popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14_bgnkxhwj.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\bgnkxhwj.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 510abd78a0252e2f_bgnkxhwj.out
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\bgnkxhwj.out
Size 598.0B
Processes 3012 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
MD5 698ffe20db83121b8420716758ac18d1
SHA1 9d435df65c907cc071166fb896ce92f127db802c
SHA256 510abd78a0252e2f0227d1e8d9f342d045f0a8e69de11db2aed18a2bfa28c992
CRC32 F61C8BFE
ssdeep 12:K4X/NzR37LvXOLMPnPAE2xOLMm4Kai31bIKIMBj6I5BFR5y:KyNzd3BPnIE2nm4Kai31bIKIMl6I5Dvy
Yara None matched
VirusTotal Search for analysis
Name d075be401b0e0035_bgnkxhwj.0.cs
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\bgnkxhwj.0.cs
Size 475.0B
Processes 3012 (powershell.exe)
Type C++ source, UTF-8 Unicode (with BOM) text, with very long lines
MD5 a6c27a69df33d4c2164173ff594e4bf2
SHA1 b51e06661718cb683b213751f680add206f91dcc
SHA256 d075be401b0e0035a666e78177f31ad8c2e7851dddb8f83c165f5154321abb84
CRC32 22CC6BF2
ssdeep 6:V/DsYLDS81zunyO/HdMevQXReKJ8SRHy4HtXrll/wKRNswvIy:V/DTLDfuX/HUXfHxkKAwwy
Yara None matched
VirusTotal Search for analysis
Name 9d404a487a47ce06_CSCACC5.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\CSCACC5.tmp
Size 652.0B
Processes 2480 (csc.exe)
Type MSVC .res
MD5 b4b5e7a8c4ae27703362b5b0d5099a19
SHA1 4bfe1fdf117ff7939cca585300921fbce040d629
SHA256 9d404a487a47ce06109bfccc6e4737fb92ed1f9c05f28c303626643955eb986c
CRC32 8F356792
ssdeep 12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryuRaak7YnqqTRrPN5Dlq5J:+RI+ycuZhN/akSBPNnqX
Yara None matched
VirusTotal Search for analysis
Name 44e8aa0601fffe82_590aee7bdd69b59b.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size 7.8KB
Processes 3012 (powershell.exe)
Type data
MD5 ee6cfd78f72f03663db2a7df0c696dd7
SHA1 56126e81a5f6577f8e24a890185d0c9eb600fa02
SHA256 44e8aa0601fffe82c494bbc7d7280aa3bc5e90effe2aee2d716d5716e1d6b568
CRC32 F27137C4
ssdeep 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu4tDHXyGlUVul:EtCgXoRtCgbHnorBTyY
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 19d058d6f3853dd7_RESAD62.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\RESAD62.tmp
Size 1.2KB
Processes 2516 (cvtres.exe) 2480 (csc.exe)
Type Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x406, 9 symbols
MD5 3564034a132474be77937bb29ecbbd40
SHA1 d45f63aaa941f151bc9ab1193faaf95bfa233756
SHA256 19d058d6f3853dd717f5f79dc73ad0e0a9498ea2b3251b9937749abd1411a66f
CRC32 9E0AF8EC
ssdeep 24:H1J9Yernv5SOFmHIUnhKLI+ycuZhN/akSBPNnqjtd:aernv4OFmDnhKL1ul/a3zqjH
Yara None matched
VirusTotal Search for analysis
Name 2ca67ba72ab71895_bgnkxhwj.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\bgnkxhwj.dll
Size 3.5KB
Processes 2480 (csc.exe) 3012 (powershell.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3eeaef2a66d1b01457f2a2db5fd35df1
SHA1 a81d6d9da52c05b6837775a9137a536ce4decda6
SHA256 2ca67ba72ab718951634cd6d272aaed4beaf673d764c1d96b6094cb55bfee15a
CRC32 B47F9EC0
ssdeep 24:etGStE9KxWnwzVt7xjukzQq5UbdPtkZfXdSU13v3YyfNmI+ycuZhN/akSBPNnq:6trn1MuJXMUJvo2o1ul/a3zq
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Is_DotNET_DLL - (no description)
VirusTotal Search for analysis
Name 82a83ba6f8f16f3e_bgnkxhwj.pdb
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\bgnkxhwj.pdb
Size 7.5KB
Processes 2480 (csc.exe) 3012 (powershell.exe)
Type MSVC program database ver 7.00, 512*15 bytes
MD5 d04ac12f2dd321928b54dfb9af1d15d5
SHA1 3071378dab19ac8659747efd2c6d39e6eeb18370
SHA256 82a83ba6f8f16f3e080cdd112c8a6713fa30cae5d6803ab50b7c2e12a3cff7a0
CRC32 4455B040
ssdeep 6:zz/BamfXllNS/ekXvYyF1mllxrS/77715KZYX1kXvYyloGggksl/3YXBGQu+e0Kd:zz/H1W/TvYyPSXS/pwzvYylmqRi
Yara None matched
VirusTotal Search for analysis
Name 18d462eb5b75112f_bgnkxhwj.cmdline
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\bgnkxhwj.cmdline
Size 311.0B
Processes 3012 (powershell.exe)
Type UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
MD5 1e730a62729a78d1e684f2865ee9b8af
SHA1 3c9ded780186629a1d49967ae448e70b62d9fc33
SHA256 18d462eb5b75112f7c2285184b71be991589023cbd7cccf39a0f3f48ed14dc07
CRC32 22861B43
ssdeep 6:pAu+H2LvFJDdq++bDdqBnmQpcLJ23fnmGsSAE2NmQpcLJ23fu9:p37LvXOLMPnPAE2xOLMm9
Yara None matched
VirusTotal Search for analysis