popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14_gawi3hkk.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\gawi3hkk.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 6fd745ce4fee5a25_CSCB7F1.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCB7F1.tmp
Size 652.0B
Processes 2636 (csc.exe)
Type MSVC .res
MD5 edbd6878ee692943177517fec6f0de4c
SHA1 34bb5611269ff16ec56f32726228c8a73d0868b2
SHA256 6fd745ce4fee5a252a6b1cad76ddcf172a684949b20249f6e8896a7f7cb36fc7
CRC32 1AE62EA1
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryyGak7YnqqHXPN5Dlq5J:+RI+ycuZhN5akS3PNnqX
Yara None matched
VirusTotal Search for analysis
Name 846763b5e6f59a5e_gawi3hkk.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gawi3hkk.0.cs
Size 457.0B
Processes 3012 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 c72c8546f144ef18250900ac75c851df
SHA1 b38fbe8f021abfbc18faeeed84f6ccdef04651a2
SHA256 846763b5e6f59a5e7a87e40d5ea93faaf0ba08575f9743183672e01e253278d7
CRC32 B3D74FA0
ssdeep 6:V/DsYLDS81zu/vwyEkMCtQXReKJ8SRHy4Hudm75bQO14vwy:V/DTLDfu/vG0aXfHad4MO14Yy
Yara None matched
VirusTotal Search for analysis
Name e75e7eb24787a60e_gawi3hkk.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gawi3hkk.pdb
Size 7.5KB
Processes 2636 (csc.exe) 3012 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 3d76f53fb8873399413ce6face54d7b4
SHA1 030c8d33210aea236c5c58fde7802bb0c42bd8bd
SHA256 e75e7eb24787a60e3c228559985a1e427157502180f6e9ea956a0f87173d8b9c
CRC32 1D63A3B3
ssdeep 6:zz/BamfXllNS/MGpwll91mllxrS/77715KZYXNGpwHl3oGggksl/3YXBGQu+e0Kd:zz/H1W/MG6SXS/pwsGsl3mqRi
Yara None matched
VirusTotal Search for analysis
Name 9acb97726c61dd2a_gawi3hkk.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gawi3hkk.cmdline
Size 311.0B
Processes 3012 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 875f46be9865ced128bbf0236e33dc17
SHA1 03f4595f76256ae48081646ecc5ca3e0bc1578f8
SHA256 9acb97726c61dd2a150a97c271a611fac8b4668172ed6d8939a6dbbe0d0dd054
CRC32 8DC3B25B
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fGymGsSAE2NmQpcLJ23fG3n:p37LvXOLM7nPAE2xOLMcn
Yara None matched
VirusTotal Search for analysis
Name 676abffc68e94635_gawi3hkk.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gawi3hkk.out
Size 598.0B
Processes 3012 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 5b0543de661849a719411a9210fba571
SHA1 af4bd2ff269a304af922bf64e822b17c02a279a0
SHA256 676abffc68e94635eb9e4a1b0217d573a566d3949989cd65898edd0f7879df6b
CRC32 9B1CC387
ssdeep 12:K4X/NzR37LvXOLM7nPAE2xOLMcuKai31bIKIMBj6I5BFR5y:KyNzd3B7nIE2ncuKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name e7a21b46329ef47c_gawi3hkk.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gawi3hkk.dll
Size 3.5KB
Processes 2636 (csc.exe) 3012 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 658ed4637d8c0b7257a8676f4ee32f0f
SHA1 b48110910643d2511cc4cf5e92e7157856a66bad
SHA256 e7a21b46329ef47c817584a050080555ffe1c0e02e7c1c6e83ed86df1562137f
CRC32 DEEEA790
ssdeep 24:etGSs9KxWnwzVHskWWkQli0SkUbdPtkZfLNlxgd1FuxmI+ycuZhN5akS3PNnq:6jHQkl1MuJLNlxizuE1ul5a3lq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name f1b38727090e58c3_RESB8CC.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESB8CC.tmp
Size 1.2KB
Processes 1504 (cvtres.exe) 2636 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 d99f00b7b824496322e3539b7805e068
SHA1 c1f08809147acce2229c4de2b1ab1964a1efc64f
SHA256 f1b38727090e58c35ec4e4323d882f1aa9c4146bc3a4326f8c3244a0dc16e300
CRC32 80C5F47A
ssdeep 24:HpJ9Yern3VmHLUnhKLI+ycuZhN5akS3PNnqjtd:OernFmonhKL1ul5a3lqjH
Yara None matched
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3012 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis