popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 018f2f9d3cd452f7_was2ls.vbs
Submit file
Filepath C:\REC93248209\idset\was2ls.vbs
Size 109.0B
Processes 192 (gugue.exe) 2672 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 df6a96762fbd603190d0d8d03abbdbd1
SHA1 a395f83354efa0e3b7e54b9ae535136ae71c93e7
SHA256 018f2f9d3cd452f74e5c5d089f9dec48ecda0dc6d5b39b4fc18f78a52c98ed09
CRC32 3D13C912
ssdeep 3:jaPFEm8nhwvyGqQB+gac57DSjSFj5gW9n:j6NqhTG1+1c57QSIW9n
Yara None matched
VirusTotal Search for analysis
Name 704fab9094d7e2a4_tmpC59F.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC59F.tmp
Size 614.7KB
Type data
MD5 9af805857751e63c43ef182d3bce0806
SHA1 de66be9d4a450211cab02da5f3d0c4bc3581ac7b
SHA256 704fab9094d7e2a4d2f7ba8639eeeaf36622ee266d332a028775c980b97bcc37
CRC32 702F19B1
ssdeep 12288:yTeqRs2qZkCBHKEwEZUn+HMya11MS2KJIg66TzJTPyAdn:0eQs2qC+JZI+HM71dJ3/
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_26948890
Empty file or file not found
Filepath C:\REC93248209\idset\__tmp_rar_sfx_access_check_26948890
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 6ec867dc1caa77ec_tmpCAED.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpCAED.tmp
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f3a100cba30b2a07a7af8886e439024e
SHA1 a454cca0db028b4d0fb29fa932c9056519efe2cf
SHA256 6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc
CRC32 72CF6AF8
ssdeep 24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW
Yara None matched
VirusTotal Search for analysis
Name 24922db2148ca3d3_tmpC5D2.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5D2.tmp
Size 273.3KB
Type data
MD5 19b0656634435462e896fef744aa57e7
SHA1 95ffda562ba8403f95a4a9c62835998f25098aee
SHA256 24922db2148ca3d3dd35d6b7d6faeeba2d560637007c80833cb31e7b3aedd2e8
CRC32 4B19E78A
ssdeep 6144:MhnRaQKsSbHY9fFFd4nIjAnBbP9mUcsOrxQLPGhVX1:MYQKsSbH49AIMndP9mUcsOrUAF
Yara None matched
VirusTotal Search for analysis
Name 20d95e2088d0956a_tmpC619.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC619.tmp
Size 341.2KB
Type data
MD5 c4fe0231a62ac1a333491872bae8a596
SHA1 6d6c9e16945247efc5d7440fa2d3fd6d50d586b2
SHA256 20d95e2088d0956af485f33b94fd4ba158bb966b20b418a46f21abea25d384ef
CRC32 8B32DD6E
ssdeep 6144:+ZQVO2O3G8ta1by2rpvlUb8E1ESV0YAROya86FSJxPgxHGS2vv6kHQsK7:wQcT3Lib95l08KEqLTFSAxHGvCmE
Yara None matched
VirusTotal Search for analysis
Name 38c389720b75365f_tmpCB47.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpCB47.tmp
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 c480140ee3c5758b968b69749145128d
SHA1 035a0656bc0d1d376dfc92f75fa664bdf71b3e4d
SHA256 38c389720b75365fcb080b40f7fdc5dc4587f4c264ec4e12a22030d15709e4a9
CRC32 954A724F
ssdeep 96:f0CWo3dOEctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:fXtd69TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis
Name f528ec6ebffb101f_tmpC5E4.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5E4.tmp
Size 230.1KB
Type data
MD5 2eba488d541f8f3fda77fabd130bef16
SHA1 5875ae06399d39f787a38738aaebecf8d873ef74
SHA256 f528ec6ebffb101f76457eef88e295b7ca290d134e5386907cda333d77c1c617
CRC32 03EF1FA4
ssdeep 6144:3axipu7kSy7EuiI4j3nhsY3QiIfWnEOY/p:qxipu7zux4rhsY3QiIfWpYR
Yara None matched
VirusTotal Search for analysis
Name 1613dfca627df925_tmpC59D.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC59D.tmp
Size 152.3KB
Type data
MD5 678f200bbdcbd766738c556fc32a58d8
SHA1 d04d2b7feb4ae5217b2e506b7029d2932a1b897d
SHA256 1613dfca627df92567ddad65992d171f58ce44f6606f6ce6a72b0d0d17641912
CRC32 D85EC086
ssdeep 3072:TUzncZdDUeK0wBA1fwBwwLjbI3czjlpIpLdxgQ5SGP8RSn5DD+ZhTCn69ABgd:gwT8IRQlipLzSFcnFDiFSA
Yara None matched
VirusTotal Search for analysis
Name cde468f4deeca2b2_tmpC5D3.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5D3.tmp
Size 625.2KB
Type data
MD5 68e1490fdc2af0fc3c5e8ad37db6d53a
SHA1 93a4a61f5703069393623bc4e89d1fe36023af3c
SHA256 cde468f4deeca2b2040a03d9b62840c1b524e311ad240b906980f2810693d2cd
CRC32 C0D062E5
ssdeep 12288:1WSE1iMAghMcFabgqQ5MMFOoIO7K+BifDmJyOusrE1qyyJj9DKnTNUzhTYpM:1RE1tfhMekgvMYOo97K+5sOusrECdKJQ
Yara None matched
VirusTotal Search for analysis
Name d800d05a71a7297a_s2341.vbs
Submit file
Filepath C:\REC93248209\idset\s2341.vbs
Size 90.0B
Processes 1908 (file3n.exe) 2672 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 05f2cd86bd44f3683aad1b6bf1756487
SHA1 4524a3003f350f94c029a0585e067a55242e9c55
SHA256 d800d05a71a7297a1c39b97f926d309213dbb0f1bdf6804c611a7f537def8a4e
CRC32 EF1E4A10
ssdeep 3:jaPFEm8nB7KqQBSddfFj5gW9n:j6NqdK1SffIW9n
Yara None matched
VirusTotal Search for analysis
Name f7a73ab6af16f6f7_tmpC5B0.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5B0.tmp
Size 885.7KB
Type data
MD5 cab9ead02dd73038c3b38e6e1e809629
SHA1 89d84eb971b789dc922880ce0b5b805cfeddeac8
SHA256 f7a73ab6af16f6f760f6a5b1a82669c41736f85c537bb2134370738272d51b3a
CRC32 9BFEB3BD
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 587e54d8d4b1410a_dhsjf72.bat
Submit file
Filepath C:\REC93248209\idset\dhsjf72.bat
Size 750.0B
Processes 192 (gugue.exe) 2672 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 a48a6a7f5dc07c9651813c5bd6adc684
SHA1 cd1896c6cf2e13f0f68cb08a3a95fb0b737feab7
SHA256 587e54d8d4b1410a64d1d0b9d397680d9e5bf195b2f05f4d2874a014655f67d3
CRC32 45FE73DB
ssdeep 6:U4J7cIjIpYvdD1c5fqDCRVGOCGOWAh4lWAh4Jpc5pce1c5zLce1c5Dh4LvKe1c5+:vJP++95EVGOCZWQ4lWQ4Jw4UKhiODDv
Yara None matched
VirusTotal Search for analysis
Name d228dd208774b9f3_78ml.bat
Submit file
Filepath C:\REC93248209\idset\78ml.bat
Size 408.0B
Processes 1908 (file3n.exe) 1456 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 d31f0ed8bd9eddf20b2573f4f3de3a56
SHA1 d92c9213f2c37308aa8e45d0fe12973d2efead26
SHA256 d228dd208774b9f36657b6f65e7cbe23c9380ee6b65ce073c6e8e6ab3b120844
CRC32 C8E498E4
ssdeep 6:pKuoTITHebvWgFFWWgwQCAAk39UAbH1F0bL8jXn2ovE1gUiBsF9QXv:poamFowQ/lt3s0AQXv
Yara None matched
VirusTotal Search for analysis
Name bade5cb0dd40454f_cocochanel.exe
Submit file
Filepath C:\REC93248209\idset\cocochanel.exe
Size 1.3MB
Processes 192 (gugue.exe) 2672 (cmd.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8ffad04d0f64b4efbc13524e9cffd0c6
SHA1 91ecc5a53f337c538b6a6bef2d9be652681bd3b3
SHA256 bade5cb0dd40454fecba0c234fbf5ca82b91cb9d63e0e3fa45faf5e3bc122a47
CRC32 2B90A500
ssdeep 12288:36lycIBT8MNzJMuUXWjNeLOuiAI82DEgCTkLl:36ly5t8azJMuUeo6pEgCQp
Yara
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 12c78c9260e3a063_tmpC5B1.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5B1.tmp
Size 975.8KB
Type data
MD5 cbd0b8b7f8282d062ec9d05ca4c1e662
SHA1 065d880f19ac4cd67504037614eaee8f4059cb15
SHA256 12c78c9260e3a063b73d0e1b782f249ea8fa75e8c7541c589d67449ef8828428
CRC32 16A9FB54
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 4d8e7ed0194f875a_tmpC5F8.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5F8.tmp
Size 689.9KB
Type data
MD5 6242560be83f1fec0db5db4169f2f09e
SHA1 f4868d2883f38896549944cdc521f1216a8736df
SHA256 4d8e7ed0194f875a147b60ac002f56ee908190a9235615c262946937908201f1
CRC32 48A2A9CF
ssdeep 12288:H/dwr411q1rgSxNIaq7C4irfvGI0ZVxi8ZrRWaV4UHpjDMtGatgWH3lEEq9XP20A:FwE1ErFjZqm4ibElRHKgpPMtJVo9u1L
Yara None matched
VirusTotal Search for analysis
Name 9e6e4772050998a5_tmpC58B.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC58B.tmp
Size 10.0B
Type ASCII text, with no line terminators
MD5 eb6b6c90251ab33cee784713c451e6d8
SHA1 451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5
SHA256 9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6
CRC32 22598B08
ssdeep 3:IS:7
Yara None matched
VirusTotal Search for analysis
Name 88e65aa69858b179_tmpC58C.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC58C.tmp
Size 31.3KB
Type data
MD5 78af5f2f35746bdaa5499e29daca737d
SHA1 7ac488b31b66b81fcd7711453acc6efede1aaf32
SHA256 88e65aa69858b179558b77e4542670d29399e83fb04dd4f207cbe9ca8ddf3d13
CRC32 71A2CC37
ssdeep 768:2zA1C82+UYugHPAH/Ug2+I7TcJTvfFAzl6vj+vFepKb:2MCaUYhIUgus9vdAzl6vjOb
Yara None matched
VirusTotal Search for analysis
Name b8e84de79a5dcf57_tmpC5C2.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5C2.tmp
Size 330.6KB
Type data
MD5 801a364bfaec60fd67f7337709a51ec0
SHA1 bfaea800a73f4fc8310e43d54b64b205c4d61dc7
SHA256 b8e84de79a5dcf57aeb4e7ebc09b1146da360681fa6a0bcb8f23e0968de31b8f
CRC32 6D9B6296
ssdeep 6144:NFdkUxINSPbz1+GLLc7q2DNSjKY/p3SaK5t+1/lGsvB7H2MdycufSRL4kfjKpH9u:/GJNSP9lMOuEeY/JjK/yGqB7H2kR14X2
Yara None matched
VirusTotal Search for analysis
Name f16ed6f7ff049e79_tmpC5E5.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5E5.tmp
Size 898.8KB
Type data
MD5 1c3a0afd5428ea2b1e11aeea596d2dbc
SHA1 e41928731b20b7420e6f1cceaaec451e400cac43
SHA256 f16ed6f7ff049e79be0a98206dfad09ccf349ae89161d16b17de023e43db177f
CRC32 CA3EE9A8
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 3b046d30dc2e6021_tmpCB22.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpCB22.tmp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 e185515780e9dcb21c3262899c206308
SHA1 230714474693919d93949ab5a291f7ec02fd286f
SHA256 3b046d30dc2e6021be55d1bd47c2a92970856526c021df5de6e4ea3c4144659b
CRC32 25EF2A64
ssdeep 24:TLNg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fBvlllYu:TC/ecVTgPOpEveoJZFrU1cQBvlllY
Yara None matched
VirusTotal Search for analysis
Name 89becd7250545585_Spack.rar
Submit file
Filepath C:\REC93248209\idset\Spack.rar
Size 320.3KB
Processes 1908 (file3n.exe) 1456 (cmd.exe)
Type RAR archive data, v5
MD5 d42cd649752a0257c7b5fefce80c7956
SHA1 9c7383376c9a40de84bddcd794edda76be07c887
SHA256 89becd7250545585a08fe642b738cc87ef50563997cd464e678a31317ff33964
CRC32 FE2D571A
ssdeep 6144:NJsAz0nBAL9wisqRpls9zHnUKb8WVzSNHn68EoKyZ:lzC6YFYWBSNHn0oKG
Yara
  • NPKI_Zero - File included NPKI
VirusTotal Search for analysis
Name eaf26d0ec1204746_tmpC608.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC608.tmp
Size 974.6KB
Type data
MD5 1b2df577f858154c756e19296abfec33
SHA1 29286588a9b2ccb436e891b8d74626d76c1a012c
SHA256 eaf26d0ec1204746c87a07a4a34ff7a43b9c11c604ad0bf8bcecc2012c3ef7a8
CRC32 F88F9597
ssdeep 12288:JoqOhE9RbUtmk1v2rH611xWTvGH4Pl8HpVIpAi7nRuXpmReFkZzvCal5wuhIHDuX:JoqWqdkUriWD64xsZMeICal5VsaDL
Yara None matched
VirusTotal Search for analysis
Name cf758b4720b94633_tmpC5AF.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5AF.tmp
Size 216.5KB
Type data
MD5 2f68caab479f65c04187a203549cc048
SHA1 86d18b2d272d2bc333c1cb885066669a36a3e7e6
SHA256 cf758b4720b946332aacd25f43ac185305a406ff0f58e6de93844cb5871f990a
CRC32 E67C3983
ssdeep 3072:Veoy3n0/k4+AE+rcJgvX7oWggyDHR27DrFIH8TGkgnFZ7qKBBQOjKMn+2i7K:VPy3Ik4DP8ykC/SUG5C8WOFnN+K
Yara None matched
VirusTotal Search for analysis
Name 4acabf712361cecc_tmpC5F7.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpC5F7.tmp
Size 687.0KB
Type data
MD5 b02d99e427bcbb0cde5927694a35dc61
SHA1 dbd860832b102d5c0ecadfd652d04595236225d9
SHA256 4acabf712361ceccfa30cfe858d8641751f3357b552438fcb4ed7b7e5466738a
CRC32 D679D58F
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 34dfe4869b0a524c_gugue.exe
Submit file
Filepath C:\REC93248209\idset\gugue.exe
Size 551.7KB
Processes 1908 (file3n.exe) 2672 (cmd.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
CRC32 AF21EEA8
ssdeep 6144:lEFCsTIKlyUvQLPSvsN6UeLrfeH9Kv526R7mO/ak/QXcBgWxJiT40/abdBZAuO8U:SsDKl7omvhpr10Oj3xgTh/arNnaGcF
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis