popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 09751c4af16e2486_k8grtpw9.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\K8GRTPW9.txt
Size 548.0B
Processes 1436 (iexplore.exe)
Type ASCII text
MD5 28104064b10f9fed4b932d01515e80d8
SHA1 13f9cb11ca384ff187ec88370cb3e67ad3e8999d
SHA256 09751c4af16e248629807ea10a79cd9636a6cbe0e95bd2b20daeb63897f7bc6a
CRC32 426B41F3
ssdeep 12:bseXtzh9B8G0eXtzhYwGmopRS6eXtzh9N0mWaeXtzh9N0pUcS6eXtzh95jmWceXC:b3b4Ri2hGUciXnk
Yara None matched
VirusTotal Search for analysis
Name e4e41c0c1c85e2ae_avcodec-53.dll
Submit file
Filepath c:\program files (x86)\recording\avcodec-53.dll
Size 13.1MB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 65f639a2eda8db2a1ea40b5ddb5a2ed4
SHA1 3f32853740928c5e88b15fdc86c95a2ebd8aeb37
SHA256 e4e41c0c1c85e2aeaff1bea914880d2cb01b153a1a9ceddccaf05f8b5362210d
CRC32 74FDFB67
ssdeep 196608:1VhJ9+5snt6w5xrYk/c8XC0iFVfZQNviW1GVwcZcru/umSggLCT7wZ72qh/TDtMA:1TJYwsF+vVrruB6W+p51
Yara
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 416dae6b49446821_NZNR21LI.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\NZNR21LI.txt
Size 363.0B
Processes 1436 (iexplore.exe)
Type ASCII text
MD5 a2b2cc19b196e0b3e3c3bc3d1a8298b2
SHA1 4f82fb87d5c691d92d2435668a3e51e6bc55fa5d
SHA256 416dae6b4944682132057226ca02ce6b62835a5baa8aec0d7f728c6e06b40dfe
CRC32 86582358
ssdeep 6:brSJ4GuRXtzhVXB8GQVYUuRXtzhVdoVCGQnPoQOJ/S6uRXtzhVXN0QvWauRXtzhT:bseXtzh9B8G0eXtzhYwGmopRS6eXtzhA
Yara None matched
VirusTotal Search for analysis
Name 7ae374c8cc8ca695_uninstall.ini
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\Uninstall.ini
Size 2.4KB
Processes 4564 (Setup.exe)
Type ISO-8859 text, with CRLF line terminators
MD5 1caf0c5b71d552f6b971161d8539c3ff
SHA1 221c1325d59c96878d9bda6449059de5cc6f1043
SHA256 7ae374c8cc8ca69507caf02bf898055349f9b31ee6321b49ddb395c18a33f1b8
CRC32 F01BFEAB
ssdeep 48:RG49yN39yNH9yx9yy9yi9yNC9y99yf9yB9yXL9yV9yJ9yk9yY69G17MTBHdGVM8E:UWyPyryzy8ysy2yfyFyDyXRyHybySyYo
Yara None matched
VirusTotal Search for analysis
Name 46a209c1f32c304a_prolab.exe
Submit file
Filepath C:\Program Files\MSBuild\YZNUZKAESP\prolab.exe
Size 884.8KB
Processes 4964 (_____________.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7233b5ee012fa5b15872a17cec85c893
SHA1 1cddbafd69e119ec5ab5c489420d4c74a523157b
SHA256 46a209c1f32c304a878395b6df5b2e306fd6eea0db40f0bab0a6d71eeb6b8628
CRC32 C0E5E963
ssdeep 24576:0QiGNuuJk6KJUWXTZDXmspFJ3Z0xnuGrPTxhwcSwRVcO:09GERa2TZjBpb2uMPTxhhSCn
Yara
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 0309f324dedcce64_temp_0.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\$inst\temp_0.tmp
Size 5.4MB
Processes 4564 (Setup.exe)
Type Microsoft Cabinet archive data, 5639702 bytes, 6 files
MD5 8ea70a1f3a6483905a4e102e3f2da0d5
SHA1 ba95529f29272d94aa9ab0080452ecfc95336ab2
SHA256 0309f324dedcce64b923d531bdfe0339a75c3f533e8d289100a17e6ff248bc59
CRC32 32FE6B81
ssdeep 98304:1K9oO80oajzM5cGJbTIiDOPNUB+BZcSj9PdkQmW5sMxIRgbe9aVsSnl:8ocoSzMfJbTIiDOVcYtdklWPeIeQVRl
Yara None matched
VirusTotal Search for analysis
Name 7194312024c415be_weifenluo.winformsui.dll
Submit file
Filepath c:\program files (x86)\picture lab\weifenluo.winformsui.dll
Size 132.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3257b5c246f0f6c30d6ec4e0f464bf1c
SHA1 d594936627d43b824bb71cd9e4610697b1dbadd3
SHA256 7194312024c415bee8c380b3d79f6d101f176841b78762461e449063df550213
CRC32 F50E9325
ssdeep 3072:evSbO/lUOtoHupGmWQupssaMfZPdv7Yg1RwR3ERb+B:6MclUahGmWYs5ZPdjYgQRf
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name b26d99296cc1f38a_adobe_caps.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobe_caps.dll
Size 209.5KB
Processes 4636 (guihuali-game.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 9decb9ebf19e4e45bd75f175140e1018
SHA1 c9d35d2bc78dd37270dbe17f2555324c6f560d11
SHA256 b26d99296cc1f38ad735c36a305eb206b8a9022e92b463886ed918f42dee0b04
CRC32 93A9CC02
ssdeep 6144:c4sJ9Xq8PZUUIw0b5xmKT1XtapIIbtrWwOlHz:cbJ9XTUUM1XtOIIbwd
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 435f79f0093c6cc6_juzhokasysu.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\0a-4bda9-e30-2afa3-2c2539260bc3e\Juzhokasysu.exe
Size 143.0KB
Processes 4964 (_____________.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e562537ffa42ee7a99715a84b18adfa6
SHA1 56b36693203dc6011e8e9bda6999b2fd914908bc
SHA256 435f79f0093c6cc640a117f40a06c3adf3c0cc26607220882c7a0078d242cd5c
CRC32 49D2D998
ssdeep 3072:jWg2okXLsQKiUkTUT5DCfpV+NUO0YrFt+b3Ohz7hPdI9mMY:j5csQKEscVYf006bEM
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT
VirusTotal Search for analysis
Name 3f6aa370d70259dc_aforge.video.ffmpeg.dll
Submit file
Filepath c:\program files (x86)\recording\aforge.video.ffmpeg.dll
Size 60.5KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5f60669a79e4c4285325284ab662a0c0
SHA1 5b83f8f2799394df3751799605e9292b21b78504
SHA256 3f6aa370d70259dc55241950d669d2bf3dc7b57a0c45c6a2f8dec0d8c8cc35b0
CRC32 56198341
ssdeep 768:SxyXJysfxmBrHgXMI32glxbr3ZpS3kPZY/UuVTodlyQTzIKNXKkHq:SxyXJpfxurHOlltT7pZcVToHXnK
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name d694ef46c44d8fa6_50AJ1KRQ.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\50AJ1KRQ.txt
Size 95.0B
Processes 1436 (iexplore.exe)
Type ASCII text
MD5 2d4456c0248f92418eac6f9fb83d7438
SHA1 8c802db2fe1ac79cecb3ac7cd0d312e45f6af947
SHA256 d694ef46c44d8fa6d5c2be38974d1c4cdee4360162f1aa166dffd30e7b7c4ba2
CRC32 87D44077
ssdeep 3:bMaRSvh4oDQEuRXy0zrtVXJW2jYFW3fWQJQRvX:brSJ4GuRXtzhVXB8GQZ
Yara None matched
VirusTotal Search for analysis
Name 684395349112bc7c_3OSZJ9DH.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\3OSZJ9DH.txt
Size 275.0B
Processes 1436 (iexplore.exe)
Type ASCII text
MD5 e3451e79ad8be7e789f6a80aced8740b
SHA1 5603a723827c22615387bbcd1569d6e0699a918f
SHA256 684395349112bc7c200bc4d12b12a5704f3859d76d06fff0a1ac5e8e5b8bd92f
CRC32 AAD279E0
ssdeep 6:brSJ4GuRXtzhVXB8GQVYUuRXtzhVdoVCGQnPoQOJ/S6uRXtzhVXN0QZ:bseXtzh9B8G0eXtzhYwGmopRS6eXtzhT
Yara None matched
VirusTotal Search for analysis
Name a45317c374d54e32_jfiag3g_gg.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe
Size 184.0KB
Processes 7144 (hjjgaa.exe) 8104 (LabPicV3.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 7fee8223d6e4f82d6cd115a28f0b6d58
SHA1 1b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256 a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
CRC32 A2E6C04C
ssdeep 3072:Wqpy/Qpjny+xdr+xG1IJQqv5Os/8+lD0y40rIyTZGnq7gUT+uX2uR:M/Ejn0ai5j/8+lDtTZGnql6n
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name f9550ace57ce5b19_swscale-2.dll
Submit file
Filepath c:\program files (x86)\recording\swscale-2.dll
Size 295.5KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 564dca64680d608517721cdbe324b1d6
SHA1 f2683fa13772fc85c3ea4cffa3d896373a603ad3
SHA256 f9550ace57ce5b19add143e507179dc601a832b054963d1c3b5c003f1a8149cc
CRC32 36240F9B
ssdeep 6144:ciLkDvPGXiVtitatdtgt68zHkZe+IT3d4dKX8K36P0ViLLgovP7x6+wglZ:ciL2vOU8bkZe+Ud4de4gQwg7
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name f0882affc386016b_{d3f9703d-cb5f-11eb-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D3F9703D-CB5F-11EB-BDE1-94DE278C3274}.dat
Size 4.0KB
Processes 4308 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 c7064dcaa3efa81f0ee8e06a8176d8b8
SHA1 1ce48734da844fb0fc9f961b3614aae5dfee1515
SHA256 f0882affc386016b445991543014d0beb10f90c30447ac3331f766185ab855ae
CRC32 7EED4D87
ssdeep 12:rl0ZGFCxrEgmfi6KFRrEgmfa6qjNl1UubaxEDAnNUASGVDTSblOk60O:ruxG4GwNlt1MzbVDTdkrO
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 2ed93c552b8e7baf_lylal220.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-6R8JP.tmp\lylal220.tmp
Size 1.0MB
Processes 8992 (lylal220.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 266dc9804b9e56532a679667801119b7
SHA1 04a9d77e71304eb6242dca9b9438af54f85f5416
SHA256 2ed93c552b8e7bafc2b2d1212c3054e510d43a06c23f4194bdad47c7b6c3be09
CRC32 D396FE9A
ssdeep 24576:XQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNaf/Cx6syx9k0:J02rPD37zzH2A6SBIfNaf/C6B
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 8c524b5151279b46_picture lab.lnk
Submit file
Filepath C:\Users\Public\Desktop\Picture Lab.lnk
Size 1.0KB
Processes 884 (prolab.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jun 12 00:22:01 2021, mtime=Sat Jun 12 00:22:01 2021, atime=Mon Feb 22 19:39:12 2021, length=1429504, window=hide
MD5 5d4faae0e1d0d79c5908b749c0a44c47
SHA1 8a5b3c67f0f68580ea2a7cb13cd4e5f5a101f54d
SHA256 8c524b5151279b46f5344446dda9456e0766f78b9f2f8cac4576c2f79c0f4b3e
CRC32 9815AA78
ssdeep 24:8m9RP8dOE9oRwoojNdAOAd2/Gxd2ZUPPyJ:8m9RUdOIqwoMNWOAd2/Gxd2SnyJ
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name a32e0a83001d2c5d_2.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\$inst\2.tmp
Size 36.0B
Processes 4564 (Setup.exe)
Type Microsoft Cabinet archive data, 36 bytes
MD5 8708699d2c73bed30a0a08d80f96d6d7
SHA1 684cb9d317146553e8c5269c8afb1539565f4f78
SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
CRC32 EAB67334
ssdeep 3:wDl:wDl
Yara None matched
VirusTotal Search for analysis
Name 2c709b91decabb0d_guihuali-game.exe
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
Size 800.0KB
Processes 4564 (Setup.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 a30bdf843d0961c11e78fed101764f74
SHA1 0c421c3d2d007a09b9b968ac485464844fa8ca9d
SHA256 2c709b91decabb0daca10556e5cdd3a5efc6422ee1e27d9914475a26fa7cf219
CRC32 80D3D1AB
ssdeep 12288:H5bJ9XTUUM1XtOIIbwdNL9GtrB6svl9WXt9lKD0sDxtv/S20NNEcQB:Hb9j+Xt0wDL2dHqdHM0sqpyH
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 4e424dfb83931963_avfilter-2.dll
Submit file
Filepath c:\program files (x86)\recording\avfilter-2.dll
Size 903.0KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 5e1e575f8125b787cd521a5107cd8272
SHA1 8603ff88badd2cd24bd41f6b82b570a325c47920
SHA256 4e424dfb83931963b3bdcba931ddd1ebb5e302792f992170227bf7181e705c47
CRC32 71805C9C
ssdeep 12288:uBUgJ5aa7butTNq/+nUCwnvxsSqG5wMe/aSaCTC1PZBQcFFyj2LgAN4dwR:uiCXONq/Y5oZrwB/aSaCTAxCfqcjdi
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 53aaa37da21edacb_TR87GLO6.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\TR87GLO6.txt
Size 182.0B
Processes 1436 (iexplore.exe)
Type ASCII text
MD5 a5b945546896c8fc3da037ec1bb62886
SHA1 1a959921e1e3c3130d420178545e19b981c001c5
SHA256 53aaa37da21edacbff6fdebdecd83c4444d0ba6378c46ba096d8cb34d88da69c
CRC32 D07ACE86
ssdeep 3:bMaRSvh4oDQEuRXy0zrtVXJW2jYFW3fWQJQRv7Jh4VaDQEuRXy0zrtVdtFQVTucK:brSJ4GuRXtzhVXB8GQVYUuRXtzhVdoVy
Yara None matched
VirusTotal Search for analysis
Name a9163105d0bb9b2a_pictures lab.exe
Submit file
Filepath c:\program files (x86)\picture lab\pictures lab.exe
Size 1.4MB
Processes 884 (prolab.tmp)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 fa7f87419330e1c753dd2041e815c464
SHA1 3e32d57f181ca0a7a1513d6b686fea8313e8f8ec
SHA256 a9163105d0bb9b2a5007e3726b093caf08d24c53147086b80fda990f90417cd9
CRC32 F4DA0E0E
ssdeep 24576:Fb3ArAZAyr+NuuJkHnNuuJkzNuuJk1NuuJkriCiNuuJkbNuuJks:JwrAZAyr+EdEVEPEriEhE
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 186cad160df5acc1_avdevice-53.dll
Submit file
Filepath c:\program files (x86)\recording\avdevice-53.dll
Size 342.0KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 f55981382a554eecfc3a513f1ee48e87
SHA1 d1fd3f977abd66ba70516e501fc65189d39ae3fa
SHA256 186cad160df5acc1b9530e6f08fce3fc6752ffeb851eaf57e6bc9d33d42f27dc
CRC32 95E91786
ssdeep 6144:atApu+grbTd0MXaHb7fwgHi2vxiZoupJa8blmh3f6KmzUwE9X4:a6ulrbTdoHb7Xi2vxiZoupfluTwE9I
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 1d3b355e35b6edda_labpicv3.exe
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
Size 749.7KB
Processes 4564 (Setup.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c4d8a9478b65d80ffde098ab61ff028e
SHA1 d5b53a3d21311e5a45bbf752e4e481887ad7f38c
SHA256 1d3b355e35b6edda7afae1d56dfe83c3aa3e3848263d08e8f1e9e65090457a48
CRC32 67BC95F9
ssdeep 12288:VQi3Yv6m6URA3Phpp1hf39Wkv8xwJOQCr:VQiIChhppdUMOQ0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 670d939d2d07701d_picture lab.lnk
Submit file
Filepath C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picture Lab.lnk
Size 1.0KB
Processes 884 (prolab.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jun 12 00:22:01 2021, mtime=Sat Jun 12 00:22:01 2021, atime=Mon Feb 22 19:39:12 2021, length=1429504, window=hide
MD5 90336e51c62ebe76574b8fb71548717a
SHA1 e3411b6f77acf1d4b75e68f22a13f5852ac64e95
SHA256 670d939d2d07701d7ca02bcbb23dd17f24fc94f7483979998f162747d4a1ac3b
CRC32 E6E050A6
ssdeep 24:8m9RP8dOE9oRwoojNdAO/+d2/Gxd2ZUPPyJ:8m9RUdOIqwoMNWO2d2/Gxd2SnyJ
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name 9e0088a2170086c2_sourcelibrary.dll
Submit file
Filepath c:\program files (x86)\picture lab\sourcelibrary.dll
Size 132.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 4b6249c336a9ea726ce3e9609edba903
SHA1 acbb8a77093da3c480381750b392029de64da3b7
SHA256 9e0088a2170086c2d5541a4227ed2295528def0886951e7b627a65f77d7f421f
CRC32 613C384D
ssdeep 1536:y7zE3eaNFuxybYQEyAzYCxybAWYGRUYwRBx2y6jGjyL5Rj/:CmewEUCWYGRUBRSyqL5Rj/
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 9c0d294c05fc1d88_kenessey.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\0a-4bda9-e30-2afa3-2c2539260bc3e\Kenessey.txt
Size 9.0B
Processes 4964 (_____________.exe)
Type ASCII text, with no line terminators
MD5 97384261b8bbf966df16e5ad509922db
SHA1 2fc42d37fee2c81d767e09fb298b70c748940f86
SHA256 9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
CRC32 AC75BF49
ssdeep 3:KWigXn:KWigXn
Yara None matched
VirusTotal Search for analysis
Name b26b2df18537b3df_avformat-53.dll
Submit file
Filepath c:\program files (x86)\recording\avformat-53.dll
