popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 072b9db4288af008_icd74nk2.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\icd74nk2.cmdline
Size 311.0B
Processes 3008 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 3a883eec26f6ca2ca3bc137a8c246639
SHA1 783931961eaaf257adf1dd3719153338c2623569
SHA256 072b9db4288af0080592866c0b51e3e01d15d02910724ce67622cae784ca2efd
CRC32 4370BEB6
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fjFmmGsSAE2NmQpcLJ23fjFV9:p37LvXOLMYnPAE2xOLMr9
Yara None matched
VirusTotal Search for analysis
Name f65bbc67235bacec_icd74nk2.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\icd74nk2.out
Size 598.0B
Processes 3008 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 60250d5a8a2ab64634924b8ba5684d16
SHA1 328f7dd9e54efaa60b5ebb399f06bcc895f2c0ce
SHA256 f65bbc67235bacec23cd896ee3517589477a2501e62bf7a3b561ae4508c40502
CRC32 F34E1AA6
ssdeep 12:K4X/NzR37LvXOLMYnPAE2xOLMr4Kai31bIKIMBj6I5BFR5y:KyNzd3BYnIE2nr4Kai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name 696ef057ce1a710a_RESAB6E.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESAB6E.tmp
Size 1.2KB
Processes 2400 (cvtres.exe) 2432 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 4585ef929fcd98bb7c31035bd87f2612
SHA1 24c3ba7ba85f0c40838b8bfd881b658ea3470707
SHA256 696ef057ce1a710ae324a7a4e7e5d48eb7d938740d8a01919adc820958ad1d2d
CRC32 05B733AA
ssdeep 24:HL6J9Yern8/6mHpUnhKLI+ycuZhNOakSWPNnqjtd:Lern8SmGnhKL1ulOa3qqjH
Yara None matched
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3008 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 95469e86a7ad56cf_icd74nk2.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\icd74nk2.pdb
Size 7.5KB
Processes 2432 (csc.exe) 3008 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 b7030c1df8ce577aee751331b8dcc17a
SHA1 b752e4b9ce73973f4886812883f61e13aa28f304
SHA256 95469e86a7ad56cfb7895ecadde4fa043995c3b523be1f87def067f98af90e00
CRC32 13033CAC
ssdeep 6:zz/BamfXllNS/UF8/P1mllxrS/77715KZYX5FekMoGggksl/3YXBGQu+e0KWEi+:zz/H1W/UctSXS/pw0ekMmqRi
Yara None matched
VirusTotal Search for analysis
Name a4d0671a65b86b20_icd74nk2.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\icd74nk2.dll
Size 3.5KB
Processes 2432 (csc.exe) 3008 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8b31518596e7aa825a4fd9edf5168719
SHA1 67ba8cc615f1ff8c1aa16e4083ae7bf799d1fe2b
SHA256 a4d0671a65b86b20204953f28f968e5f0a784c45a4c891aa0735bffe9eb05ea0
CRC32 C3128E6C
ssdeep 24:etGSyWNiGTw3lqp6mgkzu8K1xgtUbdPtkZfZa5UuIV1KeomI+ycuZhNOakSWPNnq:6mpV2LEgtMuJZaKbEeT1ulOa3qq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • Network_Downloader - File Downloader
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 21b5a917a033d5ee_CSCAB00.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCAB00.tmp
Size 652.0B
Processes 2432 (csc.exe)
Type MSVC .res
MD5 5ba2ef2bcb81140c5c5d62ea2d53b12a
SHA1 5d0a9519588beb2f3d08a0403487a2f2aa310c1e
SHA256 21b5a917a033d5ee72eed06b9b215bcb94607ad47bdfa104814ab7fe1fbbde67
CRC32 7F5E1DC3
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryN+ak7YnqqmfPN5Dlq5J:+RI+ycuZhNOakSWPNnqX
Yara None matched
VirusTotal Search for analysis
Name 43f4204a7211616a_icd74nk2.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\icd74nk2.0.cs
Size 480.0B
Processes 3008 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 878ef8307e7854f9fc7d5ec99dd9fc04
SHA1 0be45f31f89a847d0ed34227bc46c7dc434d41ff
SHA256 43f4204a7211616a361f86b3ab2220b1855d15c61ab71f9327dbafd3c58af591
CRC32 43AE5E72
ssdeep 6:V/DsYLDS81zuaQF05oFFVMmNvQXReKJ8SRHy4HgCcxUYKCQ1Okzy:V/DTLDfuZvFMXfHUDxU97zy
Yara
  • Network_Downloader - File Downloader
VirusTotal Search for analysis
Name e3b0c44298fc1c14_icd74nk2.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\icd74nk2.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis