popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 7f519772a47c9cec_AntiAV.data
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\AntiAV.data
Size 2.1MB
Processes 2216 (7z.exe) 3016 (cmd.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 45b4a36f7e071bbbd88ffb90b651b51e
SHA1 c1181a6773c18f8468d0ca75a4bf0f2988cf9431
SHA256 7f519772a47c9cecd48a49e177e4fe5924ede5a4472e2240f6b10a58350a3d4f
CRC32 2F09D600
ssdeep 24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs95
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name cbc0c90dfd9f0a4c_winlogson.exe
Submit file
Filepath C:\ProgramData\Dllhost\winlogson.exe
Size 2.9MB
Processes 1340 (Installer.exe)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 edbbe60d5fc43c859be7363de9eb5798
SHA1 7234f3293e278fea274d64e7872bd7b6aaf3a0ee
SHA256 cbc0c90dfd9f0a4c60d50b18802a3b62724706d819a6cb7940c73f4f6cb7b319
CRC32 E0774D48
ssdeep 49152:UI3SAT1kBuJ+ybYpqYOBFOpTqj9l2WjGoWjymlhvCjPyFkbyPFLFZWZ:PMybY6QymlhGPyKeLFZE
Yara
  • Malicious_Library_Zero - Malicious_Library
  • XMRig_Miner_IN - XMRig Miner
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 9faa499615c5ab0f_file_1.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_1.zip
Size 9.4KB
Processes 1752 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 d90f777b94dcff5fa07510fc15b68d65
SHA1 62b1ff747ad3fe45cb2596425ba39fc04ad34cfe
SHA256 9faa499615c5ab0fab20697e06b5dc523b08a85fae14bdfa5562b4e1c1509954
CRC32 AA5B9666
ssdeep 192:jSoL2ZzyQ9aA/8mbF08dE3m+MaiGDxs58l03eDNTXgobMMS/u7ybt3kb5cR:jS9T9PjbFum+MD5b3UNTwob8/ukqb5s
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 8a9235655b1a499d_dllhost.exe
Submit file
Filepath C:\ProgramData\Dllhost\dllhost.exe
Size 62.0KB
Processes 1340 (Installer.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 4aa5e32bfe02ac555756dc9a3c9ce583
SHA1 50b52a46ad59cc8fdac2ced8a0dd3fceeb559d5f
SHA256 8a9235655b1a499d7dd9639c7494c3664e026b72b023d64ea8166808784a8967
CRC32 8E7E3EE7
ssdeep 768:+vfLyCdU0puufOIK1Nekmd52a3bCnP2PmxeETwM:+3LE0pu59ikmdYebCnO+xeEsM
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
VirusTotal Search for analysis
Name a4941bc025575300_file_6.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_6.zip
Size 10.0KB
Processes 2324 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 789e4347559f90207c063c3021a9ddc5
SHA1 9fda01e755e3f348ddf7dad287beac335b617cab
SHA256 a4941bc02557530071f242302f1369acfbc85e04f82241c845c8dcb7c660cd38
CRC32 9F7F2F6B
ssdeep 192:7PY3cTjym71hG1ORajSkjkZUs00Mt1L2xQ74knOL+nnUDcDKmqc/w7:YQ61NRk9CzixQXq+UDDmn/6
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 64929489dc8a0d66_killduplicate.cmd
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\KillDuplicate.cmd
Size 222.0B
Processes 2896 (conhost.exe)
Type ASCII text, with CRLF line terminators
MD5 68cecdf24aa2fd011ece466f00ef8450
SHA1 2f859046187e0d5286d0566fac590b1836f6e1b7
SHA256 64929489dc8a0d66ea95113d4e676368edb576ea85d23564d53346b21c202770
CRC32 F14E4A56
ssdeep 6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
Yara None matched
VirusTotal Search for analysis
Name 344f076bb1211cb0_7z.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\7z.exe
Size 458.0KB
Processes 2896 (conhost.exe)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
CRC32 085DB415
ssdeep 6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name bd5d988235d7444b_file.bin
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\file.bin
Size 1.6MB
Processes 2896 (conhost.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 b55401b1ab48b2e0635743d93c3bc004
SHA1 933e48fcf9169584a58f3e54cd1e9227b10cc655
SHA256 bd5d988235d7444b9abcb0577cf4a3c6606faa04bef2c6c0b3899bf5a6ecf6e6
CRC32 C0B10E01
ssdeep 49152:VJu8YJCOqjRTMZWilcSTK8q8OpKrbl8IOQd/n:V48YJCO89MhcSe8LOql8IOQd/
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 34ad9bb80fe8bf28_7z.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\7z.dll
Size 1.6MB
Processes 2896 (conhost.exe)
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
CRC32 D5226149
ssdeep 24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
Yara
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 8d6c861735a7f1a7_logs.uce
Submit file
Filepath C:\logs.uce
Size 345.0B
Processes 1340 (Installer.exe)
Type ASCII text, with CRLF line terminators
MD5 4bea38adff65b88a0f8e54a41e9354ef
SHA1 741c15d4f121c1e865b3ab53b33e9b0dbc66b917
SHA256 8d6c861735a7f1a722c0ab5202bef8cae4edb0bcecac6e8fef17272ecc3e3b57
CRC32 D5355EAE
ssdeep 6:DiYgE/ovKDMcPmriYgE/ovKDMcirT5fhXGT2QSBa5ydXnzAiGUlQPo9eAKS3/y:uwgyXmGwgyaH55GT2Qtyc3rAfy
Yara None matched
VirusTotal Search for analysis
Name 7639902414ba520d_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2292 (powershell.exe)
Type data
MD5 8fed317383bd416dc56f3c7e484eaf93
SHA1 1d7e6d5961ccee52963dcca530b9f40ce443a3ae
SHA256 7639902414ba520d3d97e7f077f97b027e57e93c103aeb8a27df101e946d3963
CRC32 3CB93394
ssdeep 96:stuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:stvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 20a65a88acc0a21a_file_2.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_2.zip
Size 9.5KB
Processes 1508 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 dad7ac33e4c74636a45ef960a4f36fee
SHA1 7486015a0034c10dc13f339ade973e7ea87c65f7
SHA256 20a65a88acc0a21a7592142a29ae8e1618b396c2d7bc3e5ca6a6324f33dadf6e
CRC32 DCDA05AD
ssdeep 192:zWrO2AB5Z7AUj0o93osZ4qgetZlu+wXBDDfs7E6HnM3oxPb:znPrZMUnRosI7+ufqEG99b
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name c38af953c71f6ec3_Installer.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\Installer.exe
Size 21.0KB
Processes 2848 (7z.exe) 3016 (cmd.exe) 2896 (conhost.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3b1ec9e00a1f356c09fc082228bd09b7
SHA1 f6a02a7c6cd7b3e8d025824d49eb8ade4f4d78dc
SHA256 c38af953c71f6ec3b5b450dd077c4f4da24d2748e6f22d686fa24cd79cc7b52f
CRC32 F96512A9
ssdeep 384:qbjjHZQ3NzofJHFrybCN906pXtM5PFNwN9zmwf15/ufjWrynX:qbjjHe32BgbGqBFNw19NG
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 3c6c49115e0f4b34_file_3.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_3.zip
Size 9.7KB
Processes 2800 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v1.0 to extract
MD5 cbbf84eb02b18b5304787ee7555c78dc
SHA1 452f0639e28f362308f587ddbb8ca520c9ac53e4
SHA256 3c6c49115e0f4b34eceda489259e9240c6659314d0791d2d920faac2a28ab222
CRC32 88CD4B60
ssdeep 192:eWrO2AB5Z7AUj0o93osZ4qgetZlu+wXBDDfs7E6HnM3oxPv:enPrZMUnRosI7+ufqEG99v
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 8257b6d9db2a0054_conhost.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\conhost.exe
Size 2.6MB
Processes 2116 (AppLaunch.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 50b831444f46f79cddd00ecba852d28c
SHA1 b294cd92d77fba5e933afc7e5b30619e2a4c60a4
SHA256 8257b6d9db2a0054895b3afaf01e40a3dfb56bdf7195865097201cc6c1e38edf
CRC32 D8BE98CE
ssdeep 49152:pO57/MSzRk4k8HRe1KBh9jAen1sl+w+wwpUIghBiOsQZEG5Pw1c6fjfbyp7:pO5cT8HyKP9spl0eIgh4O6G5t6LuV
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 60b498169e7a85b1_file_9.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_9.zip
Size 1.6MB
Processes 2144 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 8db46bb282962185f31c095282a433e3
SHA1 75d3eec214c872b6cf3afeab430ad4469bbbf7a4
SHA256 60b498169e7a85b1dcbc6262c02c68a8c129ddf5891d8f7084e5cbd1450f64bf
CRC32 15C85D2C
ssdeep 24576:2bI/7AAb+JQl3Vd02kOC/l5X4/KiROMdWbBkDC6SX39qbwK1ZNKdvLIJvQ270R:2ujCK3D0AC/l5mwbBkDWYb1ZN4UJ94R
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name e302dcf98781b3b5_file_4.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_4.zip
Size 9.7KB
Processes 2788 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 0ea4e5b24a86591a1fb933b5b7ff8c72
SHA1 6ddb6e91fac253aec23739b1bf1b2ad7aa6a4ef9
SHA256 e302dcf98781b3b5c5aabf83c1f1cfcff115f48c1c0d6712ef491515e01bbc75
CRC32 21129ACC
ssdeep 192:6ja6MAGG9ZJQyisuof6++kwGwywsLtwsE+15YqzHsCka0mHmRe1O:vJG9j5uZKwG3Lq3o5HsrAY
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 5f69e6120dc923f6_main.bat
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\main.bat
Size 475.0B
Processes 2896 (conhost.exe)
Type Little-endian UTF-16 Unicode text, with no line terminators
MD5 2851efe0644af879099ca9585fd05f3c
SHA1 23c8c0b33554a400b2efa10c252310d439f314d0
SHA256 5f69e6120dc923f6a9c91fbd07070f8d475e80cb84e96a6f6ce939032074236c
CRC32 961463E5
ssdeep 12:QUp+CF16g64CTFMj2LIQLvXW57CVGrMLvmuCCgXjgrXgX78agXrrEOXUigXY:QUpNF16g632CkeXW57CVGYTtS0rXS78F
Yara None matched
VirusTotal Search for analysis
Name 6ad9ac5ab7a0071a_svchost.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\svchost.exe
Size 322.0KB
Processes 2116 (AppLaunch.exe)
Type MS-DOS executable
MD5 a4212217a2e90127cf2870215d72edf5
SHA1 2fc4ad01c10a37cc88e0c7ac02fed8734c0aa6e7
SHA256 6ad9ac5ab7a0071a789065d1fe2fde732d88be8faaf4e875e3097157bee34d38
CRC32 955FC88A
ssdeep 6144:jSt2tu6b3Ulc6Bxz/Bn8ETaWASeIN8Sez8cihLtKb4XM1gvKUdFebAXmCEctjlLK:O36b3wcYxTBVcSeIWSeYXBKb48MJnBdK
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Is_DotNET_EXE - (no description)
  • Obsidium_Zero - Obsidium protector file
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 5903e7ae9340ebeb_file_7.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_7.zip
Size 10.2KB
Processes 1156 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v1.0 to extract
MD5 0c76fc4fe5480f3daf33d2cc9ce12ca0
SHA1 20eed5717281fb1e12a9b3f776943cc0ae7cf0d1
SHA256 5903e7ae9340ebebd381ce07ea152a6aff0ee43e051798cd4f1f51de7f600b2a
CRC32 AA8C5205
ssdeep 192:OPY3cTjym71hG1ORajSkjkZUs00Mt1L2xQ74knOL+nnUDcDKmqc/wbm:pQ61NRk9CzixQXq+UDDmn/f
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 11bd2c9f9e2397c9_winring0x64.sys
Submit file
Filepath C:\ProgramData\Dllhost\WinRing0x64.sys
Size 14.2KB
Processes 1340 (Installer.exe)
Type PE32+ executable (native) x86-64, for MS Windows
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
CRC32 6B0323EB
ssdeep 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
VirusTotal Search for analysis
Name 166ab6c018a343e3_file_8.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_8.zip
Size 10.2KB
Processes 2216 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 7a4f38a0cb1a6426c639bff28c9999aa
SHA1 f13824f4eba57f5f78be388def74c7624546a548
SHA256 166ab6c018a343e304af7ca120fe820b846108bfc7a8e75228b0691d88eb223e
CRC32 83E4D58A
ssdeep 192:48egFb4yAdcsny9v+5AFvl/CcC3LPj7EOUob7wZguIr00:4854yrsnMphl7q7/QZwrr
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name e48d94437b64e5a2_file_5.zip
Submit file
Filepath C:\Users\test22\AppData\Roaming\temp\extracted\file_5.zip
Size 9.9KB
Processes 2632 (7z.exe) 3016 (cmd.exe)
Type Zip archive data, at least v2.0 to extract
MD5 ba66ccaf4837614dcd0d9acbbdbe3d3d
SHA1 d049c32a639b7919bc1a6cf073213fe93c8b7e6d
SHA256 e48d94437b64e5a2dc1d543f0c3e95c9c0c669c659c02a82e608125516d9826d
CRC32 A2A87072
ssdeep 192:ddbOIlep8mmFrjb2Tm7DF+plNrzD1hrVcHV7UQi/5pfxSwiKO3P2NRV2vY:ddbOtpOFrmTm7DF+pllHVEtEQTONR
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF1830072.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1830072.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis