popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 66a7f4c06b6ad752_CSC2972.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC2972.tmp
Size 652.0B
Processes 1728 (csc.exe)
Type MSVC .res
MD5 fa88203806d2d392a68eb99d37818d69
SHA1 03852794e110aeae9c19c010b62aa8fe31145462
SHA256 66a7f4c06b6ad75269b58ee4ec58053a27faba565238e0373e14e76cc2973236
CRC32 40228C3E
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryajak7YnqqRsPN5Dlq5J:+RI+ycuZhNiakSqPNnqX
Yara None matched
VirusTotal Search for analysis
Name c87b2d1dc48893c2_RDC195.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RDC195.tmp
Size 24.0B
Type ASCII text, with CRLF line terminators
MD5 e540573823a70d013fb06327842a1b31
SHA1 ff14cd795eac5e37a395a71c2d5bcc6a54cc61f3
SHA256 c87b2d1dc48893c272285f8d59b5ef0fe69072839ec9c48d1d3488914b37e92e
CRC32 20178441
ssdeep 3:+QP3WjHFWeev:+c3Wju
Yara None matched
VirusTotal Search for analysis
Name aa66b05cff837c26_~DF8C0F100C7231519A.TMP
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~DF8C0F100C7231519A.TMP
Size 16.0KB
Type data
MD5 76acbc1831894efc30bb60066c50146c
SHA1 7d324b303c640c93d5940f20e0461aa65c2b874b
SHA256 aa66b05cff837c2696e9731229ad96950095f6ab1f1995f354ae82ac432cbc76
CRC32 7FD7C859
ssdeep 3:Hqa/lGAUolllnolclllv/nt+lybltll1lRsl/hlEl6l/1pm/i6a/l:1/ll4UFAlpaotao
Yara None matched
VirusTotal Search for analysis
Name 0303bf6741d00253_RES2983.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES2983.tmp
Size 1.2KB
Processes 1720 (cvtres.exe) 1728 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 80e9f21f6c1267ea3b7ee1d809207103
SHA1 263d3f034b00e7f7da027ac2de5534bbf1c82d5f
SHA256 0303bf6741d00253e4e4ae2b25d6d5bc1a1df2ee2602a16a7a8b97191e24a786
CRC32 DD6F9731
ssdeep 24:HXiJ9YernBdsmHTUnhKLI+ycuZhNiakSqPNnqjtd:nernomAnhKL1ulia3GqjH
Yara None matched
VirusTotal Search for analysis
Name 9c8875eaf3b26c90_litmq795.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\litmq795.cmdline
Size 311.0B
Processes 2900 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 6e5b2b036fcb227b64f10e0d233606c0
SHA1 4429dc56456e81687c91b64d042fec7bd7ea88e7
SHA256 9c8875eaf3b26c90c4dcfdf1401149bac4b9c9dbefbf89952745861082a005d6
CRC32 C0DD3279
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fvNqmGsSAE2NmQpcLJ23fvNP:p37LvXOLMInPAE2xOLMJ
Yara None matched
VirusTotal Search for analysis
Name be6d81013e3a3e2b_temp.txt
Submit file
Filepath C:\Users\test22\temp.txt
Size 690.0B
Type ASCII text, with very long lines, with CRLF line terminators
MD5 1f322f1bfd9dfe0ac531ac2da9aed3ad
SHA1 54730e382efc3faa8afae0963394417e58cd64ce
SHA256 be6d81013e3a3e2b1855ea973ed0b08d77f8ffe96111ec4ca411175566d67c82
CRC32 2DC46ABF
ssdeep 12:724l8YHNfy+MtS6QYOQPZJAN5GibGM40UVTQw4u74g2y2IdQ1EeZy+7x1mM9wWUw:y4ljNb6SrGAN5GMeV3lBl2Id6zZyexBf
Yara None matched
VirusTotal Search for analysis
Name a7409ac1228afa5d_temp.txt
Submit file
Filepath C:\Users\test22\temp.txt
Size 1.4KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 1dc581fcf5593c17c3de7ef0eae7b7b2
SHA1 5d256696b6594e5829c1bf706b0306872e0a9db6
SHA256 a7409ac1228afa5d1c6d085aaf2d4a4ed4efd9dcfc75c2904cd93c62b81a75d7
CRC32 3A91F0A0
ssdeep 24:QEJ0QAVJwARKxscmwwizgG/n251CClxQK6O5ebGp5elNoNn9arBGdbXokrX8vY5:QEfKlR4XzRzS56K6+l5el2Nn9awkQ5
Yara None matched
VirusTotal Search for analysis
Name 50e509c56ee7437d_RGI1518.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RGI1518.tmp
Size 10.1KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 cfe2f1194768ebe8914c07c57cbada52
SHA1 70d1ca67cd1d3381fa7fea37605417510456d37b
SHA256 50e509c56ee7437d710345b977cb5edbde526206034dce0e52cc132c61cc5cae
CRC32 39E6814F
ssdeep 192:U9QI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:FwA1jUr2olylWouwRQ7
Yara None matched
VirusTotal Search for analysis
Name 248cf0409636fe61_litmq795.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\litmq795.0.cs
Size 489.0B
Processes 2900 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 60c4d5dd1d227a40fb4ba01716aba6e2
SHA1 1c62ffc5151478eec49c484bb6490c4909bc4364
SHA256 248cf0409636fe61a22c8ebf50d2a0e01db609568ded2d5047b0841b09712b99
CRC32 E2DBE2B6
ssdeep 6:gCsHkaS6ya3F/5XuMIQQA82SR7f2LBR24BrvFwMGbiQQAYQXRF42SRkbH+MObRgf:gC4kaxfOA2rsnXBrvjAHXCZ1gTBQvU
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14_litmq795.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\litmq795.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 567f60275a6ebdd4_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2900 (powershell.exe)
Type data
MD5 874c255c82669c27665355e2aa348971
SHA1 4adc2f236ea01bdfe846ad6e5f10a3abe9a4312b
SHA256 567f60275a6ebdd4f8b5fa6cbf8d00a7d4559cf3b4d8b3417dc827f02a0ce9f1
CRC32 7B1523E4
ssdeep 96:RutuCUXGCPDXBqvsqvJCwo+utuCUXGCPDXBqvsEHyqvJCworSj7Hwxf2lUVul:Uti2Xoxti2bHnor/xQ
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 061efe7f182966ce_RGIC87.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RGIC87.tmp
Size 10.1KB
Type ISO-8859 text, with very long lines, with CRLF line terminators
MD5 aae8f5b14439d75e8151d0d9a4cc6485
SHA1 9fce1026ecbb90b90802779a046cafd7ce4a3e81
SHA256 061efe7f182966ce91eb999bd2587aa779b5c1f61eaa7b0b9032c7dccf2dc414
CRC32 E5C5599E
ssdeep 192:oeQI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:oBwA1jUr2olylWouwRQ7
Yara None matched
VirusTotal Search for analysis
Name e908ea82c5f020a5_RGI1518.tmp-tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RGI1518.tmp-tmp
Size 8.7KB
Type ASCII text, with CRLF line terminators
MD5 6f430c55aec23bc128397127f8e31b19
SHA1 669f7c3ade66a1a790c2aec2c1d0bb4ed5ebd6ee
SHA256 e908ea82c5f020a5006c5feeaae75b98dc5da5d376ab091c31990554e28a46d9
CRC32 C6A04325
ssdeep 192:qI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:CwA1jUr2olylWouwRQ7
Yara None matched
VirusTotal Search for analysis
Name 617f733c05b42048_y.ps1
Submit file
Filepath C:\Users\test22\y.ps1
Size 1.1KB
Processes 1844 (wscript.exe) 908 (cmd.exe)
Type ASCII text, with CRLF line terminators
MD5 db7ed25a92793aba319c08d67ca8bb17
SHA1 a240a8bb7630d3a060dda875abbc9690b9b6fb8a
SHA256 617f733c05b42048c0399ceea50d6e342a4935344bad85bba2f8215937bc0b83
CRC32 F1B49AB4
ssdeep 24:DXz4kaRUQXBrvYXCZ4QvcZRkSNfKAOQnQ4vSQjIvnYsOw2:DD43KqBEXCZ4QvcDf+QnQ4vSQ0B52
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name aad73dd8cd536cb2_litmq795.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\litmq795.pdb
Size 7.5KB
Processes 1728 (csc.exe) 2900 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 df1e04b7e5e8edb4782eedb62caf867d
SHA1 c2970b970b2a8c66d278108467b3cd400de6c8b7
SHA256 aad73dd8cd536cb20113d5283df012927d4f7c43498146d4677ec5d8b39c0cf1
CRC32 F5EC3678
ssdeep 6:zz/BamfXllNS/KrewN1mllxrS/77715KZYXxGQu+e0KpYXTrewnlKioGggksl/cI:zz/H1W/KreeSXS/pw2q6reofRD
Yara None matched
VirusTotal Search for analysis
Name 7f82540a6b3fc81d_y.js
Submit file
Filepath C:\Users\test22\y.js
Size 1.3KB
Type Pascal source, ASCII text, with very long lines, with CRLF line terminators
MD5 3e93e0e991adc9641910e3ec1f44a5dc
SHA1 32d1f228b557e8037178ca428440e16e5141c54d
SHA256 7f82540a6b3fc81d581450dbdf7dec7ad45d2984d3799084b29150ba91c004fd
CRC32 AAEF9BBC
ssdeep 24:1eK+C6uSc+0zG5i5KIReS17mrV4LcdV4Ly49V4LMMPKRuknF6Fwg0sWMTbszoflw:k1CTC0UA7DRWM57sf+oflskAr
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name e4e927493aff81e5_~wrs{83a5e08d-85bb-49ae-8eb1-204329bdeeff}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{83A5E08D-85BB-49AE-8EB1-204329BDEEFF}.tmp
Size 1.5KB
Processes 420 (WINWORD.EXE)
Type data
MD5 62d59d278e9208e07db6d0552093a8ae
SHA1 07d53721ce80cf242a451b7ada1233a2a8fbc7d4
SHA256 e4e927493aff81e5b81213777f4df5bb6122768888d0fc756dc76a5305081395
CRC32 EA0594D1
ssdeep 6:IiiiiiiiiiI4/9+Qc8++lPkalT4Mu8lPloBl/CE/:W49+QG+3/TE/
Yara None matched
VirusTotal Search for analysis
Name ccaec9d7a575b615_cabA0CC.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\cabA0CC.tmp
Size 177.8KB
Type HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
MD5 ca833c3853b7d394d39c460da2ee3db1
SHA1 d24d61e6df9d4682e30b88728ce4c474b5004a5c
SHA256 ccaec9d7a575b615342e9943c1c18ad9dcdef3219d7de684b33269b4f8c0e3fd
CRC32 B7E77569
ssdeep 3072:3KalR8doLUaBAq3B5tLY0pgJ5W/DzzrozHfPxOgiv:35GdoLJYWFP44d
Yara None matched
VirusTotal Search for analysis
Name 205d000aa762f3a9_~DF2C79C1E8AE840965.TMP
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~DF2C79C1E8AE840965.TMP
Size 16.0KB
Type Composite Document File V2 Document, Cannot read section info
MD5 679672a5004e0af50529f33db5469699
SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
CRC32 115F6835
ssdeep 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 20052d8569b3e136_tmp2A3D.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmp2A3D.tmp
Size 915.0B
Processes 2900 (powershell.exe) 2160 (cmd.exe)
Type data
MD5 6db121f397c3b090d118f2c2e730515d
SHA1 50284f0b0592974dfc44bbf6d59ced8146099033
SHA256 20052d8569b3e136406f43ecbee812a0b07fd1d8dd6349f450fa4bed75a994a8
CRC32 4EE39A5F
ssdeep 24:T8/j4xB3hkA2j9u/lkPyscx/rwIRoMJ0aZD:T80xoR4/eP5c5weD
Yara None matched
VirusTotal Search for analysis
Name 11e656df0a9372f4_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 420 (WINWORD.EXE)
Type data
MD5 2923ed1b60613352b7f0721e7ef79cbe
SHA1 5ad6ba1b4f8cb2d140e5b235e31993722bed3f83
SHA256 11e656df0a9372f49e8d5e3890b0fccc7532be54dc304650fecbd6dfde6abdd2
CRC32 C47F12AC
ssdeep 3:yW2lWRd6/ldW6L7U8l/vK7LN0CFItJllXl/:y1lW2vWmTK7NWBt
Yara None matched
VirusTotal Search for analysis
Name 8bf38ccef7a6e930_~$onomic relations.doc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$onomic relations.doc
Size 162.0B
Processes 420 (WINWORD.EXE)
Type data
MD5 f026ce9eacf08f1c75d5c1ce105a977f
SHA1 afc11302d008832c3523ede2189989f3e23a5df6
SHA256 8bf38ccef7a6e930af9bf5aef18d619d73e187857860203d71303345374b2239
CRC32 A7E57341
ssdeep 3:yW2lWRd6/ldW6L7U8l/vK7LN0CFItJllHAXn:y1lW2vWmTK7NWuX
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{23c6385f-bf3a-4019-bf46-35229423d7ca}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{23C6385F-BF3A-4019-BF46-35229423D7CA}.tmp
Size 1.0KB
Processes 420 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name 7a8f0690cb0eb7cb_yy.js
Submit file
Filepath C:\Users\test22\yy.js
Size 516.0B
Processes 1844 (wscript.exe)
Type ASCII text, with CRLF line terminators
MD5 d6507fc0b69885eb1a9befa28e92a356
SHA1 68dfaf8bb01f23a63372106a13c6523d978739fd
SHA256 7a8f0690cb0eb7cbe72ddc9715b1527f33cec7497dcd2a1010def69e75c46586
CRC32 7CA84C0E
ssdeep 12:MKrPMMGK2nNDZdkiMTnUaF13/fQE2DeoyPIkAsUR74NHn:LcK2NldRMTUS13/fQEAeoy9AR74Z
Yara None matched
VirusTotal Search for analysis
Name 291a6227cd50ef22_litmq795.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\litmq795.out
Size 588.0B
Processes 2900 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 31580c1c561c062de1f6e42a947f355e
SHA1 11489e085f6ef0ac931ceea428a351cbf9292734
SHA256 291a6227cd50ef229af3072dd0ac53108c8b6f5754ee9a2fb87a09624f3f6c4c
CRC32 5C834656
ssdeep 12:K4jnzR37LvXOLMInPAE2xOLMMKai31bIKIMBj6I5BFR5y:Kinzd3BInIE2nMKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 1982f490b2ea515e_litmq795.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\litmq795.dll
Size 3.5KB
Processes 1728 (csc.exe) 2900 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 1c8556ef0b6b3bee935bf0a88e168350
SHA1 b36ce576486b75d922429b1d94db6e55c9cf23de
SHA256 1982f490b2ea515ef8655259be2baf7bd08d2b281c18ed15452703b8a3adfe52
CRC32 1A700049
ssdeep 24:etGSZtusmuE7m7oRSQsmV0MUzbdPtkZfK2mZF4Qzr4j+lunEmI+ycuZhNiakSqPE:6BfTCpUluJK2mZF4Qoj+Yn31ulia3Gq
Yara
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • IsDLL - (no description)
  • Is_DotNET_DLL - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis