popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 2c9d0d53f3a79988_folder-drag-accept-symbolic.symbolic.png
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\folder-drag-accept-symbolic.symbolic.png
Size 194.0B
Processes 2784 (.svchost.exe)
Type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
MD5 aa914e2bdbde1ec9c239435d8b055a02
SHA1 8a58a07f6b36402a8056bd95a1464d16d92638f3
SHA256 2c9d0d53f3a79988827dfb4ef3976426b1bbbfab86fec7acbe54f18d701ed5a7
CRC32 12DC852D
ssdeep 3:yionv//thPl9vt3lAnsrtxBll+xdozoKn/NDPuOT1mLpRkNKukdT08egUiBwpH42:6v/lhPysIoEKhueyykOi6w1Py5QAVp
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 308e7004f86037c5_undergaaedes.ini
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Undergaaedes.ini
Size 34.0B
Processes 2784 (.svchost.exe)
Type ASCII text, with CRLF line terminators
MD5 b5c46af3ddfb45720a481dad1438a969
SHA1 59a045a8611bd41ba987aca6a3ebdf694477934b
SHA256 308e7004f86037c5178eb071abe5f85fdc7dfdc69090f5a019dbc383b560ef4a
CRC32 FFB7617A
ssdeep 3:1eMvby8EaR:1vLHR
Yara None matched
VirusTotal Search for analysis
Name 738a9aa0a6c97ed6_baglommerne127.ini
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Baglommerne127.ini
Size 37.0B
Processes 2784 (.svchost.exe)
Type ASCII text, with CRLF line terminators
MD5 250ca69db2135923badd7dfb18b072c0
SHA1 b61c42f860f077ba47d6144e00652c2ce548408f
SHA256 738a9aa0a6c97ed657a814e3a608b675484487bd19ef9ea10f0d21887a070300
CRC32 6667AFFC
ssdeep 3:BTuLEPmR:BTux
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nsbDF15.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsbDF15.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 8dc562cda7217a3a_system.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nscE0EB.tmp\System.dll
Size 12.0KB
Processes 2784 (.svchost.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
CRC32 7D3D580E
ssdeep 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name bcee197f14da16ed_brohovedernes7.wad
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Brohovedernes7.wad
Size 76.5KB
Processes 2784 (.svchost.exe)
Type data
MD5 570bcec72df7961167829f7387fe6017
SHA1 2dddc94a58ecb7e1030f91a8b72085ab74446fe4
SHA256 bcee197f14da16ed1e5d080982c308333cc7afabbba62ad46c1af7effcb1b15c
CRC32 2E5FF19D
ssdeep 1536:Sx4aru8b6KXeCrfl+ouYU01h2QgHPnRUf1BMLtTW:xI1RNpU6EPRUPATW
Yara None matched
VirusTotal Search for analysis
Name 744d858d6c6a7b6e_airplane_14.bmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Airplane_14.bmp
Size 9.0KB
Processes 2784 (.svchost.exe)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
MD5 8df53262dd7366acc7ca948d11197771
SHA1 3902822b1e93424f83731c8fe0fcc0c6b25e5ca7
SHA256 744d858d6c6a7b6e771a5b2d09a0de81df56ba28dcc15ba803871a97513c345c
CRC32 73D636E4
ssdeep 192:oXRe/9ug6TLD7hE6T18DBHuJMlvNGi7aWCndwcKMwVof4aBLodMI:KRe/UfD1E658DFucGi2tdEILodMI
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name d1ebb73829c3d885_system.net.quic.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\System.Net.Quic.dll
Size 284.1KB
Processes 2784 (.svchost.exe)
Type PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
MD5 426138a0c01454dfc374b843214b4d69
SHA1 bd76b974407cd4c6b901b38a1f9c650382431c59
SHA256 d1ebb73829c3d8850a8e6b73d4e37b0390e7e323734dfe0cf7db4e425bb719ce
CRC32 A4DBD1A4
ssdeep 6144:VkpAOgAGlSfFta06poKYhh++Z1Sz/lbwHUxS:2p07OFt6poK6f6l00A
Yara
  • IsDLL - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
VirusTotal Search for analysis
Name 816caf018cee837d_euda.lnk
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\euda.lnk
Size 962.0B
Processes 2784 (.svchost.exe)
Type MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 15:32:08 1600, mtime=Sun Dec 31 15:32:08 1600, atime=Sun Dec 31 15:32:08 1600, length=0, window=hide
MD5 5d4af631783410c937aff49cdc5191a5
SHA1 56e27771879ae964a20754ee6e5e3a22692a160a
SHA256 816caf018cee837db4927fd870fd3a6eb28460ac9d1b767492792f659d57b52c
CRC32 0A6E2E81
ssdeep 12:8wl0URY3HV7GyuR+/fGUk3/3Wmm/Q18/omNJkKA54t2YLEPKzlX8:8o+ZqRQREvWYSoCHADPy
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis