popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e9bb69f7c58708d8_RESC148.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESC148.tmp
Size 1.2KB
Processes 544 (cvtres.exe) 2660 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 3f9cea043ccc9c344bd3ae5ba1f3d54a
SHA1 b635724841aee2996f5723dffd908209856feaa9
SHA256 e9bb69f7c58708d8a7875f05a6243593f147bee0ee3d7f9458b4b68871b924ae
CRC32 0858DC52
ssdeep 24:HvJ9Yern8zIOEmHLUnhKLI+ycuZhNFRWakSqRHPNnqjtd:oernCEmonhKL1ulF8a3qjqjH
Yara None matched
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3016 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 48442343179c8016_gh_jpqeh.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gh_jpqeh.cmdline
Size 311.0B
Processes 3016 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 a2e8f1fb84df257833b86bfe846c24a6
SHA1 846207e0415b6c653983c5b4e80a4c80d686e0fd
SHA256 48442343179c801622fbaf15df3c13a77ba00fc793e179647ce95064f150aa77
CRC32 53DC3B99
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fdQmGsSAE2NmQpcLJ23fn:p37LvXOLMlQnPAE2xOLM/
Yara None matched
VirusTotal Search for analysis
Name c2f8ba9cd87b680d_gh_jpqeh.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gh_jpqeh.0.cs
Size 473.0B
Processes 3016 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 cbc8f71e1223cd46d435bc99640f96de
SHA1 bdb4b27215ea02d8c8b03f7933827b1c531b9ef8
SHA256 c2f8ba9cd87b680d6cb50ecc85568951d7149864a8b38b4cc1947963604e180c
CRC32 9926F8A6
ssdeep 6:V/DsYLDS81zujw8j2mM2QXReKJ8SRHy4HFfmtJqy3Iy:V/DTLDfuMMMXfHnyYy
Yara None matched
VirusTotal Search for analysis
Name ff32456df756863d_gh_jpqeh.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gh_jpqeh.pdb
Size 7.5KB
Processes 2660 (csc.exe) 3016 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 6af209b46148a3e47e05abe6016d87f3
SHA1 44f6ff7e0c5539a058736c5d9abb8c685dd69d60
SHA256 ff32456df756863d6f23b8503c7aba64ec3578fb34d4e62e72fd0e8f09a296ec
CRC32 AF154CCB
ssdeep 6:zz/BamfXllNS/QskF1mllxrS/77715KZYXjskflyMoGggksl/3YXBGQu+e0KWEi+:zz/H1W/Qs0SXS/pwws+lyMmqRi
Yara None matched
VirusTotal Search for analysis
Name 00ecef58ea130c7d_gh_jpqeh.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gh_jpqeh.dll
Size 3.5KB
Processes 2660 (csc.exe) 3016 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 11a0d8e03600e5d326a14b3fb3bc45e2
SHA1 a0f91fcfdc51a48e4057f429e180c463fc0d9fe7
SHA256 00ecef58ea130c7d77d81f1a4341bd57053f0517dec6964e9c2cfa884e31868e
CRC32 4D8B32D6
ssdeep 24:etGSoNiGTw3lq5OOklNaqnDUbdPtkZf+nA1wOmI+ycuZhNFRWakSqRHPNnq:6bpnLBMuJ+nA2F1ulF8a3qjq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 7a3e5591dd2ad2f9_CSCC0CA.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCC0CA.tmp
Size 652.0B
Processes 2660 (csc.exe)
Type MSVC .res
MD5 ac485ed6eaeb9ea7adc7957fcac6608f
SHA1 47d2ed5c5d0878836c94cc1e3c6958959d44ddf6
SHA256 7a3e5591dd2ad2f90cf63ce01d5ceac0b3d4995c6cef3cdb028841af60caa7f0
CRC32 E2578428
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry3RWak7YnqqqRHPN5Dlq5J:+RI+ycuZhNFRWakSqRHPNnqX
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_gh_jpqeh.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\gh_jpqeh.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 3f26b1380f477f85_gh_jpqeh.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\gh_jpqeh.out
Size 598.0B
Processes 3016 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 b48809c958e73440f31009d8462601a2
SHA1 7017440e5a90fa95b8c5217c42a474aa975261ec
SHA256 3f26b1380f477f855123fe6b8ab439ed73020287d30706c4c102c6e8a6eb9ad8
CRC32 C4B3CD20
ssdeep 12:K4X/NzR37LvXOLMlQnPAE2xOLMmKai31bIKIMBj6I5BFR5y:KyNzd3BlQnIE2nmKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis