popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 0e4c3eab3f9bd681_hwico4i0.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hwico4i0.out
Size 598.0B
Processes 1560 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 0f81d2681524b136d836ae7a95963165
SHA1 93bd574ded963e8eeeb55f9187a7978ed44077eb
SHA256 0e4c3eab3f9bd681e81078070ab1dd63b7c6edecdd9100fe1fb0171629818dde
CRC32 BAE72B72
ssdeep 12:K4X/NzR37LvXOLMaLmnPAE2xOLMaLaKai31bIKIMBj6I5BFR5y:KyNzd3BaLmnIE2naLaKai31bIKIMl6IU
Yara None matched
VirusTotal Search for analysis
Name 2c528ab02d097f05_hwico4i0.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hwico4i0.dll
Size 3.5KB
Processes 2508 (csc.exe) 1560 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 00cdb18e57419b6d108b0943e88076ab
SHA1 22de6ea35442aaadc534d04147a2665c8ce61a88
SHA256 2c528ab02d097f05e9d4aac179bed55d2631fa9a107c71297104901fd2b4a66b
CRC32 C8DA1A25
ssdeep 24:etGS7WN+GSOw8Lq/9kKIqU5ggLeUbdPtkZf90mHNIBt1CNKaLWmI+ycuZhNdakSI:69nq/vWOeMuJymtIf0KAt1ulda3xq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name ab76562e36bf4d92_hwico4i0.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hwico4i0.pdb
Size 7.5KB
Processes 2508 (csc.exe) 1560 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 3a79ada370d35a9782c5c9584af15ac9
SHA1 6754875fd5c3cdc20904bbbccc7cbf9dd1ce24ea
SHA256 ab76562e36bf4d9213298ab4b20a7a3cf76cff92e97c602d5416b5f63f9a36ae
CRC32 E7CB2F2A
ssdeep 6:zz/BamfXllNS/mNO91mllxrS/77715KZYXDNICpMoGggksl/3YXBGQu+e0KWEi+:zz/H1W/G+SXS/pwmIqMmqRi
Yara None matched
VirusTotal Search for analysis
Name b532bdfd47a18199_CSC3A5F.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSC3A5F.tmp
Size 652.0B
Processes 2508 (csc.exe)
Type MSVC .res
MD5 a7750d982091e675094097dc2fafcb28
SHA1 e9763fef79e6dce9bd077376035301c76dcdd77c
SHA256 b532bdfd47a181993998ed1eded5c3935bdf681ce683c9d8e6906f1530c6877d
CRC32 F3126F23
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryfak7Ynqq7PN5Dlq5J:+RI+ycuZhNdakS7PNnqX
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_hwico4i0.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\hwico4i0.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 0ed5b0823e71e0e3_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 1560 (powershell.exe)
Type data
MD5 f4a8a3e56bca0190031a365f104571cf
SHA1 7a4eac7016b8feca961f757cfe05bfeb4b76c10f
SHA256 0ed5b0823e71e0e3262a8a73ff269499135b20c9c5aa71e34b57a9f43218ed41
CRC32 E95A2C69
ssdeep 96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworQStDHXyWlUVul:QtbXoFtbbHnorFTyo
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name aa8fc15e2a8a8612_hwico4i0.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hwico4i0.cmdline
Size 311.0B
Processes 1560 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 17afc2ad407f0d8041fc9952747eca44
SHA1 db79537605fc7be20f90cfc70b3cb9b23db3f99b
SHA256 aa8fc15e2a8a861214e802c442638829e71593fda87f1d39be734e37955ae341
CRC32 FA5EE827
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fCLmmGsSAE2NmQpcLJ23fCLb:p37LvXOLMaLmnPAE2xOLMaLb
Yara None matched
VirusTotal Search for analysis
Name 0c3bf00e589e0f23_hwico4i0.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\hwico4i0.0.cs
Size 486.0B
Processes 1560 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 80df00e05039bed15106a36137db1880
SHA1 7af28560e3dbca466635fe6a019122977c6119bf
SHA256 0c3bf00e589e0f232384f324a47dcde879870b7ee1414142fce345b88e8dae90
CRC32 CD3E828F
ssdeep 6:V/DsYLDS81zuL6FWmMCQXReKJ8SRHy4HobOSuVL+L/EP7ZxFFQy:V/DTLDfuuYXfH0oJzZuy
Yara None matched
VirusTotal Search for analysis
Name 800878efef856026_RES3ACE.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RES3ACE.tmp
Size 1.2KB
Processes 2084 (cvtres.exe) 2508 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 a72fda3fd59f263ba5d80390234c22ab
SHA1 373df9e1ad297298fd040d92d169730f6d5eb8f9
SHA256 800878efef8560264ef75f5af4f8e36bbf7ff430815187d3816a77414ced5767
CRC32 8F9901A0
ssdeep 24:HRiJ9YernkvlV3mHWoUnhKLI+ycuZhNdakS7PNnqjtd:VernklV3m2DnhKL1ulda3xqjH
Yara None matched
VirusTotal Search for analysis