popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name d47bc41800651733_vm8aajwx.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vm8aajwx.out
Size 607.0B
Processes 2560 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 268563775145af83964c1da9ff93645c
SHA1 d500c4109dd9e52e1d325adeba4eab0bd68539e6
SHA256 d47bc41800651733a5810fe6c36b31c24c1e388c3261867f1b9987adbe17caff
CRC32 0053F432
ssdeep 12:K4OLM9nzR37LvXOLMhlInPAE2xOLMhlMKai31bIKIMBj6I5BFR5y:K+9nzd3BhKnIE2nhWKai31bIKIMl6I5G
Yara None matched
VirusTotal Search for analysis
Name 4dd9f618bd7c97f4_vm8aajwx.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vm8aajwx.cmdline
Size 311.0B
Processes 2560 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 a85482061ee9ba0cfc84079135744b95
SHA1 5c7e1f61c38072a0fce5381872ebbf9714e9f3e5
SHA256 4dd9f618bd7c97f4226c1e5e4e611762bc8ef6e00b1a70f1e9fe895bb64a2d2f
CRC32 321CE3CA
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fpEqImGsSAE2NmQpcLJ23fpEqJ:p37LvXOLMhlInPAE2xOLMhlJ
Yara None matched
VirusTotal Search for analysis
Name ab5ed5d9d2e9ce36_vm8aajwx.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vm8aajwx.pdb
Size 7.5KB
Processes 2676 (csc.exe) 2560 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 96cf92df7eac88fb3e5e3a7faa113ab8
SHA1 7e88c71ce49da4fc63ef2c2a9f19f675c3c8e079
SHA256 ab5ed5d9d2e9ce36193385650e1f65b5337bce307b9a297cb52bb66763f9b80d
CRC32 66DAC817
ssdeep 6:zz/BamfXllNS/AF6vt31mllxrS/77715KZYXxGQu+e0KpYXdF6v/tfoGggksl/cI:zz/H1W/A6tlSXS/pw2qQ6/tfRD
Yara None matched
VirusTotal Search for analysis
Name e942a03ebee7e375_CSCF712.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCF712.tmp
Size 652.0B
Processes 2676 (csc.exe)
Type MSVC .res
MD5 9edbd8c6ada994bcee5faefc756d56c3
SHA1 7b28fc4e9a05da76a592fc36928a40bdd52d3318
SHA256 e942a03ebee7e37543a9b363ba73398191a5eaa4948e3e66feb237ddda9be05c
CRC32 ED2DC97E
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryUak7YnqqKPN5Dlq5J:+RI+ycuZhNyakSKPNnqX
Yara None matched
VirusTotal Search for analysis
Name 5a67bcd5871f71a7_vm8aajwx.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vm8aajwx.0.cs
Size 468.0B
Processes 2560 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators
MD5 52cc39367c8ed123b15e831e52cbd25f
SHA1 497593af41731aedd939d2234d8d117c57a6d726
SHA256 5a67bcd5871f71a78abf1da47c3529617f34b47a5ab7bde0f1133a33fa751012
CRC32 3D3641A5
ssdeep 12:V/DTLDfuUrE+mQMTOpEtc9JFqmmsmPzgKy:JjmYE+mZTCE29LqtsmPz9y
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_vm8aajwx.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\vm8aajwx.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2560 (powershell.exe)
Type data
MD5 81ca4510272caf505e8091e9a28cb716
SHA1 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e
SHA256 b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf
CRC32 FC31E90F
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 532d693315e21ab5_vm8aajwx.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\vm8aajwx.dll
Size 3.5KB
Processes 2676 (csc.exe) 2560 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 af898c7869d5737c6da3e229de14bcc4
SHA1 965921bd5c7d5c7625acdca0ae662c7c0a6ebdfb
SHA256 532d693315e21ab5d2e5b3914c3d2324cc0bd0162a34cd084d3f1a6c26f7cb35
CRC32 C1413F5A
ssdeep 24:etGSNc+8De6H3qvQCQ/CEItOij7bdPtkZfkMXIJKNShDJ2ihWYsmI+ycuZhNyakl:6cKvw/CLxxuJkANIiijf1ulya3mqa
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 70541a58935de2b5_RESF722.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESF722.tmp
Size 1.2KB
Processes 2720 (cvtres.exe) 2676 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 e463ae502a8f75379ebe9ee3ed966fbe
SHA1 fcddc2656ba597848902c0badf9e5b4bd41be12d
SHA256 70541a58935de2b5281a76f08fc6d91614c9a8636de8e8bb5f1f00faa8ea6049
CRC32 8E434C6B
ssdeep 24:HLJ9YernFSmHWUnhKLI+ycuZhNyakSKPNnqjtd:EernsmhnhKL1ulya3mqjH
Yara None matched
VirusTotal Search for analysis