popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 9936888a722a2e78_dc0bff9de4868a
Submit file
Filepath C:\tmpvmqcut\lib\common\dc0bff9de4868a
Size 274.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with no line terminators
MD5 167c9fecfa63841ec6aa4d0948d04462
SHA1 f995abbea6d13a5d8317f697b127b17f17610588
SHA256 9936888a722a2e78eafbb58ee384a99c02c243f9837973182ad6b09ed684069c
CRC32 A4E2E031
ssdeep 6:2HRavsiAjivEQVHw26kbAuWQSMq1jTH6yPfd5MOwfGEV7T7:MYvEHQh62tWlMqRL6yN5yGEV7T7
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name e3b0c44298fc1c14_pf7KT1k2ox
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\pf7KT1k2ox
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 0b69d0392669c696_82f40ba0-f4f6-4390-a32a-396e70473755.vbs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\82f40ba0-f4f6-4390-a32a-396e70473755.vbs
Size 736.0B
Processes 3012 (wininit.exe)
Type ASCII text, with CRLF line terminators
MD5 3967b82ad5587d33446e238f9a600989
SHA1 e568d004152c0b7369e1f062191b0d25b8850647
SHA256 0b69d0392669c696063f3579a5dd4765a681e2a11655991ea25fb56a091f9803
CRC32 40D8ED91
ssdeep 12:9vWdTzyMsRfhMA6KIjMpVjOQPouurv3vAGThYsTaHozv/K/ynMaSxqjdxWg9VbNV:9AnyHfCATIjbQQpD/AEmHob/uhEjdxWo
Yara None matched
VirusTotal Search for analysis
Name a998b621c895959a_088424020bedd6
Submit file
Filepath C:\GPKI\088424020bedd6
Size 907.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 dba7617c40abdfd9dd13d3b190ded805
SHA1 52f0a45fce27db8a48565bd932911979bfb837c3
SHA256 a998b621c895959a075cdaf0482fb37884205883c5b0f960c3c30d7d05b20b4d
CRC32 4E43BA96
ssdeep 24:D0OsnG68qIFRA2SssFuPmPFxEq2ka/mgbEX7ouYHiCLtwc:DKlFIas6HTrUdwPL6twc
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 08bdf865e18e3b53_56085415360792
Submit file
Filepath C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\56085415360792
Size 282.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with no line terminators
MD5 2774fa1ef1bab390d641c87177275c09
SHA1 8456fda6faa5a674fdface3aa37a1742ac1b9039
SHA256 08bdf865e18e3b534fce96b58b4fe5e7df3c352db53acd99e248b1466c732d29
CRC32 7B90C7D1
ssdeep 6:pBT40KHTGpcj1hXsRwVLtrmbgid/hXkp2loi5FU30SnsjJMn:fT4zapcBhXZvrmbgwxloiLU3rns1M
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name f1958f8b26acaaf0_d240f5eb091d68e7143ebead5b33c9f98356953a4.5.333c41e16e6065c9632a8b83543d86c3703a2e123a
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\d240f5eb091d68e7143ebead5b33c9f98356953a4.5.333c41e16e6065c9632a8b83543d86c3703a2e123a
Size 848.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 fb51185fd61bfc99d80282b8a04cc845
SHA1 f5c97c3a3fc7fd18886f0c96df6c8ea78367460d
SHA256 f1958f8b26acaaf069593ca36eb9e0684ac24cd35fc0784fd660a30fe07fe558
CRC32 F4C397D1
ssdeep 24:ak22LeKVeMM8/bNTgwjKxnTg/0yFY8/bsP:feKV1M8/bZzGTG0yFY8/b8
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 824fae3331b95e2f_XLTZgvcC2Y
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\XLTZgvcC2Y
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name 5b5625f49eed11d9_617403385cfa57
Submit file
Filepath C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\617403385cfa57
Size 278.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with no line terminators
MD5 c026522b08180bde8a1d357a69d7c59c
