popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 1d07cfb7104b85fc_TUN3.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-GK0T2.tmp\TUN3.tmp
Size 694.5KB
Processes 1476 (TUN3.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ffcf263a020aa7794015af0edee5df0b
SHA1 bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA256 1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
CRC32 59A45BB2
ssdeep 12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQYq9KgERkVfzrrNVyblD4cNaf/yxyR:bQYh1yLmSKrPD37zzH2A6QD/IpqggE29
Yara
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 8182ddcf6762f127_unins000.dat
Submit file
Filepath C:\Program Files (x86)\powerOff\unins000.dat
Size 1.2KB
Processes 2940 (poweroff.tmp)
Type data
MD5 7f1495b24ebf92ddcb9fec43e4b2c6cc
SHA1 a0bb6c4d8ce12b4515b836902fdc8da7a3b886d0
SHA256 8182ddcf6762f127341b2803ea60a0cd93845f641a443d6c44faf7f02fe948a7
CRC32 CC15C2A4
ssdeep 24:Db0nQcGVWRQtVM+ExwRQuQqdLVM6LVMrRUV1r:DQnQFVWRQt4xwRQuQqdLrLxrr
Yara None matched
VirusTotal Search for analysis
Name 21d03f19c4b1c12d_red_shield[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\red_shield[1]
Size 3.4KB
Type PNG image data, 14 x 16, 8-bit/color RGBA, non-interlaced
MD5 87de5d9a3403e1d7635885cbaa52389d
SHA1 50b32c5966331e3e27bef987fd1da0129423d348
SHA256 21d03f19c4b1c12db2feb8fb3a373d7e378976ecdfb64efb300204edc8947d3d
CRC32 15814E36
ssdeep 96:5SDZ/I09Da01l+gmkyTt6Hk8nTzVcxkZFd/:5SDS0tKg9E05TJcxi
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name d0ba19f5e334e60f_invalidcert[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\invalidcert[1]
Size 2.1KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 66f441cef8801549c2f0ff12cbe752a5
SHA1 de506bfb63225b3cc084ae292d4bf98a21ae6250
SHA256 d0ba19f5e334e60fb5056bc2e05b97de09aee4db49e5e11abde482bab9c4e8fb
CRC32 13C10CC2
ssdeep 48:mPntofz4/i5DjktylVDJlObUBsBXcysTqysg2Bp5Bi8OwaBynLysTqys4Bwy/Ae:SE4a5HlVDJMbUB2XcylyNkpfi8OwgynN
Yara None matched
VirusTotal Search for analysis
Name fbc23311fb5eb53c_background_gradient_red[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\background_gradient_red[1]
Size 868.0B
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1x800, frames 3
MD5 337038e78cf3c521402fc7352bdd5ea6
SHA1 017eaf48983c31ae36b5de5de4db36bf953b3136
SHA256 fbc23311fb5eb53c73a7ca6bfc93e8fa3530b07100a128b4905f8fb7cb145b61
CRC32 C08DA614
ssdeep 24:vk9YMW80o0XxDuLHeOWXG4OZ7DAJuLHenX36n8R0O3kwd2q:M9YM3uERAq8uyJdB
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name 0106ddc69f01d3dc_lejaerosholy.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\05-d7c6e-2df-0e0b2-8e8cba4909419\Lejaerosholy.exe
Size 361.5KB
Processes 2216 (zizou.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 524ac8e72b5fe522e85d3df2060edf95
SHA1 1c940e9e0a1627a8b1192b206d68197e59b97516
SHA256 0106ddc69f01d3dc3aa8beef31cd32f58aa08ff5fb751ebeb87398199ac53b37
CRC32 3C533800
ssdeep 6144:+SWrT2JZ7+2YLeUe4lEEEA2F1Qs8o/n8DQLYWOJvg2nkM4y2z72IoZKzI/rfPfW2:+x3y7+lxMAjsn8P5Jvg2nkM4y2z72Io1
Yara
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 39e7de847c9f731e_down[2]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\down[2]
Size 748.0B
Type PNG image data, 15 x 15, 8-bit colormap, non-interlaced
MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
CRC32 B475DDD7
ssdeep 12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 131db8d74350a9e8_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 252.0B
Processes 2216 (zizou.exe) 2012 (iexplore.exe)
Type data
MD5 826849a72a98b895360997197780c646
SHA1 4593e5d4789caa998b3fa04083261e0961b19992
SHA256 131db8d74350a9e800c8c9219af5eb95b7cd92219f15e6f37b2a3a5e3ec92058
CRC32 6CE8EDDC
ssdeep 3:kkFklkMtVltfllXlE/VWw1BllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB1ADEQl:kKJwlMWA1liBAIdQZV7CDEQcK1
Yara None matched
VirusTotal Search for analysis
Name a2ce3a0fa7d2a833_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 893.0B
Processes 2216 (zizou.exe) 2012 (iexplore.exe)
Type data
MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
CRC32 1C31685D
ssdeep 24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
Yara None matched
VirusTotal Search for analysis
Name 8c1a062cf83fba41_poweroff.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-FIOTD.tmp\poweroff.tmp
Size 981.5KB
Processes 2852 (poweroff.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 01515376348a54ecef04f45b436cb104
SHA1 111e709b21bf56181c83057dafba7b71ed41f1b2
SHA256 8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0
CRC32 AB83FFF1
ssdeep 24576:sQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafSWVyx9eR:Q02rPD37zzH2A6SBIfNafwC
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 61b3ed7e0c34462a_invalidcert[2]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\invalidcert[2]
Size 4.7KB
Processes 2012 (iexplore.exe)
Type HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 f200b6453c3681a59928507b6c7bf9c8
SHA1 cd0cd684a0c1404f612dca4e0ee6afff98ec7175
SHA256 61b3ed7e0c34462a25ef97bee5736c0424098ad1b9403896805ab6fb0620fd1d
CRC32 08E28AD1
ssdeep 96:UUHUD0Ws5PFkiGjUpEajPCMCz27BSIb8i:3UIWsnkdjoFDd57BSIb8i
Yara None matched
VirusTotal Search for analysis
Name 9c0d294c05fc1d88_kenessey.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\05-d7c6e-2df-0e0b2-8e8cba4909419\Kenessey.txt
Size 9.0B
Processes 2216 (zizou.exe)
Type ASCII text, with no line terminators
MD5 97384261b8bbf966df16e5ad509922db
SHA1 2fc42d37fee2c81d767e09fb298b70c748940f86
SHA256 9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
CRC32 AC75BF49
ssdeep 3:KWigXn:KWigXn
Yara None matched
VirusTotal Search for analysis
Name 5e2cd0990d6d3b0b_red_shield_48[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\red_shield_48[1]
Size 4.0KB
Processes 2012 (iexplore.exe)
Type PNG image data, 40 x 48, 8-bit/color RGBA, non-interlaced
MD5 7c588d6bb88d85c7040c6ffef8d753ec
SHA1 7fdd217323d2dcc4a25b024eafd09ae34da3bfef
SHA256 5e2cd0990d6d3b0b2345c75b890493b12763227a8104de59c5142369a826e3e0
CRC32 FB79B148
ssdeep 96:d+IXaQsYpHlXqSHpGjk2p1949uFgq2IzybQOmxtqdE9Z0elca:d+maspzHMjkm49uWq9ffME3lf
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name c34233832ba58e65_naegajysipae.exe
Submit file
Filepath C:\Program Files (x86)\7-Zip\Naegajysipae.exe
Size 126.0KB
Processes 2216 (zizou.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 70a9b681d28137cfb4f0b4ab59ef51c6
SHA1 91d2af3d463821562b8fe9be06d4b304ebc2585b
SHA256 c34233832ba58e65dfaf36d7be1c5395326a9f601e894c6615748ab5600e0220
CRC32 980E17C1
ssdeep 3072:8kIyEk+sfa7YyBJFYDmuStguz3j2qtB+KN+m1+zAqSoMY:8kIyxfaDJFYCuStgoiJ++m18AqDM
Yara
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 1ba122f4b39a3333_green_shield[2]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\green_shield[2]
Size 810.0B
Processes 2012 (iexplore.exe)
Type PNG image data, 14 x 16, 8-bit colormap, non-interlaced
MD5 c6452b941907e0f0865ca7cf9e59b97d
SHA1 f9a2c03d1be04b53f2301d3d984d73bf27985081
SHA256 1ba122f4b39a33339fa9935bf656bb0b4b45cdded78afb16aafd73717d647439
CRC32 B4CE0ACE
ssdeep 12:6v/7uYS13ahSxS0U+uSaXyPtcAM9ikFQoYIWYX08jIVNLSY/c7nYxOEYgiWI0oC1:vD13x0p7y1cAoQW/kEIVNLVBx670oDp+
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name c23f223e4d981eb0_poweroff.exe
Submit file
Filepath C:\Program Files\HashTab Shell Extension\OUVIFXRJHA\poweroff.exe
Size 838.7KB
Processes 2216 (zizou.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c0538198613d60407c75c54c55e69d91
SHA1 a2d713a098bc7b6d245c428dcdeb5614af3b8edd
SHA256 c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed
CRC32 A2395C84
ssdeep 12288:+Qi3reTWxN15q3ZsRfGGduNOXPTd7yts/G6UWi9P3P5cN1IGh0nqPjU6xg7:+QiuWl55R+OeOX7UeRAP3xcNLeqPjUX
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 6c9f9fd197cec7a2_recoverystore.{492cae8b-7698-11ed-91c7-080027c2f7b0}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{492CAE8B-7698-11ED-91C7-080027C2F7B0}.dat
Size 4.5KB
Processes 2700 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 7fa7a38eaab55a3fd1c7a2491acb8116
SHA1 dfb0488b80ee497cb31653b67ae643f93d6a7337
SHA256 6c9f9fd197cec7a2fe05502d91fb32ca51af494b65c72969dcbc8cd6886a7fc2
CRC32 EAA11B25
ssdeep 12:rlfF2w1HrEg5+IaCrI0F7+F2DrEg5+IaCrI0F7ugQNlTqbax0fogyNlTqbax0fob:rqqH5/1D5/3QNlWLogyNlWLogM
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 96564abe9ba7cd32_poweroff.lnk
Submit file
Filepath C:\Users\Public\Desktop\powerOff.lnk
Size 1016.0B
Processes 2940 (poweroff.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Dec 7 16:32:32 2022, mtime=Wed Dec 7 16:32:32 2022, atime=Thu Oct 7 05:10:24 2021, length=635904, window=hide
MD5 3cb2c367cc13456cbb0f373bfa007884
SHA1 a27f9188fd95146fe63a63bc59bc94e6ef30accf
SHA256 96564abe9ba7cd327f34f14c89d6e863e5521378eb8e753de76b0bfbdc2bdb16
CRC32 E0AF5ACB
ssdeep 24:8mopMddOE4fec9WIuAkQqQCdWdqddUPPyV:8m4MddOfl1kQqQCdWdqdenyV
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name f9d12723a5ac3ade_power off.exe
Submit file
Filepath c:\program files (x86)\poweroff\power off.exe
Size 621.0KB
Processes 2940 (poweroff.tmp)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8d0b18eb87590fa654da3704092b122b
SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
CRC32 11692D45
ssdeep 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
Yara
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 9884e9d1b4f8a873__shfoldr.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-QN97K.tmp\_isetup\_shfoldr.dll
Size 22.8KB
Processes 1156 (TUN3.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
CRC32 AE2C3EC2
ssdeep 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name f2afc04a24c9d89d_red_shield_48[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\red_shield_48[1]
Size 6.8KB
Type PNG image data, 40 x 48, 8-bit/color RGBA, non-interlaced
MD5 f413dd8a75b81a154a1fd5e4c4a0a782
SHA1 667f7e3da51ca3417a1feb66d238466423c9487d
SHA256 f2afc04a24c9d89d3c2f0d73f8cd6fb6b65adbe333196c3f99cc7d6868847ceb
CRC32 D96BDACF
ssdeep 192:8SDS0tKg9E05Tz045xhOwZtbiFHsrC3rlTqpHbW:7JXE05d5xhOwtGsSTqpHC
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 203d7b61eac96de8_idp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-QN97K.tmp\idp.dll
Size 216.0KB
Processes 1156 (TUN3.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
CRC32 90D9CA64
ssdeep 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 9dc0f11a787e6c1e_zizou.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-QN97K.tmp\zizou.exe
Size 297.0KB
Processes 1156 (TUN3.tmp)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c34836636624cc3b5a7566743b7a1931
SHA1 6c61def45f28d9d324e027a77927f9ba8179c3f3
SHA256 9dc0f11a787e6c1effbcaf3e1d98a5748f1c29677ba4f8d0d1a552236bf7c1b9
CRC32 9C303F31
ssdeep 6144:4N7MsPfldUHmlssVLqR5YexOdt6IoKixgDuliAEQvjwPk:EAsPfldzvqR5YexOdt6IoKixgDuliAE+
Yara
  • IsPE32 - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name de49590462f15f50_unins000.exe
Submit file
Filepath c:\program files (x86)\poweroff\unins000.exe
Size 992.7KB
Processes 2940 (poweroff.tmp)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0dc551f0d46e1db221d08790f7f94e96
SHA1 3d0844ec278555c450ab4fad78ed8beb55233bd6
SHA256 de49590462f15f506aa8ecef4d20e74cb54d9afb33d4c28829746e775737f690
CRC32 F3A85DE8
ssdeep 24576:0QYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafSWVyx9ej:402rPD37zzH2A6SBIfNafwG
Yara
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 221c9b39306c9227_bymixiliti.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\d5-11fc1-9d3-a4ab1-2b1b74524b84f\Bymixiliti.exe
Size 585.0KB
Processes 2216 (zizou.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 2fd508f75431de5565c4972b2586c582
SHA1 27c67e1dfb1b6846d40cd76f43f6db63362a7bfa
SHA256 221c9b39306c92270ea2e6268cc343ac11ee53635a27b291088308c50f0ddde4
CRC32 2EEBA405
ssdeep 12288:BVkQPKGIOON+ihFF6A8IIdbfiSMJrc0aWS:BOQSGIOON+
Yara
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 4bd9f96d6971c7d3_red_shield[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\red_shield[1]
Size 810.0B
Processes 2012 (iexplore.exe)
Type PNG image data, 14 x 16, 8-bit colormap, non-interlaced
MD5 006def2acbd0d2487dffc287b27654d6
SHA1 c95647a113afc5241bdb313f911bf338b9aeffdc
SHA256 4bd9f96d6971c7d37d03d7dea4af922420bb7c6dd46446f05b8e917c33cf9e4e
CRC32 FF24F41E
ssdeep 24:VX9dkhKJykEcGrfr9GiuY6ouyrItaMUZ9jL1:FrfZEckG4IsD31
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 0792a97c77501e78_poweroff.lnk
Submit file
Filepath C:\ProgramData\Microsoft\Windows\Start Menu\Programs\powerOff.lnk
Size 1.0KB
Processes 2940 (poweroff.tmp)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Dec 7 16:32:32 2022, mtime=Wed Dec 7 16:32:32 2022, atime=Thu Oct 7 05:10:24 2021, length=635904, window=hide
MD5 519ecb1734722c16a190befabd6cfba9
SHA1 756e8ff0ad8cabc53fb8cf0f2d5b766cb8d52977
SHA256 0792a97c77501e78cb792e0c436a1a1fd166675c7abe0313aa92ea65cd922342
CRC32 A5F453FB
ssdeep 24:8mopMddOE4fec9WIuAkQqndWdqddUPPyV:8m4MddOfl1kQqndWdqdenyV
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name c686babc034f53a2_green_shield[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\green_shield[1]
Size 3.4KB
Type PNG image data, 14 x 16, 8-bit/color RGBA, non-interlaced
MD5 254d388ce19d84a54fd44571e049e6a6
SHA1 51ca725642f679978f5880278e5cac5ca4f70fae
SHA256 c686babc034f53a24a1206019e958ba8fc879216fd7b6a4b972f188535341227
CRC32 265B0B9C
ssdeep 96:5SDZ/I09Da01l+gmkyTt6Hk8nTkN9D6ZB+:5SDS0tKg9E05TkN92ZE
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 018f54b9f11b3ad7_{492cae8c-7698-11ed-91c7-080027c2f7b0}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{492CAE8C-7698-11ED-91C7-080027C2F7B0}.dat
Size 6.0KB
Processes 2700 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 2b45297a805d9d3ba7ebe6e65701ae7b
SHA1 cb201b1bc306d0930f56f4e59d6a87025b8c9624
SHA256 018f54b9f11b3ad7efe51368ae65f4e5052ccbd93121750557e77c4b920b0222
CRC32 39788598
ssdeep 48:rwbQGRxJ7K1MzzOPcsgMzzmBLeaMzzuMzz2//b1MzzcgMzh:yZ6kOUmmByTn23bky
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 41e3f69ecc09290e_httpErrorPagesScripts[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\httpErrorPagesScripts[1]
Size 5.4KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 dea81ac0a7951fb7c6cae182e5b19524
SHA1 8022d0b818a0aea1af61346d86e6c374737bc95a
SHA256 41e3f69ecc09290ebc49be16d2415036ddb2f7a4b868eef4091d0b5a301762fe
CRC32 5E7F4A18
ssdeep 96:JCc1g1V1riA1CiOcitXred1cILqcpOnZ1g1V1OWnvvqt:xmjriGCiOciwd1BPOPmjOWnvC
Yara None matched
VirusTotal Search for analysis
Name 8a94163256a722ef_lejaerosholy.exe.config
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\05-d7c6e-2df-0e0b2-8e8cba4909419\Lejaerosholy.exe.config
Size 1.2KB
Processes 2216 (zizou.exe)
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
CRC32 2328D28C
ssdeep 24:2dZmht+SDfy4GOy4TO4q5X4tndGubyB8GRyF:ccdfy4G74TO4qN4hRN
Yara None matched
VirusTotal Search for analysis
Name 18ae9d76727c45a5_errorPageStrings[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\errorPageStrings[1]
Size 2.0KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 867666e4f73a755e0c135ce4e90de230
SHA1 a7b1d23f1d2ef9de6b149925147d44076e17fcb3
SHA256 18ae9d76727c45a577073bfc8d8914fedccfcf43b5afeeaf26737448712334e3
CRC32 D8C63FA6
ssdeep 48:z9UUiqu6xl8W22751dwvRHERyRyntQRXP6KtU5SwVze/6e/+Ng7FU50U5ZF0:z9UUiqRxqH211CvRHERyRyntQRXP6C8o
Yara None matched
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-QN97K.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 1156 (TUN3.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 8d018639281b33da_ErrorPageTemplate[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\ErrorPageTemplate[1]
Size 2.1KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
CRC32 E6FF242A
ssdeep 24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
Yara None matched
VirusTotal Search for analysis