popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 4cc2f239f8838c6e_temp
Submit file
Filepath C:\ProgramData\622721517687069\temp
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 2a51cf5f096c5924c7f47732d12e7c92
SHA1 6fcb446f6e2af378bb6aae032d58fbf939c98826
SHA256 4cc2f239f8838c6ec8297440c1455f09491854bcc3ac644fbcb53fe42dfb6ee2
CRC32 E70F8913
ssdeep 48:O3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:kSe7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name 0081609236a1f7eb_system.txt
Submit file
Filepath C:\ProgramData\622721517687069\system.txt
Size 2.2KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type ASCII text, with CRLF line terminators
MD5 5a13a458faed1b2830ce8289a77a212a
SHA1 d1c9c20f3481d08aa76b1eb5cc4e1508d63091b9
SHA256 0081609236a1f7eb6d9d3926dde948afb18f007a17c753c931f426058f0530e6
CRC32 BD334F78
ssdeep 48:7RU1taFFGrSzNc98GGBuwHLM+YZ0352Bf5774mRNMPpX:7Re2Qeq7GBuwHLMX2352Bf5774mRixX
Yara None matched
VirusTotal Search for analysis
Name a770ecba3b08bbab_freebl3.dll
Submit file
Filepath C:\ProgramData\freebl3.dll
Size 326.5KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ef2834ac4ee7d6724f255beaf527e635
SHA1 5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256 a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
CRC32 B698D0CA
ssdeep 6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
VirusTotal Search for analysis
Name 88f9dc0b9a633e43_temp
Submit file
Filepath C:\ProgramData\622721517687069\temp
Size 512.0KB
Type SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5 dd47ebe6866ad2ab59d0caa1de28d09e
SHA1 afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663
SHA256 88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3
CRC32 8DEE9EEA
ssdeep 24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm
Yara None matched
VirusTotal Search for analysis
Name fd4c9fda9cd3f9ae_temp-shm
Submit file
Filepath C:\ProgramData\622721517687069\temp-shm
Size 32.0KB
Type data
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
CRC32 DDC506B6
ssdeep 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
Yara None matched
VirusTotal Search for analysis
Name c40bb03199a2054d_vcruntime140.dll
Submit file
Filepath C:\ProgramData\vcruntime140.dll
Size 81.8KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
CRC32 9BB5124B
ssdeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsConsole - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 43536adef2ddcc81_softokn3.dll
Submit file
Filepath C:\ProgramData\softokn3.dll
Size 141.5KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 a2ee53de9167bf0d6c019303b7ca84e5
SHA1 2a3c737fa1157e8483815e98b666408a18c0db42
SHA256 43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
CRC32 760685C5
ssdeep 3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
VirusTotal Search for analysis
Name 3fe6b1c54b8cf28f_mozglue.dll
Submit file
Filepath C:\ProgramData\mozglue.dll
Size 134.0KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
CRC32 E28A5E21
ssdeep 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_registry - Affect system registries
VirusTotal Search for analysis
Name 5e411f36b3a6bc62_Google Chrome_Default.txt
Submit file
Filepath C:\ProgramData\622721517687069\cookies\Google Chrome_Default.txt
Size 339.0B
Processes 1660 (IMG_106_680_74_80.pdf)
Type ASCII text, with CRLF line terminators
MD5 5ede65a1bb8817ae21d95167d81faf26
SHA1 35a4e9b7513d52225e4f5fbe38cdaedbd2defd12
SHA256 5e411f36b3a6bc62de53db70d488c149a0dc9c56f604fd2abde01ae920276c0d
CRC32 431BD5AC
ssdeep 6:PkopYj36ruIX0x8ptTUL2Scq0finQHPzWc3rOjlQLEv3rdu:copYD6RXs8PY5cqLnOb7OjlQ4v7du
Yara None matched
VirusTotal Search for analysis
Name 16574f51785b0e2f_sqlite3.dll
Submit file
Filepath C:\ProgramData\sqlite3.dll
Size 630.5KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 e477a96c8f2b18d6b5c27bde49c990bf
SHA1 e980c9bf41330d1e5bd04556db4646a0210f7409
SHA256 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
CRC32 9F30A75E
ssdeep 12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsConsole - (no description)
  • HasOverlay - Overlay Check
  • MinGW_1 - (no description)
  • PE_Header_Zero - PE File Signature Zero
  • win_mutex - Create or check mutex
  • win_files_operation - Affect private profile
  • ldpreload - (no description)
VirusTotal Search for analysis
Name ffb18189c8e04084_temp
Submit file
Filepath C:\ProgramData\622721517687069\temp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 c19826403c4c8e5086a8d49e37c94838
SHA1 4d19768231a3373fb0fa91d5513e21ad772b137b
SHA256 ffb18189c8e040846bba547b243fda347516329d58a44b26fd8616549249e077
CRC32 36EBD488
ssdeep 48:ToLOpEO5J/KdGU1/X2ydikE6HDHCp0mSzW34KXEw:ENwudLE6jOSzLw
Yara None matched
VirusTotal Search for analysis
Name 334e69ac9367f708_msvcp140.dll
Submit file
Filepath C:\ProgramData\msvcp140.dll
