popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 23161895cc82025f_lictfppc.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lictfppc.dll
Size 3.5KB
Processes 932 (csc.exe) 1728 (POWeRshelL.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f295a5ed96bbbe7eb3985a025409e25f
SHA1 a87881e3f2f3f2729caf3467bdd983ae8dd28cab
SHA256 23161895cc82025f842e88b010a9c8b47808d1f8c78b4729e3156e6371368c35
CRC32 F0FA8CF2
ssdeep 24:etGS1NOHGuEw+7Lq/9kKkU5gltUbdPtkZfr2mZl1OPmI+ycuZhNjWGakS4WXPNnq:6+CEWltMuJrhZlkO1ul9a3Bq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 444477f83d8c60dc_CSC9DFB.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC9DFB.tmp
Size 652.0B
Processes 932 (csc.exe)
Type MSVC .res
MD5 281f32ea3498dba1e3add156c2712fa2
SHA1 d636ced5fa3b1222f2709f5d4d251203305dc986
SHA256 444477f83d8c60dc08bb0138f7366ecb700f2544e51fdf18ed515de7bbe4c9f4
CRC32 445E0DF0
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryaqWGak7YnqqRqWXPN5Dlq5J:+RI+ycuZhNjWGakS4WXPNnqX
Yara None matched
VirusTotal Search for analysis
Name e848254e420fd50e_lictfppc.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lictfppc.cmdline
Size 311.0B
Processes 1728 (POWeRshelL.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 c96b6065d5a5fc501ca07b710e692546
SHA1 5643349f419192f4279551ad9fc6211e4186f45a
SHA256 e848254e420fd50eeeec7ad6479c033351f1fdd7a57283778a9210e8fd9528d5
CRC32 070FFC32
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fHDVnmGsSAE2NmQpcLJ23fHDVEx:p37LvXOLMFnPAE2xOLM6
Yara None matched
VirusTotal Search for analysis
Name 2f1655a43c2b14ba_lictfppc.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lictfppc.pdb
Size 7.5KB
Processes 932 (csc.exe) 1728 (POWeRshelL.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 3a2781b91e90d43ba8fac17b1520e841
SHA1 58798db306c12dee4caf3fc3a7ac9c9228f31599
SHA256 2f1655a43c2b14ba8b122ed4f11d5264aa594c33e0100fac8d05112464e72dd9
CRC32 C699C5FA
ssdeep 6:zz/BamfXllNS/SllpWDbg1mllxrS/77715KZYXfllpWDbLMoGggksl/3YXBGQu++:zz/H1W/SkoSXS/pwykAmqRi
Yara None matched
VirusTotal Search for analysis
Name 0ed5b0823e71e0e3_590aee7bdd69b59b.customDestinations-ms~RFf02ff9.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RFf02ff9.TMP
Size 7.8KB
Processes 1728 (POWeRshelL.exe) 1060 (powershell.exe)
Type data
MD5 f4a8a3e56bca0190031a365f104571cf
SHA1 7a4eac7016b8feca961f757cfe05bfeb4b76c10f
SHA256 0ed5b0823e71e0e3262a8a73ff269499135b20c9c5aa71e34b57a9f43218ed41
CRC32 E95A2C69
ssdeep 96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworQStDHXyWlUVul:QtbXoFtbbHnorFTyo
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 7a82dd3c5151ef97_lictfppc.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lictfppc.out
Size 598.0B
Processes 1728 (POWeRshelL.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 a75b3c153cd9c53dbef4011a04f4e79c
SHA1 bca49d8a61165e793df426ee6f831150c40a45cf
SHA256 7a82dd3c5151ef97459e43f682cc3cc479719ad9433ef8410f30d62a92065147
CRC32 12419C39
ssdeep 12:K4X/NzR37LvXOLMFnPAE2xOLMzKai31bIKIMBj6I5BFR5y:KyNzd3BFnIE2nzKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name d7984ae829db2ad2_lictfppc.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\lictfppc.0.cs
Size 470.0B
Processes 1728 (POWeRshelL.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 1b7db458ab6d1febf55faabae1cfeb94
SHA1 8c3456b33e14c129c6071fa57eb6afc02543e02d
SHA256 d7984ae829db2ad2967fdffaa8c83ff397fe072ac6779b20d89b0f55a462b79d
CRC32 2E05CF93
ssdeep 6:V/DsYLDS81zuPfUdM6RQXReKJ8SRHy4H4w9lSEUlb9NEMFvdKy:V/DTLDfuHNXfHcw9YEU7fFvdKy
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_lictfppc.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\lictfppc.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name e042c81bca501c6e_RES9E5A.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES9E5A.tmp
Size 1.2KB
Processes 2900 (cvtres.exe) 932 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 d4518501e2bf5edb3f626cf8b17e539d
SHA1 cf37cf02028b330ed33ccb645cb7fa1b18547a18
SHA256 e042c81bca501c6e6fd58dd45071601397f9dd77ceb0950624a74314501413bc
CRC32 247FF580
ssdeep 24:HiJ9YernqYKbmH+wUnhKLI+ycuZhNjWGakS4WXPNnqjtd:XernabmebnhKL1ul9a3BqjH
Yara None matched
VirusTotal Search for analysis