popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 9dc5ed543efb2ef3_RES163E.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES163E.tmp
Size 1.2KB
Processes 3008 (cvtres.exe) 1536 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 5c98a00e8273cd9f0bf304c50c4cad8c
SHA1 383ac48fda9f74b02e9d816638dc10263c5a2e4a
SHA256 9dc5ed543efb2ef32ee60758f989bb61a3b034ca77a8cf197373f8cbece91aed
CRC32 7AC8A88A
ssdeep 24:HY6J9YernIc/kZmHeUnhKLI+ycuZhNoHoakShH9PNnqjtd:OernDWmZnhKL1uloHoa3hHnqjH
Yara None matched
VirusTotal Search for analysis
Name 514f001439b15a1b_ki9mslvh.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ki9mslvh.out
Size 598.0B
Processes 2944 (PoWERsHeLl.EXe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 232fdaca0d07df6f0787efe540a57bae
SHA1 275572ab5ab46869f718dc1428c8fcfcc1b0be0d
SHA256 514f001439b15a1b04e1fbcd9f2ab76d0a9b269b832eff13c246ac01fc81a6be
CRC32 3A719EE2
ssdeep 12:K4X/NzR37LvXOLMMBQnPAE2xOLMMaKai31bIKIMBj6I5BFR5y:KyNzd3BAQnIE2n3Kai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 977b687ccdcaea25_ki9mslvh.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ki9mslvh.0.cs
Size 472.0B
Processes 2944 (PoWERsHeLl.EXe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 1a212b8a44924d84eeba108f2409b5e8
SHA1 b19066fab9c3329cd206958dacee65a08607586b
SHA256 977b687ccdcaea25b4afdd04dbac19bf12b31afad4ae226d7b7e5ed5cabcf073
CRC32 EBFAC970
ssdeep 6:V/DsYLDS81zuE40zmMm/nQXReKJ8SRHy4H+J4EEJ4rNgueIy:V/DTLDfuER5XfHCzETueIy
Yara None matched
VirusTotal Search for analysis
Name d4cbad6af4b7f478_ki9mslvh.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ki9mslvh.dll
Size 3.5KB
Processes 1536 (csc.exe) 2944 (PoWERsHeLl.EXe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8d8a3dbc1a9d4c53ae1dac2b27bf64d2
SHA1 dd57e8e908838d3a20e01232f1a7cc8c0c6329fd
SHA256 d4cbad6af4b7f4785e63f9b526e41bee3aa674c3c261beadfb43e5d7e9e3ac55
CRC32 AFCDF5CF
ssdeep 24:etGSyN6G7wcp6lgkvK1bsStUbdPtkZfZTW21A3mI+ycuZhNoHoakShH9PNnq:6h/zhStMuJZTW2eW1uloHoa3hHnq
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customDestinations-ms~RF1822e0f.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1822e0f.TMP
Size 7.8KB
Processes 2944 (PoWERsHeLl.EXe) 2168 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 04b93a34ceb1785e_ki9mslvh.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ki9mslvh.pdb
Size 7.5KB
Processes 1536 (csc.exe) 2944 (PoWERsHeLl.EXe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 13362a275a55307f5ee67b6e3f812227
SHA1 049546ef41f3a2b9cb111e1d82d4891e9383040d
SHA256 04b93a34ceb1785e374e00ee8a5d057d80195cd34a50c612644a9251fb4242c1
CRC32 C2D73FF1
ssdeep 6:zz/BamfXllNS/tx1mllxrS/77715KZYXuMioGggksl/3YXBGQu+e0KWEi+:zz/H1W/tTSXS/pwNRmqRi
Yara None matched
VirusTotal Search for analysis
Name 24c046658f4e78c3_ki9mslvh.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ki9mslvh.cmdline
Size 311.0B
Processes 2944 (PoWERsHeLl.EXe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 e15110ad21b1c2633d70f07a1c9ee471
SHA1 bb1e22324e3fdb0c2e34fe092838ae0676008900
SHA256 24c046658f4e78c3334aaf59192626d35629edefa30ba7ea6c8771964f8476fb
CRC32 601C2EAF
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23f0BQmGsSAE2NmQpcLJ23f0b:p37LvXOLMMBQnPAE2xOLMMb
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_ki9mslvh.err
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\ki9mslvh.err
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 246da4ff3a7a4426_CSC15D0.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC15D0.tmp
Size 652.0B
Processes 1536 (csc.exe)
Type MSVC .res
MD5 db39fb9e5dda4edb0551ecf82c0e0e18
SHA1 abd378999e1f975425a2d97f5b7531ff5b51f389
SHA256 246da4ff3a7a44267c62771f892b42643b1c02862cdd94aed50af4e28f13f1a2
CRC32 567F9D3C
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryCHoak7YnqqhH9PN5Dlq5J:+RI+ycuZhNoHoakShH9PNnqX
Yara None matched
VirusTotal Search for analysis