popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 6fcea34c8666b063_system.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsdF398.tmp\System.dll
Size 11.5KB
Processes 2564 (Forrderes.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
CRC32 7D939E74
ssdeep 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Yara
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name f90db5a877fa65e8_system.threading.tasks.dataflow.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Lredrengene\hjerneskadernes\System.Threading.Tasks.Dataflow.dll
Size 492.6KB
Processes 2564 (Forrderes.exe)
Type PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
MD5 6436d65bd6de59d8ed057f84b7b64121
SHA1 721c820a702067207da09ffdf9351dde8e2f33fc
SHA256 f90db5a877fa65e8fb3f7e86ae676759de64f2858a21259b53c37a614647a6da
CRC32 6E840F27
ssdeep 6144:Q5EzHO03uPIhSTcNO/LSsjM5REz4s14CGFHD6ioscEu/L2SJASGsvfT5v3Ptm9Zf:Q5IgOCGFHuioHEdSSvub5v38cOTH
Yara
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name ddf45b30af34463e_birdieing.phw
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Lredrengene\hjerneskadernes\Birdieing.Phw
Size 89.2KB
Processes 2564 (Forrderes.exe)
Type data
MD5 50395fa9ed9c8ff9313e6da16b6ce468
SHA1 edb9fb564581069a3f7c1e7f2df3751d1c7e4852
SHA256 ddf45b30af34463e25f0b236e783ce3dcc3d07ef73e585f2aeaef65b23f6e177
CRC32 0EF86C7C
ssdeep 1536:sL2hY4Fk8cKfgfuXS4l8K3/HOXf9Zl+AdfZTtfWP2vCzu:ZhY2BIfaS4yK3QfTLfZTZWA
Yara None matched
VirusTotal Search for analysis
Name 32650c77feffd28a_warning.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Skrhatten\Transpireringen\Staudebedene\WARNING.TXT
Size 762.0B
Processes 2564 (Forrderes.exe)
Type data
MD5 96b3e4aa975d8c895141fd6e86d9ace1
SHA1 80dc9cf9c62ade7cd59cfac5790ea3fe9dd422b9
SHA256 32650c77feffd28af418b42c137d16e877da5e0c260ceb27ab16eb64fbeea5e4
CRC32 6379EA9E
ssdeep 12:JdSdVOcBGj1iSIbEKirxXJhKfpK7FPUyFjCnFrg1+553Z4lGuhaKTpwKshFOq3wN:mjkgbEXlXBFFOO1oNZ4F5wKwOowbxf
Yara None matched
VirusTotal Search for analysis
Name 084c7fc15a577c63_libgobject-2.0-0.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Underlb\libgobject-2.0-0.dll
Size 312.7KB
Processes 2564 (Forrderes.exe)
Type PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
MD5 3b26423718df307468a2c5dc9fd8d381
SHA1 93114dbbb6c7e0934df8f8c21dbb944b0338d305
SHA256 084c7fc15a577c63bad88d9e1f94ce38f1f539db64c6fbc2e1d9c3ad31ecb428
CRC32 1ECB6344
ssdeep 6144:TiiRQEtW0Yh0JztEJIPmcjljFzEElkZKwDcEjiQec9lD6OvhTXQ:TKuW0Yh0JT1P5lcV56ahTXQ
Yara
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nscF08A.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nscF08A.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name e7d4458ef5309c17_process-stop-symbolic.symbolic.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Archleader\Reges\Afskridtningers\Ritualmords\process-stop-symbolic.symbolic.png
Size 242.0B
Processes 2564 (Forrderes.exe)
Type PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
MD5 898350735ab537acb1bc974d7c9394cd
SHA1 72b9ad83216b6df34e70eb050a6a289cb0278af3
SHA256 e7d4458ef5309c17297d537bf6025358749cccf10626f512692ba6801f4d3870
CRC32 3202962D
ssdeep 6:6v/lhPysF3oPq59757tPn1z85/Z3k1xlllVp:6v/7l34i97h9nm5/Z3k//1
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 55514d9bb54b741a_x-office-presentation-template.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Archleader\Reges\Afskridtningers\Ritualmords\x-office-presentation-template.png
Size 462.0B
Processes 2564 (Forrderes.exe)
Type PNG image data, 16 x 16, 8-bit colormap, non-interlaced
MD5 4bff465b1cd1c7f0490b08e292859852
SHA1 6673c0c7cbba1ec3b58507e1c4b2b22d357fd8c4
SHA256 55514d9bb54b741a9de3740bc2532bfd8b309cb9bd181e51c287223c44ae57f7
CRC32 FB3151FE
ssdeep 12:6v/7X0ZAVGkarWgo/xsDxEEd1IkPpayR5VAgqlzjwF+vN:C0WVGkMWgopUxT11p7R5KgqZfvN
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 827dbc7f4564d4db_worcestersaucens.tri
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Lredrengene\hjerneskadernes\Worcestersaucens.tri
Size 362.7KB
Processes 2564 (Forrderes.exe)
Type data
MD5 63a4a3e1f92dc437051da3198949c53b
SHA1 696ce742864088793ea90d79e6317074cc111556
SHA256 827dbc7f4564d4db52446d339f20d9b2468ff73ebbdb638efc299bba9d862ab0
CRC32 7C2DA608
ssdeep 3072:Y4dCf4m5tJHL/23B3AFnKAlELij/yAqZtf7XjKr0C0MVyjZXGxC3SPUa7jqkqwOY:YIqr/2R3+npELU/sNeYhiWXEP7Xqzuj
Yara None matched
VirusTotal Search for analysis
Name b6b660e5099c1c65_defess.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Underlb\defess.dat
Size 13.3KB
Processes 2564 (Forrderes.exe)
Type data
MD5 8f4b534ed6a82e1885e155541aab0940
SHA1 3c71d762c74a6387367b4dd21498b065b0e4c5e1
SHA256 b6b660e5099c1c65226fb2957bf7e84a498cea9e0e0d7f2e0cba196130a76d90
CRC32 6BCF7B04
ssdeep 12:tHnwSO7GjfgzGz9bi/Hzbkj4cmoCNJGJ0TIsLRhtbYLG3TxLRQ+JtLXeJTTLR1iG:tHIIfE+9bi/Hzbkj4giW
Yara None matched
VirusTotal Search for analysis
Name 96fd21810715242c_error.wav
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Aflseligt\Cocainising\sikhers\Underlb\error.wav
Size 11.6KB
Processes 2564 (Forrderes.exe)
Type RIFF (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 11025 Hz
MD5 dcda9d8947b0e8bb8eaae9212ec4179b
SHA1 9e786a3ea1ac1426800734e7330b6eb084516217
SHA256 96fd21810715242c3441c7c06b966e06494acf1d51198e1ddb35a135d9f24937
CRC32 5E27DD1D
ssdeep 192:3P7IlmYhb3TfI55UPe9iG5swAMqZ9YPVoJS/WXD2oaMszgglqCe3ohwQ6BPeTHmg:k5bjQUDDMqZnbD3ygglqcwQ/Hm9u
Yara None matched
VirusTotal Search for analysis