Size 429.8KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
CRC32 97BCF588
ssdeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsConsole - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_files_operation - Affect private profile
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 23d9f3121e3fe208__6227215176.zip
Submit file
Filepath C:\ProgramData\622721517687069\_6227215176.zip
Size 11.4KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type Zip archive data, at least v2.0 to extract
MD5 8dba958bec62b89e61a307f4f6eefb73
SHA1 4aaa8d6119521787faa6bfeeb128d49a61a94dba
SHA256 23d9f3121e3fe208ac3dd1753ca3da6b119a4c3a2d38f95c7140f3d3a9d79ec0
CRC32 FEBB08AC
ssdeep 192:X0rXKJGlnxkKeTN9rsQUMzeSlQghlJKBHrWLGtMSOeicF8MOBfK7EZuYl5xOAcux:ERRxlkN9AcznualJuLkGttlJUC7clq+
Yara None matched
VirusTotal Search for analysis
Name ad07adc0cfd1ad4a_screenshot.jpg
Submit file
Filepath C:\ProgramData\622721517687069\screenshot.jpg
Size 22.0KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5 462667260886bd7f32da6fbfcc087255
SHA1 de37419afe63700d6afb438c8ad9d931882a6362
SHA256 ad07adc0cfd1ad4a26f0bebe73cae67f9ce25783d80f3764eccd5ed56140bbd3
CRC32 6321EFAC
ssdeep 192:pCzay86L/MbtH2mBSCqNxEr/RRRxMS4x9f8yJXQXmFiEXb:4586L/MbtjLDMX9BgXiFL
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name e2935b5b28550d47_nss3.dll
Submit file
Filepath C:\ProgramData\nss3.dll
Size 1.2MB
Processes 1660 (IMG_106_680_74_80.pdf)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
CRC32 9F24F4E3
ssdeep 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
Yara
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • cred_ff - Steal Firefox credential
  • win_mutex - Create or check mutex
  • win_token - Affect system token
  • win_files_operation - Affect private profile
  • Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration
VirusTotal Search for analysis
Name 8916fb1d76be83e4_temp
Submit file
Filepath C:\ProgramData\622721517687069\temp
Size 192.0KB
Type SQLite 3.x database, user version 4, last written using SQLite version 3031001
MD5 6b9c2ac2b5025e180231d8d38ece698c
SHA1 36f5cfe6ac59aaa7d7173555edeef5caa9bf61c6
SHA256 8916fb1d76be83e42cd2f7b41ee06706fe0adb936259ed7a7daa4dbcb4c51fcb
CRC32 95ACFD74
ssdeep 12:DBl/lkf12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLlI1x7WxHaiSlMxosJF/Ezo
Yara None matched
VirusTotal Search for analysis
Name 9b26547086a1489e_IMG_106_680_74_80.pdf
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IMG_106_680_74_80.pdf
Size 381.3KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 e05e738dcb98a9f8c125138b492f82e5
SHA1 02f9a41a35cc4794456fbc48b8e0245e622eab69
SHA256 9b26547086a1489e5534452021694af3a565fe76926e671112be4852947a5d27
CRC32 EBC6D7FF
ssdeep 6144:MHQYxtfUeAIQHuA36cd92HPNh7C9UKjn+TvhRG:DYxeeAItC669ar7CeVpA
Yara
  • IsPE32 - (no description)
  • IsNET_EXE - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • Win_Trojan_AgentTesla_IN_Zero - Win Trojan AgentTesla
  • PE_Header_Zero - PE File Signature Zero
  • Win_KeyBase_Keylogger_IN_Zero - Win KeyBase Keylogger
VirusTotal Search for analysis
Name 6c5bdba65823d907_temp
Submit file
Filepath C:\ProgramData\622721517687069\temp
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 2879b25c64012e6d19d0d34da682dcdd
SHA1 554af0d1d9d3c0daf0567f75128426c48ad7f3c5
SHA256 6c5bdba65823d9079daae7ca8fe953fbdea165742db98a7e4f0de3e5c2252758
CRC32 EF73B05C
ssdeep 96:ZBv7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9uE:ZBMOUNlCTJMb3rEDFAl67/
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_temp-wal
Empty file or file not found
Filepath C:\ProgramData\622721517687069\temp-wal
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 915dd6370c01bf55_Thunderbird_g8t0pe67.default-release.txt
Submit file
Filepath C:\ProgramData\622721517687069\cookies\Thunderbird_g8t0pe67.default-release.txt
Size 357.0B
Processes 1660 (IMG_106_680_74_80.pdf)
Type ASCII text, with CRLF line terminators
MD5 5e52ae0ab76f7db35d0873b986c1c3f7
SHA1 7e49b5cbe09da1b7d044cd84231830a707662845
SHA256 915dd6370c01bf552b13c3a6f9b268fb6c7aaf4a06a258ed7ecfe661db2471e2
CRC32 2DDF4481
ssdeep 6:JihKT6lphXX7aQ2vSI95Bj9GfBHthf+CthfMl0kq/H+LkihKT6lphXXrSdrNBPPm:JZohXraQ2v795BxGfBHff+CffMOkqP0b
Yara None matched
VirusTotal Search for analysis
Name 4b218390206b5fb4__6227215176.zip
Submit file
Filepath C:\ProgramData\622721517687069\_6227215176.zip
Size 12.1KB
Processes 1660 (IMG_106_680_74_80.pdf)
Type Zip archive data, at least v2.0 to extract
MD5 263c167f023c23637603f57ae20b18a4
SHA1 80e45efac532a9e1d746a6e8ec40c6c7ca15e8d7
SHA256 4b218390206b5fb4ee64d3001c7a7ad9673770bddea6b3f86d871a17b4534326
CRC32 C2FC89C3
ssdeep 192:X0rXKJGlnxkKeTN9rsQUMzeSlQghlJKBHrWLGtMSOeicF8MOBfK7EZuYl5xOAcu1:ERRxlkN9AcznualJuLkGttlJUC7clq4
Yara None matched
VirusTotal Search for analysis