popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 44e8aa0601fffe82_590aee7bdd69b59b.customDestinations-ms~RF1947b8b.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1947b8b.TMP
Size 7.8KB
Processes 2980 (pOweRSheLl.ExE) 2232 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name e3b0c44298fc1c14_ipb0cqod.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\ipb0cqod.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 1fc1fbcef3f07712_ipb0cqod.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ipb0cqod.pdb
Size 7.5KB
Processes 2972 (csc.exe) 2980 (pOweRSheLl.ExE)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 c3f6ef7916df3ad167ce90a8f611d819
SHA1 7ef6c93a22bfaf0b154a5f5f941c9c3b1438559c
SHA256 1fc1fbcef3f077121159f67bbd600b41dbe98ee1d318347ffa52333e140646cc
CRC32 B6F718D2
ssdeep 6:zz/BamfXllNS/KcM/Oz/l31mllxrS/77715KZYXhcM/ODFoGggksl/3YXBGQu+e1:zz/H1W/hM/E/fSXS/pwBM/OFmqRi
Yara None matched
VirusTotal Search for analysis
Name f2f60be683e5dc81_ipb0cqod.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ipb0cqod.out
Size 598.0B
Processes 2980 (pOweRSheLl.ExE)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 b83acf7c098c7ae1e25812b512c38c69
SHA1 56cef0a369b968493a70e9376baa1fbead8fd800
SHA256 f2f60be683e5dc8167c5527fb8625751f103c701018d0728add6b46f155caed3
CRC32 1B29758B
ssdeep 12:K4X/NzR37LvXOLM6nPAE2xOLMNUKai31bIKIMBj6I5BFR5y:KyNzd3B6nIE2nmKai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 3b955e3c74519870_ipb0cqod.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ipb0cqod.0.cs
Size 480.0B
Processes 2980 (pOweRSheLl.ExE)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 ce22e90871744b25a04ac8c5691f49cc
SHA1 bc0a93c1fe61e00daa34774994b638d19f735228
SHA256 3b955e3c74519870aacef3876b7cdc4420f0b77d2d09937b7385e8b578f26546
CRC32 C06D784A
ssdeep 6:V/DsYLDS81zuH0qiwPMmHnQXReKJ8SRHy4HOCluVmmZOe/o2Iy:V/DTLDfuH05tXfH6ysXIy
Yara None matched
VirusTotal Search for analysis
Name 7a63c2808f0c2387_ipb0cqod.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ipb0cqod.dll
Size 3.5KB
Processes 2972 (csc.exe) 2980 (pOweRSheLl.ExE)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 fbc25511c964f54edfaaae0cd1b4314a
SHA1 9f0516f1f90036d4275fcae090a6e0e42edb8476
SHA256 7a63c2808f0c23870cd192db156c59fae08bc97a979e0fd61764fcd796784366
CRC32 AA67D11B
ssdeep 24:etGSSdatX2vw1JTkLFZ/Hf6UbdPtkZfq0VP1C6mI+ycuZhN5MakSuBPNnq:6Tp0T6MuJqIPQJ1ul+a3qq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 0c61477e8e4f6bd1_ipb0cqod.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ipb0cqod.cmdline
Size 311.0B
Processes 2980 (pOweRSheLl.ExE)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 f68f136edeadbf694d4cd9ef6a96d562
SHA1 50eb27c2fe9ea12249cf3f0f9eef4977ada699e7
SHA256 0c61477e8e4f6bd13ce32a93df995e947f36a8027b7851d26806c307e2211fa4
CRC32 4E556A67
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23f9wmGsSAE2NmQpcLJ23fFxn:p37LvXOLM6nPAE2xOLMNx
Yara None matched
VirusTotal Search for analysis
Name 79907edf513b6af4_RES260D.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES260D.tmp
Size 1.2KB
Processes 1892 (cvtres.exe) 2972 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 04eaff6ea548f73fa10e964f7492cf5e
SHA1 3f40f298fa49427d27b71d23c2f408d35c43ba86
SHA256 79907edf513b6af460f60f6d764f709da6cfaa8799074eed293bb7eee981838d
CRC32 7E1F80E7
ssdeep 24:HTJ9YernIm3mHKwUnhKLI+ycuZhN5MakSuBPNnqjtd:8ern/mqbnhKL1ul+a3qqjH
Yara None matched
VirusTotal Search for analysis
Name 90dd2b3a10787dbd_CSC258F.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC258F.tmp
Size 652.0B
Processes 2972 (csc.exe)
Type MSVC .res
MD5 ffd67fb9305a1d44ff83a83bc8dd4a89
SHA1 e100f6da889f3aba0bba03195c0660a28fb33c18
SHA256 90dd2b3a10787dbd3c1312573013012803e710c30dd5604e324190e71bd85c4c
CRC32 43F578B4
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry7Mak7YnqquBPN5Dlq5J:+RI+ycuZhN5MakSuBPNnqX
Yara None matched
VirusTotal Search for analysis