SHA1 d45ce1676bc8da5b7c5a13b44b6a22f4eedfca63
SHA256 5b5625f49eed11d946cb628ca36c58bdeb0d5510ca99ba6cbc02d8eeb2a1308e
CRC32 373787BE
ssdeep 6:l1K2Aq+BJ5brKJ9lUbrOGg23RTHOiyWdmVvLaiW6tGx1Amjn4QVUCUaVNY:l1K2PMJ5yu/53cuyGOECmj4OEP
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name ea1456b430be1039_088424020bedd6
Submit file
Filepath C:\Users\Public\Music\Sample Music\088424020bedd6
Size 359.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 8eb8e17820ec065f22b6702bd85fa860
SHA1 4c4b946a95c3922cbb47b4a1686a45878f803c5e
SHA256 ea1456b430be1039d03c21c0f9d96f1ffe5183ee9408006a66e501fb227da77b
CRC32 C989585E
ssdeep 6:EvkojmIA8NOQYhCqIqaHsFQhFwwX+ihhLArPo9HOUN/O+C/3RA2rja1uOuJX9vYV:EvkQAwzFq6hFwwX+vrPo9HOUN/O+C/Bs
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name c119a54b6bef3a48_ENw2cyqwNf
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ENw2cyqwNf
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 255929949dea51a2f43a1f40e63764ec
SHA1 8f32ab419264fdad05f4f3828db3c1cd38d919fd
SHA256 c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6
CRC32 F7A79605
ssdeep 96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/
Yara None matched
VirusTotal Search for analysis
Name 38a9fb8f144d14c3_4a1145983886ca
Submit file
Filepath C:\Sandbox\test22\DefaultBox\4a1145983886ca
Size 955.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 154629dfce053cd11c52b76ecfef7d55
SHA1 9550f64332e2b0c59b603f129309d6effb25aa79
SHA256 38a9fb8f144d14c3c37c2d02c586781bf88d34b3025b0bb694070d52c74113de
CRC32 4F5643FB
ssdeep 12:lewql60wWn7A06+yDPbcnmjTbQQj0I0UTVaAmNwCe68hr0qGPM4PQhR0vJCy/XHm:LW/U0P2QfAgwb68mqGA0xf/mZR
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 54cfed4f859d0ec3_IBwUNk4lLY
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IBwUNk4lLY
Size 116.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 6f490da5428093674c9e609077dcdef2
SHA1 d77592944313656a90f359fea62921c20078ff19
SHA256 54cfed4f859d0ec37535b9f16acfe42cae6206fad4b1652c2a3d33d5acf636c7
CRC32 A046246D
ssdeep 48:T4ItVG+3C7nNfVcS2+VANULn36uw5NPM5ETQTpUPxK2PIs6kJL5R2+zaSZ00LTLU:ce/C7n/c0VANUjwQU+KraSZ00LTL0J
Yara None matched
VirusTotal Search for analysis
Name b3dfa692f7da19ee_q8YwwyqIdl
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\q8YwwyqIdl
Size 5.0MB
Type SQLite 3.x database, user version 69, last written using SQLite version 3038003
MD5 c395620f9a8337341636a78a98f5b3d9
SHA1 97700ec4db7362e02a56df5e70dd828ad9823d24
SHA256 b3dfa692f7da19eede9aa2fe2ac76052cfaa32a7d30cc53b88ea5ef23ec32624
CRC32 476CDB88
ssdeep 192:StsqHQnwkYjcoBMc+uySBQies13A29D+oBpp0:StsbwVTBMc+uySOiJ3Z
Yara None matched
VirusTotal Search for analysis
Name 88f9dc0b9a633e43_gMjZ5uASFA
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gMjZ5uASFA
Size 512.0KB
Type SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5 dd47ebe6866ad2ab59d0caa1de28d09e
SHA1 afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663
SHA256 88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3
CRC32 8DEE9EEA
ssdeep 24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm
Yara None matched
VirusTotal Search for analysis
Name d7446e2f307027c9_2MEQ6AA8Ql
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\2MEQ6AA8Ql
Size 20.0KB
Type SQLite 3.x database, last written using SQLite version 3027002
MD5 1aa08ff2105515de3602f503e87dff1a
SHA1 485e040226d426c66dc5678d33723ea265d6f4ae
SHA256 d7446e2f307027c9bda2a92d1df1c13c376581372f6ae8708f4d5baccb2e6813
CRC32 ED031CD0
ssdeep 24:TLeSBwnZXaFpEA3xbNmCF06UwcQdfp15fB:Tbw5OpE+xJZF7U1+B
Yara None matched
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_gAMEFDr2rv
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gAMEFDr2rv
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 487452a6143d256d_winstartuped.vbs
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winstartuped.vbs
Size 88.0B
Processes 912 (Ozgkdiw.exe) 2928 (wininit.exe)
Type ASCII text, with no line terminators
MD5 0a02901f83742676899fa17f5cd13e17
SHA1 3c886afa8eb7e9b183d6efdf697ccf148a0b5af0
SHA256 487452a6143d256d8d95730f95d0a4585632d80fd4a98626e9a15f37896621b5
CRC32 14E7D046
ssdeep 3:FER/n0eFHHomWxpcL4EaKC5DLRAk0In:FER/lFHImQpcLJaZ5DLyDI
Yara None matched
VirusTotal Search for analysis
Name 169c04331f72fe4a_DC8y7KwGlE
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\DC8y7KwGlE
Size 5.0MB
Type SQLite 3.x database, user version 53, last written using SQLite version 3031001
MD5 f77930486de1b1bb4b397d5d8f3cd124
SHA1 e3f5727a0774c7cba17f0b10569012dcea24cb55
SHA256 169c04331f72fe4ae9958da09e1b28ec5910f7ea523d6105b7e4ad521b2baaee
CRC32 D85072F9
ssdeep 96:Dm8j5PnH6xY2Wi+67tH2iB4q2xfX7ZbiZzdFzb4PPwI3A7:l5/IYOTAlQzdFzaDm
Yara None matched
VirusTotal Search for analysis
Name 07ed4a9c008533c1_56085415360792
Submit file
Filepath C:\GPKI\56085415360792
Size 410.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 9eded8819ce23ed5645b6c386faf993e
SHA1 e74e9588944e784052e8c6dc773e57e19e719739
SHA256 07ed4a9c008533c151f973013d69eacdaad52e99e3b54d2311129a855e12250f
CRC32 02745F71
ssdeep 12:n6MtUrpr8OH3Ge2U98bCR6CT6LPsdsVT6ncku7Mn:n56prZXGPU98bCR6C2UgkcT7Mn
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 8916fb1d76be83e4_SeTKrEvAHM
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\SeTKrEvAHM
Size 192.0KB
Type SQLite 3.x database, user version 4, last written using SQLite version 3031001
MD5 6b9c2ac2b5025e180231d8d38ece698c
SHA1 36f5cfe6ac59aaa7d7173555edeef5caa9bf61c6
SHA256 8916fb1d76be83e42cd2f7b41ee06706fe0adb936259ed7a7daa4dbcb4c51fcb
CRC32 95ACFD74
ssdeep 12:DBl/lkf12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLlI1x7WxHaiSlMxosJF/Ezo
Yara None matched
VirusTotal Search for analysis
Name 501c26f4ba11e1db_4BdphWitBx
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\4BdphWitBx
Size 25.0B
Processes 3012 (wininit.exe)
Type ASCII text, with no line terminators
MD5 787f3f9e91a1f001c719c8d3fa01002d
SHA1 269112d27a54fa44f0d5fd7cef6f977821fae3a5
SHA256 501c26f4ba11e1dbf31288f5104ded710dc86121e107b8813329967b2e861577
CRC32 C26C98C1
ssdeep 3:sF1nn:sTnn
Yara None matched
VirusTotal Search for analysis
Name 2e872b2d0aa395c4_woVgT5Kv1n
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\woVgT5Kv1n
Size 28.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 f020d65a0cba76591b77daa36fa1b9c7
SHA1 ceee524f9457e0daee4850441103f0bd448cf7a5
SHA256 2e872b2d0aa395c4ed5ea503f233f9791a9a188784532a7e8658ed88ce0ee42a
CRC32 C02E7ADA
ssdeep 12:TL6NPskv0RR+qDFdbXGwcFOaOndOtJRbGMNmt2SHZ+e06FxOUwa5qWarPZ7KTrS:TL6t0RlPbXaFpEO5bNmISHdL6UwcOxv
Yara None matched
VirusTotal Search for analysis
Name 0764759d3340301f_088424020bedd6
Submit file
Filepath C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies\088424020bedd6
Size 603.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 1e9d54b51b3e0eef3438bbfc99aae6cc
SHA1 e3e6e1bbf5fe1b0ec87c32ccd6be5c25c95487b9
SHA256 0764759d3340301f4cbbbc79b2f00d5abdc666bda4247d187166006f43c38995
CRC32 5BE70BDB
ssdeep 12:gnP9pW3Ohzv3UHE6ym7l72zHm3RnCruS9dV2xHC9p0IV3GcH:gnWge6URng1l2pC9pBV3GcH
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 381d22efe5a31298_886983d96e3d3e
Submit file
Filepath C:\MSOCache\All Users\{90150000-0016-0409-0000-0000000FF1CE}-C\886983d96e3d3e
Size 305.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 a50a13e046d5ba5326a575fbc7a23a97
SHA1 2d86ebd62fa7bc65fbccf74d39d96d0cc4ea1076
SHA256 381d22efe5a31298c22962319ccf8df0e4c1dbfe03c84ea6fa51bba66ae48ef5
CRC32 C0C3FE0A
ssdeep 6:9zsgyf/LzQqq9aClk2y0nUo+ZWdoSzXEvt6fKIV1f9GtWMN:9lK/oqk02ycSSzXk6Co1eWM
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 6d5ff34761dac740_56085415360792
Submit file
Filepath C:\Sandbox\test22\DefaultBox\user\56085415360792
Size 331.0B
Processes 2072 (Ozgkdiw.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 7bf631e4e9324a1e9f7eecc7210fd003
SHA1 5930b71a00866ccbd6fe0a64c5889e9eff8cf581
SHA256 6d5ff34761dac7407abde3073cbdccf2f91c4f671e14ba007d35a4c58fd30d93
CRC32 2E68E127
ssdeep 6:1OFzR+uUlwV/iOrRKH3RTMOR6/cKOCOpmYRb4GqGXprf4W:1OznU+/iSR8TxRwcKlUrDxD
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 38eab3b5010af92f_VAr0DodzJS
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\VAr0DodzJS
Size 136.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 769895f923af8f7d7c79b149ea325568
SHA1 57a08fc6458c6f27a4b74fab694f5a01e12d857f
SHA256 38eab3b5010af92f64cffbbc20b7b9bdaf9b3c43fcc239e0e6f443a4481dacf6
CRC32 EE162E92
ssdeep 96:5H5QdSIHfFZx+haloJ/rMqyqrXHqlqZrQHpd2rBRyI4766LBp86B+2DrOC6afM:5H5aaMLmHgMQHpuBvGr86B+orOafM
Yara None matched
VirusTotal Search for analysis
Name 0ab1edf15b595913_25210e93-554f-42f6-8135-f54885a014ac.vbs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\25210e93-554f-42f6-8135-f54885a014ac.vbs
Size 513.0B
Processes 3012 (wininit.exe)
Type ASCII text, with CRLF line terminators
MD5 19a93c306446f9dac6aa087f01a78cc4
SHA1 0c1a3898f7e7e5ca5f3659273e81f448e826e3c9
SHA256 0ab1edf15b595913136f16a0f55314390bcdd5f1e56ac5b20f75ab60765094b9
CRC32 817F091E
ssdeep 12:9vWdDIyRfhMAyjMpVjOQMrOLM9ysGo0BMhFiXAp4QCk3:9A3fCAyjbQ89ysRcMDYAp4QCw
Yara None matched
VirusTotal Search for analysis
Name e708be5e34097c8b_DppBzQ5vWh
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\DppBzQ5vWh
Size 6.0B
Type data
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
CRC32 89582EE3
ssdeep 3:lg9l:69l
Yara None matched
VirusTotal Search for analysis
Name edb006e05cfa8501_6FjCBYZJix
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\6FjCBYZJix
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 3f5ca3e29b1b60e298aeca0a32164c03
SHA1 f9b5ee59c31a3b06a6b8e476b22d2d7cf1fa8b66
SHA256 edb006e05cfa85015aa76c758d6298c279fd318cff0dbb286927c7ad45105488
CRC32 E1ACA097
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis