popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a2ce3a0fa7d2a833_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 893.0B
Processes 1392 (powershell.exe)
Type data
MD5 d4ae187b4574036c2d76b6df8a8c1a30
SHA1 b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
CRC32 1C31685D
ssdeep 24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
Yara None matched
VirusTotal Search for analysis
Name a9b1dc8eaa5fcd00_d93f411851d7c929.customDestinations-ms~RF4a839f.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF4a839f.TMP
Size 7.8KB
Processes 200 (powershell.exe) 2528 (powershell.exe)
Type data
MD5 c1d8708bab1e838a2deda26d58bb8d42
SHA1 95d39e75a804752961c139bb6c0b67f84f685035
SHA256 a9b1dc8eaa5fcd0034694cf9742ae915a5932142a1477c3ab6fada45d98750b2
CRC32 E71AF2A2
ssdeep 96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworFS7HwxWlUVul:QtbXoFtbbHnor/xo
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 19a4f76b2403e88b_e0f5c59f9fa661f6f4c50b87fef3a15a
Submit file
Filepath C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
Size 252.0B
Processes 1392 (powershell.exe)
Type data
MD5 922b470c28d5607cdbee417aca789de4
SHA1 86d699a4b534f1d2d4340f0e5f6353e711705d99
SHA256 19a4f76b2403e88b014fe83f95c3489e999aef2d42c36fe0fe15245c1448f315
CRC32 68D30664
ssdeep 3:kkFklGSDltfllXlE/zwEkhlHllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8VbAH:kKx2lqwrlXliBAIdQZV7IpAhx
Yara None matched
VirusTotal Search for analysis
Name 35ec92cb8a440fd6_debug.vbs
Submit file
Filepath C:\Windows\Temp\Debug.vbs
Size 254.8KB
Processes 2420 (curl.exe)
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5 a28f130308c18357e5d78caa5483e81e
SHA1 5c510da7f4725d60b79b5a7862c2930c43ab4472
SHA256 35ec92cb8a440fd6cf53e1c2d47f70b3198d1c49b30dd956a4a0ee115cf1d25e
CRC32 A03BB58D
ssdeep 3072:b8+mXwgMKPOyOBMdxdAsWOSdhPdMsG8TTUTeToTM66hs+:b8+mXwgMt66j
Yara None matched
VirusTotal Search for analysis
Name fc4092f4ae23cbe1_19a44628da0a8a5.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\19a44628da0a8a5.customdestinations-ms
Size 5.2KB
Processes 2204 (powershell.exe)
Type data
MD5 56ef2b20153b58774b3b7710f7c02dcb
SHA1 e441a99410c2f31636a4b299849d19bbfc841642
SHA256 fc4092f4ae23cbe1f42e3bfa5160908307947052221c683abe9b0724f34f8744
CRC32 25E4CD8A
ssdeep 48:oSUsJRDBBpR6QbFSUsJRDBBpR6XEHjrb9bqKSb3+SogZolxgUQlUVul:oSD/mkFSD/mXEHjn9VS7HwxWlUVul
Yara None matched
VirusTotal Search for analysis