popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name f6161b1ef63b41d8_RES1E77.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES1E77.tmp
Size 1.2KB
Processes 2360 (cvtres.exe) 3028 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 bc8339f9bb5ff400a9c266138711fd92
SHA1 b37f91091fc7be346430674741c6f313a19fd7db
SHA256 f6161b1ef63b41d88b0ec9eb793ba58ba86351a639dd621dce439262513ab9b4
CRC32 60643E50
ssdeep 24:HIJ9Yern8FbTmHfUnhKLI+ycuZhNFakSTPNnqjtd:pernaTm8nhKL1ulFa3ZqjH
Yara None matched
VirusTotal Search for analysis
Name 8c293eb63a310484_ehimwunj.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ehimwunj.out
Size 598.0B
Processes 2632 (pOwersHElL.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 b6050bc55ada04b728c9b3a255ce9fec
SHA1 95142115e470d2f27de372f478351b51a64a1c56
SHA256 8c293eb63a31048404b12957cee89edde32ee85c2d47829c4cd2fa1760cdfce3
CRC32 257C3594
ssdeep 12:K4X/NzR37LvXOLMIQnPAE2xOLMt1Kai31bIKIMBj6I5BFR5y:KyNzd3BJnIE2nt1Kai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 5f3880ae2d3d7dbf_ehimwunj.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ehimwunj.dll
Size 3.5KB
Processes 3028 (csc.exe) 2632 (pOwersHElL.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5091eab0486370850fc9a0171ff1b4bb
SHA1 745fd99a82bf7429d6edfaf790313ea173fd51aa
SHA256 5f3880ae2d3d7dbf75ff0797c3b35f264593001e0f729581d00682189dfc8a61
CRC32 2E7BBFF2
ssdeep 24:etGS7NOHGuEw+75EgOkFaq5bUbdPtkZfhv1fL+cQmI+ycuZhNFakSTPNnq:6oaZjbMuJhv1+y1ulFa3Zq
Yara
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 94354ac41122acfb_ehimwunj.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ehimwunj.pdb
Size 7.5KB
Processes 3028 (csc.exe) 2632 (pOwersHElL.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 68101c39500d11296e7a28024a4948d3
SHA1 053488f33114960d8fb4006b4b3889e89d5e469d
SHA256 94354ac41122acfb21b9340e5750ba6f1adabb332b360d4972b3e74ca3b1b426
CRC32 25BA5EFE
ssdeep 6:zz/BamfXllNS/+1fsA1mllxrS/77715KZYXJ1fsrMoGggksl/3YXBGQu+e0KWEi+:zz/H1W/cxSXS/pw8zmqRi
Yara None matched
VirusTotal Search for analysis
Name 3c667a3bd30fef3a_ehimwunj.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ehimwunj.0.cs
Size 472.0B
Processes 2632 (pOwersHElL.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 ebe44eb3851718dda661ef08a5ae1f72
SHA1 fc84762887e0b10691ab43cb52f59169096936ec
SHA256 3c667a3bd30fef3aa5caf37fb56f20687efa429605d0412bad70f15890e9e6d4
CRC32 C19BA607
ssdeep 6:V/DsYLDS81zumeUrMORQXReKJ8SRHy4HmGmOR6m+D/g1MqQy:V/DTLDfumesWXfHxAD42qQy
Yara
  • Network_Downloader - File Downloader
VirusTotal Search for analysis
Name becd312fd4be3cde_CSC1E18.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC1E18.tmp
Size 652.0B
Processes 3028 (csc.exe)
Type MSVC .res
MD5 c3577323a03e48d8e69e29d38e5a2b71
SHA1 90359328c85e7a891217066a6df0b808de29081e
SHA256 becd312fd4be3cde831bc6170732f2b8e93c24c850da660acf04d625cb0104dd
CRC32 6315410D
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry4Yak7Ynqq5NPN5Dlq5J:+RI+ycuZhNFakSTPNnqX
Yara None matched
VirusTotal Search for analysis
Name 3a255c0024916f19_590aee7bdd69b59b.customDestinations-ms~RF1dec186.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1dec186.TMP
Size 7.8KB
Processes 2632 (pOwersHElL.exe) 2788 (powershell.exe)
Type data
MD5 6fd29def73b2779e0ae71c4eecd304f7
SHA1 4ba660e4db856e04eb93a01c59ee764259ec55e7
SHA256 3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6
CRC32 1F966CD8
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14_ehimwunj.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\ehimwunj.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name d6b6077a344a31a3_ehimwunj.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ehimwunj.cmdline
Size 311.0B
Processes 2632 (pOwersHElL.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 a623fa57d7d26aa8be23614957ecdf65
SHA1 b2d3cfcff2ad68db8b4a867c6467d991b630377c
SHA256 d6b6077a344a31a39fb85eb270cccdd1bccee246b76683d780fec9b59ea3cf97
CRC32 3731047F
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fQQmGsSAE2NmQpcLJ23fiGA:p37LvXOLMIQnPAE2xOLMtA
Yara None matched
VirusTotal Search for analysis