popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name c87b2d1dc48893c2_RDC195.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RDC195.tmp
Size 24.0B
Type ASCII text, with CRLF line terminators
MD5 e540573823a70d013fb06327842a1b31
SHA1 ff14cd795eac5e37a395a71c2d5bcc6a54cc61f3
SHA256 c87b2d1dc48893c272285f8d59b5ef0fe69072839ec9c48d1d3488914b37e92e
CRC32 20178441
ssdeep 3:+QP3WjHFWeev:+c3Wju
Yara None matched
VirusTotal Search for analysis
Name 3e548fc305de49b7_jt6a_ory.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jt6a_ory.cmdline
Size 311.0B
Processes 2064 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 e3c3d733e0b716e7f21b8e4d28f247b0
SHA1 62666315f70b020c76a432a7744728d8a5b0f0dc
SHA256 3e548fc305de49b76711edfe1a4d11ce8ce4dd866001c6d07d5d732d39def75f
CRC32 89F2AD7D
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fBVBQmGsSAE2NmQpcLJ23fBVb:p37LvXOLMZVmnPAE2xOLMZVb
Yara None matched
VirusTotal Search for analysis
Name aa66b05cff837c26_~DF8C0F100C7231519A.TMP
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~DF8C0F100C7231519A.TMP
Size 16.0KB
Type data
MD5 76acbc1831894efc30bb60066c50146c
SHA1 7d324b303c640c93d5940f20e0461aa65c2b874b
SHA256 aa66b05cff837c2696e9731229ad96950095f6ab1f1995f354ae82ac432cbc76
CRC32 7FD7C859
ssdeep 3:Hqa/lGAUolllnolclllv/nt+lybltll1lRsl/hlEl6l/1pm/i6a/l:1/ll4UFAlpaotao
Yara None matched
VirusTotal Search for analysis
Name c56b7e98ddbb0100_y.ps1
Submit file
Filepath C:\Users\test22\y.ps1
Size 1.1KB
Processes 2196 (wscript.exe) 2236 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 1808e9a22c2fec2a681b7826c64b8d23
SHA1 918bc392230309117f3bd2e623a320bfbbde5696
SHA256 c56b7e98ddbb01004efa7b89965683c13bae9f04ab612babdc24588486196d64
CRC32 1B511B42
ssdeep 24:DXz4kaRUQXBrvYXCZ4QvcykVfKAOQnQ4vSQjIvnYsOw2:DD43KqBEXCZ4QvcDf+QnQ4vSQ0B52
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name be6d81013e3a3e2b_temp.txt
Submit file
Filepath C:\Users\test22\temp.txt
Size 690.0B
Type ASCII text, with very long lines, with CRLF line terminators
MD5 1f322f1bfd9dfe0ac531ac2da9aed3ad
SHA1 54730e382efc3faa8afae0963394417e58cd64ce
SHA256 be6d81013e3a3e2b1855ea973ed0b08d77f8ffe96111ec4ca411175566d67c82
CRC32 2DC46ABF
ssdeep 12:724l8YHNfy+MtS6QYOQPZJAN5GibGM40UVTQw4u74g2y2IdQ1EeZy+7x1mM9wWUw:y4ljNb6SrGAN5GMeV3lBl2Id6zZyexBf
Yara None matched
VirusTotal Search for analysis
Name 428b100e597c8a6b_~wrs{357ee2f0-d86b-4afe-aebf-782347e51eed}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{357EE2F0-D86B-4AFE-AEBF-782347E51EED}.tmp
Size 1.5KB
Processes 212 (WINWORD.EXE)
Type data
MD5 247fc21b8a39584da06a5e8531f7c459
SHA1 f0fad6fbccb5840e77b45235a0a0d500f105ef69
SHA256 428b100e597c8a6b63d3d02adcbc062c4702351f29007e8b847d236e78cbf356
CRC32 6B057605
ssdeep 6:IiiiiiiiiiI4/9+Qc8++lPkalT4Mu8lPloBl/3:W49+QG+3/W
Yara None matched
VirusTotal Search for analysis
Name 50e509c56ee7437d_RGI1518.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RGI1518.tmp
Size 10.1KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 cfe2f1194768ebe8914c07c57cbada52
SHA1 70d1ca67cd1d3381fa7fea37605417510456d37b
SHA256 50e509c56ee7437d710345b977cb5edbde526206034dce0e52cc132c61cc5cae
CRC32 39E6814F
ssdeep 192:U9QI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:FwA1jUr2olylWouwRQ7
Yara None matched
VirusTotal Search for analysis
Name 567f60275a6ebdd4_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2064 (powershell.exe)
Type data
MD5 874c255c82669c27665355e2aa348971
SHA1 4adc2f236ea01bdfe846ad6e5f10a3abe9a4312b
SHA256 567f60275a6ebdd4f8b5fa6cbf8d00a7d4559cf3b4d8b3417dc827f02a0ce9f1
CRC32 7B1523E4
ssdeep 96:RutuCUXGCPDXBqvsqvJCwo+utuCUXGCPDXBqvsEHyqvJCworSj7Hwxf2lUVul:Uti2Xoxti2bHnor/xQ
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 061efe7f182966ce_RGIC87.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RGIC87.tmp
Size 10.1KB
Type ISO-8859 text, with very long lines, with CRLF line terminators
MD5 aae8f5b14439d75e8151d0d9a4cc6485
SHA1 9fce1026ecbb90b90802779a046cafd7ce4a3e81
SHA256 061efe7f182966ce91eb999bd2587aa779b5c1f61eaa7b0b9032c7dccf2dc414
CRC32 E5C5599E
ssdeep 192:oeQI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:oBwA1jUr2olylWouwRQ7
Yara None matched
VirusTotal Search for analysis
Name 14fe4a38da55114b_jt6a_ory.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jt6a_ory.out
Size 588.0B
Processes 2064 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 3d158171424af361f8efa03711ad7a0c
SHA1 151f65d4b2cd4eff32b6cdcbe1ff4ca41b694c60
SHA256 14fe4a38da55114b8bb77dcdd86bf42d982eb6f7a4f92b3f9b2acb2d76b3e29e
CRC32 DE0403C2
ssdeep 12:K4jnzR37LvXOLMZVmnPAE2xOLMZVaKai31bIKIMBj6I5BFR5y:Kinzd3BPmnIE2nPaKai31bIKIMl6I5Da
Yara None matched
VirusTotal Search for analysis
Name e908ea82c5f020a5_RGI1518.tmp-tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RGI1518.tmp-tmp
Size 8.7KB
Type ASCII text, with CRLF line terminators
MD5 6f430c55aec23bc128397127f8e31b19
SHA1 669f7c3ade66a1a790c2aec2c1d0bb4ed5ebd6ee
SHA256 e908ea82c5f020a5006c5feeaae75b98dc5da5d376ab091c31990554e28a46d9
CRC32 C6A04325
ssdeep 192:qI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:CwA1jUr2olylWouwRQ7
Yara None matched
VirusTotal Search for analysis
Name 7f82540a6b3fc81d_y.js
Submit file
Filepath C:\Users\test22\y.js
Size 1.3KB
Type Pascal source, ASCII text, with very long lines, with CRLF line terminators
MD5 3e93e0e991adc9641910e3ec1f44a5dc
SHA1 32d1f228b557e8037178ca428440e16e5141c54d
SHA256 7f82540a6b3fc81d581450dbdf7dec7ad45d2984d3799084b29150ba91c004fd
CRC32 AAEF9BBC
ssdeep 24:1eK+C6uSc+0zG5i5KIReS17mrV4LcdV4Ly49V4LMMPKRuknF6Fwg0sWMTbszoflw:k1CTC0UA7DRWM57sf+oflskAr
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name ccaec9d7a575b615_cabA0CC.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\cabA0CC.tmp
Size 177.8KB
Type HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5 ca833c3853b7d394d39c460da2ee3db1
SHA1 d24d61e6df9d4682e30b88728ce4c474b5004a5c
SHA256 ccaec9d7a575b615342e9943c1c18ad9dcdef3219d7de684b33269b4f8c0e3fd
CRC32 B7E77569
ssdeep 3072:3KalR8doLUaBAq3B5tLY0pgJ5W/DzzrozHfPxOgiv:35GdoLJYWFP44d
Yara None matched
VirusTotal Search for analysis
Name 205d000aa762f3a9_~DF2C79C1E8AE840965.TMP
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~DF2C79C1E8AE840965.TMP
Size 16.0KB
Type Composite Document File V2 Document, Cannot read section info
MD5 679672a5004e0af50529f33db5469699
SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
CRC32 115F6835
ssdeep 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 248cf0409636fe61_jt6a_ory.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jt6a_ory.0.cs
Size 489.0B
Processes 2064 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 60c4d5dd1d227a40fb4ba01716aba6e2
SHA1 1c62ffc5151478eec49c484bb6490c4909bc4364
SHA256 248cf0409636fe61a22c8ebf50d2a0e01db609568ded2d5047b0841b09712b99
CRC32 E2DBE2B6
ssdeep 6:gCsHkaS6ya3F/5XuMIQQA82SR7f2LBR24BrvFwMGbiQQAYQXRF42SRkbH+MObRgf:gC4kaxfOA2rsnXBrvjAHXCZ1gTBQvU
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 7852b19681a395a2_~wrs{cbf0ac96-b2ae-4b24-8f99-733c735a4bd3}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{CBF0AC96-B2AE-4B24-8F99-733C735A4BD3}.tmp
Size 40.0B
Processes 212 (WINWORD.EXE)
Type data
MD5 9afe172681470f66d1e34e143ea8ab25
SHA1 1cb82301e99c8c68e3a75911ff77f426777bb6b5
SHA256 7852b19681a395a21e8bc5a733b54bbd4284274d2243607ffee9ccebf4ed807f
CRC32 004F8887
ssdeep 3:cllKllUlH:clcOlH
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_jt6a_ory.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\jt6a_ory.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name a8077e1f3dbb3869_CSC32AA.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC32AA.tmp
Size 652.0B
Processes 1784 (csc.exe)
Type MSVC .res
MD5 46d04b5faeb0f8f4bac7f948a3772b09
SHA1 395b6dfce85150c17695b94f40a7a1d8fc7e6171
SHA256 a8077e1f3dbb3869e8d8eb06ea86a6460c9f333f85f36b8b209f42fc181f31a3
CRC32 80DAF0B7
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grygak7YnqqWPN5Dlq5J:+RI+ycuZhN+akSWPNnqX
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{8f58e0a5-6708-4a30-8d00-f9cbfb13dcde}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8F58E0A5-6708-4A30-8D00-F9CBFB13DCDE}.tmp
Size 1.0KB
Processes 212 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name f22750103bcb63ba_jt6a_ory.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jt6a_ory.pdb
Size 7.5KB
Processes 1784 (csc.exe) 2064 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 e0c87cd321d035963a7cf2b5c671a219
SHA1 b05d2d503935bbdbc14d16240c09e1347d003e60
SHA256 f22750103bcb63ba8d22dd18b1b96c3bb4e42330a128068c0034a2f3f637291b
CRC32 9E39C757
ssdeep 6:zz/BamfXllNS/jZn1mllxrS/77715KZYXxGQu+e0KpYXm7/lyMoGggksl/cEDf:zz/H1W/jZ1SXS/pw2qzzlyMRD
Yara None matched
VirusTotal Search for analysis
Name 69160e325a6523fe_jt6a_ory.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\jt6a_ory.dll
Size 3.5KB
Processes 1784 (csc.exe) 2064 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 80294fda843da3a0b1a80722307f90be
SHA1 62081937bdffc4f836cdd129ed1d245747c8c19d
SHA256 69160e325a6523fe4ffdaeb1ff3e21b65691d83a4b9a27084c041ab20ef63dbc
CRC32 49574740
ssdeep 24:etGSWEtusmuE7m7oRSQsmV2aUzbdPtkZfqZF4QzEmAcvxNzPOmI+ycuZhN+akSW8:6JfTC2aUluJqZF4QfJxpPF1ul+a3qq
Yara
  • Generic_Malware_Zero - Generic Malware
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 7a8f0690cb0eb7cb_yy.js
Submit file
Filepath C:\Users\test22\yy.js
Size 516.0B
Processes 2196 (wscript.exe)
Type ASCII text, with CRLF line terminators
MD5 d6507fc0b69885eb1a9befa28e92a356
SHA1 68dfaf8bb01f23a63372106a13c6523d978739fd
SHA256 7a8f0690cb0eb7cbe72ddc9715b1527f33cec7497dcd2a1010def69e75c46586
CRC32 7CA84C0E
ssdeep 12:MKrPMMGK2nNDZdkiMTnUaF13/fQE2DeoyPIkAsUR74NHn:LcK2NldRMTUS13/fQEAeoy9AR74Z
Yara None matched
VirusTotal Search for analysis
Name e54eafe58a20e84a_~$866ae254de4cabd60a95abcc52c315.doc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$866ae254de4cabd60a95abcc52c315.doc
Size 162.0B
Processes 212 (WINWORD.EXE)
Type data
MD5 1cec0f74da8ff160a345792dbfe18d44
SHA1 e58076bd3423542eca198233a17344d4723b5e72
SHA256 e54eafe58a20e84afbad1d2f029a0643f47a2b7cc68aa11009d59aff2dbe20bf
CRC32 D71115B4
ssdeep 3:yW2lWRdStll/W6L7P1ZJK79OzuIt9l/t1p:y1lWmX1WmjdK7O9l/7p
Yara None matched
VirusTotal Search for analysis
Name 760771b97e5ae18c_RES32BA.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES32BA.tmp
Size 1.2KB
Processes 1964 (cvtres.exe) 1784 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 8ab6607ad81d389489d1b97a0598cd7e
SHA1 03d879c989f7cd8f341f37838d75567327ba5a4a
SHA256 760771b97e5ae18c1327333a3866cd4e5de84ccd6a236ca103231e06d8cd63a5
CRC32 7992B977
ssdeep 24:HUJ9YernkdQsmH2iUnhKLI+ycuZhN+akSWPNnqjtd:VernomQnhKL1ul+a3qqjH
Yara None matched
VirusTotal Search for analysis
Name 2fa314a2de5bde3a_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 212 (WINWORD.EXE)
Type data
MD5 4e838e8290bdfa8084e5bf70483385da
SHA1 77263077682c3cafc15f90a67b9ac84bb6b44061
SHA256 2fa314a2de5bde3a2064293e52539a39a82fa0cf540d603055f0c9a38683159c
CRC32 4D387FCD
ssdeep 3:yW2lWRdStll/W6L7P1ZJK79OzuIt9l/t15n:y1lWmX1WmjdK7O9l/75n
Yara None matched
VirusTotal Search for analysis
Name acf30cbb6d5edc48_temp.txt
Submit file
Filepath C:\Users\test22\temp.txt
Size 1.4KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 605af052d510bbf51b551cf96babc6bd
SHA1 7e19697a9ff7af5dbd88e2ebd181d05cddaff0c8
SHA256 acf30cbb6d5edc48f6e1407681b5972189f663b75604e6935b5b3e8fd4fe3fcc
CRC32 66764473
ssdeep 24:QEJ0QAVJwARKxscmwwizgG/n251CClxzysUIKmO5ebGp5elNoNn9arBGdbXokrX7:QEfKlR4XzRzS5oTIKm+l5el2Nn9awkQ5
Yara None matched
VirusTotal Search for analysis