popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

chrome_elf.dll

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 12, 2021, 8:01 a.m. April 12, 2021, 8:04 a.m.
Size 1.7MB
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
MD5 98e44115d6f4faaa25524d66776c4eb7
SHA256 69d8803acb91391e58dca18e69448c74fb604e6e6e53ee3fdc5446207a00f0c6
CRC32 A9D6FCC7
ssdeep 49152:OMMYZfLghGFn/uNHpYbajfOGnCzV5vdn:Osz/ep5pq5
Yara
  • screenshot - Take screenshot
  • PE_Header_Zero - PE File Signature Zero
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsConsole - (no description)
  • IsPacked - Entropy Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
103.145.86.184 Active Moloch
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name None
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72131000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x738b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e80000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71f81000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73771000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73821000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72da4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73e01000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76891000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x768d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74e21000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x750f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x740f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74f41000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75241000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75111000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x673a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x765b1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x737f1000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 13294759936
free_bytes_available: 13294759936
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d8150 size 0x000000b4
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7ed0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7ed0 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7ed0 size 0x00000144
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d5840 size 0x0000022a
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d7de0 size 0x00000034
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype hp300 (68020+68881) BSD sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003d9520 size 0x000001a6
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000288
process_name: SearchIndexer.exe
process_identifier: 2548
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: thunderbird.exe
process_identifier: 3960
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: pw.exe
process_identifier: 5008
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: audiodg.exe
process_identifier: 7936
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: splwow64.exe
process_identifier: 3928
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: SearchProtocolHost.exe
process_identifier: 3816
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: SearchFilterHost.exe
process_identifier: 7776
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: mobsync.exe
process_identifier: 3220
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: pw.exe
process_identifier: 5952
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: taskhost.exe
process_identifier: 1816
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: cmd.exe
process_identifier: 2240
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: conhost.exe
process_identifier: 1932
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: pw.exe
process_identifier: 656
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: rundll32.exe
process_identifier: 7180
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 3532
1 1 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 7180
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 32768
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x10001000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x001aa000', u'virtual_address': u'0x00278000', u'entropy': 7.81794301848204, u'name': u'UPX1', u'virtual_size': u'0x001aa000'} entropy 7.81794301848 description A section with a high entropy has been found
entropy 0.995908825248 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0

Process32NextW

 snapshot_handle: 0x00000288
process_name: slui.exe
process_identifier: 6881397
0 0
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
host 103.145.86.184
host 172.217.25.14
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\QQￓￎ￀￀ￆ￷ update reg_value C:\Windows\SysWOW64\rundll32.exe
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Bulz.425080
Arcabit Trojan.Bulz.D67C78
ESET-NOD32 a variant of Win32/Kryptik.GXYG
ClamAV Win.Malware.Deepscan-6824108-0
BitDefender Gen:Variant.Bulz.425080
Avast Win32:Trojan-gen
Rising Backdoor.Shellex!1.D217 (CLOUD)
Ad-Aware Gen:Variant.Bulz.425080
Emsisoft Gen:Variant.Bulz.425080 (B)
FireEye Gen:Variant.Bulz.425080
Jiangmin Backdoor.Farfli.esv
MAX malware (ai score=88)
GData Gen:Variant.Bulz.425080
ALYac Gen:Variant.Bulz.425080
Malwarebytes Malware.Heuristic.1003
AVG Win32:Trojan-gen
Panda Trj/Genetic.gen