popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 824fae3331b95e2f_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name 3b9359aa15b557a7_Thunderbird_g8t0pe67.default-release.txt
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\History\Thunderbird_g8t0pe67.default-release.txt
Size 199.0B
Processes 2428 (batgo.exe)
Type ASCII text, with CRLF line terminators
MD5 96ff6c1c6667d77616be8cf0442b4842
SHA1 7eb7d9d12c9e3e31d01a2770ac073ba7575905ba
SHA256 3b9359aa15b557a7873312db2388393e9136a162dcfd632bc039f154672412c5
CRC32 408E1C81
ssdeep 6:2OLciKBFVWOLci+GIzWOLciVGIzWOLciAqGU:2DID9sDAsDy1
Yara None matched
VirusTotal Search for analysis
Name ef25b0726b694e3d_information.txt
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\information.txt
Size 2.9KB
Processes 2428 (batgo.exe)
Type ASCII text, with CRLF line terminators
MD5 3cb378b175d4fd4649400b905db17cfc
SHA1 8f6591ce0c418f72dda384ff753f7f8fa8969085
SHA256 ef25b0726b694e3da581bb191b2bb839c1252f814f9ee7112e1f7f5da6d32c65
CRC32 F53136B1
ssdeep 48:t9LpbtaFdRn8udF/SOn4cyyYMhPYtimH90sXOr1Uqdkpwxqdb5dbIdb8db1db+RT:t9dC8udFEBndrXOr1Uqdkmxqdb5dbIdh
Yara None matched
VirusTotal Search for analysis
Name 169c04331f72fe4a_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 5.0MB
Type SQLite 3.x database, user version 53, last written using SQLite version 3031001
MD5 f77930486de1b1bb4b397d5d8f3cd124
SHA1 e3f5727a0774c7cba17f0b10569012dcea24cb55
SHA256 169c04331f72fe4ae9958da09e1b28ec5910f7ea523d6105b7e4ad521b2baaee
CRC32 D85072F9
ssdeep 96:Dm8j5PnH6xY2Wi+67tH2iB4q2xfX7ZbiZzdFzb4PPwI3A7:l5/IYOTAlQzdFzaDm
Yara None matched
VirusTotal Search for analysis
Name 0e96ee672fd5a964_screenshot.jpg
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\screenshot.jpg
Size 84.4KB
Processes 2428 (batgo.exe)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5 fc12ff7c8a309025aaacf12833304cdb
SHA1 c31dcd42f9b66451f3afaade48779d236978196d
SHA256 0e96ee672fd5a96421037e41aed954f1d8e1ba6210d78ecf28c618a385d5855f
CRC32 43BF1805
ssdeep 1536:08qQRlKOOL6gNbUCWbtpwgyMhgL1jThr+wi52wgPdLShdkTd4NdYQ6xb47:NRl8L6IULpwqhgL1jTJ+wxPdykTd4NdJ
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name a770ecba3b08bbab_freebl3.dll
Submit file
Filepath C:\ProgramData\freebl3.dll
Size 326.5KB
Processes 2428 (batgo.exe) 2676 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ef2834ac4ee7d6724f255beaf527e635
SHA1 5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256 a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
CRC32 B698D0CA
ssdeep 6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 88f9dc0b9a633e43_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 512.0KB
Type SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5 dd47ebe6866ad2ab59d0caa1de28d09e
SHA1 afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663
SHA256 88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3
CRC32 8DEE9EEA
ssdeep 24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm
Yara None matched
VirusTotal Search for analysis
Name fd4c9fda9cd3f9ae_temp-shm
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp-shm
Size 32.0KB
Type data
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
CRC32 DDC506B6
ssdeep 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
Yara None matched
VirusTotal Search for analysis
Name c40bb03199a2054d_vcruntime140.dll
Submit file
Filepath C:\ProgramData\vcruntime140.dll
Size 81.8KB
Processes 2428 (batgo.exe) 2676 (cmd.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
CRC32 9BB5124B
ssdeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
Yara
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 25e74473a07d97f3_017bd04f-b3bf-45b6-8167-9e8f41ff87bf2267573883.zip
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\017bd04f-b3bf-45b6-8167-9e8f41ff87bf2267573883.zip
Size 84.0KB
Processes 2428 (batgo.exe)
Type Zip archive data, at least v2.0 to extract
MD5 b2ce5765b2d9b00230984a5fcec3e302
SHA1 34bf1ccd097a83a53a8a12a04a1e3c18a2a213f7
SHA256 25e74473a07d97f3316dba134ea786387c18aa539e07f3ee0b6050e429169e7c
CRC32 6CE84C28
ssdeep 1536:DOenbmsJEpd6lretJyaxNPweXtD+U8Q1rYbojmbIPhuup9sHwwGRnLxRB/Uu5POL:DOenbmsmaoyGNPweXgO1rYem8TsPA9b4
Yara None matched
VirusTotal Search for analysis
Name 97cf50e1aa17d3c1_Google Chrome_Default.txt
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\Cookies\Google Chrome_Default.txt
Size 218.0B
Processes 2428 (batgo.exe)
Type ASCII text, with CRLF line terminators
MD5 bb97d2a6c4d5600a01f949d1ad6c2d4c
SHA1 e9f9f64b8b30d0a6915cdc15c7a866a13cc4dca6
SHA256 97cf50e1aa17d3c1371610f0e61bcadf6d08b70e0b8c5a58e4274af11652ec3d
CRC32 3559655F
ssdeep 6:PkopYjasNXtknNnfGIqVO7jUnP3D9E9ATQXWRoPmMdtd:copYms/EGjIW9irVTvd
Yara None matched
VirusTotal Search for analysis
Name 43536adef2ddcc81_softokn3.dll
Submit file
Filepath C:\ProgramData\softokn3.dll
Size 141.5KB
Processes 2428 (batgo.exe) 2676 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 a2ee53de9167bf0d6c019303b7ca84e5
SHA1 2a3c737fa1157e8483815e98b666408a18c0db42
SHA256 43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
CRC32 760685C5
ssdeep 3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 3fe6b1c54b8cf28f_mozglue.dll
Submit file
Filepath C:\ProgramData\mozglue.dll
Size 134.0KB
Processes 2428 (batgo.exe) 2676 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
CRC32 E28A5E21
ssdeep 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 334e69ac9367f708_msvcp140.dll
Submit file
Filepath C:\ProgramData\msvcp140.dll
Size 429.8KB
Processes 2428 (batgo.exe) 2676 (cmd.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
CRC32 97BCF588
ssdeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
Yara
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name b0a9673e25b0915d_Default.zip
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\Files\Default.zip
Size 158.0B
Processes 2428 (batgo.exe)
Type Zip archive data, at least v2.0 to extract
MD5 023ed88c7dc17f053db974042560a41a
SHA1 5334647902b0830e0507bc725a6acf3d933aca37
SHA256 b0a9673e25b0915db4836c67c4fb4bb2890f0c859f5fd03357044e358a2f0aad
CRC32 CDB42416
ssdeep 3:vhj3lzptrpdclcBnSmmOwpx9eEtptrpdclElktfAPhB+l2lTln:5jLt9mlMTm7Ldbt9mlFtfiB+lCp
Yara None matched
VirusTotal Search for analysis
Name 4ac80c7c5151bdcf_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 116.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 bce6c6883de82f98bf29297f030cc9ab
SHA1 c3b948ef9f7d90b50539b46bba2384c6fa82dbd4
SHA256 4ac80c7c5151bdcf1d84a19daaa49673280a2806cee4bfeb26cca845da1f9891
CRC32 60399F3F
ssdeep 48:T5Lth3C7nNfVcS2+VANULn36uw5NPM5ETQTpUPxK2PIs6kJL5R2+zaSZ00LTL0oy:9hlC7n/c0VANUjwQU+KraSZ00LTL0J
Yara None matched
VirusTotal Search for analysis
Name e2935b5b28550d47_nss3.dll
Submit file
Filepath C:\ProgramData\nss3.dll
Size 1.2MB
Processes 2428 (batgo.exe) 2676 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
CRC32 9F24F4E3
ssdeep 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 8916fb1d76be83e4_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 192.0KB
Type SQLite 3.x database, user version 4, last written using SQLite version 3031001
MD5 6b9c2ac2b5025e180231d8d38ece698c
SHA1 36f5cfe6ac59aaa7d7173555edeef5caa9bf61c6
SHA256 8916fb1d76be83e42cd2f7b41ee06706fe0adb936259ed7a7daa4dbcb4c51fcb
CRC32 95ACFD74
ssdeep 12:DBl/lkf12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLlI1x7WxHaiSlMxosJF/Ezo
Yara None matched
VirusTotal Search for analysis
Name 5eada5dc19ab310e_batgo.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\batgo.exe
Size 4.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5ee0b97e90e31e11ce72b3a7c76c3e6f
SHA1 575fe30764d482d41030eeb8e45e4ed66243afc3
SHA256 5eada5dc19ab310ed6edd61b1747b2fd9342b44be7241afa21bb0865d7fc132d
CRC32 C390B305
ssdeep 98304:BW9yeVpl4q6db2jGRmtdJHOECutgepYRwPx5SS7RuA:w9yed4nb7GdJuEl13oA
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 8997b95e496b8023_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 09e6369fd6743eae25da7cba77abf33d
SHA1 e529fa5af82fa7cc91865b7fe8616efce46ae726
SHA256 8997b95e496b8023f051ea88912bf718fbf8cf400f06bba09f60d14a462e0553
CRC32 694B0A72
ssdeep 24:TLbd0RlPbXaFpEO5bNmISHdL6UwcOxvz7w2K36eLI6AGxdfyG:TILOpEO5J/KdGU1Ez7XexASl
Yara None matched
VirusTotal Search for analysis
Name e3b0c44298fc1c14_temp-wal
Empty file or file not found
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp-wal
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 915dd6370c01bf55_Thunderbird_g8t0pe67.default-release.txt
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\Cookies\Thunderbird_g8t0pe67.default-release.txt
Size 357.0B
Processes 2428 (batgo.exe)
Type ASCII text, with CRLF line terminators
MD5 5e52ae0ab76f7db35d0873b986c1c3f7
SHA1 7e49b5cbe09da1b7d044cd84231830a707662845
SHA256 915dd6370c01bf552b13c3a6f9b268fb6c7aaf4a06a258ed7ecfe661db2471e2
CRC32 2DDF4481
ssdeep 6:JihKT6lphXX7aQ2vSI95Bj9GfBHthf+CthfMl0kq/H+LkihKT6lphXXrSdrNBPPm:JZohXraQ2v795BxGfBHff+CffMOkqP0b
Yara None matched
VirusTotal Search for analysis
Name 06fce454b964f8a6_temp
Submit file
Filepath C:\ProgramData\6AVRG3J7KPK6HGVJCMTVMV617\files\temp
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 7c9e768ab93f73497a35470de07c2ada
SHA1 5c2bb051e15ed92187bad616d489ada38e34e04b
SHA256 06fce454b964f8a6dd0bc941a34ac0054159a400be65f3d9b6a1cd76668c01be
CRC32 6849234A
ssdeep 96:JBc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9uE:JBPOUNlCTJMb3rEDFAl67/
Yara None matched
VirusTotal Search for analysis