popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 7415bfdfd5c3cbbf_wxt848r0.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wxt848r0.0.cs
Size 479.0B
Processes 2732 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 cde2050c36edda68de2cf74abe032dd5
SHA1 28d9dcf7ee777d329f8cee6fed273165ef83af1f
SHA256 7415bfdfd5c3cbbf43b6d80d0c8a253e15987b1a1917fe47fe41968fb4b0bafa
CRC32 F6FFB7DC
ssdeep 6:V/DsYLDS81zu/w80WmMOfJNQXReKJ8SRHy4HZEDbk8u5Coe/RaPy:V/DTLDfuoYKIXfHF/PeJaPy
Yara
  • Network_Downloader - File Downloader
VirusTotal Search for analysis
Name 6788d9281eb20aab_wxt848r0.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wxt848r0.dll
Size 3.5KB
Processes 2852 (csc.exe) 2732 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 23cd669a15f95ed31ad6900814c7c455
SHA1 58f0fe8b91b2bad33d3640646653d5c153c4cb78
SHA256 6788d9281eb20aabe086663ba41e2d5a113e3b26eddbf221bc49f7feb084522f
CRC32 CA5DBC38
ssdeep 24:etGShdatX2vw1vgtBkma3W8UbdPtkZfjisGe4T10VmI+ycuZhNfakShPNnq:6mpToaNMuJjn4TGw1ulfa3Tq
Yara
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name e3b0c44298fc1c14_wxt848r0.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\wxt848r0.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 4b5a948f466405b2_wxt848r0.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wxt848r0.out
Size 607.0B
Processes 2732 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 31c41529b327c90da0dad54e55eb728f
SHA1 b19fa7527b7697e6a2fae8f3a2b1b4802a14e1fd
SHA256 4b5a948f466405b29efc9d7a6a8201a4ead48b3086b8707862233e214639d963
CRC32 A46F8415
ssdeep 12:K4OLM9nzR37LvXOLMPnPAE2xOLMFKai31bIKIMBj6I5BFR5y:K+9nzd3BPnIE2nFKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 18ebef8df7877c20_wxt848r0.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wxt848r0.cmdline
Size 311.0B
Processes 2732 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 ee06b2c2e69839f3acd50139507ecf0b
SHA1 19f98b7e61d44717eb11a609db4820d77c585d10
SHA256 18ebef8df7877c2021b0a89d8610856e5352ae98750fdb5fb0a4c008176fc32e
CRC32 A0B99E0D
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fHmGsSAE2NmQpcLJ23fI:p37LvXOLMPnPAE2xOLMQ
Yara None matched
VirusTotal Search for analysis
Name 122d63d99dffb099_CSCFB28.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCFB28.tmp
Size 652.0B
Processes 2852 (csc.exe)
Type MSVC .res
MD5 a993341dd3b38b6eec736b7e7b542b97
SHA1 ecdffb30f028543ed56df0b650bc2f5f235fdb7a
SHA256 122d63d99dffb0999beffcede0bf6a9db68c61effb343ea92e1526f28de96d88
CRC32 16C5A96E
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryI+ak7YnqqZfPN5Dlq5J:+RI+ycuZhNfakShPNnqX
Yara None matched
VirusTotal Search for analysis
Name ea93b0c926a37207_RESFB39.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESFB39.tmp
Size 1.2KB
Processes 2912 (cvtres.exe) 2852 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 284c52c5160fd22d9d0b3ab1e3d1f89d
SHA1 7b2d28c600f074925619bf8760385340ecbf8a5c
SHA256 ea93b0c926a372077a68db49b330441c8ae8121d75ffec06d29b8e3f58a8b6d4
CRC32 357B8532
ssdeep 24:HfJ9YernPImHrUnhKLI+ycuZhNfakShPNnqjtd:4ernAmInhKL1ulfa3TqjH
Yara None matched
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2732 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name fd43d932d04364dc_wxt848r0.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wxt848r0.pdb
Size 7.5KB
Processes 2852 (csc.exe) 2732 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 a76381829f0228998108a4ebec3d8a26
SHA1 db1ac7b9ae61be7225f2e2bafd7bd5c2bd36242d
SHA256 fd43d932d04364dc59225540e24f54537ba88ca0fd154f9df8e967305691a2d1
CRC32 4C2037B4
ssdeep 6:zz/BamfXllNS/CEvt0R1mllxrS/77715KZYXxGQu+e0KpYXxEvt0xoGggksl/cEb:zz/H1W/CEvuzSXS/pw2qyEvuxRD
Yara None matched
VirusTotal Search for analysis