popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a0bda99fce16870f_uqjk_klz.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\uqjk_klz.out
Size 607.0B
Processes 3040 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 4bf4d77d1d92b9f1d618e8ad19d67130
SHA1 fd8b9166ed82f2514e5245ac5a126b078be43c2f
SHA256 a0bda99fce16870f5b1e6d1b4622059e73e49a8dfe3d6b598928f88744603d0f
CRC32 0FEA3248
ssdeep 12:K4OLM9nzR37LvXOLM9MJinPAE2xOLM9MJlUKai31bIKIMBj6I5BFR5y:K+9nzd3B9IinIE2n9IOKai31bIKIMl6v
Yara None matched
VirusTotal Search for analysis
Name 52b11690f3cc46b4_uqjk_klz.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\uqjk_klz.dll
Size 3.5KB
Processes 2404 (csc.exe) 3040 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 7918e4c702086028a82c704eaef63e05
SHA1 a84cb2a2aacaca3875d26c879ea6446b7d750a81
SHA256 52b11690f3cc46b4ed29a3e96eb1fcd91c6ae81bff89c0cbe89f565e791e4f4c
CRC32 CB93A916
ssdeep 24:etGSM9JWvUXc1EQj9bdPtkZf7TDriut/9InmI+ycuZhNlakSTPNnq:6URvivuJ7TDmU/9Im1ulla3Zq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 4a92532316bb7b9a_RES3302.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES3302.tmp
Size 1.2KB
Processes 2420 (cvtres.exe) 2404 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 7d1ada66b39a6815d5ee9127c921a320
SHA1 34dfd4161481176cddbb891408a6c1aeb87b88fb
SHA256 4a92532316bb7b9aa02b2909b7e1c4a51c8bd9ca58cf2bdf9747249ef3111f0c
CRC32 7E86A42A
ssdeep 24:HuJ9YernCDPqIcsmHiiUnhKLI+ycuZhNlakSTPNnqjtd:DernLDsmEnhKL1ulla3ZqjH
Yara None matched
VirusTotal Search for analysis
Name 988d9c3f7406982b_uqjk_klz.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\uqjk_klz.cmdline
Size 311.0B
Processes 3040 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 5f9d853e224aed18b470a765447244bf
SHA1 dc2d959ec51b4ca2b16a6ab81364b3e085a26b08
SHA256 988d9c3f7406982b1d78d7fddab568152f79f6d18115f9ec7e7a98e63c925517
CRC32 BD8ACC6D
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23flMJ9QmGsSAE2NmQpcLJ23flMJlx:p37LvXOLM9MJinPAE2xOLM9MJlx
Yara None matched
VirusTotal Search for analysis
Name daff0ce8ac84173f_CSC310D.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC310D.tmp
Size 652.0B
Processes 2104 (csc.exe)
Type MSVC .res
MD5 6fac00f8291bf925be0b7086fddc3cc2
SHA1 b192c05d252f584b0e93814626286d681bafb858
SHA256 daff0ce8ac84173f269184ecbce2f28ac1a34cf38a43d238510634108dac595c
CRC32 1DDAC203
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grySdak7YnqqnyPN5Dlq5J:+RI+ycuZhNqakSyPNnqX
Yara None matched
VirusTotal Search for analysis
Name 352d18e362fda93d_xcbpv-vj.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\xcbpv-vj.dll
Size 4.0KB
Processes 2104 (csc.exe) 3040 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 20c748dd23a355aeb2ce13aef893057a
SHA1 ccbb59082e746df784630b1991441116b064dc05
SHA256 352d18e362fda93dae90c99b5fe05037f5ed21f2c7fb260795d16aa8b79674b0
CRC32 D5B36576
ssdeep 48:6IJlC2uwtxxBGEi3zYtPQSsSF3JMCXP27h1ulqa3eq:jlCmzxBGFasSFKCf2OsK
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 90ad1e8f6095bf4d_xcbpv-vj.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\xcbpv-vj.cmdline
Size 311.0B
Processes 3040 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 ee255a806f6b47a89af4c783316ccc04
SHA1 e2d7f6972d5c122fa55b2804d56531b3dbfcbaf8
SHA256 90ad1e8f6095bf4d235d1bf0c84ca1ab462cebc3a31f065df5ec4b38b03749a9
CRC32 1444EACF
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fRX/emGsSAE2NmQpcLJ23fRXb:p37LvXOLM4nPAE2xOLMZ
Yara None matched
VirusTotal Search for analysis
Name 3611d5a7a0c6edf0_xcbpv-vj.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\xcbpv-vj.out
Size 607.0B
Processes 3040 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 148f088a18c1a93b98a9287ef8378535
SHA1 22b285f29d089078e69c472c5aaa33a94b716e9c
SHA256 3611d5a7a0c6edf0a05aba1446ad8dffb93ec9448d4cda0f746134182b09cb4b
CRC32 ED344CF4
ssdeep 12:K4OLM9nzR37LvXOLM4nPAE2xOLMcKai31bIKIMBj6I5BFR5y:K+9nzd3B4nIE2ncKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 90fdc39b6b871c15_xcbpv-vj.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\xcbpv-vj.0.cs
Size 993.0B
Processes 3040 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 99c5b8908e4f3a536d6ceb284abbca3a
SHA1 6ba180dbfa04d3b314e03cbf0e493e534df3a897
SHA256 90fdc39b6b871c155bedfb6a19e68491356a8b26746213da2105a34466607fcd
CRC32 FD74A1FF
ssdeep 24:JaiUipioTydJkrHk2kiwkjFk5AYPA++R8X+ESA9zLm7oFrMouD:JaiUipioGJgEL1kjFk5AYPAxmuEr9vV8
Yara None matched
VirusTotal Search for analysis
Name 8f992905bc09bb8b_RES311E.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES311E.tmp
Size 1.2KB
Processes 200 (cvtres.exe) 2104 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 b8f091f6cb8dc82fab2325c6eb916074
SHA1 ae0054431f7a85c377724358b5fa92b5454722a3
SHA256 8f992905bc09bb8b1ed425980a1e667e60d4e9a53a01c7edb89d934c9db28cdc
CRC32 B203CFDD
ssdeep 24:H9J9Yern0m6mH1UnhKLI+ycuZhNqakSyPNnqjtd:yern0VmynhKL1ulqa3eqjH
Yara None matched
VirusTotal Search for analysis
Name 2bbd1dcfa8f970c5_uqjk_klz.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\uqjk_klz.pdb
Size 7.5KB
Processes 2404 (csc.exe) 3040 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 439403591311c5466428587f772afa4d
SHA1 05060f76613e6ab7692d3ad234c7ccf24af29832
SHA256 2bbd1dcfa8f970c56ce7b8135a107287f7066039f84ddd79aec7b02fbeb1f939
CRC32 8113AD1E
ssdeep 6:zz/BamfXllNS/S2hl1mllxrS/77715KZYXxGQu+e0KpYXd2hFoGggksl/cEDf:zz/H1W/5hvSXS/pw2qphFRD
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_xcbpv-vj.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\xcbpv-vj.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 9060331d9bcc7659_uqjk_klz.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\uqjk_klz.0.cs
Size 190.0B
Processes 3040 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators
MD5 74bf484c3850abed59a4951f34aba5d1
SHA1 3d34643945d3963a8ca3387bb297c038e2303898
SHA256 9060331d9bcc7659b44b2260ea8848f5eb1247c4a4af0fb723d68e1064b9d519
CRC32 D3B738AD
ssdeep 3:V/DsIWMLCI53eqIusd81AWVEG6w0zji/Xw/B1lEFGFR9AXMGVrMaFFQy:V/DsYLDS81zuvtq/gOFSRiHVzFFQy
Yara None matched
VirusTotal Search for analysis
Name a24c001980f95650_CSC32F2.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC32F2.tmp
Size 652.0B
Processes 2404 (csc.exe)
Type MSVC .res
MD5 c0b0f2ab36f657683a155999c9e3a0ed
SHA1 535cfcb240bb27e85845aa3a0044725bf6e07bbb
SHA256 a24c001980f95650247a70bda6fedeedbf165718db44096c6c2bb976e3860a99
CRC32 270B9F44
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryHak7YnqqTPN5Dlq5J:+RI+ycuZhNlakSTPNnqX
Yara None matched
VirusTotal Search for analysis
Name 24369de23a546ee8_xcbpv-vj.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\xcbpv-vj.pdb
Size 7.5KB
Processes 2104 (csc.exe) 3040 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 dcbe144ba1e2b6679657ab7aebcf82b3
SHA1 20e1f116ec86c85dfa0004c1f57f6ce3094ed232
SHA256 24369de23a546ee80f995fafd53c1d38ab282fd14d6f876e26e11b24e9c0eb93
CRC32 10D612B6
ssdeep 6:zz/BamfXllNS/dLl31mllxrS/77715KZYXxGQu+e0KpYXeBoGggksl/cEDf:zz/H1W/dRlSXS/pw2qtBRD
Yara None matched
VirusTotal Search for analysis
Name a9b1dc8eaa5fcd00_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 3040 (powershell.exe)
Type data
MD5 c1d8708bab1e838a2deda26d58bb8d42
SHA1 95d39e75a804752961c139bb6c0b67f84f685035
SHA256 a9b1dc8eaa5fcd0034694cf9742ae915a5932142a1477c3ab6fada45d98750b2
CRC32 E71AF2A2
ssdeep 96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworFS7HwxWlUVul:QtbXoFtbbHnor/xo
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis