0x00000148 process_name: %E9%AD%94%E6%99%B6.exe process_identifier: 1188	1	1

Communicates with host for which no DNS query was performed (1 event)

host

112.74.185.5

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

112.74.185.5:8100

%E9%AD%94%E6%99%B6.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All