popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 55e469860cd0abd0_ttg6w_f7.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ttg6w_f7.out
Size 607.0B
Processes 508 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 a2bfe92ae293617baae73275de533f45
SHA1 2ae59d1a56d4cf8a3653fb69ca48c51089065e89
SHA256 55e469860cd0abd09622ee4841aefd4a081e17a7d4ad19d85d4780776dec3443
CRC32 7016D0E5
ssdeep 12:K4OLM9nzR37LvXOLMxQnPAE2xOLMaKai31bIKIMBj6I5BFR5y:K+9nzd3BmnIE2naKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name d6431d5645fffd05_d93f411851d7c929.customDestinations-ms~RF1824dbc.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1824dbc.TMP
Size 7.8KB
Processes 508 (powershell.exe) 2296 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 6557db431909a6ac_ttg6w_f7.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ttg6w_f7.dll
Size 3.5KB
Processes 2128 (csc.exe) 508 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 01ca592c61211c03d8dff12c98414b50
SHA1 625fbfb441c33021df402bbdaa5cf5ddb030c80f
SHA256 6557db431909a6ac74d7ecaa7a334a4a734193a6a7d4a62e162273d81b54b14e
CRC32 AC16CF76
ssdeep 24:etGSVc+8De6H3qvQCQ/CEItOi57bdPtkZfBAMXIJKNPgR2JaYsmI+ycuZhNoakSs:6EKvw/CLx7uJBAANpJRf1uloa3Eqa
Yara
  • Is_DotNET_DLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 917a1ce9d86da183_ttg6w_f7.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ttg6w_f7.cmdline
Size 311.0B
Processes 508 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 20eba5bea50fbca521e3d8096d4b91d9
SHA1 132732a1240673e07793a491e9baceded5a71c76
SHA256 917a1ce9d86da183d60e9ff81269dfaba8e2b9c3b38acabeeee1e9419b8d557d
CRC32 20C0EBCF
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fJQmGsSAE2NmQpcLJ23fLH:p37LvXOLMxQnPAE2xOLMb
Yara None matched
VirusTotal Search for analysis
Name 11a81030132c901d_CSCC454.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCC454.tmp
Size 652.0B
Processes 2128 (csc.exe)
Type MSVC .res
MD5 610504b356b2af57df11d958bc0c21da
SHA1 3171989f4b0a934e83f3138f6bbd230a2945616c
SHA256 11a81030132c901d48a35868a392e1856970be8a7b6ec6895fe1989ab5a28af3
CRC32 445C0496
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryGak7YnqqEPN5Dlq5J:+RI+ycuZhNoakSEPNnqX
Yara None matched
VirusTotal Search for analysis
Name a3d9938f4d472901_ttg6w_f7.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ttg6w_f7.pdb
Size 7.5KB
Processes 2128 (csc.exe) 508 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 683320f8c974472f5a729f585ae7be98
SHA1 36cbfb4da96e9ceaaa87f61603caf3ed813f4157
SHA256 a3d9938f4d4729011899b88448dfd4d80520e6d0c971e88c2d7680c58f662f59
CRC32 1BE93663
ssdeep 6:zz/BamfXllNS/WVthvb8kV1mllxrS/77715KZYXxGQu+e0KpYXxVthvb8k1oGggL:zz/H1W/WnhY+SXS/pw2qmnhYyRD
Yara None matched
VirusTotal Search for analysis
Name 5a67bcd5871f71a7_ttg6w_f7.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ttg6w_f7.0.cs
Size 468.0B
Processes 508 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators
MD5 52cc39367c8ed123b15e831e52cbd25f
SHA1 497593af41731aedd939d2234d8d117c57a6d726
SHA256 5a67bcd5871f71a78abf1da47c3529617f34b47a5ab7bde0f1133a33fa751012
CRC32 3D3641A5
ssdeep 12:V/DTLDfuUrE+mQMTOpEtc9JFqmmsmPzgKy:JjmYE+mZTCE29LqtsmPz9y
Yara None matched
VirusTotal Search for analysis
Name 66226848f35a8432_RESC475.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESC475.tmp
Size 1.2KB
Processes 2196 (cvtres.exe) 2128 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 da9bae9b416180786ac3a7c177e23724
SHA1 0ffb3ff9ff9821d770f6216eb44822b77856f40e
SHA256 66226848f35a843255e2d45c811e45b179cdb4c3c6475ed33e0548714b5472bc
CRC32 9E14998E
ssdeep 24:HYJ9YernG0R6mH5oUnhKLI+ycuZhNoakSEPNnqjtd:ZernNkmxnhKL1uloa3EqjH
Yara None matched
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF1824456.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1824456.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14_ttg6w_f7.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\ttg6w_f7.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis