popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 70f316a5492848bb_down[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\down[1]
Size 3.3KB
Type PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced
MD5 555e83ce7f5d280d7454af334571fb25
SHA1 47f78f68d72e3d9041acc9107a6b0d665f408385
SHA256 70f316a5492848bb8242d49539468830b353ddaa850964db4e60a6d2d7db4880
CRC32 9EA3279D
ssdeep 96:/SDZ/I09Da01l+gmkyTt6Hk8nTjTnJw1Ne:/SDS0tKg9E05TPoNe
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name afce792469d28568_ErrorPageTemplate[2]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\ErrorPageTemplate[2]
Size 2.2KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 cd78307e5749eb8aa467b025dc66bcd3
SHA1 7f85f932532719bc0ca23a21a24e146cdcd40668
SHA256 afce792469d28568da605230d27a6d5354f9451c60b5a3ce998edeaf098c8327
CRC32 12B03B3E
ssdeep 24:5Lj5x55k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+BieyuSQK:5f5H5k5pvFehWrrarrZIrHd35IQfOS6
Yara None matched
VirusTotal Search for analysis
Name 6976c426e3ac66d6_noConnect[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\noConnect[1]
Size 8.0KB
Type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
MD5 3cb8faccd5de434d415ab75c17e8fd86
SHA1 098b04b7237860874db38b22830387937aeb5073
SHA256 6976c426e3ac66d66303c114b22b2b41109a7de648ba55ffc3e5a53bd0db09e7
CRC32 F9D26F41
ssdeep 192:SSDS0tKg9E05TKPzo6BmMSpEJH8x07oLKsiF+2MxNdcNyVE:tJXE05g/uEJH8m7oLKLo2MxncUVE
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 5da7c8d33d3b7db4__isdecmp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1KOMR.tmp\_isetup\_isdecmp.dll
Size 23.7KB
Processes 1224 (setups.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 77d6d961f71a8c558513bed6fd0ad6f1
SHA1 122bb9ed6704b72250e4e31b5d5fc2f0476c4b6a
SHA256 5da7c8d33d3b7db46277012d92875c0b850c8abf1eb3c8c9c5b9532089a0bcf0
CRC32 6278054E
ssdeep 384:BHvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCgcoSmonTpXoi+Pbd0ia:BJ7FEAbd+EDsIO7oST1Yi+Ph0i
Yara
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name acd2bc6f0f4f0f0c_recoverystore.{b9111c19-9909-11eb-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B9111C19-9909-11EB-BDE1-94DE278C3274}.dat
Size 4.5KB
Processes 2744 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 5cc49b876862b78badd6444832af90d2
SHA1 1fe6e04b7aebc57cace03c6dee368eb028c0cbaa
SHA256 acd2bc6f0f4f0f0ccb36a112ebb674b338f54c9ee3a5bb07d55da5386d15e30b
CRC32 AF3B20EC
ssdeep 12:rlfF2jrEg5+IaCrI0F7+F2EIBrEg5+IaCrI0F7ugQNlTqbaxnx8DZNlTqbaxnx8s:rqj5/1Ec5/3QNlW2YNlW2
Yara
  • Microsoft_Office_Document_Zero - Microsoft Office Document Signature Zero
VirusTotal Search for analysis
Name 003d30e7d128c677_errorPageStrings[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\errorPageStrings[1]
Size 2.5KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 07d7197d980e82c3ce6b22c0342711ae
SHA1 e3e675f4507d3d2f4f56f06c76abdc40d09dd1a2
SHA256 003d30e7d128c6771b36ab2b0f02d36670e42488d86ba7db00ad862528266060
CRC32 3485002F
ssdeep 48:zTW8quJiyUlyHWKShUpeHRitRflRynLRX4Y1WW90W2olr8tcUV/9z8/pWMI9EMIN:zTW8qIiyUcAhUpIRSRflRynLRX4LMlrT
Yara None matched
VirusTotal Search for analysis
Name 469fdfcaca047a13_dnserror[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\dnserror[1]
Size 6.1KB
Type HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 8c98552955cbb31ebed64742bf23349a
SHA1 e1d12cf6c84e4dca1c69421209e12237633f8e75
SHA256 469fdfcaca047a13a75283d5fd4bb96b56a28666d9df02195fdc2a4b78250539
CRC32 1A5BE0FF
ssdeep 96:uATpCAEQIgGN2P8bWF2oxrjSaFXQsgUkn:ukp4QSN2aWFFjSGXQVUkn
Yara None matched
VirusTotal Search for analysis
Name b258c4d7d2113dee_itdownload.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1KOMR.tmp\itdownload.dll
Size 200.5KB
Processes 1224 (setups.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 d82a429efd885ca0f324dd92afb6b7b8
SHA1 86bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256 b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
CRC32 B44CDA1F
ssdeep 3072:lfb9mvexZXivFFmLFam1BEsW61HgAIwSMaentFGTaIgBx9rs0NBGZZuey2E0QeqB:lfbueviGLVUyHgAIwSMaenTrNWcmE
Yara
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • screenshot - Take screenshot
  • keylogger - Run a keylogger
  • win_registry - Affect system registries
  • win_files_operation - Affect private profile
  • Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration
  • Str_Win32_Wininet_Library - Match Windows Inet API library declaration
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • borland_delphi_dll - Borland Delphi DLL
VirusTotal Search for analysis
Name 50f814aa0cb77d40_setups.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-7FC88.tmp\setups.tmp
Size 699.5KB
Processes 1016 (setups.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b42ac864a109d3219709c65158f95673
SHA1 78f76fbc0387f9984f71c0807a18ba61ffd0016d
SHA256 50f814aa0cb77d407f46e4a7811fe866195aaa5516656ca62bb3d37a5344bf40
CRC32 21664EEF
ssdeep 12288:EqIRz+f+ui8TrPO37fzH4A63RRwDNtuXUZERvDrNMRdT9Taslb0GtzCOpkyx9ho:pIZg+uiirPO37fzH4A6haDzcUZEIdT96
