popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 9060331d9bcc7659_giq5wshx.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\giq5wshx.0.cs
Size 190.0B
Processes 2552 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators
MD5 74bf484c3850abed59a4951f34aba5d1
SHA1 3d34643945d3963a8ca3387bb297c038e2303898
SHA256 9060331d9bcc7659b44b2260ea8848f5eb1247c4a4af0fb723d68e1064b9d519
CRC32 D3B738AD
ssdeep 3:V/DsIWMLCI53eqIusd81AWVEG6w0zji/Xw/B1lEFGFR9AXMGVrMaFFQy:V/DsYLDS81zuvtq/gOFSRiHVzFFQy
Yara None matched
VirusTotal Search for analysis
Name 90fdc39b6b871c15_dz3f3t3y.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\dz3f3t3y.0.cs
Size 993.0B
Processes 2552 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 99c5b8908e4f3a536d6ceb284abbca3a
SHA1 6ba180dbfa04d3b314e03cbf0e493e534df3a897
SHA256 90fdc39b6b871c155bedfb6a19e68491356a8b26746213da2105a34466607fcd
CRC32 FD74A1FF
ssdeep 24:JaiUipioTydJkrHk2kiwkjFk5AYPA++R8X+ESA9zLm7oFrMouD:JaiUipioGJgEL1kjFk5AYPAxmuEr9vV8
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_dz3f3t3y.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\dz3f3t3y.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 31de20e0b52361f5_RESF88A.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESF88A.tmp
Size 1.2KB
Processes 2848 (cvtres.exe) 2804 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 e17525a46b798ea1a9bbbb64386bb003
SHA1 16b0218ce644c76f4491e93828079f1b2b04e17b
SHA256 31de20e0b52361f59972341ec093ed9d55482b62cce9641ac887614f8dcd0065
CRC32 991391BC
ssdeep 24:HPMJ9YernbRmHwUnhKLI+ycuZhNiakSqPNnqjtd:v9ern9m7nhKL1ulia3GqjH
Yara None matched
VirusTotal Search for analysis
Name 2d6b583c187f09f1_dz3f3t3y.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\dz3f3t3y.pdb
Size 7.5KB
Processes 2680 (csc.exe) 2552 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 15894c975f4ce2ee934e28c050ca0050
SHA1 480a3cb43a3e0dd282b49feefd3ead22fe4bd63e
SHA256 2d6b583c187f09f1154759f876c3effb44f341278dbb58b930ce77a2ae77f0b3
CRC32 48ECC82E
ssdeep 6:zz/BamfXllNS/tMOWdn1mllxrS/77715KZYXxGQu+e0KpYXCMOW/4ioGggksl/cI:zz/H1W/tMl1SXS/pw2qdMlRD
Yara None matched
VirusTotal Search for analysis
Name 7bb4c7a8505631b6_dz3f3t3y.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\dz3f3t3y.out
Size 607.0B
Processes 2552 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 85bd7711ca9bbb1e43b92847ab023012
SHA1 600dfb7e545197b99709b79d9a2019cb5249e331
SHA256 7bb4c7a8505631b68557936437e857f747cfa1a09085f43374be80cd9d53ea8b
CRC32 3A61B796
ssdeep 12:K4OLM9nzR37LvXOLMinPAE2xOLMOKai31bIKIMBj6I5BFR5y:K+9nzd3BinIE2nOKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name ba7e039a17595b4d_CSCF6A4.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCF6A4.tmp
Size 652.0B
Processes 2680 (csc.exe)
Type MSVC .res
MD5 24a278c71688205490a91f21c42d4998
SHA1 1fa895fce23015babe152dcfa07e0761903d1a7f
SHA256 ba7e039a17595b4dd1345799c45e7fa69da32b4428b09f17db8d08f180a74b6d
CRC32 9B47E867
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grysak7YnqqSPN5Dlq5J:+RI+ycuZhNKakSSPNnqX
Yara None matched
VirusTotal Search for analysis
Name 465ee6c09ba1ee40_CSCF879.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCF879.tmp
Size 652.0B
Processes 2804 (csc.exe)
Type MSVC .res
MD5 c98e5e1c28e0949440c919622f56ac72
SHA1 cff6bcd5c2878ad3f78286ff61250cf83c8ef030
SHA256 465ee6c09ba1ee409a2e02af43c8e322dce93efc483f1daf5bead86178c50211
CRC32 E9662B65
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryw+RWak7Ynqqj+RHPN5Dlq5J:+RI+ycuZhNiakSqPNnqX
Yara None matched
VirusTotal Search for analysis
Name 09c4968f9df64419_giq5wshx.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\giq5wshx.cmdline
Size 311.0B
Processes 2552 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 19cfda64052ff51a6e885bbedf3251f5
SHA1 17a432ee2ecb2ca5224a491abfc00f15720a6600
SHA256 09c4968f9df644197732f3dc9f378f2a242a332d42ea1e18a667a16280c30f23
CRC32 962EF775
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23foQYmGsSAE2NmQpcLJ23foQrLGA:p37LvXOLMgQYnPAE2xOLMgQ5
Yara None matched
VirusTotal Search for analysis
Name 44809cd57b8b21aa_RESF6B5.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESF6B5.tmp
Size 1.2KB
Processes 2748 (cvtres.exe) 2680 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 63e96ba4f31d146f28bb0f570faffb95
SHA1 86519f6200a603b30e04f7d9d123e2cc380221f2
SHA256 44809cd57b8b21aacbbec6892ad2a02f7050b5f69a486bb1060b9b8b759e0352
CRC32 9884C130
ssdeep 24:HXJ9YernyjfmHvwUnhKLI+ycuZhNKakSSPNnqjtd:AernwfmjnhKL1ulKa3+qjH
Yara None matched
VirusTotal Search for analysis
Name d18a7fe243227311_giq5wshx.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\giq5wshx.pdb
Size 7.5KB
Processes 2804 (csc.exe) 2552 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 443fddaee6d1681586ada8fdf329dbae
SHA1 a5ebf8a81bb332b7999ce7f6a163a45cf81d379d
SHA256 d18a7fe243227311ccb75fc672ff6a22febeb9822c42d01cb295a609e9b2b174
CRC32 FD77AE73
ssdeep 6:zz/BamfXllNS/Hl+UD91mllxrS/77715KZYXxGQu+e0KpYXel+UJ3oGggksl/cEb:zz/H1W/F+UD3SXS/pw2q1+URRD
Yara None matched
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2552 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 491825d9817603e3_giq5wshx.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\giq5wshx.dll
Size 3.5KB
Processes 2804 (csc.exe) 2552 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 2598cfe1e296f78e2ab47f2559cb0180
SHA1 1a9b4180ba4605d2b22e1ed6dd249a28042de691
SHA256 491825d9817603e3e12ebe44b05e6fc5a8449d8f6e5890a081b2ffb98cf0ec03
CRC32 659ABB55
ssdeep 24:etGSe9JWvUXc1EQ4bdPtkZfKrHBgQ9mI+ycuZhNiakSqPNnq:6GRvTuJK9gd1ulia3Gq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 99178416a9e8c2e2_giq5wshx.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\giq5wshx.out
Size 607.0B
Processes 2552 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 8b11ba899e4c62559d5b6c601f5e5d02
SHA1 27f07677bdcb3fdf1e2538b34ca4154ee6385b43
SHA256 99178416a9e8c2e24188911ccf7a23a516d448f7024d21d54793ffbde54c0956
CRC32 5A8E3F2F
ssdeep 12:K4OLM9nzR37LvXOLMgQYnPAE2xOLMgQ8Kai31bIKIMBj6I5BFR5y:K+9nzd3BgQYnIE2ngQ8Kai31bIKIMl6v
Yara None matched
VirusTotal Search for analysis
Name ef58001438962e83_dz3f3t3y.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\dz3f3t3y.cmdline
Size 311.0B
Processes 2552 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 54652b4b0fdd2a2c855db6d385cefabd
SHA1 618a5b0e9db58fb2d4af4787f432de2d2f400b03
SHA256 ef58001438962e839ee5995f9ed4162e5349e14698024831d3255d6fa7403e69
CRC32 E60DC4A8
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fqmGsSAE2NmQpcLJ23fdx:p37LvXOLMinPAE2xOLMH
Yara None matched
VirusTotal Search for analysis
Name 29c570d14db8a95a_dz3f3t3y.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\dz3f3t3y.dll
Size 4.0KB
Processes 2680 (csc.exe) 2552 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 176cd4ab25144ecb8a08aab0afab4ed8
SHA1 4831ee29a70a94607cff2507755b5908480afb59
SHA256 29c570d14db8a95ae034a9116630994ff2c55e356dda38f6c24758802db6a23f
CRC32 E1D3ADA4
ssdeep 48:6aJlC2uwtxxBGKi3zYtPQSsSF3JSEeXPROG331ulKa3+q:NlCmzxBG7asSFgrfROf8K
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis