popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name ff69f3cc4d75e593_rfc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Rfc
Size 194.6KB
Processes 2548 (700.exe)
Type data
MD5 a26e2ad7c64f747682ec1a40f891a5af
SHA1 13c3833f02b73e369b5b9a2b1350082b6a48aab3
SHA256 ff69f3cc4d75e5937f5a76905487420b333f55261ad4505ac981b2029fa728b4
CRC32 80D2BEB5
ssdeep 3072:76jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:764EgarxUaBZ2myoG
Yara
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name 9acfeae5a5130167_information.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempCMSbahrIBKLh1bJ\information.txt
Size 2.7KB
Processes 2852 (Pros.pif)
Type ASCII text
MD5 b119b5b093283f4eacfdda9ece995b2c
SHA1 ab10f927a1d93aa4b407a7a406096aabc07f52f2
SHA256 9acfeae5a5130167d3151078d5e16c8ec77c253715b27abd9f42341d17228b04
CRC32 820D71BD
ssdeep 48:tVQyataFLnB4IEFRMScxiqh392GoxyqcjRSQStFY6L+DeqH+rZvuolQ2oa6L1RaX:tVQ7enEPwuDEjReTYfDeqHOxuolQ2oar
Yara None matched
VirusTotal Search for analysis
Name 39c3cb4761ba5fbb_700.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\700.exe
Size 2.2MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 450783b6304d896d217b0a816a3f4853
SHA1 535b2eb77aaadabb2c7696e026fcb64bf7d244c5
SHA256 39c3cb4761ba5fbb081b564c592a3f01c461b72277fe6baaff24907208eae99f
CRC32 C5EDBE7C
ssdeep 49152:CD96aQpIPAMnqnQIQ0z4DMRu29DMDd22:Cx6aeI4MnVIJtMZ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
VirusTotal Search for analysis
Name e54e94a709698276_b
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\4422\B
Size 2.1MB
Processes 2120 (cmd.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 c60c50f1e7a359d7996bbb420a135a65
SHA1 747c7c0d62d17fa8af321817cd5301cede842e1a
SHA256 e54e94a7096982764317bca990edc75bafdf547306a16af6a1a01152c28df9ec
CRC32 3CCF4898
ssdeep 24576:Zt5E4XORFr4ou/3MmqmvPVmW2CyS99V0ZQTNscZ:Zr
Yara
  • hide_executable_file - Hide executable file
VirusTotal Search for analysis
Name 570778bf44b2e8f2_monetary
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Monetary
Size 12.4KB
Processes 2548 (700.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 a3c1af710c39017388bdd142383cbfd8
SHA1 c33dd6431c682c259dfd034796476ede3b5888e7
SHA256 570778bf44b2e8f2ec43f75992f8b06f2e80be908032167371f8ff8fc455c847
CRC32 F883AF1A
ssdeep 192:h4iR3SJeCC6sbEixfyXoWsyotgoTjeNqS7rugZm:h4iH69dXxL+g3v7K/
Yara None matched
VirusTotal Search for analysis
Name 16187ff9b5096b21_D87fZN3R3jFeplaces.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempAVSbahrIBKLh1bJ\D87fZN3R3jFeplaces.sqlite
Size 5.0MB
Type SQLite 3.x database, user version 69, last written using SQLite version 3038003
MD5 837705c24eaa032145b6f82119af4eea
SHA1 7d38a13b37105ef0f6c24c585de581949616f32c
SHA256 16187ff9b5096b217d405d1492c115a096f8d63d72befbf5851e19b61581f857
CRC32 8BF87D31
ssdeep 192:StsqHQnwkYjcoBMc+uK6ik4QtjJz3ig48pp0:StsbwVTBMc+uK6ikPpJz3E8
Yara None matched
VirusTotal Search for analysis
Name 798a0ad978b44eb0_oo
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Oo
Size 463.0KB
Processes 2548 (700.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 3aef5ce6af09248618786c5c9683a13c
SHA1 17c50318dad45ca16b803e30a38b423198fc6904
SHA256 798a0ad978b44eb07271c24d4eb2d7339c0f21a13683582fe59566095988e0d4
CRC32 E09A580E
ssdeep 6144:l73H7qRBGGkA/dBeV24DMCc0cOTLkAB4UZ0DGTaI3tjLUL3crvAouxc:l73H7OEGtB3CT4ORPtjL3r4ouc
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name c850d22cdc098146_coupons
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Coupons
Size 449.0KB
Processes 2548 (700.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 55e509a8bb41146d56512d1685ff36ad
SHA1 faf65e920367aed3ba40abc747d24ed927018d33
SHA256 c850d22cdc0981462db7765a2c82630e4e7f8054ee34efe626ea5bc809afc272
CRC32 FEA764F0
ssdeep 6144:u3MyynAwrReSxzk+e+i4TLmpvBppHv+GHl:u3MZQz+enymvPpHv+GF
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name f58d3a4b2f3f7f10_pros.pif
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\4422\Pros.pif
Size 924.6KB
Processes 1964 (cmd.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
CRC32 4FCA9037
ssdeep 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 1552a7e016e26239_scheme
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Scheme
Size 467.0KB
Processes 2548 (700.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 63762e8b142beb1993554443a989861f
SHA1 d3c171c4a3019fcf39a43bd136572b08e62cc27d
SHA256 1552a7e016e2623989b06fff20dc64c2ea735fef307189f38d4513e5b96e48e4
CRC32 2A23D190
ssdeep 6144:scSoXKCxij92NOYs7OrQHayrO+oWtBqWUjSk0m1yfAD:so6Cxi5p7gnyrO9wqFjSkYID
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 5ee454eb05fcbbc0_02zdBXl47cvzHistory
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempAVSbahrIBKLh1bJ\02zdBXl47cvzHistory
Size 120.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 64202674f6acaafa94c3390b0cc720b9
SHA1 38c8537feccfaabb095805d290af69272aeb32f1
SHA256 5ee454eb05fcbbc0ac1ff5662ba2be1f22688ddb97d3cc357d4da5cff5b5e5e9
CRC32 3685166F
ssdeep 48:TGjDU66tTKfxNPp+suktLReRK+NaUvdWSZ00LTL0drQHHp7C5fVcS2+VANUXq6uG:BeJQpWSZ00LTL0QCbc0VANPjwQU+
Yara None matched
VirusTotal Search for analysis
Name 512e4e95427a8c66_5lop_S5WM5ERCookies
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempAVSbahrIBKLh1bJ\5lop_S5WM5ERCookies
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f4c540f52d5c08d24a79805eda1d7abf
SHA1 22be46826df7693f58736adb232ab2da790f2571
SHA256 512e4e95427a8c66b2993b27bb23d99cdab2ebd6e9e8937c7f6a39ed8c6a5b94
CRC32 95C9FB3A
ssdeep 24:TLmg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fB34444z:T5/ecVTgPOpEveoJZFrU1cQB34444z
Yara None matched
VirusTotal Search for analysis
Name e8dec475bf53ea5b_united
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\United
Size 429.0KB
Processes 2548 (700.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 169b3b68dc68b9556bb99812d82b74eb
SHA1 8e9f1d8d8dc3c6da998fc17a8266aff19e22c899
SHA256 e8dec475bf53ea5bf0d9eb2bacc4a86693b2959ee23e0530e6d3eea096b11f4c
CRC32 3CDAFC9A
ssdeep 3072:9s0i8pNiPFvChCdKc08R3HPNHP1vHaFfkaFXCB9lrWUwV3Tq1hOXB2N+WbzaLW+w:Q8/yi/+bLwVDqjOXB2NtWLhVm09dHQzx
Yara None matched
VirusTotal Search for analysis
Name 16f2e1c7549e316e_falls
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Falls
Size 273.0KB
Processes 2548 (700.exe)
Type data
MD5 badc5f310280cfe909c05deb00c19044
SHA1 364303672e87755b57afbc29603c6dd168df839c
SHA256 16f2e1c7549e316e19dadb4662849f08e6144ff92efac14c33707b38ad592193
CRC32 4C60E5D8
ssdeep 6144:FvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYmFqZvEAOz04pmdV7:FvqJWNAB+X0lHPOGNnlMZce4wdV7
Yara None matched
VirusTotal Search for analysis
Name 367a99acc640a280_goal
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Goal
Size 251.0KB
Processes 2548 (700.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 9df8d2430872a7987f2acb31d0ce9994
SHA1 4a6c400856c1500e947abb5cd392bdcd0789c50e
SHA256 367a99acc640a280aec570df67a92b4209e21bbeddee9366a2e1892080d43ab1
CRC32 56DE209B
ssdeep 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lT:LO0z8e0lvSr0Wyw20K4mqClT
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name d0523bdaf7c260c8_lexus
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Lexus
Size 206.0KB
Processes 2548 (700.exe)
Type data
MD5 c61732739204ae0888c811c83c138771
SHA1 67c5f3afbf881bbc71736916d30fe33e9676cd86
SHA256 d0523bdaf7c260c8394adbebf9b05a14e1c5f84114943daf5edb58ec7ed56592
CRC32 25B9FED9
ssdeep 6144:OlEAehuqN8zwNzlmhPL1b5nZ2tZ6lfA6Gfm608Do:OlEZuB1b5Z2tZ6XKmf
Yara None matched
VirusTotal Search for analysis
Name c3f185c9bbc7872b_operaconnect116.lnk
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OperaConnect116.lnk
Size 1.2KB
Processes 2852 (Pros.pif)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Tue Oct 31 13:44:58 2023, mtime=Tue Oct 31 13:44:58 2023, atime=Tue Oct 31 13:43:40 2023, length=946784, window=hide
MD5 67fcd107e59a20a1a3701eaecc9e7d24
SHA1 f6e951f6ec9ad713df5625d0307a84ef0da8922f
SHA256 c3f185c9bbc7872bdd5475b8fd7698f1103bded3aa004fbb790546636e474a1b
CRC32 7ECCC630
ssdeep 12:8ivMk64cZCrR8EvSW7yjR+/7yXqqX7P1bBimQrcetkWCizCCOLM6sS1uQPPzawuP:8nkHsERd+RzBt4cikczNR6sSwQPO6PyB
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_02zdBXl47cvzcookies.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempAVSbahrIBKLh1bJ\02zdBXl47cvzcookies.sqlite
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 204a93e1274c57f4_passwords.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempCMSbahrIBKLh1bJ\passwords.txt
Size 4.8KB
Processes 2852 (Pros.pif)
Type UTF-8 Unicode text, with CRLF line terminators
MD5 974cc190d5703018c01ce08b904e227b
SHA1 b4f0f2a72907fcf9551846411a7221f60a88f97d
SHA256 204a93e1274c57f489adb21e0bf56064624582bb3b79fd59ba779ec8a137d8ff
CRC32 C32C1308
ssdeep 48:tMMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMME:m
Yara None matched
VirusTotal Search for analysis
Name bbc59eb43822e646_Ei8DrAmaYu9KLogin Data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempAVSbahrIBKLh1bJ\Ei8DrAmaYu9KLogin Data
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 53ea322f91d6f0de8448b68583284d22
SHA1 b6c835867fbf7e432b834f7366eb0407f3eebbfa
SHA256 bbc59eb43822e64660cc4ccbca37d6dc016eaa9b85b2c6f5b40826bb03188b34
CRC32 CA013001
ssdeep 24:LLY10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6ocW:4z+JH3yJUheCVE9V8MX0PFlNU12W
Yara None matched
VirusTotal Search for analysis
Name 563058dd647532d0_o9KGTZtYtBboZzLUOJvLcldZix6RIjfu.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\o9KGTZtYtBboZzLUOJvLcldZix6RIjfu.zip
Size 36.2KB
Processes 2852 (Pros.pif)
Type Zip archive data, at least v2.0 to extract
MD5 934edf0d03446bb704c5c67ee964753a
SHA1 d9038ce0317ea9386857f202da2cc99d874cb3a5
SHA256 563058dd647532d028452031c712e29ea2d967159f193e4dfb685e0b84470c1c
CRC32 D99E458B
ssdeep 768:NIQeqbY1WaVLPg1DRWPeZsAMoscefQP7zwJ90ei43BZi7PMm2:VvbqdVL4vWP05MoheoDEyjKiDMm2
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name d9e87c23937a77ec_screenshot.png
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempCMSbahrIBKLh1bJ\screenshot.png
Size 50.2KB
Processes 2852 (Pros.pif)
Type PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
MD5 f09f2168798cf76a58007d785928be41
SHA1 7b007d1343fdfb47edaa0f834feea974b22cebde
SHA256 d9e87c23937a77ec267543237f702cd17185d2602e7421b8fe1b462b1d4c04c9
CRC32 D47CF43F
ssdeep 768:XoGqpQ1IX5dDH7dwN3+YzyAD/j12J/GUvJ5lFDxH/ls9NZ8Hf/C:Xp1IX5drpm+YpZevJ5lRs9NZM/C
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 5869fd8477415c95_rural
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\54429\Rural
Size 356.6KB
Processes 2548 (700.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 72618a766bbaa6a78b03756dd3ad603a
SHA1 e20138d66a4fc2764c87fb62744ab101f779dbbb
SHA256 5869fd8477415c9522a0fcec6bb4fa12e2a7593788b3bb840d5c0a5b4bf41c30
CRC32 1052E136
ssdeep 6144:7tuMyZZfuIZKriKTU5gesC1+vXv6T16sI:7tJyZZWrrfTU2eP+vXZ
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
  • hide_executable_file - Hide executable file
VirusTotal Search for analysis
Name 9a8ea0e2df7554c5_D87fZN3R3jFeWeb Data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tempAVSbahrIBKLh1bJ\D87fZN3R3jFeWeb Data
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 0539a773e44d21a84fd97fee0dffd4a3
SHA1 5904058c20aad54c552edc57826babd36ab61149
SHA256 9a8ea0e2df7554c57fb4ee6a8a12782f5a2474a3e4c23dc61e4768631dc4eb9f
CRC32 964BC0B2
ssdeep 96:P0CWo3dOOctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:PXt769TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis