popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name c7d804e8fb096769_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\85f469ce401df1\cred64.dll
Size 126.0KB
Processes 2144 (gntuud.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 c0fd0167e213b6148333351bd16ed1fb
SHA1 1cfb2b42686557656dead53e02d1db3f2a848026
SHA256 c7d804e8fb096769b0e199102bdf8efa97dfae1a9b57a479819971146877368b
CRC32 0E2D5B6A
ssdeep 3072:Yx7pOYzBek53tiINwyP7XSSJds3zhrjPcnqULv4i9:Yx7ZNh53vwyOztPc3L
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_PWS_Loki_Zero - Win32 PWS Loki
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_cookies.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\cookies.sqlite
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 62d5b300b911a022_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 126.0KB
Processes 2648 (gntuud.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 98cc0f811ad5ff43fedc262961002498
SHA1 37e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA256 62d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
CRC32 F056D589
ssdeep 3072:ox7pOYzBekgmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhg/dMq6AO0a7vVlT
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_PWS_Loki_Zero - Win32 PWS Loki
VirusTotal Search for analysis
Name 160a426ff2894252_jquery-3.3.1.min.js
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js
Size 84.9KB
Processes 2300 (mp3studios_97.exe)
Type ASCII text, with very long lines
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
CRC32 609A5B84
ssdeep 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
Yara None matched
VirusTotal Search for analysis
Name 4743bad8f6939aa7_wish.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000067001\wish.exe
Size 175.0KB
Processes 2648 (gntuud.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3b6246132b7fb972ed877b79d700e32e
SHA1 af68ac119ccce9c7be5aeefa1e86102ee4019ebb
SHA256 4743bad8f6939aa7645a043208010c2a9e75fbbcbbc8ca597a0c2a74ce7b6cc0
CRC32 198AD44A
ssdeep 3072:hxqZWBJaHEDgX1Ifef5FchQTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cj:TqZV1Iech
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name f73069e98a330348_metadata
Submit file
Filepath C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
Size 114.0B
Processes 2572 (chrome.exe)
Type data
MD5 fa6d450696ada4ed406a2c5e94adbfbe
SHA1 4f7f8f246b6dec552c2d88e8eec6e2f5f32618c0
SHA256 f73069e98a330348e505b1b344edb3f18c607f8b5e5681053953cdbf3dbdc54b
CRC32 913C9364
ssdeep 3:mTll+Xl+UhW2/M/lslLGudVIE9IWGcURHh8Bon:mTlE+UaoY8rcQon
Yara None matched
VirusTotal Search for analysis
Name 9434dd7008059a60_icon.png
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png
Size 6.9KB
Processes 2300 (mp3studios_97.exe)
Type PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
MD5 c8d8c174df68910527edabe6b5278f06
SHA1 8ac53b3605fea693b59027b9b471202d150f266f
SHA256 9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5
CRC32 34316141
ssdeep 192:arFa6ynwcj6POoDbxN9EUQYZRia+ce/lkygkkl0:apa6mhjshD9QYZR3qkr/S
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name fc7e184beeda61bf_aes.js
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js
Size 13.0KB
Processes 2300 (mp3studios_97.exe)
Type ASCII text, with very long lines
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
CRC32 7FCBF36E
ssdeep 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
Yara None matched
VirusTotal Search for analysis
Name fd4c9fda9cd3f9ae_cookies.sqlite-shm
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\cookies.sqlite-shm
Size 32.0KB
Type data
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
CRC32 DDC506B6
ssdeep 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
Yara None matched
VirusTotal Search for analysis
Name 4bb81fe8f94fe04c_background.js
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js
Size 20.1KB
Processes 2300 (mp3studios_97.exe)
Type UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 c60091ccbbbdca5f2927000022cee14a
SHA1 a9aa49a4b461d853acb1cb01326bf4d1b951a503
SHA256 4bb81fe8f94fe04c906d213af3001e54b52be7d183b6951c6233d3d5705ce84d
CRC32 9328A6CE
ssdeep 384:WSE/+xHMJkLBQs44FPpv2459S5D9jJQCIb4j30EoqkTyReBd3FYGjowbN1Ta:Wl/+d6kLBQs44FPpv2459S5D9jJQCDrr
Yara
  • anti_vm_detect - Possibly employs anti-virtualization techniques
VirusTotal Search for analysis
Name 2c9dd2b0e16c64a4_ygcr.s
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\YGCR.s
Size 2.1MB
Processes 2704 (linda5.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8250a053ee35cacbb88769213872b9fc
SHA1 9baa37f36930bee494c74ae3cc3ea1744e578a2e
SHA256 2c9dd2b0e16c64a41cd6b652130b47d01f3867939edda6e86e9d9c9296ab98a0
CRC32 51111589
ssdeep 24576:HpJfzQi5Cv8dsMYplMoS7hpF2beku6TyFLXjUTN:HfzQiNdsMY2jie0a
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 282308ebc3702c44_pad-nopadding.js
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js
Size 268.0B
Processes 2300 (mp3studios_97.exe)
Type ASCII text
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
CRC32 17D655FD
ssdeep 6:UonrLqmcxXDFXBkamjSPuNhsrIe2tKGXfGZwn:UoqmcZD5mamSw9tKGXfGqn
Yara None matched
VirusTotal Search for analysis
Name c07318dada4f3791_last version
Submit file
Filepath C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version
Size 13.0B
Processes 2376 (chrome.exe)
Type ASCII text, with no line terminators
MD5 27badea5c6dfd30fb41db26efb8428c9
SHA1 263d2a8c3512f3c497af888ccc93e40a96ef9da7
SHA256 c07318dada4f37913d94909bf3129a3616fcb8eefa2be021745b86a0368cc2b7
CRC32 AD46D01F
ssdeep 3:tVLRkUU:uN
Yara None matched
VirusTotal Search for analysis
Name fc0e730c9b09606e_nash.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000002001\nash.exe
Size 175.0KB
Processes 2144 (gntuud.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f9021651b165064dfbe6662f543e1792
SHA1 104ab0e4fb3302dd77489f9d41ee28b60d06adc0
SHA256 fc0e730c9b09606eb09f91f39d9e780f005bd0f1674ee411cbb0de75acbe4bae
CRC32 10B7C57B
ssdeep 3072:axqZWBJaHEDgXc5De55FshGHxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cX:IqZVc50sh
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name e97322a7d210a939_secure preferences
Submit file
Filepath C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 35.1KB
Processes 2300 (mp3studios_97.exe)
Type UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 7c0576fa41a6f8a299077e4bd74b2d2d
SHA1 cd84f2ede1bf642ba1c2bfb1bf4066ce017e0622
SHA256 e97322a7d210a939aa2e085003bf7ce57ff176bdfae91db2eede8a85fb536b94
CRC32 5971D55C
ssdeep 768:las8yRugQcIL4ALZLlfV1kXqKf/pUZNCgVLH2HfLrUdRHnCIQ/oglN:VR1abZL5nHnjS
Yara None matched
VirusTotal Search for analysis
Name edb006e05cfa8501_30164140.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\30164140.dat
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 3f5ca3e29b1b60e298aeca0a32164c03
SHA1 f9b5ee59c31a3b06a6b8e476b22d2d7cf1fa8b66
SHA256 edb006e05cfa85015aa76c758d6298c279fd318cff0dbb286927c7ad45105488
CRC32 E1ACA097
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis
Name 0e3dc4ccd259716b_settings.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40.0B
Processes 2376 (chrome.exe)
Type data
MD5 62325aa04f35880232330f344df8018c
SHA1 58fe9532ee8d96e8d12448408cf3ccf9d0542543
SHA256 0e3dc4ccd259716b24376fddb4ee07a6c227f8bcb2532a7dd75bb36a4290e7cc
CRC32 6F0BEA7C
ssdeep 3:FkXJRYcTUM:+wcTb
Yara None matched
VirusTotal Search for analysis
Name 9bb0126258ad5270_linda5.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000001001\linda5.exe
Size 1.5MB
Processes 2144 (gntuud.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5fbbdd4640920778a90d657242f50236
SHA1 a5280b1f3092b058ba99cdb8ff06b4e538109379
SHA256 9bb0126258ad527060a082aa374747d760bd81aa53a53522aae3cd976749758e
CRC32 3FC5646E
ssdeep 24576:VLeTtjJF5HrKzWhHHeHuDuGn86u8rQNQnPU8SCxYIUX8Xm64JX6lpI5iZezz0e:VLYgzWhH+HuD7DtZBSCxEcH4+pIRzz0e
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name a1064146f622fe68_background.html
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html
Size 786.0B
Processes 2300 (mp3studios_97.exe)
Type HTML document, ASCII text
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
CRC32 DCC24689
ssdeep 24:OCXspY0w5LYKJ8oRpOFQxaVxtNVxHVxiaPNVxi1gV4T:tcpo9YoRpOE4tZTNhgT
Yara None matched
VirusTotal Search for analysis
Name 66f5620e3bfe4692_manifest.json
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json
Size 1.2KB
Processes 2300 (mp3studios_97.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 6da6b303170ccfdca9d9e75abbfb59f3
SHA1 1a8070080f50a303f73eba253ba49c1e6d400df6
SHA256 66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333
CRC32 6D4D05E6
ssdeep 24:1HgUpRWT0ATbggRDBT4uZWHjKRskEDGFUQWswyztkGlmxKw/xKFF838z6X1Ly:RWT20TZWHDqUpswyzt3m5In838z6lLy
Yara None matched
VirusTotal Search for analysis
Name 03164b1ac43853fe_mode-ecb.js
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js
Size 604.0B
Processes 2300 (mp3studios_97.exe)
Type ASCII text
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
CRC32 6744B21E
ssdeep 6:UonrLqmcxXDFXBkamjSPuND5Z9sE/A6M8IvHosCkV/hqN3+8R+WkV/hqNhAYa83V:UoqmcZD5mamSS5ZpXM8RjNhRfNDlv3V
Yara None matched
VirusTotal Search for analysis
Name b57fbd21d0cad164_f13cd130-bd44-4180-a60f-3cfe14b0b6ef.dmp
Submit file
Filepath C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports\f13cd130-bd44-4180-a60f-3cfe14b0b6ef.dmp
Size 565.0KB
Processes 2572 (chrome.exe)
Type Mini DuMP crash report, 10 streams, Thu Dec 8 09:53:16 2022, 0x0 type
MD5 6762b6cf848b812b5269f657402c1ca7
SHA1 a99de46fb450e7d3761affc29263a1943a16cbb3
SHA256 b57fbd21d0cad16493a11e0a803bfaaa18e920d490bcb364f32925164587d7c0
CRC32 EB6179FA
ssdeep 3072:HqDh0i4VfnEyuG6ReNf1pQZ5oS3KC9Kz89rLsf5dMYpcj2qang:saiMqN3KC9KANsSj6
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name fc71ffee5ac2918d_anon.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000003001\anon.exe
Size 175.0KB
Processes 2144 (gntuud.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 27dd08d95b0ba699f7938eb299155460
SHA1 85a7f9c295cc1bbe1a6957a1f7edbf277bcbc418
SHA256 fc71ffee5ac2918dfdc256014dbb3533ca09771b17fcfcf1ed1cb3d4acbda8d5
CRC32 8B58B948
ssdeep 3072:MxqZWDXaMI5ZUgNHClXJeOCFNhsPxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOP:iqZmgNH0cNh
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_30118484
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\__tmp_rar_sfx_access_check_30118484
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 4dbd33435c697ddf_debug.log
Submit file
Filepath C:\Program Files (x86)\Google\Chrome\Application\debug.log
Size 290.0B
Processes 2572 (chrome.exe)
Type ASCII text
MD5 ff71aa68236222f81a74ceb9647e47a1
SHA1 4be7856ed8299b6d411a0753eb70b20e7a07e9c7
SHA256 4dbd33435c697ddf1ddbf283083eba38abb4583b7d98991c7cb70dacfe8999ac
CRC32 25B0FECB
ssdeep 6:qS448TCGGDLeX/WSfyRU4LGGFw3V4vlXcRU4LGGFw3V4vF:OJOOWSfyRU4LG6w3V6lMRU4LG6w3V6F
Yara None matched
VirusTotal Search for analysis
Name 7c8203dabbe621d9_mp3studios_97.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000058001\mp3studios_97.exe
Size 1.4MB
Processes 2648 (gntuud.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4b5f6278f37184c8de5d9a26d738ec99
SHA1 84e149f65af913a544042f8fcdc0ef2d71ddefaa
SHA256 7c8203dabbe621d997618cc74e82877f6a04d539e8c69205a373e6c928d55892
CRC32 BBAA1642
ssdeep 24576:1QpyBPGxrdclka3bP2WwgTKbgtD8rs1gPPKetGqByH:6pcEiKdaTmPPKegq4H
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • Malicious_Library_Zero - Malicious_Library
  • Credential_User_Data_Check_Zero - Credential User Data Check
  • SQLite_cookies_Check_Zero - SQLite Cookie Check... select
  • PE_Header_Zero - PE File Signature
  • Trojan_PWS_Stealer_1_Zero - Trojan.PWS.Stealer Zero
  • Malicious_Packer_Zero - Malicious Packer
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 824fae3331b95e2f_30164156.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\30164156.dat
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name ab728f6ff7762185_832866432405
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\832866432405
Size 87.2KB
Processes 2648 (gntuud.exe)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5 d14d451f68ad12e86a1f87a37bd8425e
SHA1 5b4a80d61d12a9233b554f0a125f55507c76b5b6
SHA256 ab728f6ff7762185ed758d56f72e489e965826f2d24bf8e480b8b81ce73242e2
CRC32 DD0F449F
ssdeep 1536:08qQRlKOtginlqeQf4gq7W9r8Wa8+3vMqHILWGBNojNM1IymNgp+/s:NRlk8lqjQg/N8WA0qoLTNojNM1PmNGT
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name be91543d87f31d5b_newlege.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000004001\newlege.exe
Size 241.5KB
Processes 2144 (gntuud.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 065ee41f9a4f66bd96f0448d68cc4178
SHA1 12cfe42b86f2f050cb40f75cd1bd1b1832e6aea7
SHA256 be91543d87f31d5bab7129c8bc63646ccc7c6aacabfa527ef4642a386145334c
CRC32 3950CF40
ssdeep 6144:QuipnySnYTepzkqldDIM4z9ujpdD5LGS:QbVlmM+ujpdDAS
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 0288d1e35f010dcd_832866432405
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\832866432405
Size 85.0KB
Processes 2144 (gntuud.exe)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5 acdd9fe5476ec842cb0dbafce1d96866
SHA1 4815ae6d824431860ff9799c579eafa56b1a271f
SHA256 0288d1e35f010dcd33b8ab1976f6d857532e18a2b0ab73b285264181fd5e90bc
CRC32 9E0F8923
ssdeep 1536:08qQRlKOtginlqeQf4gq7W9r8Wa8+3vMqHILIIsw/jUrBte2EQ:NRlk8lqjQg/N8WA0qoLhd/jUFtT
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name f3f30c5c271f80b0_content.js
Submit file
Filepath C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js
Size 3.8KB
Processes 2300 (mp3studios_97.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 f79618c53614380c5fdc545699afe890
SHA1 7804a4621cd9405b6def471f3ebedb07fb17e90a
SHA256 f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c
CRC32 C253DE35
ssdeep 96:U4nKOglavznz/jdpS9taiAtMwwRFhfWzDMwwRFhfW/kA:VnMl+zjdp6taiAtMb6DMb7A
Yara None matched
VirusTotal Search for analysis