popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 92f4b761a1b0541b_RESB0FC.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESB0FC.tmp
Size 1.2KB
Processes 2504 (cvtres.exe) 2412 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 4bb3e5bbec599299c86a7280196dcf1a
SHA1 30ae6d9c472485a4cda988a10ed7fe00256d5e5e
SHA256 92f4b761a1b0541bd0c661f0bd871cc68f6d4cad391d3e20fd260a01ee52f623
CRC32 EECF4A6A
ssdeep 24:H+J9YernN88NUNmHYUnhKLI+ycuZhNiakSqPNnqjtd:zernNsNmznhKL1ulia3GqjH
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_3xsesmxu.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\3xsesmxu.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name e66862d2a3679230_3xsesmxu.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\3xsesmxu.pdb
Size 7.5KB
Processes 2412 (csc.exe) 3000 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 5ec4c03f3e3cc81d3a4bcb0774be7606
SHA1 2e8926a65450f9eec4e5f0bd01b5597939020b48
SHA256 e66862d2a367923046d36d5a2d34ba0f9fb52903aa10f83285432b2ef66d53dd
CRC32 5CE9386A
ssdeep 6:zz/BamfXllNS/2DMGD31mllxrS/77715KZYX7DMGxFoGggksl/3YXBGQu+e0KWEb:zz/H1W/GMGDlSXS/pwmMGxFmqRi
Yara None matched
VirusTotal Search for analysis
Name 5746bba6685f2760_3xsesmxu.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\3xsesmxu.0.cs
Size 463.0B
Processes 3000 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 3096af1d28ca298bcf9076e8f16a3234
SHA1 fba14e96bfe62df020412656995ac72ad019aa85
SHA256 5746bba6685f2760545c55a3d7871240eeaef6de4769cdec2c73535369ffec1d
CRC32 983CE3C6
ssdeep 6:V/DsYLDS81zu1Vx2mMibQXReKJ8SRHy4HLrKmELmQ1bdy:V/DTLDfuZ8XfHfqHLy
Yara None matched
VirusTotal Search for analysis
Name 8c51642c967f3c73_3xsesmxu.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\3xsesmxu.dll
Size 3.5KB
Processes 2412 (csc.exe) 3000 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 799bbd265b14fed30b44a6739852f1f1
SHA1 f988c1faf0d1796479f10ee737a3a46eb648f8a0
SHA256 8c51642c967f3c730b894b0c8f54710dc0bfccf142dd48ed02231aeb670e15ec
CRC32 D575D277
ssdeep 24:etGSN9KxWnwzVHskWWkQa8kUbdPtkZfu2t1X+mI+ycuZhNiakSqPNnq:6OHQkiMuJukRV1ulia3Gq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3000 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name f45e2b31e5148058_CSCB05F.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCB05F.tmp
Size 652.0B
Processes 2412 (csc.exe)
Type MSVC .res
MD5 f06edbbcc9b7528c961573d037d90986
SHA1 ec3e8c3933fa8f86a64a78e4caa4421029b12561
SHA256 f45e2b31e514805882297dbaecc00cd86290200f4e5d9e7a7d8be03b67305ad4
CRC32 9B775F12
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry0ak7YnqqqPN5Dlq5J:+RI+ycuZhNiakSqPNnqX
Yara None matched
VirusTotal Search for analysis
Name 957caa0caae1a8bc_3xsesmxu.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\3xsesmxu.cmdline
Size 311.0B
Processes 3000 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 6d268b22101520000d61e203fa18744c
SHA1 51c59d112896df48cca2380e278acf66f769b849
SHA256 957caa0caae1a8bce804503c7784bd925f46dbf322658f42a00f5c96d7b9c9f9
CRC32 E21997F7
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fGmGsSAE2NmQpcLJ23f7n:p37LvXOLMunPAE2xOLMjn
Yara None matched
VirusTotal Search for analysis
Name ebc17c4adc3b03f8_3xsesmxu.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\3xsesmxu.out
Size 598.0B
Processes 3000 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 b025bfbf4981262c48543fd5ee5352fe
SHA1 2da5921eb8cb69a57f60d1cc4c819b3d74071eda
SHA256 ebc17c4adc3b03f8ab54ef77838e96a0b82fcaac82b7836e9e547813e59e8d3e
CRC32 4350FAFD
ssdeep 12:K4X/NzR37LvXOLMunPAE2xOLMjuKai31bIKIMBj6I5BFR5y:KyNzd3BunIE2nCKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis