popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 6af94e17e4272446_rules.json
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\rules.json
Size 30.0B
Processes 2652 (1.exe)
Type ASCII text, with CRLF line terminators
MD5 98c1b263c68b17f662f6dfefce7fade4
SHA1 4d40ccb13668776194c1310ed1bfbf0ce07367ae
SHA256 6af94e17e4272446fb91ba04b299c4f28d0cd0e693dfc20f0c83773ecfc8a3aa
CRC32 56BC6CDF
ssdeep 3:3FF3x6In:3FFB6In
Yara None matched
VirusTotal Search for analysis
Name 5369152e9ac52e78_page.js
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\page.js
Size 31.9KB
Processes 2652 (1.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 e6d0eb16dea2e5479e7d522929e39309
SHA1 40e1343c75a02c0b1061b22a32a1e3082f67ff2a
SHA256 5369152e9ac52e7881ae4a4b95b47278deb866dbaa5ed8c6287b642b4bb20b74
CRC32 3922532A
ssdeep 768:r22bxmvFiCfwC/mDs1jal+NKWu0933g3guUU/i/QI1UCkNEZBUHhkZFzeRuuKF6b:xkwhQUoXnJAk1gSKm9eM406FA63xsFzk
Yara None matched
VirusTotal Search for analysis
Name 5ea9c13507463e9f_manifest.json
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\manifest.json
Size 913.0B
Processes 2652 (1.exe)
Type UTF-8 Unicode text, with CRLF line terminators
MD5 b4881bd4277a3bb59972b255dc49fe1a
SHA1 3ce49288c897cae0800400832f2ece28d9eba377
SHA256 5ea9c13507463e9f07c31d03504efd2843348c383dab9478e711ae61fc12981e
CRC32 DC01463E
ssdeep 24:53h13tOzmD0vVIKUDWABZo/TUiuy4O2zLM0aOiV:9z3Tm+gNuTM0aOiV
Yara None matched
VirusTotal Search for analysis
Name f2d9153ef4e22911_chrome.lnk
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Chrome.lnk
Size 2.3KB
Processes 2652 (1.exe)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Jan 31 21:43:01 2018, mtime=Wed Jan 31 21:43:01 2018, atime=Tue Jan 23 22:48:00 2018, length=1581912, window=hide
MD5 a10b628d21c15f65acbdcb066db924af
SHA1 7976733c185c381adeaa6127242775bfcad9188a
SHA256 f2d9153ef4e22911447f28a5e980ecea29cad11d0489e614b32fed2df8d7c202
CRC32 F10093E1
ssdeep 48:810qdXgWRymiMfdAKR+d/LqtNd/KRCipAKRx8Cy/:81KECh
Yara
  • Lnk_Format_Zero - LNK Format
  • lnk_file_format - Microsoft Windows Shortcut File Format
VirusTotal Search for analysis
Name fb2530337383de15_icon48.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\images\icon48.png
Size 4.0KB
Processes 2652 (1.exe)
Type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
MD5 38cbe30dec0e1907892b2c8bfeabb8dc
SHA1 f9c57bcd54ceb159c5ba5657bc76819995931d4b
SHA256 fb2530337383de156f38a66faf42b4b7fe4f8a78b34bd907927023bd777c5820
CRC32 D93CE6AD
ssdeep 48:N5Mfkv5gQQJRgxlSDqokn+aBTQ26I+hyTuWHm5Fb4EG1R+Pslp8OCaC4R2/ouphA:N5UNbJUdNj+V5FsEG1xrBeh9Qs6vPEzS
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 8dc327f3c0e3994d_._icon16.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\images\._icon16.png
Size 266.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 666bf497f48bc2779131dff808af9e91
SHA1 c8933b7eae2b6167adbf7143a9ae89120f46d88a
SHA256 8dc327f3c0e3994d20813b955d13d934add8ae402bc6c5530507f491ed488f21
CRC32 C92CCA04
ssdeep 3:PFoESNt/FPl2Xdlk9lte3//lQV/vll1lAL83426LNRitN/ldTwPXi7R/XNtsl96G:PgG0H2/GHo26P2dwviV/9tEotUh
Yara None matched
VirusTotal Search for analysis
Name 2427670ba207666c_chrome.lnk
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Chrome.lnk
Size 2.3KB
Processes 2652 (1.exe)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Jan 31 21:43:01 2018, mtime=Wed Jan 31 21:43:01 2018, atime=Tue Jan 23 22:48:00 2018, length=1581912, window=hide
MD5 7eaf2c4fa12a94f645d867fb4bd73fed
SHA1 900735bfb08a02c310d25a8ce4e63efdca60d697
SHA256 2427670ba207666c3d08158b679a832dbcf8855126717bf30e41a513059d2b2f
CRC32 F5CD6BFC
ssdeep 48:810qdXgWRymiM1dAKR+d/LqtNd/KRCipAKRx8xyqE:81KuCy4
Yara
  • Lnk_Format_Zero - LNK Format
  • lnk_file_format - Microsoft Windows Shortcut File Format
VirusTotal Search for analysis
Name d3e68c794c2e02c0_._background.js
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\._background.js
Size 309.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 1d39f795f6b40aef01045824fbe7b0e8
SHA1 c9b6079ef55fb41ea9460392af5433dde4019d51
SHA256 d3e68c794c2e02c03397cd6e2ba6dc3cd4b02f4dd723e7152a78c51c10507665
CRC32 0DF8D270
ssdeep 6:PgGWS/nsQlllo/LllVl4NIUctQZo26P24juK6AOc2o4/9tESm:PgdisQ/+/RPWSt24juKxOc2J9Kl
Yara None matched
VirusTotal Search for analysis
Name c951415b94fa9bc7_._manifest.json
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\._manifest.json
Size 359.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 60b00281141cd02ac0c470ba3bfcb82e
SHA1 34bb6e2f9b4662280eba48c6ae540d3102a6834a
SHA256 c951415b94fa9bc7ceb4a8775dce689cf811dfb3a3e54bd71e0ad53096cdc9fb
CRC32 89B30E4D
ssdeep 6:PgGWQlnl+X/hHGSIUct6/VZo26P2mfjuK6A/hXSviTlN/9tESK1/1:PgdQH+X/hHGzE42mfjuKx5XSv2z9Kv91
Yara None matched
VirusTotal Search for analysis
Name 94e702f0f75560a8_._icon48.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\images\._icon48.png
Size 266.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 5325feaa13aa6b390fd29f578427a6c5
SHA1 8653c3bc100036a383f4719b6757e2d6097a68ca
SHA256 94e702f0f75560a84d75a04e620ce64d8350f270e2494b749bbfe576fc8fae6c
CRC32 E5258588
ssdeep 3:PFoESNt/FPl2Xdlk9lte3//lQV/vll1lAL83426LNRitN/ldTwPXi7R/XNtsl965:PgG0H2/GHo26P2dwviV/9tEotksh
Yara None matched
VirusTotal Search for analysis
Name 6fc80fc5daca9383_popup.html
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\popup.html
Size 2.2KB
Processes 2652 (1.exe)
Type HTML document, UTF-8 Unicode text, with CRLF line terminators
MD5 60e9f65feba88aa8789aabdc84e5b114
SHA1 33d3bed70542ad1909aa6b2b784fc7eda5405dcf
SHA256 6fc80fc5daca938373207f346d5717016e22808100199c2a8e7a14801eadb29d
CRC32 CE2C2FB1
ssdeep 24:hP3RCDm6T74267E/T+v5EfoSZSElnE/PL2Xo8j4YLAFunFiAXOOs4BvAxjoEVUny:tQR4E/q6dZM/PV4l1ndlZw5aJg5
Yara None matched
VirusTotal Search for analysis
Name 8abe13917a5a1475_._rules.json
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\._rules.json
Size 260.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 35d0e93b27c53cb9d8bc3043eb489a6f
SHA1 780894582c37218d77e960dc79288ed13306381d
SHA256 8abe13917a5a1475524f9975887681fff081cd87d2e2e8d12399d5bf5cd3c75c
CRC32 ED629866
ssdeep 3:PFoESNt/FPl2X/+zltl83//lOV/Tl1lAL83426LNRitN/l7kPXi7R/XNtsl96d1N:PgGmJ2/YVo26P2YviV/9tEor/1
Yara None matched
VirusTotal Search for analysis
Name 13c02c7fb4d19c71_._icon128.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\images\._icon128.png
Size 266.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 5f4978f441215a00bb34c8d692ebdc21
SHA1 d8f9242849e306eae8cac9afec78ce7f3b9c1bf1
SHA256 13c02c7fb4d19c718eaba6213cab81c89e2ac96064be49a29279d9d2530ca39e
CRC32 947229CA
ssdeep 3:PFoESNt/FPl2Xdlk9lte3//lQV/vll1lAL83426LNRitN/ldTwPXi7R/XNtsl96g:PgG0H2/GHo26P2dwviV/9tEotqTDh
Yara None matched
VirusTotal Search for analysis
Name bdedd43704a77045_chrome.lnk
Submit file
Filepath C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
Size 2.2KB
Processes 2652 (1.exe)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Wed Jan 31 21:43:01 2018, mtime=Wed Apr 4 19:59:09 2018, atime=Mon Mar 19 20:59:56 2018, length=1589592, window=hide
MD5 f109d2f1adc2ebe733fd388917b467bb
SHA1 195e21a02f6aac5f6f1deff25637d91a6ea98ed8
SHA256 bdedd43704a77045a0cb5cd0969b8321b3adc3845ef3a787967c6e9ed61c6338
CRC32 B1984B3A
ssdeep 48:8Q+ZqdXg2RymiMAdAKR+d/LqtNd/KRCipAKRx84E:8vTDCO
Yara
  • Lnk_Format_Zero - LNK Format
  • lnk_file_format - Microsoft Windows Shortcut File Format
VirusTotal Search for analysis
Name a13e665a0534e1ed_._popup.html
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\._popup.html
Size 316.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 853c6f344aa42bff457bd694d64094ba
SHA1 ad191c885adc6c4385a647dba405e529829c375b
SHA256 a13e665a0534e1edfc0c314067bc1bc43ab945b11a5a792c768908ff9bc9bacf
CRC32 5A125992
ssdeep 6:PgGWHeU/g3IUctQZo26P2zvistL/9tEor/1:Pgd+U/g4t2zv19Koj1
Yara None matched
VirusTotal Search for analysis
Name 402594e8db5720ec_background.js
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\background.js
Size 18.5KB
Processes 2652 (1.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 c2d70259cdb8287bbce1f746f0009a4c
SHA1 90569660bc455025dafa41e5dbce6d00c6ec0a3a
SHA256 402594e8db5720ec0a49e970936b6d3ac0ea5a52547a58f9a86aac997dac1210
CRC32 158FDE94
ssdeep 384:ROzn+FVqiBvZLY/BmOWGFmt8VZOu7MXKknq5/l28URJWH39t2+Lb7rmGShCmCyrY:RM+FoiBvZk/BmOWGFmt8VZOu7M6yq5NN
Yara None matched
VirusTotal Search for analysis
Name 6aaf75610170e5d9_icon16.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\images\icon16.png
Size 1.2KB
Processes 2652 (1.exe)
Type PNG image data, 16 x 16, 8-bit colormap, non-interlaced
MD5 9ae6336aaf98308fdc2309467cad9cf5
SHA1 c798cb8115ed9a261a458f2717d3749ff8ed2dae
SHA256 6aaf75610170e5d9be58b569a8413191271773c0b6c476906292c6fe4f7049a8
CRC32 64CFAFEC
ssdeep 24:9GJvJGDa8O2Ibm1u2UarnYf2xXLekPO1VT+uNrMRkyLMfu5zksEME/n:IJxGDJWbm1YiYfqLo1VTXhMRkyLMm5Yb
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 1b8228b5f1305316_icon128.png
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\images\icon128.png
Size 23.7KB
Processes 2652 (1.exe)
Type PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
MD5 13b5800a78a6cadafb3a47eee047bc8d
SHA1 2c7340f1f0141654fb8a231d22680aa29c7df156
SHA256 1b8228b5f130531628e131b87dfc517de37271b479aa0d9b516c224d41509cba
CRC32 04BA4883
ssdeep 384:dcpi1xDvaAP52ySkVNRTQi8UqR0ktvZ4i3HwXmrY4tBEEB3JzuCCe/v9kqOA/Nf6:u6x/52dMTQFUqNrgXsptBEK6mppAqju
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name ebe716c9084e430c_._images
Submit file
Filepath C:\Users\test22\AppData\Roaming\Maps\__MACOSX\._images
Size 210.0B
Processes 2652 (1.exe)
Type AppleDouble encoded Macintosh file
MD5 4f1a618439f68950eb748274e2a5a1ff
SHA1 48b44711d6ed34ab0d666a7449160b8b32c2d1d8
SHA256 ebe716c9084e430cf2b1691e7c2d17e6f0879c6b6998bfe82aa69715e91a3127
CRC32 A802DE96
ssdeep 3:PFoESNt/FPl2XXtll83//lFlP1WlFmL83426LNRiZB/XNtslE:PgGA/i5o26PsB/9tEE
Yara None matched
VirusTotal Search for analysis