Size 2.4MB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 11340a55f155a904596bf3a13788a93a
SHA1 92a2f79717f71696ebde3c400aa52804eda5984e
SHA256 b26b2df18537b3df6706aa9e743d1a1e511a6fd21f7f7815f15ef96bb09a85e9
CRC32 C66E5CC3
ssdeep 49152:qXk+2XJrm/rMbrxMCSmhfShEGFpdDVne4BP8XC6M3eNTVox/FW4Dp:qXk+2oTMRMmhfShEGFppVe4BP8y6AeE
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 743dcd957b3b1f54_LabPicV3.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-M1GNJ.tmp\LabPicV3.tmp
Size 1.0MB
Processes 7072 (LabPicV3.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 dda84ebcc3c9968655702f7a6da23e1f
SHA1 8514f2e9eab129bd8288d5f13cf0030cae2e7fc5
SHA256 743dcd957b3b1f5401d1812cbae0e546a31eff23507b5238198f8f0e7b65682b
CRC32 902AD1CB
ssdeep 24576:nQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafNyx9DQ:Z02rPD37zzH2A6SBIfNafki
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 549cfac1e569be02_recording.lnk
Submit file
Filepath C:\Users\Public\Desktop\recording.lnk
Size 1018.0B
Processes 500 (irecord.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jun 12 00:22:15 2021, mtime=Sat Jun 12 00:22:15 2021, atime=Tue Apr 13 20:46:24 2021, length=893952, window=hide
MD5 84008293569c3f9576928f0b46d67819
SHA1 291899f5d88ce4a5f871d19e05a2e466bad1e666
SHA256 549cfac1e569be02b32a4e0c963ff74e309fe444a36b92384931e5111387c89e
CRC32 1E4B9F74
ssdeep 12:8m45zEEg0AhGdp8DCDyMRxU+zRRjAkGa2DabdpYl5bdpYllBNU94t2YLEPKzlX8o:8m45s0dOETRmqAkCCdkd+UPPyx
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name e0cba3d1317e54fc_aforge.imaging.dll
Submit file
Filepath c:\program files (x86)\picture lab\aforge.imaging.dll
Size 104.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 7c7a4cfc5fd5dc6ca9f959381f0b4f0c
SHA1 078b72ba90cc660caf0442eed0f73d4b455e2bc3
SHA256 e0cba3d1317e54fc8bb800b28954cb28c86f17155b3bd6941303b4be27cec72b
CRC32 CED4F4F4
ssdeep 1536:S3d8g6QqwmZBlukobGkGW1aQ8xQ800JHZCElh:Ud8hQVmZBl+GWkQ+n00ZEM
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name eeee76ff88c5a78b_i-record.exe
Submit file
Filepath c:\program files (x86)\recording\i-record.exe
Size 873.0KB
Processes 500 (irecord.tmp)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 40c46046d54ca5ab730488654e1947e7
SHA1 a68b88d09ff5a61f21ebd8080d26370e0678c5ec
SHA256 eeee76ff88c5a78b359c8d9af9c4d00937b60f711b6a223d07417be67124f8ff
CRC32 912CC77C
ssdeep 12288:dCx6G3fxQ3hyRHyUIv0CZI3jhLRHyUNVS3fxQ:dCx6G3ysRSRMCS3ZRSIS3y
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name b3211a671a5965b6______________.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-GMNUJ.tmp\_____________.exe
Size 220.5KB
Processes 8104 (LabPicV3.tmp) 6152 (lylal220.tmp)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 23c3e480318751d3ae8ae72be0974cd3
SHA1 6be7a71037f41a9227b6f90ae30b8e90fe310b72
SHA256 b3211a671a5965b6d7a6ade6f41febfcb2555f14f09447d6885ba25a7a4c66da
CRC32 0D4A3E6C
ssdeep 6144:V8vqsQKEsII9aXFPuwWTI7m6OoBqtgDXc/ntlM:V8ysQKEjFPu507VBiKXc/ntC
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT
VirusTotal Search for analysis
Name 10e5ac89b123f7a6_fj4ghga23_fsa.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\fj4ghga23_fsa.txt
Size 367.0B
Processes 7664 (jfiag3g_gg.exe) 7144 (hjjgaa.exe)
Type Netscape cookie, ASCII text, with CRLF line terminators
MD5 4c26325fb75a37583434f62a7c665474
SHA1 495bff1c1a803ea047d12d08ec53d4e312df01c1
SHA256 10e5ac89b123f7a61c425f13a326851d9ae8afe0b8249c22a0a54a0b00345d98
CRC32 0329FBEE
ssdeep 6:SIB8uTEv3rT66Dvl03rT6D36ruIX0x8ptTUL2Scq0finQHPzWZW4vopYxA66SQ3:jB8OEv7PDvl07I36RXs8PY5cqLnOivoF
Yara None matched
VirusTotal Search for analysis
Name 545569d6e600647a_unins000.exe
Submit file
Filepath C:\Program Files (x86)\recording\unins000.exe
Size 705.7KB
Processes 500 (irecord.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d074656e5fd5ff09106f0c7a9025fea4
SHA1 6be8489a18f04c13f0835fa80913be3df973f30d
SHA256 545569d6e600647aa2e97298422903e1214a1d4b174a8799e30532e60c3ef626
CRC32 98E3245C
ssdeep 12288:jQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyRk:jQYh1yLmSKrPD37zzH2A6QD/IpqggE2m
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 1ed1054f26443dc5_{d3f9703c-cb5f-11eb-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D3F9703C-CB5F-11EB-BDE1-94DE278C3274}.dat
Size 4.0KB
Processes 4308 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 5e88b36ae8995f0bf534bf3031c32995
SHA1 7fca4d197c7a9e506f5168848cecff9994ae0704
SHA256 1ed1054f26443dc5b8961733f7cfa79c639cb121fe52067ec3ed91012f8fffc6
CRC32 0CC92DC6
ssdeep 24:rXGFXZaG9uNlt1MzbVDTdkHNlt1MzbVDTdk:rXGtZaG9E1Mzzw1Mzz
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name c998b8f4898d0f84_MBGSRZBN.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\MBGSRZBN.txt
Size 458.0B
Processes 1436 (iexplore.exe)
Type ASCII text
MD5 3253a7e25a6a6b2409747eb40385da63
SHA1 448fd5737b823a4f29ffdefe4d5164ce2bff1645
SHA256 c998b8f4898d0f84762be941f856bc84bf23e97b751d7d762eb6e8f18b437e26
CRC32 CE6BC484
ssdeep 12:bseXtzh9B8G0eXtzhYwGmopRS6eXtzh9N0mWaeXtzh9N0pUcS6eXtzh95jC:b3b4Ri2hGUcik
Yara None matched
VirusTotal Search for analysis
Name f10c1553bbdb2205_swresample-0.dll
Submit file
Filepath c:\program files (x86)\recording\swresample-0.dll
Size 35.0KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 85e7d6000e076b4c071d49ee1b6b6122
SHA1 79a21e2d4402a8cdc989fd96c2096bb737b67e43
SHA256 f10c1553bbdb2205953ed6ae2dbdd1cda2219eb594cba776ab0529790bbf6449
CRC32 14BE290C
ssdeep 768:qTS4nJhuLN8gVrooUNTrhYFK2SoXl2hoHqcVvYjpS/:qbnruJ8gtMxrhN2Zl2hgqyvY
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name ca6f4924a4cd5948_prolab.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-BC9K1.tmp\prolab.tmp
Size 850.5KB
Processes 3788 (prolab.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 47006dae5dde9f202bd32aec59100cc7
SHA1 bee5cf5cedd4d8c7aa4795285470f9745da857ef
SHA256 ca6f4924a4cd5948178a17aa622433c83ee53bf06d0417adb85a29a941f4385f
CRC32 C976200B
ssdeep 24576:uQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafvNuuJkYyx9Hq:u02rPD37zzH2A6SBIfNafvEbk
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 51160c501e8e13bd_aforge.math.dll
Submit file
Filepath c:\program files (x86)\picture lab\aforge.math.dll
Size 28.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 6cc29c59798b014945e622876d3cdf14
SHA1 deef0eb2f9e866ac64197f0ae0bd02e91e0b6b9b
SHA256 51160c501e8e13bd9e95d1e226ad89752d1e59b6a52d13a8b775e8cf5107c901
CRC32 A64888EF
ssdeep 192:4Kw3pNIaFz2kLdzZRkfvnGwEbXxaUTQaLpmEMDKBPnh/XikOtwp3m+wyZ:fwZv2kPRkfvn0bXxaUjLESnh/yqm+wU
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 8b581869bf8944a8_jfiag3g_gg.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe
Size 61.5KB
Processes 7144 (hjjgaa.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 a6279ec92ff948760ce53bba817d6a77
SHA1 5345505e12f9e4c6d569a226d50e71b5a572dce2
SHA256 8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
CRC32 4FB6B99A
ssdeep 1536:kFqVH99TlY1Gsae6hiQ0OghNUenX7snouy8/JVz5:79TlY1Gsae6hKhNUaX7sout/JJ5
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 0c4f05d90c3d1e8d_dyxovumuji.exe
Submit file
Filepath C:\Program Files (x86)\Windows Sidebar\Dyxovumuji.exe
Size 27.5KB
Processes 4964 (_____________.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 cba44ca491b55ab3b4fbf5b3e3155ba7
SHA1 eda0c7aaaace20c30c3ffc4899e15c31ff5e49fc
SHA256 0c4f05d90c3d1e8d9ce6074628e1a9c59637530b7f1b3f8fd19f5c0a184e515c
CRC32 5CC10CC5
ssdeep 768:+dWnXbMHtq+urGHDS/JybvcwHNdxVjYcLdjF:c0Ll+urGG9wHvjztF
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 5de363c229ba060e_sourcegrid2.dll
Submit file
Filepath c:\program files (x86)\picture lab\sourcegrid2.dll
Size 184.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 2d0592f78c835045821a7d9bf83f64f2
SHA1 650405212407a02bda5fa7094112d6819571e1c0
SHA256 5de363c229ba060ebdbaa783442c4fa937a275f752e9c772e52bdde3c901f269
CRC32 0CD8230E
ssdeep 3072:QlMvGMAO3jjRilPZQ4iMEE/feG5wQyw1UIUiXMXQX2UZ:QqGE3j3vHImQyw
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name dfab174a9d81d026_lylal220.exe
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
Size 730.6KB
Processes 4564 (Setup.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4d4ca1d5c59e0f86cd10113734fbca0a
SHA1 abeef06f9fb5dc7497a1db7713b6105980db7c42
SHA256 dfab174a9d81d02668a3aed6378e51c78d5b2f24a9a49d5d15baae4a3a7069b8
CRC32 D406BCB1
ssdeep 12288:lQi3yCx6fL6m6URA3PhxgJqCrqiryneEje0l:lQiiCx6fehhseiWeEjrl
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 9bcb9896164711df_aforge.dll
Submit file
Filepath c:\program files (x86)\picture lab\aforge.dll
Size 20.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 aa509274ad95ac602418863e70af166a
SHA1 c3ba5125595e89339b65b51bd379deab70eeaa5b
SHA256 9bcb9896164711dfeefe49f6417bd4722a5c9a6f8bdf64435227a2280027350b
CRC32 4848A4E5
ssdeep 96:+CLijUBLlLsLyngD++MSq7xUGvRoktSibcfG2rP8:+CLXBLlIfUP7xUGJdbAxk
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 709c18d0d7e72561_unins000.exe
Submit file
Filepath c:\program files (x86)\recording\unins000.exe
Size 1.0MB
Processes 500 (irecord.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 446aa8f4782ef88fdb3186f20a76f0f9
SHA1 8b1104cbe83e7a4cca81efd8d918045f9a918129
SHA256 709c18d0d7e7256166c9c044e0f3a335b3dde89e6b5002986e98a0dfc71f81aa
CRC32 8CE1B8A0
ssdeep 24576:/QYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNaf/Cx6syx9kC:x02rPD37zzH2A6SBIfNaf/C6h
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 01808f7bce25db18_install.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\install.dll
Size 5.5KB
Processes 4636 (guihuali-game.exe) 4608 (rundll32.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 5e6df381ce1c9102799350b7033e41df
SHA1 f8a4012c9547d9bb2faecfba75fc69407aaec288
SHA256 01808f7bce25db18bce99e432555fcfff148a1d931128edebc816975145cabd7
CRC32 DD4D555B
ssdeep 48:q06Bne2I+Zdn1MG9trHvY9eQtt1IEpRZWAbfbdyR+P8Wseu/gdW:r6hk+ZJyB46t1IEZWiuXI
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name fe62d3e0876142d7_postproc-52.dll
Submit file
Filepath c:\program files (x86)\recording\postproc-52.dll
Size 157.5KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 d2636c9e6e302341b59e244b8c71f3c1
SHA1 42490a1efad20a1d4a908ccea118f41c5b636016
SHA256 fe62d3e0876142d72379c2c36623bff4f71e31b1fd86c5b865e36a5a2c278c0f
CRC32 A424D083
ssdeep 3072:PxxxxRxRw6B3L9Qaa6aa66z1lQh6608Hv5ZgWdM+VYOt/wY0vns:PxxxxRxRw6BWaa6aa66z1lI+8Hv56W2J
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 27c8cea7e793ace7_bunifu_ui_v1.52.dll
Submit file
Filepath c:\program files (x86)\recording\bunifu_ui_v1.52.dll
Size 220.5KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3764580d568e4fc506048e04db90562c
SHA1 e8d2771a4891ad7b751c4ac153f599d7d58ebd31
SHA256 27c8cea7e793ace737415881a5c16b4e2d98ce46609d272e82c6c905ad2d9f36
CRC32 A9317669
ssdeep 3072:UYZOzNgqlPPL42pFzo3tgyGkToR74K5BC6u+QVTNDcHaDDPuD6bl4:UYZYgEr44Fzo3tFIEKiJNDcHKPueb
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 678ca4d9f4d4ad17_avutil-51.dll
Submit file
Filepath c:\program files (x86)\recording\avutil-51.dll
Size 136.5KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 78128217a6151041fc8f7f29960bdd2a
SHA1 a6fe2fa059334871181f60b626352e8325cbdda8
SHA256 678ca4d9f4d4ad1703006026afe3df5490664c05bb958b991c028ce9314757f7
CRC32 FE3DAD76
ssdeep 3072:G+PT/YkOkRgHzlc5XROode1FZ6rkp7dPVPU:tPT/YNAgHzS1szf7dPVs
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 9884e9d1b4f8a873__shfoldr.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-A8KK2.tmp\_isetup\_shfoldr.dll
Size 22.8KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
CRC32 AE2C3EC2
ssdeep 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 3f49b3f232574b82_dockmanager.config
Submit file
Filepath c:\program files (x86)\picture lab\dockmanager.config
Size 2.2KB
Processes 884 (prolab.tmp)
Type XML 1.0 document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5 f5ab7df010b3ea35e0369f4e25b9e4a1
SHA1 638b5be948271a9ed3f306a2c14d558002c9b32f
SHA256 3f49b3f232574b825482b9891d5153535a53827122b5d542ad88093788fe4752
CRC32 C3314978
ssdeep 48:y+JIqg2YINTAMoEh65uUkBzQj76kBzB7p9bYv1eRD5e4EE8U4HIMEd6ZtS8m7D7y:9IqbYIPaE1QfP1Np9bSeRD5e4EEwHGd2
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_favicon[2].ico
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\favicon[2].ico
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 203d7b61eac96de8_idp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-GMNUJ.tmp\idp.dll
Size 216.0KB
Processes 8104 (LabPicV3.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
CRC32 90D9CA64
ssdeep 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name b40569bcef62bff9_unins000.dat
Submit file
Filepath C:\Program Files (x86)\recording\unins000.dat
Size 2.0KB
Processes 500 (irecord.tmp)
Type data
MD5 7a4f44065d5fcc830bd01bd817e850bd
SHA1 3e1b1ba7b95b8978213c2b37768e9eaed616e557
SHA256 b40569bcef62bff9e2319f4f68d3c1d3f03e44f75cfec90cf88dfb9c93ff1823
CRC32 CD85F6CD
ssdeep 48:dH9o34xSLMVkf4+KzZHkLztL/EWBxWDLyKlH:CSpLyKZ
Yara None matched
VirusTotal Search for analysis
Name 955c501a1dd5216c_uninstall.exe
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\Uninstall.exe
Size 97.6KB
Processes 4564 (Setup.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c749c4d392a5e931c84007144a30f7d2
SHA1 788fcc4d4b19e7c09f597dd14421f53717545d13
SHA256 955c501a1dd5216c55b253c0165efc3653ef17ea216dc1a3fd870835957c67f5
CRC32 E23A41D2
ssdeep 1536:zO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45o75q:kzgjO/Zd1RePDmZ8tf05iW4u1q
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name fe9e28ff0b652e22_fj4ghga23_fsa.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\fj4ghga23_fsa.txt
Size 31.0B
Processes 3460 (jfiag3g_gg.exe) 7144 (hjjgaa.exe)
Type Netscape cookie, ASCII text, with CRLF line terminators
MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
CRC32 03997E72
ssdeep 3:SIWG8Advn:SIB8uv
Yara None matched
VirusTotal Search for analysis
Name 86041e0dd4d57fe2_unins000.dat
Submit file
Filepath C:\Program Files (x86)\Picture Lab\unins000.dat
Size 1.7KB
Processes 884 (prolab.tmp)
Type data
MD5 44f72f1e895b39dd957fc2481aa8a335
SHA1 46ee2789ae6fa355993d874b6e7d7da0bddb4d15
SHA256 86041e0dd4d57fe20927d0ab0811a4428057cdd5dac802f23e3d589a001454d5
CRC32 1026C01E
ssdeep 24:Szp0I3EZFG7hVM+Ex+iAf2/bfMrf2/b52f/bIb9LoXVMxVMhGwGsmGsYGMVgC:Szpb3EZ47h4x+iACeC52g9LoXUgyC
Yara None matched
VirusTotal Search for analysis
Name 97409c125b1798a2_bynikaqahy.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ab-30604-9bc-d29ad-578b95c248612\Bynikaqahy.exe
Size 103.5KB
Processes 4964 (_____________.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ba164765e442ec1933fd41743ca65773
SHA1 92c1ac3c88b87095c013f9e123dcaf38baa7fbd0
SHA256 97409c125b1798a20a5d590a8bd1564bd7e98cfffa89503349358d0374f2cf6c
CRC32 D2DFB3A8
ssdeep 1536:Q3s5LsrMKi/IXkzgWUT3pZVjLn89fV2kMsn7XBNSGn3jfHkThbLX1:Q3s5LsQKiUkTUT5DCfoan1NSc7kT91
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT
VirusTotal Search for analysis
Name 02b51b8e732ff02e_install.dll.lnk
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\install.dll.lnk
Size 796.0B
Processes 4636 (guihuali-game.exe)
Type MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hide
MD5 4a7806de9590904a313be10aed7a58fa
SHA1 33fa8a36fd39effaafc24fef8621e7e231a0f0e5
SHA256 02b51b8e732ff02e18b02d125b41d975e981b58e018ac59a81a692067bbd350e
CRC32 75A37135
ssdeep 12:8AlXEbC3pQVe/4V3lrW+filrs/Q1cwADmNz4t2YLEPKzlX8:8A7pQQClK+filrLbBPy
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name 9051a4489a9fa483_install.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\install.dat
Size 544.9KB
Processes 4636 (guihuali-game.exe) 4608 (rundll32.exe)
Type SysEx File - JLCooper
MD5 77038c199399d4830a6bf570d46c4edb
SHA1 6158a9e03e797535e4438bf2f995c4904ed16079
SHA256 9051a4489a9fa483934b8df5146cc5cb6c55a6f74fd58b266f731dffa4a3271e
CRC32 66A08D50
ssdeep 12288:JL9GtrB6svl9WXt9lKD0sDxtv/S20NNEcQl:JL2dHqdHM0sqpyn
Yara None matched
VirusTotal Search for analysis
Name 1d07cfb7104b85fc_irecord.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-RTHQU.tmp\irecord.tmp
Size 694.5KB
Processes 8116 (irecord.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ffcf263a020aa7794015af0edee5df0b
SHA1 bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA256 1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
CRC32 59A45BB2
ssdeep 12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyR:bQYh1yLmSKrPD37zzH2A6QD/IpqggE29
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name a0e7dbe6851f5dc7_dockingtoolbar.dll
Submit file
Filepath c:\program files (x86)\picture lab\dockingtoolbar.dll
Size 32.0KB
Processes 884 (prolab.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 314e05b9507b7d22fd30b36450293ca0
SHA1 f2308e5cd227cd59647eea32d62a4f52b181400e
SHA256 a0e7dbe6851f5dc7ed874e764508705817109610ee12c8ea007cca650f99b943
CRC32 C51D92E7
ssdeep 384:aOoxr/UazX2CQ2dWyNgQciU0mlATVQxf6POGch71:IDT2CpgyG2QQUiPOGcr
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name f21521eebe58dc9e_recording.lnk
Submit file
Filepath C:\ProgramData\Microsoft\Windows\Start Menu\Programs\recording.lnk
Size 1.0KB
Processes 500 (irecord.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jun 12 00:22:15 2021, mtime=Sat Jun 12 00:22:15 2021, atime=Tue Apr 13 20:46:24 2021, length=893952, window=hide
MD5 1b1e1aef55bfcbdf9fc37bacf1786769
SHA1 b41a48ae75eb5a4a42a219fb2b50f2e88ad5e359
SHA256 f21521eebe58dc9ee81f7dd051489ce8697f959226ab9bf5932b1e0afa7d89aa
CRC32 4BE0C8E7
ssdeep 12:8m45zEEg0AhGdp8DCDyMRxU+zRRjAkGatbdpYl5bdpYllBNU94t2YLEPKzlX8yxv:8m45s0dOETRmqAkldkd+UPPyx
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name 03c79dcae7e7db4a_e2q8zu9hu[1].htm
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\e2q8zu9hu[1].htm
Size 3.2KB
Type HTML document, ASCII text
MD5 1baa231a4064c1e15443ac63d280d61f
SHA1 58bbeea2cf7dc93672a2d070adf49ba039e02cae
SHA256 03c79dcae7e7db4aa2f803153d7997a10d03a594050a960d91eccec4ab6553bf
CRC32 60933770
ssdeep 48:HD2W1kLj5kB+bwI7Bn5+nf7q6x0gelpamSE6BD:j2W1a9Uk6f7qFgelpLEB
Yara None matched
VirusTotal Search for analysis
Name faae49fcc25f6c53_hjjgaa.exe
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
Size 3.8MB
Processes 4564 (Setup.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6bd341bfca324b52dfa4f696c7978025
SHA1 09029b634ff31a7e2cc903f2e1580bc6f554558d
SHA256 faae49fcc25f6c53f5b94d7d878b4babffcc2fbcb79f4f3183c68b465b1c33c6
CRC32 2B01F8AC
ssdeep 98304:DkjFATmgWH//O5wEboe8TlTV/Og4V5Zc983+arUqU:D8LHXO5xiZVEi83+c
Yara
  • PE_Header_Zero - PE File Signature
  • VMProtect_Zero - VMProtect packed file
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name f65b69e816308bba_runww.exe
Submit file
Filepath C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
Size 618.0KB
Processes 4564 (Setup.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 aae3164438b0bb23c3ebba50ac6a0855
SHA1 d84149c1a2df033250f30b64ab6a76694d1c9006
SHA256 f65b69e816308bba915741f2f07ee8548612c2bd84d4ebf8aa5cd6ea2081e551
CRC32 813F24AA
ssdeep 12288:at7SDUeim1CCSxGwB5lJJiuT6Z9BeUbNW+sMWiJhPoQr6YP8dDa1KpGpVgL:vD32c26XBT5sMWicpsyPL
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Malicious_Packer_Zero - Malicious Packer
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 8a94163256a722ef_juzhokasysu.exe.config
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\0a-4bda9-e30-2afa3-2c2539260bc3e\Juzhokasysu.exe.config
Size 1.2KB
Processes 4964 (_____________.exe)
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
CRC32 2328D28C
ssdeep 24:2dZmht+SDfy4GOy4TO4q5X4tndGubyB8GRyF:ccdfy4G74TO4qN4hRN
Yara None matched
VirusTotal Search for analysis
Name eb5fc27c49c8b0da_56FT____________________.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-55P3Q.tmp\56FT____________________.exe
Size 175.0KB
Processes 6152 (lylal220.tmp) 8104 (LabPicV3.tmp) 4608 (rundll32.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0013b42646adc1c1f36a7f14573a608a
SHA1 94e0f507569339195ef46a05c2a03c2bb4b9fcee
SHA256 eb5fc27c49c8b0da671e5aed5363774eafd9c2941577263e8d5fcb459f7110c8
CRC32 8B15513A
ssdeep 3072:X8vALsQKiUkTUT5DCfiwD569a/bN1C+6YAMY:X8vqsQKEsoI9a++6ZM
Yara
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win_Backdoor_njRAT_1_Zero - Win Backdoor njRAT
VirusTotal Search for analysis
Name bafa6ed04ca27822_aforge.video.dll
Submit file
Filepath c:\program files (x86)\recording\aforge.video.dll
Size 20.5KB
Processes 500 (irecord.tmp)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
CRC32 3D46CE4C
ssdeep 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name f54dfda6d1ab00ab_recoverystore.{cdb01cf1-cb5f-11eb-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CDB01CF1-CB5F-11EB-BDE1-94DE278C3274}.dat
Size 5.0KB
Processes 4308 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 1b7ab3a7bcde72d3447f5775dbac9ade
SHA1 c460ee90e66cbcbe99c05deffe232d3b38ef6717
SHA256 f54dfda6d1ab00ab45c2817c055144e2e34ada6b8c21e0d697eeeae9df99663f
CRC32 2BD8F2A0
ssdeep 12:rl0YmGFYiWrEgmZ+IaCyZ7gCFYXorEgmZ+IaCyZ7eFRsgG77GsgG77vNlTqbaxXm:rCNG5/JXoG5/VabhNlW81J/0
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name c535da9493427f64_unins000.exe
Submit file
Filepath c:\program files (x86)\picture lab\unins000.exe
Size 861.7KB
Processes 884 (prolab.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ab0b517a7373f069b1cac6e23de92e52
SHA1 06472c2e81388f9240e26d8165e248c94938c6af
SHA256 c535da9493427f64abbd53b689ae8ea2f014965db3372e6c1c8f1f8cf18e2c0a
CRC32 8DB44865
ssdeep 24576:WQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafvNuuJkYyx9HT:W02rPD37zzH2A6SBIfNafvEbt
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-A8KK2.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 884 (prolab.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
VirusTotal Search for analysis
Name 6fadd81f3cbc295e_irecord.exe
Submit file
Filepath C:\Program Files\HashTab Shell Extension\EJCJHZGFIU\irecord.exe
Size 6.1MB
Processes 6912 (56FT____________________.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6580a339df599fa8e009cccd08443c45
SHA1 d20527ca7b9ef9833dabe500980528c204e24838
SHA256 6fadd81f3cbc295ee85e553a900159840805c45ceb73a841ed03c1404a61827d
CRC32 9BB727D5
ssdeep 98304:3RvF3vlcN68QkGRl+s6Pnw1nr9abBi3oPogk6csyu1uLQa4v19Szjgt01HuBV0Cl:B939wGR0s6fwXadi131NoKst01HY
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name f3d7125a0e0f61c2_i-record.exe.config
Submit file
Filepath c:\program files (x86)\recording\i-record.exe.config
Size 196.0B
Processes 500 (irecord.tmp)
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 871947926c323ad2f2148248d9a46837
SHA1 0a70fe7442e14ecfadd2932c2fb46b8ddc04ba7a
SHA256 f3d7125a0e0f61c215f80b1d25e66c83cd20ed3166790348a53e0b7faf52550e
CRC32 40EF1269
ssdeep 6:TMV0kIGkfVymRMT4/0xC/ya7VNQlchAW4QIm:TMG1GEVymhsSj23xm
Yara None matched
VirusTotal Search for analysis