popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 4ef1355ae5f60c4b_ori.com
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ori.com
Size 2.3MB
Processes 3040 (RegAsm.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 086f78aa81b3d1ad4e648f90da0a7f13
SHA1 4c6e7510eedf12a9d7315c93ae24f8bc0577db32
SHA256 4ef1355ae5f60c4b41eb02c2e8c6ca35e4d5c195badfcaaae34a943e3d8a9f00
CRC32 352D57C5
ssdeep 24576:2zvKRdhY16Vkw2ny/v/LtGZsYjot0pUKsPGO/LbkQr5ANA2rUnu48f5jJoVReH6t:2zgyaTmOINTqzE/BVB3o
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • NPKI_Zero - File included NPKI
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name e3b0c44298fc1c14_xojvwrrdxmhk
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\xojvwrrdxmhk
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF1b94593.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1b94593.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name b3d510ef04275ca8_caqku
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\caqku
Size 2.0B
Processes 2364 (RegAsm.exe) 3040 (RegAsm.exe)
Type Little-endian UTF-16 Unicode text, with no line terminators
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
CRC32 88F83096
ssdeep 3:Qn:Qn
Yara None matched
VirusTotal Search for analysis
Name d6431d5645fffd05_d93f411851d7c929.customDestinations-ms~RF1baf892.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1baf892.TMP
Size 7.8KB
Processes 2172 (powershell.exe) 2632 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name a51eb251f696457a_muddvzhk
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\muddvzhk
Size 435.0B
Processes 2032 (RegAsm.exe)
Type ASCII text, with CRLF line terminators
MD5 453a6b7949477c770a13cfa7e6bcbb6f
SHA1 387ae697aff4261e610c8a47182c430b4f5e4d5a
SHA256 a51eb251f696457a0ea5efa1291069f2857a5209a1434b42b1c31959fb015564
CRC32 4BB1D58F
ssdeep 6:QAXvqKwHNx7hzIRMCADAwzRZvSAmY/SPIFvBnDWncnDWAwb:Qqwz5UMCADzRAGaetyngyAwb
Yara None matched
VirusTotal Search for analysis