popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 940 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 8fa9bf983310ef06_skoleledere8.fir
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Skoleledere8.Fir
Size 285.8KB
Processes 2004 (taskhostsw.exe)
Type data
MD5 8f10966c7ffa2def5d56f5ef3fadf108
SHA1 cd4deb49124d9c6c0d1a882e1b7e97a5ab34277c
SHA256 8fa9bf983310ef068532bdcd11c103da2de7fe638659e49407b992ffcc71a8f0
CRC32 D8C99139
ssdeep 6144:Fr0f4kfCCiI0eC6x2v8fr3HwapwhIJ7cXpFu9L:GwIxb7b2wCO
Yara None matched
VirusTotal Search for analysis
Name aecd2d7ffc06f274_stenos223.hof
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Stenos223.hof
Size 312.8KB
Processes 2004 (taskhostsw.exe)
Type data
MD5 b7141eaad1bf0756d267fe61f33d954a
SHA1 50273ade0e1a2e60015a4c55ffc2a50a14afd67e
SHA256 aecd2d7ffc06f27489e964265b5a7f272b66fc759978be63079bb25d0bb18cf5
CRC32 46DE41B8
ssdeep 768:IKv21sC8JM4X8rzq7SyllkfM3wAhCW2VfoFlIXclfKxfVZ02HhIFHmKZfrWj7sB3:dGAZS03wEMRsctr6fv8U1iw6MYe
Yara None matched
VirusTotal Search for analysis
Name 4489a9b0b9efe25d_midtskibs.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Ultrafashionable\midtskibs.txt
Size 433.0B
Processes 2004 (taskhostsw.exe)
Type ASCII text, with CRLF line terminators
MD5 c08c845a427bcb3acdab38d6a60e4c60
SHA1 30f6bf1e8e00d8041aa8e154bf5c31d5ae66132d
SHA256 4489a9b0b9efe25d0ea9edd6848a018b36b03ff655a76e45fe7827978b4b9250
CRC32 9D133263
ssdeep 12:HmzJT54PFYeFRF0LL/dCJXCW7RCIEWmEmsbLW3TM+:GePFYhTdMCWFC1EmsbyT
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsnBE0B.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsnBE0B.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name d43857aad5fe716d_fjendtligtsindedes171.ort
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Fjendtligtsindedes171.Ort
Size 66.8KB
Processes 2004 (taskhostsw.exe)
Type ASCII text, with very long lines, with CRLF, LF line terminators
MD5 04a999365f1d65e80daf5d94c630244e
SHA1 192f43611707b02ed130ad7cf889fe4f130cf25c
SHA256 d43857aad5fe716d6c72a653b5f89377e44ca97781b038a151bb81bf9d858db1
CRC32 C6D98B3B
ssdeep 1536:b5gUGqJnROkN4I0i8A2W+XaO7RKtu8XrZvSbNoTh7xAMVq:lgnSnTZ0iHaSu8XtvQNMhun
Yara None matched
VirusTotal Search for analysis
Name f5b5d04030f2bcbc_javanesere.una
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Javanesere.una
Size 225.2KB
Processes 2004 (taskhostsw.exe)
Type data
MD5 b031771dca10777cb87d0a2801ec4a4d
SHA1 31fc7ad53da754d15c24621e91da53ca7c7c7cbd
SHA256 f5b5d04030f2bcbc10c0215c973c091b6e84cf39e888908721212fc478938ef6
CRC32 08E3F930
ssdeep 768:hGUmUq4XncDuopMAmkSdbqsLNcdYMwdx5pYZIDzDGwd5v9E5wKzBVBUkCTll0epz:Xmi313Zr3Dqo9Auic
Yara None matched
VirusTotal Search for analysis
Name e0650dc01dbf7a68_shivaistic.rig
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Jacobean\shivaistic.rig
Size 343.5KB
Processes 2004 (taskhostsw.exe)
Type data
MD5 d214dc306cd7d2a11ad6f083fae4cc2b
SHA1 5a3f282073936f701e4f731f116b6d1f6140e610
SHA256 e0650dc01dbf7a68cf2da308f3dba79ff7d0262fab3f7bf9e8a5a4c9811b2d08
CRC32 0AD73A96
ssdeep 768:KW+r7LctmdRqSKgtMxaSqkSgjAUPKzbukqiqvQzNaV6N5jsmhRSR932V/0oEd70N:Acc3KjHmQ/dfSmkRJEvb/pIPCZMEk
Yara None matched
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF114695a.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF114695a.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name c5858812fec1e212_ekkoer.ski
Submit file
Filepath C:\Users\test22\AppData\Roaming\gurlis\billeter\pli\Ultrafashionable\ekkoer.ski
Size 353.9KB
Processes 2004 (taskhostsw.exe)
Type data
MD5 dd9935189278cbe33db1610279d33a61
SHA1 7de27de465a15b69c282ed95e9fc9bbe0d8ab193
SHA256 c5858812fec1e212fd5917167e61a2b4ec70c80c3c8fbbb6b08d5d0e4e71b632
CRC32 F6269FC4
ssdeep 768:dghM76bpC67WKzXYJUcbS9OaehRYveLdoBNJZ+0VFw3wiuUMXZqJtyT33CFzMdyb:KLWeGm8mN5TnCRXzPED3/YQiJ9MO
Yara None matched
VirusTotal Search for analysis