popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 401af16fe1146e21_clr.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\clr.exe
Size 6.9MB
Processes 2456 (unknown.exe)
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 8492877b90e31014727c75124a1e7cc8
SHA1 279c8b9781fbb2c12fa67df8e1e85d71b3eead27
SHA256 401af16fe1146e2116c0b0c2768cbe424e64833fcf01b16e1a93f87ab97fad39
CRC32 0044A062
ssdeep 98304:j1u8ab1Yb2Sar8+l1PRdU6wjvo8+NcbCOX69G5xZSJ9S9VpeWPUh:j1CJSaoIR6xsu/qQxkJEzYj
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 88f9dc0b9a633e43_tmpA4E3.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA4E3.tmp
Size 512.0KB
Type SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5 dd47ebe6866ad2ab59d0caa1de28d09e
SHA1 afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663
SHA256 88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3
CRC32 8DEE9EEA
ssdeep 24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm
Yara None matched
VirusTotal Search for analysis
Name d5e2a15da15235bb_tmpA3FB.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA3FB.tmp
Size 737.0KB
Type COM executable for DOS
MD5 2c6a1e02eb26c38df5e9a2c951eef901
SHA1 317e69769afaf4c034ca8b134ae5be0009dbd6bc
SHA256 d5e2a15da15235bb3c9146693ee291348bb6babb8251a0198f87ce7d267776e6
CRC32 464E32AA
ssdeep 12288:qLkNqaLYUr96enA1K9XXEcqKlfuuyVOsOTCOwZxz40ptJ6T/MEEbi0zN7NGcKGo3:qLbaHnA8flfryVgUZK0R6T/MEEbi0zN0
Yara None matched
VirusTotal Search for analysis
Name 9d3d13c55b2614c0_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 1580 (powershell.exe)
Type data
MD5 3eb6fb80f9dbbc1201de9e762252141b
SHA1 c6d1e6ea5f2fef6f4458695b8ed7586aed429f1c
SHA256 9d3d13c55b2614c0615acea119139123b2a29f2a0daded7edd5146e4614a78e6
CRC32 23B7285A
ssdeep 96:YtuCaGCPDXBqvsqvJCwo9tuCaGCPDXBqvsEHyqvJCwor/tDHXyWlUVul:YtzXo9tzbHnorlTyo
Yara
  • Antivirus - Contains references to security software
VirusTotal Search for analysis
Name 0f5273b8fce9bfd9_lmwuxmb6.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lmwuxmb6.0.cs
Size 424.0B
Processes 1580 (powershell.exe)
Type UTF-8 Unicode (with BOM) text
MD5 4864fc038c0b4d61f508d402317c6e9a
SHA1 72171db3eea76ecff3f7f173b0de0d277b0fede7
SHA256 0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
CRC32 FDA6B056
ssdeep 6:V/DsYLDS86pCMjFs2SRadPc8hAfWhMjFs2SRFo1cLDMeWhMjFs2SRcBuhmwORXWu:V/DTLDCY+Pjh+kLWhcB4mwoFcekG
Yara
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 9a179af324e327fc_RES34FA.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES34FA.tmp
Size 1.2KB
Processes 2032 (cvtres.exe) 1820 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 1bbfaf55f19af4d922bde2b4bbd8b07b
SHA1 b6e248d556d428395880dd57a728729e40d04b93
SHA256 9a179af324e327fcf1c75ea23b847f52c32aa9fc6c044212ff8fc91a7fc7e86f
CRC32 A7F4AC5D
ssdeep 24:HMJ9YernKAJmHVUnhKLI+ycuZhN0LakSVkPNnqjtd:dernTmSnhKL1ulOa36qjH
Yara None matched
VirusTotal Search for analysis
Name 9520067abc34ce8a_ready.ps1
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ready.ps1
Size 2.0KB
Processes 2752 (clr.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 3447df88de7128bdc34942334b2fab98
SHA1 519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA256 9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
CRC32 DA3471C2
ssdeep 48:Nm9KncuG64du5pH6cagzU/CxzjTJfpKps7+k1P3V:vnkzGqYxzpf8pmPF
Yara None matched
VirusTotal Search for analysis
Name 9e6e4772050998a5_tmpA3EA.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA3EA.tmp
Size 10.0B
Type ASCII text, with no line terminators
MD5 eb6b6c90251ab33cee784713c451e6d8
SHA1 451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5
SHA256 9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6
CRC32 22598B08
ssdeep 3:IS:7
Yara None matched
VirusTotal Search for analysis
Name 1923a52b413a2d58_lmwuxmb6.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lmwuxmb6.cmdline
Size 311.0B
Processes 1580 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 b20e59930ebc5933b02a991f3d844043
SHA1 62736ba55905fd8c337d758b0cb459986691e874
SHA256 1923a52b413a2d581f18f694bc132df43cb8d8c30b0f8d24a4068f6597382077
CRC32 77746A90
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fHDemGsSAE2NmQpcLJ23fHPn:p37LvXOLMCnPAE2xOLMn
Yara None matched
VirusTotal Search for analysis
Name f96c8ff445a08210_lmwuxmb6.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lmwuxmb6.out
Size 609.0B
Processes 1580 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 d6a5e1cf4b33ed522a28fe30857c6b18
SHA1 bfcff95a6fbf20d2a9cae610a3dbe547c8a82121
SHA256 f96c8ff445a0821000ce648fca08e1cecd193ded512a28648b61990e1234db50
CRC32 51FC5A92
ssdeep 12:K4OLM9NzR37LvXOLMCnPAE2xOLMuKai31bIKIMBj6I5BFR5y:K+9Nzd3BCnIE2nuKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name eb5ed128539eeb68_resolve-domain.ps1
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\resolve-domain.ps1
Size 2.5MB
Processes 2752 (clr.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 c16f184d9d62eddb657c4a000477bed7
SHA1 5cae0c725cec08ec9bc5a2b246f55401329641f6
SHA256 eb5ed128539eeb68644aa0546eb88a8ee6c35e9bb0627dff4d59f6ac9b114528
CRC32 70F6171C
ssdeep 49152:T8qh4SO9pWIt+JHgenenjUFDAMr/bLG2A7oxLjnsf13JX:M
Yara
  • NPKI_Zero - File included NPKI
VirusTotal Search for analysis
Name 3625992e0befddd4_tmpA3FC.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA3FC.tmp
Size 221.5KB
Type data
MD5 e6e344d7420f6f572a939b83f9b85488
SHA1 f2448e8bebf1536ee5a477f78c1899dc3aee29d7
SHA256 3625992e0befddd4fca3772b8a0f6e5f6cb3aaceafd02a2fc43f056c4e627c28
CRC32 8D9B7F9F
ssdeep 3072:DfHiMUCGCvpQS+RuipV9PjKNMLtFiNa9MqU0NF5bY5NVfckj7iCYhvQcrkdZ:zHBUCGCBQScxFqdqU45bY5cG7RYhJu
Yara None matched
VirusTotal Search for analysis
Name df870b22add34d52_CSC347C.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC347C.tmp
Size 652.0B
Processes 1820 (csc.exe)
Type MSVC .res
MD5 3fc3b24dc30f9f2ccf0e10c810e95eb9
SHA1 f473345bc88851790b60298bdf78ad640b959b7e
SHA256 df870b22add34d52796168e1ab32131e4adff0159447c93f3330acbddd2909f0
CRC32 B0E8A31E
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryeLak7YnqqVkPN5Dlq5J:+RI+ycuZhN0LakSVkPNnqX
Yara None matched
VirusTotal Search for analysis
Name 824fae3331b95e2f_tmpA43F.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA43F.tmp
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name e5c7931e871678ae_tmpA464.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA464.tmp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 8e36f9cfbb4e98a1ea4cb31b1dfd18ba
SHA1 271e10b8bb5623e6552f2be568b01ae93b3e5a3a
SHA256 e5c7931e871678ae9bf44ed496a03ba8524a3d7600a44b29a60847ddda90eb86
CRC32 C73EAD8F
ssdeep 24:TLea0RlPbXaFpEO5bNmISHdL6UwcOxvyUU3Z:TYLOpEO5J/KdGU1EyU2Z
Yara None matched
VirusTotal Search for analysis
Name cf214617955f7dd0_lmwuxmb6.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lmwuxmb6.pdb
Size 7.5KB
Processes 1820 (csc.exe) 1580 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 e96d9e235bb6904ccf3a9a1a8a2b6d87
SHA1 a12c706d57f8832fb33554eee1267c05af1d19cb
SHA256 cf214617955f7dd0fafbf7b9e3c9c572c5186ff980a0003575aa450c3b84df28
CRC32 451B052B
ssdeep 6:zz/BamfXllNS/N3iCn1mllxrS/77715KZYXY3igyMoGggksl/3YXBGQu+e0KWEi+:zz/H1W/9P1SXS/pwdvfmqRi
Yara None matched
VirusTotal Search for analysis
Name 079473a1752fb5e1_tmpA489.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA489.tmp
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 5f98cfac1d9c02587e0db4a6e5a20739
SHA1 be4f97d8544c22d01a1b941fe835d91ffc8a5efd
SHA256 079473a1752fb5e18f755627476b14192bb76894459f1430888e6ae3d07bd763
CRC32 B01FA20E
ssdeep 96:JBc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9ul:JBPOUNlCTJMb3rEDFA867/
Yara None matched
VirusTotal Search for analysis
Name caac5df60d9885e4_lmwuxmb6.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lmwuxmb6.dll
Size 3.5KB
Processes 1820 (csc.exe) 1580 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 281dcfe60d3355556c05da4fe8d33f2b
SHA1 b35f88d893d4cfbbd8c8e256c4d68edb048df68f
SHA256 caac5df60d9885e49f3755f02711dab29efced3303f3a5fd1fb9f0524114d169
CRC32 C5432CF7
ssdeep 24:etGSpdBjEeK6D8lsckyTCM/PkbdPtkZfmjOwfRcW2dOmI+ycuZhN0LakSVkPNnq:6V9lD8lsNyOE0uJmLfaW2dF1ulOa36q
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_DLL - (no description)
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name b1d151b357cae3bc_tmpA40D.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpA40D.tmp
Size 765.9KB
Type data
MD5 435354a6a08814c63d7fae78abc6b03d
SHA1 16e93921f55ad7d03c696f6f4cad483276875e25
SHA256 b1d151b357cae3bc2c7617dbd8ff5b3be801d41c77df3d3cfdd87211f639a6b0
CRC32 D7D05DE3
ssdeep 12288:BV7c3MO5OmZxrB/hwQ7Qr2wFxF7rZqeco93jQglFZo2c2ZxHIu4DqTDu58a:aMO5OmbrB/+mQ3t7rUw938glF+2c2ZdG
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_lmwuxmb6.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\lmwuxmb6.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis