popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2272 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 978d2d42710dbb07_my.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1O625.tmp\my.bat
Size 15.3KB
Processes 2056 (2927.tmp)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 e5b24d4924665bdc5540f9888c5b1acc
SHA1 e39f12bdfd3340285555e82280706496aae42c50
SHA256 978d2d42710dbb07d6ebd5650fd6eb946c9e70af830cb0ef35b4ef14d1e88297
CRC32 C1536EB6
ssdeep 384:fn81XCO33usr4HogANWZGz/5ap9PQ/eqdao2tmT:fneuu4Ho1WZGL5ap9PQ/eqdao2tmT
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name b6e4f561c0b62744_2927.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-UQTRQ.tmp\2927.tmp
Size 3.1MB
Processes 1508 (2927.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bba584f217419c351e6ae092c664271d
SHA1 972ba560cdff81c57ce852687e9b3e85542d2c61
SHA256 b6e4f561c0b627441f052fc40bf2dcab04c4320da15205f24e64b40d55fa4151
CRC32 54A11E8C
ssdeep 49152:2WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbQ333TY:6tLutqgwh4NYxtJpkxhGj333T
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 54e7e0ad32a22b77_idp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1O625.tmp\idp.dll
Size 232.0KB
Processes 2056 (2927.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
CRC32 E86B363C
ssdeep 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RFa69850.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFa69850.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 6987953baf28a22f_onesave.ps1
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1O625.tmp\onesave.ps1
Size 10.3KB
Type ASCII text, with CRLF line terminators
MD5 fb1447f30958503a9f845ec7667329dc
SHA1 c2c0fe3676ea70d8a4afac145d8ff7aa12a85c79
SHA256 6987953baf28a22f923e167e6466f071464c70ad00f2901266091455e9e410b1
CRC32 3B93BA16
ssdeep 192:PnyM+5AO34ibaZVVI6O1g7O2KOywBwqKZ1Xa+jwKOMw3wEKqYO1777KO/wwwHKcx:PnK5AO3e2YKtCpK6+cKTc/KqxKUPoKBG
Yara None matched
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1O625.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 2056 (2927.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis