popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 1247863e7de1e157_RESF86A.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESF86A.tmp
Size 1.2KB
Processes 2744 (cvtres.exe) 2700 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 1183eaa9738dc25ebef3e592bbd667f4
SHA1 2e129e820900b042712fd71aa6cb88ac91ffc78c
SHA256 1247863e7de1e157e01c8b26793f2163b72497c5a1cc8a4f3d7ec46af88fad35
CRC32 88A93B1B
ssdeep 24:HIJ9Yernd/imHqUnhKLI+ycuZhNiakS6PNnqjtd:pern0m1nhKL1ulia32qjH
Yara None matched
VirusTotal Search for analysis
Name 5ae2855e03f0059b_pzy8xxob.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pzy8xxob.out
Size 607.0B
Processes 2540 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 5fda6ded2c23121376200f16f88b7e33
SHA1 1a63bd6efde61daf92f4889e8b27cd00e6c041ad
SHA256 5ae2855e03f0059b2db0d4636bbe4be8dcc7367eab6439777bff491d2adad600
CRC32 CDFFBC46
ssdeep 12:K4OLM9nzR37LvXOLMInPAE2xOLMMKai31bIKIMBj6I5BFR5y:K+9nzd3BInIE2nMKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 414a302889d0909f_pzy8xxob.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pzy8xxob.0.cs
Size 433.0B
Processes 2540 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 37f91c2e34b7139eb3fba18b5d19e667
SHA1 dca362e9e6cd5030a95ed1daf2b5ce60d4f4b352
SHA256 414a302889d0909f5e2b54aa66ee4a433d9237335da73688f34cd749409cdfde
CRC32 3338E525
ssdeep 6:V/DsDrSxh/eM92SRadPc8hAfzM92SRFo1cLDMezM92SRcBuhmwORX4tXROLtl5AO:V/DGrc+PP+kLucB4mwo4twekN
Yara None matched
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2540 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name c90f5f961d7626f5_pzy8xxob.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pzy8xxob.cmdline
Size 311.0B
Processes 2540 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 d6118b6b550933dc19a160d4a7241227
SHA1 861c1a2e51138a7cb9ac6f8f20134c4fa16e2ca4
SHA256 c90f5f961d7626f5ea5cf03130deab4f4fee1c20484d44a51fe9699a16c31ae3
CRC32 E588F2DC
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fGf3mGsSAE2NmQpcLJ23fGfY:p37LvXOLMInPAE2xOLMJ
Yara None matched
VirusTotal Search for analysis
Name 60ed499b00a72bc6_CSCF85A.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCF85A.tmp
Size 652.0B
Processes 2700 (csc.exe)
Type MSVC .res
MD5 37e12b452c867f6dbf6f5e7f61b25dca
SHA1 da551a551a7328661bc48a92d4a04532055b81c1
SHA256 60ed499b00a72bc692af18ce364a0c6d91c3f409902e5ce3a0439a9455929439
CRC32 4AE18582
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryEHak7Ynqq1QPN5Dlq5J:+RI+ycuZhNiakS6PNnqX
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_pzy8xxob.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\pzy8xxob.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 71d0c06662005288_pzy8xxob.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pzy8xxob.pdb
Size 7.5KB
Processes 2700 (csc.exe) 2540 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 a9a00899f42187894e40d96c7a14548e
SHA1 d9ffea3e026383f83322e7fd80ef1d4275b3bf75
SHA256 71d0c0666200528891421afb7c879453a22d997dfe1f340ebbcd721631ca6733
CRC32 BF455E6B
ssdeep 6:zz/BamfXllNS/wNrj31mllxrS/77715KZYXxGQu+e0KpYXHNrRtfoGggksl/cEDf:zz/H1W/wNrjlSXS/pw2qgNrRFRD
Yara None matched
VirusTotal Search for analysis
Name 788fa27f9dba415f_pzy8xxob.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\pzy8xxob.dll
Size 3.5KB
Processes 2700 (csc.exe) 2540 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3d671eec0c90d135410fc75f367092ca
SHA1 376e2d876652a750c7dbda545fe58d79cc032cd1
SHA256 788fa27f9dba415f86eee2ab6123c11e9a8d266e506ee24f903709fb8962cc6f
CRC32 B708F21B
ssdeep 24:etGSDdBjEeK6D8lsckyTCMoqkbdPtkZfsjOz+Rwm2bQmI+ycuZhNiakS6PNnq:6n9lD8lsNyORuJsZCm2bb1ulia32q
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis