popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14_nsgBF44.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nsgBF44.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 4cce5f45f185524b_LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu
Size 1.2MB
Type SQLite 3.x database, user version 30, last written using SQLite version 3031001
MD5 fe169ca1afaa6be2776a175c90427b38
SHA1 72bb87cd1b2b000088d1ee4c14675b2c19de4aa9
SHA256 4cce5f45f185524b6c75c819ad5923d70dcb9662e833b5e1229022693f471235
CRC32 8B4FBD0F
ssdeep 96:D7/cYoynhZlbJPZOwr4oR84J4Aqx4ZA7O9jgv106WEWbEm2JioMetQ:3cYoEn/oGJYxapEWAm2J2
Yara None matched
VirusTotal Search for analysis
Name b99842b985a6f2f3_fireplough.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fireplough.exe
Size 409.2KB
Processes 2064 (win32.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 6a3154595de5779cf6f0facb0c8c3cec
SHA1 352e285d044720c51b9eae39f8f70fba8b2d11fd
SHA256 b99842b985a6f2f3f6143250917607ccef271d03b631331fa498d7a2b1caa7a1
CRC32 7C9BCCBF
ssdeep 12288:vYyqocAaqRCT9ulR8RMnQ6YC61QtQHjUrud+lH8Q1omB6JqW:vYynpam09BRMjYC3Ql+lHv6mB6kW
Yara
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name dcfcd16fbf0511d3_vbsqlite3.dll
Submit file
Filepath C:\Users\Public\Libraries\vbsqlite3.dll
Size 161.5KB
Processes 2064 (win32.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 073a17b6cfb1112c6c838b2fba06a657
SHA1 a54bb22489eaa8c52eb3e512aee522320530b0be
SHA256 dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab
CRC32 9619DAD7
ssdeep 3072:eNFwdmspaPg9g9oOavAQBNrPkVdc88GjU+vF6nuxRocX5GOOUleo+c:e8d1/w5KA81IJ8GpF6nuTmOOU
Yara
  • UPX_Zero - UPX packed file
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 1fa1994bb5833af1_qiawkrvxx.at
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\qiawkrvxx.at
Size 456.1KB
Processes 1968 (win32.exe)
Type data
MD5 e5ed5a7cf15fc6cff4968a34b1d1f3ba
SHA1 82dd537479418f4f9e67a278aa375534705877fc
SHA256 1fa1994bb5833af1b1c534bc154c521628cfb47290f260e87d33f540b9547b64
CRC32 79D3C612
ssdeep 12288:RNZivIOFXbf/cF5MNQM+Ka0RFtl/zqrnk5G1hDsHoNaA:pRaLaKyMVLv/zqiGzKvA
Yara None matched
VirusTotal Search for analysis
Name c119a54b6bef3a48_WebData
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\WebData
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 255929949dea51a2f43a1f40e63764ec
SHA1 8f32ab419264fdad05f4f3828db3c1cd38d919fd
SHA256 c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6
CRC32 F7A79605
ssdeep 96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/
Yara None matched
VirusTotal Search for analysis
Name 824fae3331b95e2f_LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name 318150272f59ea96_yyfxwt.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsvBF55.tmp\yyfxwt.dll
Size 12.0KB
Processes 1968 (win32.exe)
Type PE32 executable (DLL) (native) Intel 80386, for MS Windows
MD5 e6e54fbf929aea713a8fcfdf0d035043
SHA1 73514f8f6b63b19c12c36f750fe0c65c3a9e016c
SHA256 318150272f59ea96815bb849e2822d2eb8cc827ac707359b6fef7f0745928c31
CRC32 E0CE2D71
ssdeep 192:FGIZ7OlKa8TtXiA3U/SpkqILz+lcfZEmuQC+E:FGK7o8TtBdpRYoCnuQC+E
Yara
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 89c57cdff7f53e45_ThunderBirdContacts.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\ThunderBirdContacts.txt
Size 21.0B
Processes 2064 (win32.exe)
Type ASCII text, with CRLF line terminators
MD5 aae099b12d63d4ff58e570ea2fdb126e
SHA1 72c2652e15cc35394dedefaeedfe711b159c0ecc
SHA256 89c57cdff7f53e45bfb5c04d9ed99c3ad4c182a503bba441ebbc4bb5de45f9bb
CRC32 99E67AA1
ssdeep 3:HvzIyHy:HvzID
Yara None matched
VirusTotal Search for analysis