popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 44cce1bb374c63af_HSTART.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\HSTART.bat
Size 30.0B
Processes 416 (Al.exe) 2360 (cmd.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 ab3271d2afead00384bba13936b3ddc7
SHA1 eda089e784e20a0ff1a3a280fe65e7968b777f6a
SHA256 44cce1bb374c63af3cb70ba836f0d68e1e57b294b6a9635530127574d72a39e3
CRC32 37F2F421
ssdeep 3:/EyLvyo6:/EUyj
Yara None matched
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF2271b8e.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2271b8e.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 17ce2fc03033721d_u&u.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\U&U.exe
Size 496.5KB
Processes 416 (Al.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 d00341a71196dbf6965ef54691a4621d
SHA1 fa1b7720bccf0f83c33f61184d6cbbb3c39c8408
SHA256 17ce2fc03033721d53a73504afb7094d707b9bfadbd292ba6f39a7626c4d2044
CRC32 22A7ADA1
ssdeep 6144:UW1uKEDqxKMtYPe2zyLog+PUHIQ6ssWJ7FSi:UuuKrKMteOMgCUHZ6ssWZSi
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_36114859
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\__tmp_rar_sfx_access_check_36114859
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name d6431d5645fffd05_d93f411851d7c929.customDestinations-ms~RF2272264.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2272264.TMP
Size 7.8KB
Processes 2436 (powershell.exe) 2520 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name be5dedff846ef5dd_vbs.vbs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vbs.vbs
Size 115.0B
Processes 416 (Al.exe) 2360 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 6fad8de519b706038ada9fff3693e53b
SHA1 9b867203ec5cafae049da516db4cc315b6f6a627
SHA256 be5dedff846ef5dd2a37b4b6c8337d72cb8af23d9a849fa043081abb76d74e27
CRC32 A4E6E9C5
ssdeep 3:jaPFEm8nh3QANX4EuSh5cNUqJajaPOUC:j6NqhvXNhCNUqOUC
Yara None matched
VirusTotal Search for analysis
Name e0b94f69ee4ec841_UuU.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\UuU.bat
Size 863.0B
Processes 416 (Al.exe) 2360 (cmd.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 6a8dd1621b2d306c12b24f6bac5fb3be
SHA1 23e05a3e2e65cc2cdca295a275070bb5b3090a9f
SHA256 e0b94f69ee4ec8416d8e8613d08e9d1ab93aff6aae7f065d9071625010c1b40a
CRC32 A14340F0
ssdeep 24:2uaudyuvVMb3ryNVMoP2zMVOUIDVMr0A4X:2vwyYtNVZPCD
Yara None matched
VirusTotal Search for analysis
Name 93274ad71a934997_Add.ps1
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Add.ps1
Size 1.2KB
Processes 416 (Al.exe) 2360 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 4290d15a8274e0f8a8500079730b3ccd
SHA1 40399f9217a00212a12a1d5f4880bcabd687ccb2
SHA256 93274ad71a934997fffe81a63eba67d4521ab4193c53d7c4f9933a3262adfcc4
CRC32 6714F675
ssdeep 24:nuMVM80uEWVMqSuvVMKKVM/LvVMF6dsobryDFy5VMhVM8EVMOoVM0:njSrWXSYkUvK6dsobryDFy5weIB
Yara None matched
VirusTotal Search for analysis