popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 33698b211b21d297_e3c82su0.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\e3c82su0.pdb
Size 7.5KB
Processes 2380 (csc.exe) 3008 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 b1f74fab18625e4a9130b486443206ee
SHA1 3f000eaefdf802051fbad669fc56c793f25c230d
SHA256 33698b211b21d2976df02a3dec736d61765af085cb3e426335c33805b340be1f
CRC32 3D287993
ssdeep 6:zz/BamfXllNS/z4D/P1mllxrS/77715KZYXu4D6ioGggksl/3YXBGQu+e0KWEi+:zz/H1W/USXS/pwkmqRi
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_e3c82su0.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\e3c82su0.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name d0f4673d24661e68_e3c82su0.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\e3c82su0.0.cs
Size 456.0B
Processes 3008 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 ed7965845f0613e885502f88d6723e96
SHA1 961675655fce8b5014a77a3b2b8497d56c73f9f8
SHA256 d0f4673d24661e68412e611d376ffd6934f6f72ee41d2833f1a5ffcd51a00634
CRC32 96CA0F42
ssdeep 6:V/DsYLDS81zuZFyW2mMCJFFXQXReKJ8SRHy4HGApbHcLmI0TMIy:V/DTLDfuZFr3CXfH6ar60MIy
Yara None matched
VirusTotal Search for analysis
Name f6229bcd50597094_e3c82su0.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\e3c82su0.dll
Size 3.5KB
Processes 2380 (csc.exe) 3008 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 b647bb5eadae5153aef62b8da1754fd9
SHA1 09d2d996e596197bb3d2063a865430b4a5e2991a
SHA256 f6229bcd505970943f51a0ca1f3299b42caa4f42b89c7f016c306115cf271075
CRC32 45B10DFE
ssdeep 24:etGS1NiGTw3lqJJkQhgpV9KRUbdPtkZfdT1ix+j10VmI+ycuZhNeKakSp7PNnq:6KpGhFRMuJdJQiWw1uleKa3pxq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name a237134e6772d6c3_RESAA26.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESAA26.tmp
Size 1.2KB
Processes 1080 (cvtres.exe) 2380 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 f932f5e91334d55fb282ac72faa2dce8
SHA1 699ce2e9917ca848c7d442eed014175e46f01062
SHA256 a237134e6772d6c3a0aecef8035ea4160514e6e05d4b781d7cca466195b29a09
CRC32 0E407A13
ssdeep 24:HDJ9YernoC+mHtvUnhKLI+ycuZhNeKakSp7PNnqjtd:MernKm+nhKL1uleKa3pxqjH
Yara None matched
VirusTotal Search for analysis
Name bfcf03159dadff41_e3c82su0.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\e3c82su0.out
Size 598.0B
Processes 3008 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 259acac880baae86e9b72f932dcb9ba2
SHA1 90e1ce247cf6ae362d230b7da7c4a0a84bf8d7b6
SHA256 bfcf03159dadff411941af82e7238cef8f0f8e201e46ab677eca153c7c78e447
CRC32 35C81A20
ssdeep 12:K4X/NzR37LvXOLM+2nPAE2xOLM+KKai31bIKIMBj6I5BFR5y:KyNzd3BjnIE2nxKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3008 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 13f1dd7c19422331_e3c82su0.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\e3c82su0.cmdline
Size 311.0B
Processes 3008 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 d498f7b2eab680da0daed3abe58e1258
SHA1 a906d9746ac6996535749d11b20826d739fda8d5
SHA256 13f1dd7c194223315b75f55ab7bf5f07f092ff99f377de8c0f33aa600731fd2d
CRC32 A60274B5
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fXGxJemGsSAE2NmQpcLJ23fXGL:p37LvXOLM+2nPAE2xOLM+L
Yara None matched
VirusTotal Search for analysis
Name de57bc3b05ce889d_CSCA9A8.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCA9A8.tmp
Size 652.0B
Processes 2380 (csc.exe)
Type MSVC .res
MD5 5861ef05a85ace2ee8c47e74c70acee8
SHA1 5d6ea9ca9c5196235e538d7b3bfc003cbc613515
SHA256 de57bc3b05ce889d603a8f1962e78538c0064f9f6b947b1e0297eb1b7135a783
CRC32 75752BF6
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryQKak7Ynqqp7PN5Dlq5J:+RI+ycuZhNeKakSp7PNnqX
Yara None matched
VirusTotal Search for analysis