popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a60c704c2880e95e_hkcmd.exe
Submit file
Filepath C:\Windows\Temp\hkcmd.exe
Size 367.1KB
Processes 2836 (curl.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 e8ea1b6581dc17674bac8ab3202fa6f3
SHA1 0d025615676dc89360262edce2ac11e9367ebc6c
SHA256 a60c704c2880e95ec250fda4314421adb44b29fdb8ac3bc6c98c1166e051f507
CRC32 3C1E7F2C
ssdeep 6144:RM23f4A9+Jhh+UxFiBisayoz9kY3j1MAqpOjzwW7FAqA+ZrEH5iAelU33j8uC:jPFgHFxFixuuY3j1MnpOjz7BZrHhlU3U
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 0ea9104af2805d08_radiosupport.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Mainprise139\pudrendes\Materialevandringer\Aquiclude\Barthiansk\RadioSupport.dll
Size 72.1KB
Processes 2980 (hkcmd.exe)
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 002cc77f74086aeed985ce0090bbf35c
SHA1 ce06844ae022c909a677b98cd3fa17b8b6523dfd
SHA256 0ea9104af2805d08295106a51f21a1423a23b168ed4598192bce02d154f3f5cd
CRC32 392E0B89
ssdeep 1536:HYDzvXOKJeZTlguRjAFmNo1P3hrpOWNEWXuXvvvvvvvvmr9IHw:HqzeZTlXR0ANo1tpOWNEWXu2yQ
Yara
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customDestinations-ms~RFca6c40.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFca6c40.TMP
Size 7.8KB
Processes 2692 (powershell.exe) 2900 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 66ff632ca2892e6b_bles.thi174
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Mainprise139\pudrendes\Aspirerendes\rejfer\Nonconcurrence\Bles.Thi174
Size 346.9KB
Processes 2980 (hkcmd.exe)
Type data
MD5 35d84bfdcc9c8bf5428e082ec84a0cce
SHA1 c9ffd878f134ee5c183f1e08b54f581536317cc5
SHA256 66ff632ca2892e6bc63df150a439a6ccc25feae6c7dcbcd404513a413b1b1b45
CRC32 6EE5F829
ssdeep 6144:Y1bjR25zecjCp8TRSzhTU8wiZiyxGRmymZTZ6EgTSYF5/IxaAo8Yn:Y1bjRyzi3tNtTOmymz6EguKAwAo8Yn
Yara None matched
VirusTotal Search for analysis
Name 4e06e2fa432e18f1_face-plain.png
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Mainprise139\pudrendes\Masende\Geldant\face-plain.png
Size 859.0B
Processes 2980 (hkcmd.exe)
Type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
MD5 4dd616ad41cf6ff02957ccc95e26670e
SHA1 7750dbfede167f7d3744ddd5004517c5e527e071
SHA256 4e06e2fa432e18f1abd3646bd65e3b84de0b5e5e4c07e515c360d5638c0c100a
CRC32 3ECA1B24
ssdeep 12:6v/7MOjcjRgnAw60rxo2iS5KsrhIOK8x0zrjuvsqwbJk/HslfdBN0AXgYh89ML7:WjIh0ufS5KWI38xYryk76slfdvwBm3
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name fa75827dba4220e8_x-office-document-symbolic.symbolic.png
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Mainprise139\pudrendes\Atmosphered\x-office-document-symbolic.symbolic.png
Size 232.0B
Processes 2980 (hkcmd.exe)
Type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
MD5 6333ee47ad3e2b6d7fbccdc9935b7d08
SHA1 6f9523328eb742b821ed51f4d9b727ddd99cd640
SHA256 fa75827dba4220e814d1c800272af911f31ecd41ddffdb3a1d4ba1211733f906
CRC32 02BA8238
ssdeep 6:6v/lhPysO4YpKPlHWbzgiXVwlSoGCHbDMtkp:6v/7iMlwzbFgEtm
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsk4EC.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsk4EC.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 7342b73593b3aa1b_system.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsa5E8.tmp\System.dll
Size 11.5KB
Processes 2980 (hkcmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 e23600029d1b09bdb1d422fb4e46f5a6
SHA1 5d64a2f6a257a98a689a3db9a087a0fd5f180096
SHA256 7342b73593b3aa1b15e3731bfb1afd1961802a5c66343bac9a2c737ee94f4e38
CRC32 B20DFD7A
ssdeep 192:Vm9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:QJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
Yara
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis