popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14_r3xzal4t.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\r3xzal4t.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 45a6440a9cb27ac7_r3xzal4t.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\r3xzal4t.cmdline
Size 311.0B
Processes 3004 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 9f69676882b0ba84d635e1345f2b45c2
SHA1 eb2c24e60362f434c72bbed5180fd39c073fdd96
SHA256 45a6440a9cb27ac74764332b1b19974c52804d0846cdd498d6fa0bcd8f9973a4
CRC32 457964BD
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fCmGsSAE2NmQpcLJ23f8A:p37LvXOLMqnPAE2xOLMEA
Yara None matched
VirusTotal Search for analysis
Name 63d9002918e000a9_RESC4F2.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESC4F2.tmp
Size 1.2KB
Processes 544 (cvtres.exe) 2724 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 100b2999339b2f9a28769afec49d40bd
SHA1 ae46b7d3ddb470d9c24665fa8bd5eb8a5659fc39
SHA256 63d9002918e000a9889d4b381e468f6072ce119219bfb44fda6faa8d5842f3f3
CRC32 3D09663F
ssdeep 24:HjJ9YernM8KfmH6UnhKLI+ycuZhNJoakSG9PNnqjtd:sernMpfmlnhKL1ulya3WqjH
Yara None matched
VirusTotal Search for analysis
Name 114af3866944b808_r3xzal4t.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\r3xzal4t.out
Size 598.0B
Processes 3004 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 7747fc1c30e08fde1a449ff693df0fe1
SHA1 fd7257805c2251f9d96ae8d524ea88a8d197bd08
SHA256 114af3866944b80871556d6d282c156199a4c4786579eefae7e980bd4853cd7e
CRC32 B97E9CD8
ssdeep 12:K4X/NzR37LvXOLMqnPAE2xOLME1Kai31bIKIMBj6I5BFR5y:KyNzd3BqnIE2nE1Kai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 95e65e8a8465c418_r3xzal4t.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\r3xzal4t.dll
Size 3.5KB
Processes 2724 (csc.exe) 3004 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0c52e3d7a53d79462e73da8a75752a2e
SHA1 a3d5dd8121b09eed6358326bedc8f9976b84975c
SHA256 95e65e8a8465c4181d31c3aa4132a56161145bd00894ac57bdf4909cb4c55b02
CRC32 9562BF6C
ssdeep 24:etGS59+3WaOwRZXw0kUYtbUbdPtkZfCB1P+fqmI+ycuZhNJoakSG9PNnq:6KRwHtbMuJCBFqZ1ulya3Wq
Yara
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 5f77df10395e812b_CSCC483.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCC483.tmp
Size 652.0B
Processes 2724 (csc.exe)
Type MSVC .res
MD5 f3b77a0c78723a5218ed6591d183a4ea
SHA1 e4d346cbb464b35e4a9bc0e1d9088d4fc7df8279
SHA256 5f77df10395e812b13991d7cf9c11a2aa302bf5a304544714900a4927e292005
CRC32 9E50A4B8
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grydpD8ak7YnqqepDRPN5Dlq5J:+RI+ycuZhNJoakSG9PNnqX
Yara None matched
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3004 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e4d48c06f078c529_r3xzal4t.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\r3xzal4t.pdb
Size 7.5KB
Processes 2724 (csc.exe) 3004 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 e9e8bff6c1f6849df2b10aca953059e6
SHA1 8e1301b399c32e445087af42f39e9cfe30972d89
SHA256 e4d48c06f078c529e273975979b76eb383efeb4e2c5d1e9641620909922ba933
CRC32 44CF938C
ssdeep 6:zz/BamfXllNS/tkllgGtP1mllxrS/77715KZYXukllgGHll8MoGggksl/3YXBGQk:zz/H1W/ilRttSXS/pwClRH/dmqRi
Yara None matched
VirusTotal Search for analysis
Name f09d09fba37d82a7_r3xzal4t.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\r3xzal4t.0.cs
Size 448.0B
Processes 3004 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 96fb5c81fd98110eccd7462295c1182e
SHA1 bf3ddf003e58c2e0e872c6219b87b3ab11095dac
SHA256 f09d09fba37d82a7c487f866673905cecc84403bde45445fbf42d69060e4a328
CRC32 69F7BF6F
ssdeep 6:V/DsYLDS81zuKF0AWmMOBpnQXReKJ8SRHy4He3Q0XlQ9bor/Qy:V/DTLDfuKFPoXfHigWtIy
Yara
  • Network_Downloader - File Downloader
VirusTotal Search for analysis