popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 82babd57f9e1ea69_rLMWKWnBLt.docm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\rLMWKWnBLt.docm
Size 488.8KB
Processes 2684 (win.exe)
Type data
MD5 cc218a4380b291c100a0bcf98779ab46
SHA1 fb5204d3a381b8ebf08516f15161487baf840b57
SHA256 82babd57f9e1ea6913f6359c923de933cc9911edefc2402298aa2145549bc05d
CRC32 548756E2
ssdeep 12288:mXLxuny3mS+OjaLyekwIS7BUeweJetVpV+:4wCuy5voB8HtjV+
Yara None matched
VirusTotal Search for analysis
Name 4f374889ac3ed672_tmp4A0F.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp4A0F.tmp
Size 1.5KB
Processes 1460 (win.exe)
Type XML 1.0 document, ASCII text
MD5 b85980c4b6f651f249c3b5dc1f3e285e
SHA1 a60748bb5d1955c8dd182ca1a8c3932e713b9950
SHA256 4f374889ac3ed67259578a7d6b135180d75e69e5742976be5a51e57291cda1f3
CRC32 BBB8D973
ssdeep 24:2di4+S2qhH/1ny1mEUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtHxvn:cgefAYrFdOFzOzN33ODOiDdKrsuTRv
Yara None matched
VirusTotal Search for analysis
Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2536 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 4cce5f45f185524b_LogforthinkinguhhVwkiOxwIAeyoXuPnwwwboorga
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\LogforthinkinguhhVwkiOxwIAeyoXuPnwwwboorga
Size 1.2MB
Type SQLite 3.x database, user version 30, last written using SQLite version 3031001
MD5 fe169ca1afaa6be2776a175c90427b38
SHA1 72bb87cd1b2b000088d1ee4c14675b2c19de4aa9
SHA256 4cce5f45f185524b6c75c819ad5923d70dcb9662e833b5e1229022693f471235
CRC32 8B4FBD0F
ssdeep 96:D7/cYoynhZlbJPZOwr4oR84J4Aqx4ZA7O9jgv106WEWbEm2JioMetQ:3cYoEn/oGJYxapEWAm2J2
Yara None matched
VirusTotal Search for analysis
Name 970e0502265a1021_PsaNJusCgINdoOeEc.rtf
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\PsaNJusCgINdoOeEc.rtf
Size 492.0KB
Processes 2684 (win.exe)
Type data
MD5 73f7a7a200ad76438364ef87acf02d94
SHA1 6883d24422ed7371886ea38861002d2d6316f870
SHA256 970e0502265a102149892f1ba6611a4e71cb9376232201dd6bbf650d8664adc4
CRC32 733D9CD2
ssdeep 12288:d3EImbfzriSFsIJhxxMbCValyckHjlfOsCxPzT6VzSqm:d3EI6fzri26FkB2L5/6VVm
Yara None matched
VirusTotal Search for analysis
Name ff006c86b5ec033f_Files.zip~RF2157d3e.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files.zip~RF2157d3e.TMP
Size 24.0B
Processes 2684 (win.exe)
Type Zip archive data (empty)
MD5 98a833e15d18697e8e56cdafb0642647
SHA1 e5f94d969899646a3d4635f28a7cd9dd69705887
SHA256 ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c
CRC32 612F49D6
ssdeep 3:pjt/lC:NtU
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 9e6e4772050998a5_readme.doc
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\readme.doc
Size 10.0B
Processes 2684 (win.exe)
Type ASCII text, with no line terminators
MD5 eb6b6c90251ab33cee784713c451e6d8
SHA1 451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5
SHA256 9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6
CRC32 22598B08
ssdeep 3:IS:7
Yara None matched
VirusTotal Search for analysis
Name dd81b5e9d9958863_phishing_file.pdf
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\phishing_file.pdf
Size 76.9KB
Processes 2684 (win.exe)
Type PDF document, version 1.4
MD5 c4d757196a348dbc813b65774a370dc3
SHA1 30674233ebfa9ecf3bd64095cf055ec24ae10724
SHA256 dd81b5e9d99588633b73117e3b1f84f1a6952f9d573057d804047a85abfb8328
CRC32 000DC085
ssdeep 1536:4IhgBQgoSXCvW8qYCinLlpJys6zg3H9TNSo+lipx5bo4W0AMysS/:jSsWAFLhDZNTgo+li35tyb
Yara
  • PDF_Format_Z - PDF Format
  • PDF_Suspicious_Link_Z - PDF Suspicious Link
VirusTotal Search for analysis
Name 21164ea90f836572_VnWDezgwvF.rtf
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\VnWDezgwvF.rtf
Size 222.2KB
Processes 2684 (win.exe)
Type data
MD5 279b651753a93ee979b3330b6c903279
SHA1 eb9d57973f34b2303671a7a59bf09f234fe503df
SHA256 21164ea90f836572bae2b5a995a7f7edfae7da9dd5f3b701d28bafed8b4b03dd
CRC32 2C853430
ssdeep 6144:/SK95E45VCH0KO0GAtAE6Zv+BFfZ3U6jWD/D+W:KKnE45IUKO6SE6ZWhWGW
Yara None matched
VirusTotal Search for analysis
Name ff784858aa8a1b80_pkEQhIYeMF.docm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\pkEQhIYeMF.docm
Size 500.9KB
Processes 2684 (win.exe)
Type data
MD5 e7edd011e0663192acb9df9165c7c4ba
SHA1 90f5b94005881c59517a76f112bef852e2c192d1
SHA256 ff784858aa8a1b80021d2bc7835d02502583b83b2c58478757330a4bdcc336c9
CRC32 ABFEC8A7
ssdeep 12288:fcqHxkuM571LSz6PYp0zCGdJRxTePK/nQZ5EkYEWnS1SMJU:JxkuMLYp0zrdJePcnQHAwU
Yara None matched
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF2154e00.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2154e00.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 73e01116f2cbbbdd_TPhoshdLkw.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\TPhoshdLkw.txt
Size 271.7KB
Processes 2684 (win.exe)
Type data
MD5 9c9d0ee6b62fbd626e45b0bc239da1c7
SHA1 09008e22b5988c8a3de51c484d8e8c4c786eb3bd
SHA256 73e01116f2cbbbdd40cb29ee98c401b850cfad7469b424636d0154bb292ee14a
CRC32 A5013A38
ssdeep 6144:nfrWr2D0zh8AlVweKje8+Cl533Vvr83ZP9syhHvmS6Zg1:nfrW6DcGKeL9l5Vr83J9zvmS6q1
Yara None matched
VirusTotal Search for analysis
Name dcfcd16fbf0511d3_vbsqlite3.dll
Submit file
Filepath C:\Users\Public\Libraries\vbsqlite3.dll
Size 161.5KB
Processes 2684 (win.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 073a17b6cfb1112c6c838b2fba06a657
SHA1 a54bb22489eaa8c52eb3e512aee522320530b0be
SHA256 dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
CRC32 9619DAD7
ssdeep 3072:eNFwdmspaPg9g9oOavAQBNrPkVdc88GjU+vF6nuxRocX5GOOUleo+c:e8d1/w5KA81IJ8GpF6nuTmOOU
Yara
  • UPX_Zero - UPX packed file
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 824fae3331b95e2f_LogforthinkinguhhVwkiOxwIAeyoXuPnwwwboorga
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\LogforthinkinguhhVwkiOxwIAeyoXuPnwwwboorga
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name c50639e0486e1c69_Files.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files.zip
Size 3.7MB
Processes 2684 (win.exe)
Type Zip archive data, at least v2.0 to extract
MD5 062f0ef50e3a75f1f70c6ccbd67d34bc
SHA1 c3e949e3116feb804f53c2d3a409265f7cb0d727
SHA256 c50639e0486e1c6907b40eee984b9e63fb7ff28efd61f0e33e93a31153e4e0c7
CRC32 BA73752E
ssdeep 98304:epsiTzUhl9fEiSfy1Pzghug8FuQb3Vy1VpG37un66hW9:XMzUfhEiS6H1FL3EpYunk9
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 1f3ba8bfb72c424c_pTCCkSolPbOS.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\pTCCkSolPbOS.txt
Size 469.0KB
Processes 2684 (win.exe)
Type data
MD5 7fa39c9819532b1aaa91ebf9810b152e
SHA1 017a578749f6ae5b5390fab918ccf704ceb3833e
SHA256 1f3ba8bfb72c424cc0e27d30504143bed32757f261f6a6462fcaa118f415a036
CRC32 1C5229F0
ssdeep 6144:mmFFJrSK9OeIQ3eyPHhMP5wOqcOjX4ORyBy6tEq2J0RmMT0BgbD5DNa9mfwBDiyD:LgeIty/iRwy+lRX6urJt3eP5U9
Yara None matched
VirusTotal Search for analysis
Name c119a54b6bef3a48_WebData
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\WebData
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 255929949dea51a2f43a1f40e63764ec
SHA1 8f32ab419264fdad05f4f3828db3c1cd38d919fd
SHA256 c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6
CRC32 F7A79605
ssdeep 96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/
Yara None matched
VirusTotal Search for analysis
Name 10f6c4dd43d80771_aqfxZwBmzRgky.rtf
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\aqfxZwBmzRgky.rtf
Size 565.5KB
Processes 2684 (win.exe)
Type data
MD5 30975f5fbccb3a49cb1062cdb280cee9
SHA1 7a8f226f4fdd4c69f19953fab9f983998c322212
SHA256 10f6c4dd43d807714bfcecf3277c1e49f24cca7184b7d236d8a3055106b4f003
CRC32 14CE27B4
ssdeep 12288:jn5CDgNLdtf9dLH8wXIPyLdRIo0sYXFsqI0xf+sUJaaXTXs9EhppKEu:dN9d/5bI/FsCxG4aXTc9EnpKB
Yara None matched
VirusTotal Search for analysis
Name a987517ada617ee9_QLzXTwpCruiaQFO.docm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\Files\QLzXTwpCruiaQFO.docm
Size 703.9KB
Processes 2684 (win.exe)
Type data
MD5 74082676297a1bde33328c2a0925a77f
SHA1 924b3f135f6c5067ed3dad5eb07edfd35b5cf6f3
SHA256 a987517ada617ee9131f90d5b632260e63abdf370de0b0b851c68944f87e7b62
CRC32 9790FF22
ssdeep 12288:+MOKNx45khLcZOUR/iHBIj2GldW80RFPLWQJ5xHKIuAO57CrRD1j/7QEGrG4m5Eb:+PKykhLcZO9hISGlIjhJvHXu5tCjfQEk
Yara None matched
VirusTotal Search for analysis
Name 89c57cdff7f53e45_ThunderBirdContacts.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\ThunderBirdContacts.txt
Size 21.0B
Processes 2684 (win.exe)
Type ASCII text, with CRLF line terminators
MD5 aae099b12d63d4ff58e570ea2fdb126e
SHA1 72c2652e15cc35394dedefaeedfe711b159c0ecc
SHA256 89c57cdff7f53e45bfb5c04d9ed99c3ad4c182a503bba441ebbc4bb5de45f9bb
CRC32 99E67AA1
ssdeep 3:HvzIyHy:HvzID
Yara None matched
VirusTotal Search for analysis