popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 9273fc74e4acdc64_beep.wav
Submit file
Filepath c:\program files (x86)\bandwidth monitor\beep.wav
Size 656.0B
Processes 1684 (bwmonitor.tmp)
Type RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 Hz
MD5 22ba829fb5ab55db43b261ae92088a77
SHA1 322e6383ee0d5084d571d5fe773e986c044aa173
SHA256 9273fc74e4acdc64cfb0d0ec73abaa9673af1866c8de628dda6ca153117467d6
CRC32 0389A74C
ssdeep 12:ZRQYImIqzFs6kLeiFHRSZWbf0RHiO1lzqYa89c37XFvbJ6:ZRqvqzFs6gei5RSU8gwK3xDJ6
Yara None matched
VirusTotal Search for analysis
Name e27fb3c711ef72ca_traffichistory.log
Submit file
Filepath C:\Users\test22\Documents\BWMonitor\TrafficHistory.log
Size 24.0B
Processes 2092 (BWMonitor.exe)
Type data
MD5 0ea656fdc182eb8598a4c2abcb440380
SHA1 e954ce8e37f90eee512684debbe71ebcecd4bdbb
SHA256 e27fb3c711ef72ca09d60800da5fa5db0cdde73fada77cca9ab24018ca27337a
CRC32 B02C92E2
ssdeep 3:spl:spl
Yara None matched
VirusTotal Search for analysis
Name 6732b67f9b2f452c_recoverystore.{33f9669b-2a2f-11ec-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{33F9669B-2A2F-11EC-BDE1-94DE278C3274}.dat
Size 4.5KB
Processes 2408 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 c225fe12f1a257f638f08c1fecd67d31
SHA1 506dd1ed6f4b22c4cfac159ae20bba46d3bf6b4e
SHA256 6732b67f9b2f452c2d3a3097610fe9a66e109289b318af696d7f2741dc07614f
CRC32 9989F5EB
ssdeep 12:rlfF2kHrEg5+IaCrI0F7+F2TrEg5+IaCrI0F7ugQNlTqbaxDJxU9RZNlTqbaxDJT:rqkH5/1T5/3QNlWM0NlWM
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 0fc5633c254dae0a_readme.txt
Submit file
Filepath c:\program files (x86)\bandwidth monitor\readme.txt
Size 3.6KB
Processes 1684 (bwmonitor.tmp)
Type ASCII text, with CRLF line terminators
MD5 6e8c164355fa9e0c021315414a5e8783
SHA1 8a204d866b2e99a4ad56aabab07cfbd72d8da9e8
SHA256 0fc5633c254dae0a3c515730f9834a6f652e1a936144430bb6cb01d983878b6d
CRC32 36F622A9
ssdeep 48:wjxmLLFtrnfF7y97yI477gDrPdVuwwItFNzMZzHk0QpXkM26j8xJgU43FzVRZSuS:5+4IDdVuwwIzNDkKNA
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 37647580c472e33a_bueo8sow.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\BUEO8SOW.txt
Size 89.0B
Processes 2656 (iexplore.exe)
Type ASCII text
MD5 1d4bb0818c74b8ec367a068c1a66d129
SHA1 8db919325b6e6a3517c19804a955dccdc5273e92
SHA256 37647580c472e33a42bac081b97fd2bcb98087f701596818ae352adb3346aaa2
CRC32 7DDAAB49
ssdeep 3:gW9NDjLXQQqDvKvYTvXeTQtdRkXvaX5r6JGDn:33XQQeSvYTvXbTRwaX5raC
Yara None matched
VirusTotal Search for analysis
Name 5b621291edae983c_alarm.wav
Submit file
Filepath c:\program files (x86)\bandwidth monitor\alarm.wav
Size 16.8KB
Processes 1684 (bwmonitor.tmp)
Type RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11127 Hz
MD5 7edc5bd19832ba575992d1a2c0a7812d
SHA1 09767cc950bf080066adffc12bb9f31ac55d78a6
SHA256 5b621291edae983cc7d2f88b663af7f8600a70754308e94b37f833b09697b9cb
CRC32 F1556FDC
ssdeep 384:xa4+1cDCWW+TWMJ2+B1lEomOd6sRHWtda2RZlrKJDpmddbka0A6:2QDWb+DlEODlOdaDfmddt01
Yara None matched
VirusTotal Search for analysis
Name a9ac4e9075045920_bwmonitor.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-E7MH1.tmp\bwmonitor.tmp
Size 3.0MB
Processes 1468 (bwmonitor.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 404d12f77bb2489b1919bbe3aeb0561f