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • escalate_priv - Escalade priviledges
  • screenshot - Take screenshot
  • keylogger - Run a keylogger
  • spreading_file - Malware can spread east-west file
  • win_mutex - Create or check mutex
  • win_registry - Affect system registries
  • win_token - Affect system token
  • win_private_profile - Affect private profile
  • win_files_operation - Affect private profile
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • borland_delphi - Borland Delphi 2.0 - 7.0 / 2005 - 2007
VirusTotal Search for analysis
Name 0afdfed86b9e8193_psvince.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1KOMR.tmp\psvince.dll
Size 42.5KB
Processes 1224 (setups.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 d726d1db6c265703dcd79b29adc63f86
SHA1 f471234fa142c8ece647122095f7ff8ea87cf423
SHA256 0afdfed86b9e8193d0a74b5752a693604ab7ca7369d75136899ff8b08b8c5692
CRC32 48964808
ssdeep 768:49aepKgsQzHklqt+hpVdTOECk13oMRSKxprl:KayJHl+hpXHz9RSKj
Yara
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name 07d07a467e4988d3_favcenter[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\favcenter[1]
Size 3.3KB
Type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
MD5 25d76ee5fb5b890f2cc022d94a42fe19
SHA1 62c180ec01ff2c30396fb1601004123f56b10d2f
SHA256 07d07a467e4988d3c377acd6dc9e53abca6b64e8fbf70f6be19d795a1619289b
CRC32 7FE3FBCC
ssdeep 96:RZ/I09Da01l+gmkyTt6Hk8nT1ny5y3iw+BT:RS0tKg9E05T1yIyw6
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 1471693be91e53c2_background_gradient[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\background_gradient[1]
Size 453.0B
Type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
MD5 20f0110ed5e4e0d5384a496e4880139b
SHA1 51f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA256 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
CRC32 C2D0CE77
ssdeep 6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name 1beb05868ce93bcc_IE9CompatViewList[1].xml
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\IE9CompatViewList[1].xml
Size 141.8KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 9b63e0fb3785ffa49686dd75e303d177
SHA1 e3992de5a1b8f58a11a52ad71f275ae413927eb4
SHA256 1beb05868ce93bcc8fafc46adccdda6d104f3c6f6c6ed454d8a6c0c208d9bd0e
CRC32 F778EDEF
ssdeep 3072:AoSMrEDL1FwhdFFaz6l8vHG+TbFPAzepobjyG7I1K1IB2+Tir8v1IG9aIedyPcFC:dSMrEDL1FwhdFFaz6l8vHG+TbFPAzepR
Yara None matched
VirusTotal Search for analysis
Name a76ac7665e777701_{b9111c1a-9909-11eb-bde1-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B9111C1A-9909-11EB-BDE1-94DE278C3274}.dat
Size 4.5KB
Processes 2744 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 8b83af757efe4370bb4ca3427432bc1b
SHA1 48b11cbea7b6c90c6d468121ef639ba534d74548
SHA256 a76ac7665e7777014aa3eaaa274a68d525e36967c8c542b19cb1decc2cc9726e
CRC32 283C1FB7
ssdeep 12:rl0ZGFCrEgmfcB06FTcDrEgmfh0qgNNlTVbaxLNlL9baxG5eX6Mf8l:rWGjGmNNlp+NlpZeK6
Yara
  • Microsoft_Office_Document_Zero - Microsoft Office Document Signature Zero
VirusTotal Search for analysis
Name 41e3f69ecc09290e_httpErrorPagesScripts[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\httpErrorPagesScripts[1]
Size 5.4KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 dea81ac0a7951fb7c6cae182e5b19524
SHA1 8022d0b818a0aea1af61346d86e6c374737bc95a
SHA256 41e3f69ecc09290ebc49be16d2415036ddb2f7a4b868eef4091d0b5a301762fe
CRC32 5E7F4A18
ssdeep 96:JCc1g1V1riA1CiOcitXred1cILqcpOnZ1g1V1OWnvvqt:xmjriGCiOciwd1BPOPmjOWnvC
Yara None matched
VirusTotal Search for analysis
Name e5a0ad2e37dde043_idp.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1KOMR.tmp\idp.dll
Size 216.0KB
Processes 1224 (setups.tmp)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 b37377d34c8262a90ff95a9a92b65ed8
SHA1 faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256 e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
CRC32 0106BEC4
ssdeep 3072:3kdYM0KYqpvmSM0IKNDe/zmNDNRpGFRMlCP7mYYY5Qt1reJbTg/knAD:UsKFrM7CNocNNreJb0/F
Yara
  • network_http - Communications over HTTP
  • network_ftp - Communications over FTP
  • screenshot - Take screenshot
  • win_files_operation - Affect private profile
  • Str_Win32_Wininet_Library - Match Windows Inet API library declaration
  • Str_Win32_Internet_API - Match Windows Inet API call
  • Str_Win32_Http_API - Match Windows Http API call
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name 388a796580234efc__setup64.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\is-1KOMR.tmp\_isetup\_setup64.tmp
Size 6.0KB
Processes 1224 (setups.tmp)
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e4211d6d009757c078a9fac7ff4f03d4
SHA1 019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
CRC32 2CDCC338
ssdeep 96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
Yara
  • win_files_operation - Affect private profile
  • PE_Header_Zero - PE File Signature Zero
  • IsPE64 - (no description)
  • IsConsole - (no description)
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis