popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF1de079c.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1de079c.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 7669553aea89f0a5_tmpF1DD.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpF1DD.tmp
Size 1.5KB
Processes 1460 (o9RbXKF6ZJDK949.scr)
Type XML 1.0 document, ASCII text
MD5 a00999c8c346b39309dfa421ee280497
SHA1 684784502f1d553d6685ac2c665eb15bdc0dde27
SHA256 7669553aea89f0a5434b11f1ca312f2d1cc09d7a28c4c43c4b0f02a86e678e88
CRC32 3F7EE852
ssdeep 24:2di4+S2qhH/1ny1mEUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt4xvn:cgefAYrFdOFzOzN33ODOiDdKrsuTYv
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 82064fb9c414c8a5_sqlite3.def
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\sqlite3.def
Size 5.4KB
Processes 2928 (wecutil.exe)
Type ASCII text
MD5 df728fe35f4e5fe7a1dbfb2bc8c99972
SHA1 b6cda0088369b887b479f4b80cda7426dfdf9010
SHA256 82064fb9c414c8a50f090c6e8f9d17269b3f9b1b35e9efe78c70adbcb31929fd
CRC32 826811DE
ssdeep 96:GcuN/gR+7Oc0XRMcGM3KOGOF++BwIMtvrENw+Y0aR:E/Q+7Oc0RKOBF+++HvrENw+cR
Yara None matched
VirusTotal Search for analysis
Name 413852f536628cfa_73897Ik2
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\73897Ik2
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 91a39ee5267872c5a86c0b791bfd0fe0
SHA1 3ee10302a6d40c7aa02afe01d36498f1b27f7895
SHA256 413852f536628cfad0f6be985e814443f8a2bbdcfd55994aff9a561fbad68fe1
CRC32 B431A379
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis
Name d6431d5645fffd05_d93f411851d7c929.customDestinations-ms~RF1de07cb.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1de07cb.TMP
Size 7.8KB
Processes 2608 (powershell.exe) 2548 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 824fae3331b95e2f_73897Ik2
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\73897Ik2
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name 7705b87603e0d772_sqlite3.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\sqlite3.dll
Size 849.9KB
Processes 2928 (wecutil.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 87f9e5a6318ac1ec5ee05aa94a919d7a
SHA1 7a9956e8de89603dba99772da29493d3fd0fe37d
SHA256 7705b87603e0d772e1753441001fcf1ac2643ee41bf14a8177de2c056628665c
CRC32 8761E584
ssdeep 24576:sBEJPplYq6r/6hllzJ6Ic01re2g+b60/17:s6JPIiDJJ6Ic0JTgZo
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name bafe3979cf8761e4_o9RbXKF6ZJDK949.scr
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\o9RbXKF6ZJDK949.scr
Size 707.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 739cefccf7fa26e1f7f9923a6cc9620a
SHA1 94a3e2a59202fd3590d1f9e4755727303e14662f
SHA256 bafe3979cf8761e4f305509427099ef0e6193ce077236e31540aff4c47ddc74c
CRC32 1AAFFEE5
ssdeep 12288:n3bjrXu7i/5sf2FOcMoywdwDvJaFSitOjaQEeopByBJ548Mpp+8MiwgNOj626tcs:3TQeFxTgoFSiODigilklco6pf
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
VirusTotal Search for analysis