SHA1 b1b1cd786742cd20121b6b73ec9a871887aafe55
SHA256 a9ac4e90750459205f4315afaeb8717ea71736fc871379777ead4c4ed9054e47
CRC32 118969DA
ssdeep 49152:qEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TY:692bz2Eb6pd7B6bAGx7s333T
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name feed5470a41d8e82_bwmonitorservice.exe
Submit file
Filepath c:\program files (x86)\bandwidth monitor\bwmonitorservice.exe
Size 188.0KB
Processes 1684 (bwmonitor.tmp)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 c1b16a6405e04045bf99ae5a566641e4
SHA1 435221cee1ec822bb9e3bc0e39ebe10a5f8fab54
SHA256 feed5470a41d8e82fee9a35989a5ceb8d0bcdacb6c0f4f7e9e933d5584e6c62b
CRC32 A0F9D70F
ssdeep 3072:O3BoeySFTe6wiKkw/GaCPIh+wTrLVARWLfonig9m:cBDFadiBw/dCMVewa9
Yara
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name fc0ca6bee9e0c104_boing.wav
Submit file
Filepath c:\program files (x86)\bandwidth monitor\boing.wav
Size 7.6KB
Processes 1684 (bwmonitor.tmp)
Type RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 Hz
MD5 a9aaefa64aeed2be1742e5b1c4c4b4bc
SHA1 3b373edbe84fce3c6db51f4b2518ca40a3b773e2
SHA256 fc0ca6bee9e0c10432cefd87c673cc8dc1cf9ef520a275ce7c7b11fee45cb0e6
CRC32 FBEDC769
ssdeep 192:WUvgrCu73CXC6qeMexuWXm2GkH6j1YFc9KqQhSk:TgrCuutLu26Q1FiLG
Yara None matched
VirusTotal Search for analysis
Name 965093c29f291d05_{33f9669c-2a2f-11ec-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{33F9669C-2A2F-11EC-BDE1-94DE278C3274}.dat
Size 4.5KB
Processes 2408 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 d9a6ef83d7c6c7ae05c87b47da01d704
SHA1 a7f72bb9a8c0a7ad433ea9fca72e39e727ec1572
SHA256 965093c29f291d05ca1a3ceeb27953c40f1c0a990ca319d4e1a3ee81c0164fe0
CRC32 8B1D6CBD
ssdeep 12:rl0ZGFNrrEgmfB06FZgcDrEgmfh0qgNNlTVbaxLNlz9baxzy:rxrGNgoGmNNlp+Nlhi
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name f90ad729efd1657c_bandwidth monitor.lnk
Submit file
Filepath C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandwidth Monitor\Bandwidth Monitor.lnk
Size 1.1KB
Processes 1684 (bwmonitor.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 10 16:04:31 2021, mtime=Sun Oct 10 16:04:31 2021, atime=Tue Jan 18 19:24:30 2011, length=585728, window=hide
MD5 3019621b782e2b7dac66ac9aab647388
SHA1 d8fbe453b2c99917dfcd67643abd8a587484683c
SHA256 f90ad729efd1657ce5ac51596b9bdcc666e2a73d2d8a931a91e831b310fa631f
CRC32 290A4052
ssdeep 24:8mKeHdOEi7HCaSQfGcKVQR2UAJFdwSiRggdwSEUPPy/08:8mKAdOrCaSQ1KWR6JFdwSiRggdwSRnyV
Yara
  • Antivirus - Contains references to security software
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name f51d5fd0753eb46d_bm.reg
Submit file
Filepath c:\program files (x86)\bandwidth monitor\bm.reg
Size 346.0B
Processes 1684 (bwmonitor.tmp)
Type Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
MD5 2392997d0c05b2bd7049c06a43139a0d
SHA1 b2c0020925336145b8de0f630f822b00ed5f8369
SHA256 f51d5fd0753eb46dbc250db912b4626cd4fbc02658fd60b8b6d65a827fdac503
CRC32 722F5214
ssdeep 6:Qyk+SkWCiiCRroZ6IJl5qIlgCVlEEm2QKlEEmRINlqskbdlrYiR2QKlEEMXRSlqO:Qy5hVZtrRNEEm2Q+EEmRI3qskbdpYy2t
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 46b6e3089ddfe3f0_unins000.exe
Submit file
Filepath c:\program files (x86)\bandwidth monitor\unins000.exe
Size 698.3KB
Processes 1684 (bwmonitor.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 31152088f26a2a61c9e758d90b824ff7
SHA1 01bb7b8504a2f999571bacfd5bd6edd91a0e9890
SHA256 46b6e3089ddfe3f0dde04d828e3951fd8c80748bf2fa40a396995e2f78c951da
CRC32 76EA6B83
ssdeep 12288:QRObekMtkfohrPUs37uzHnA6zg5cIsalHERjUrNN/RQ9wgUT5EDExyck:6ObekYkfohrP337uzHnA6cHswHE/6gU0
Yara
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 1587fdc587508b7e_bwmonitor.chm
Submit file
Filepath c:\program files (x86)\bandwidth monitor\bwmonitor.chm
Size 584.5KB
Processes 1684 (bwmonitor.tmp)
Type MS Windows HtmlHelp Data
MD5 22c8032a987ee72bfd202a4ea3977469
SHA1 1ca9d0cae9a3e191719499edd65cb3743b02cad6
SHA256 1587fdc587508b7ecdf578e4941f9f98f8eb94d36254ff11f3f0f6afcf644ca1
CRC32 7BFD3810
ssdeep 12288:c6y9KkIjyaqtlbIqRZPAYuA0SY4kzTbfmA3aBx:uk1qtlbtRd0aATb+Esx
Yara None matched
VirusTotal Search for analysis
Name e44736da0dc57a4f_unins000.exe
Submit file
Filepath C:\Program Files (x86)\Bandwidth Monitor\unins000.exe
Size 3.1MB
Processes 1684 (bwmonitor.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a1e61cfa8fea8d42d7324ccb3e3ce0a4
SHA1 7852579d3da158f7cc22d80bd9361ca434c64ec7
SHA256 e44736da0dc57a4f2d1a6f9462ed73286dffd2f408fa5dfb47c6315fc2cf6a3a
CRC32 97600FBB
ssdeep 49152:iEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TYu:i92bz2Eb6pd7B6bAGx7s333TX
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 294a129c242bd4c9_license.txt
Submit file
Filepath c:\program files (x86)\bandwidth monitor\license.txt
Size 4.1KB
Processes 1684 (bwmonitor.tmp)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 cd741a112dfd5feaad82f51567b9ef9a
SHA1 746ce8c3c2f1d5afe083c21a79ce9ebd935e5791
SHA256 294a129c242bd4c9ecda53f7d2867211d20166ca59f965dc664d63c85293569b
CRC32 39FA4220
ssdeep 96:FOiSjwaIYMQIVNcl/gNuvUT9ue+6cHoyUtjfbKRJdxLf7:FOIQI/DmUT9r+VHoyUBKJdx/
Yara None matched
VirusTotal Search for analysis
Name 5508e571995f6dd3_1234567.sfx.exe
Submit file
Filepath c:\program files (x86)\bandwidth monitor\1234567.sfx.exe
Size 2.6MB
Processes 1684 (bwmonitor.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a2993fc9b80020df5cee1a708a71109a
SHA1 ce4aac86baafc16166c0d98938a00af5304a4f21
SHA256 5508e571995f6dd30c8168bd0c47e4f59462b8f9b5f69706379cb6c409799187
CRC32 7D69D67F
ssdeep 49152:VIfb+ysJpwmfYClkMu7fV5u/zTXYRyg4FFbEQ3YecmAwJBCnkmsvG7:VIEfsfNo/zzY8vucYecmSkvvu
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 4b49990aac29b599_notify.wav
Submit file
Filepath c:\program files (x86)\bandwidth monitor\notify.wav
Size 15.7KB
Processes 1684 (bwmonitor.tmp)
Type RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 8000 Hz
MD5 83edea256522547cceb2335a00334b31
SHA1 fa218046c29aaae7532c725199d792fbc83964e6
SHA256 4b49990aac29b59958bb6d3881f0f84024f6730aaef37bb480f5bcc2ed30afd3
CRC32 570CE312
ssdeep 384:R9bC1MmygO6GdSaqVYjRKGTJojcqI2X4VIK3qXSb68qJ:7Clu7TJ0XQIK3iSb68qJ
Yara None matched
VirusTotal Search for analysis
Name 1beb05868ce93bcc_IE9CompatViewList[1].xml
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\IE9CompatViewList[1].xml
Size 141.8KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 9b63e0fb3785ffa49686dd75e303d177
SHA1 e3992de5a1b8f58a11a52ad71f275ae413927eb4
SHA256 1beb05868ce93bcc8fafc46adccdda6d104f3c6f6c6ed454d8a6c0c208d9bd0e
CRC32 F778EDEF
ssdeep 3072:AoSMrEDL1FwhdFFaz6l8vHG+TbFPAzepobjyG7I1K1IB2+Tir8v1IG9aIedyPcFC:dSMrEDL1FwhdFFaz6l8vHG+TbFPAzepR
Yara None matched
VirusTotal Search for analysis
Name a7940d92fd358574_BWMonitor.exe
Submit file
Filepath C:\Program Files (x86)\Bandwidth Monitor\BWMonitor.exe
Size 572.0KB
Processes 1684 (bwmonitor.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2ab06806b6017092625fe55f2bb7971e
SHA1 dca8f1434503d8f94b5946f3e863691d5dd89247
SHA256 a7940d92fd358574ce3cf2f11626cdc9949518d718c1e50920394d184d43a7bb
CRC32 45393AA1
ssdeep 6144:Qk0DukIgw+M4ho1ZhJ32AtzXtlFxgUGdhcoJmrKEsS4+849IPabDInwwQ2TR0xIy:QkrgoNJGoXtl6hchuPS474uPaowwMj
Yara
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet
  • Antivirus - Contains references to security software
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 315d9d968b0ab851_1234567.exe
Submit file
Filepath C:\Program Files (x86)\Bandwidth Monitor\1234567.exe
Size 2.9MB
Processes 560 (1234567.sfx.exe)
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 aab718e1b6c67366348db0ad07ca49cf
SHA1 1ba8c447f13ca9bcbac325d20cbbe845d96891f4
SHA256 315d9d968b0ab851a710a0d0ea43d15e990a01dc7c73a3525a2c6d6b7a41001f
CRC32 4FCFF165
ssdeep 49152:8Cd6SNccYT1YqULx0/GyT6dDE+/L0zm/IO0i3onYawkvLlYHn2Pq:V6SNBks0/Gy+lEgZEYYLyHyq
Yara
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • themida_packer - themida packer
VirusTotal Search for analysis
Name f3dd31196092ac66_unins000.dat
Submit file
Filepath c:\program files (x86)\bandwidth monitor\unins000.dat
Size 3.9KB
Processes 1684 (bwmonitor.tmp)
Type data
MD5 a9b2f013e04824e7b2a5fb7a656f0575
SHA1 5b49aaf37f41dee43b483b627612acf59a02d1b6
SHA256 f3dd31196092ac66d3a6b24de281b432f6dd902acfe5633c11402c6c2a9fabda
CRC32 1CBF0D34
ssdeep 96:2cSKgS0C6SOS6FSeSK8SNSaSBSbSKrSKASK3S9S1SD3S+23S+aSxsSWcC6SLbC6u:2/Y5Hh
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name e3b0c44298fc1c14_unins000.dat
Empty file or file not found
Filepath C:\Program Files (x86)\Bandwidth Monitor\unins000.dat
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 377e20a354fd825b_favicon[3].ico
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\favicon[3].ico
Size 16.1KB
Type MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
MD5 dd345aee82d34847e8abd2a695302336
SHA1 87e2444681a0c4d9127b5328740ec8957d7972d1
SHA256 377e20a354fd825b9763c87836482bb7b79d2794e6d25ed693376ca33eac990a
CRC32 4CF50320
ssdeep 192:GyrOOOOOOOOOOOOTOOOOOOOOOOOOOOOOOOOOlOOOOOOOOOOOOOOOOOOOOOOCOOOm:N3wUorF4JNM3gpxjzre9
Yara None matched
VirusTotal Search for analysis
Name 095b8715eaad104e_warning.wav
Submit file
Filepath c:\program files (x86)\bandwidth monitor\warning.wav
Size 531.0B
Processes 1684 (bwmonitor.tmp)
Type RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 11025 Hz
MD5 60518f02c5f281027afb3b490a26381f
SHA1 9c2ceb437af0d53359c9ad754d9aa77de4832555
SHA256 095b8715eaad104eafe469504de9ae284007260fdf4bfe1fd8ea4fdf535b165f
CRC32 D7D6CAAF
ssdeep 12:k2REvH9fJU1F65T74pnWm+Ztvyr7dQeJIq1UmsfBNa/b4t/OU4bL:k2EvTu65EmtvyVQfq1kfBpOfbL
Yara None matched
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-79QFN.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 1684 (bwmonitor.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis