popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name c5f27936773412c2_a77vwg3r2bv_qy103lsx.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\a77VWg3R2bV_Qy103LSX.exe
Size 3.0MB
Processes 2548 (reals.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f77ab27de74f95dc4ffc7ce77f450c09
SHA1 3864e3e77e95ec97f7bd4e8885a092dfe1a24d46
SHA256 c5f27936773412c27d3823fdcdb1a262c8824988bcb4b9278ebce988bf5ed03b
CRC32 E5DC7E71
ssdeep 49152:N2XMDVVAi8ejLK20OOnUyoi0NrjFSADeBhPcv+EkapBIQB2xT4FXu:N2cDPAJej22/IUpPphluhQjPpB8xsFXu
Yara
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • EnigmaProtector_IN - EnigmaProtector
VirusTotal Search for analysis
Name 4993311fc913771a_passwords.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobeuMNHkTdTYfan\passwords.txt
Size 4.8KB
Processes 2548 (reals.exe)
Type UTF-8 Unicode text, with CRLF, LF line terminators
MD5 b3e9d0e1b8207aa74cb8812baaf52eae
SHA1 a2dce0fb6b0bbc955a1e72ef3d87cadcc6e3cc6b
SHA256 4993311fc913771acb526bb5ef73682eda69cd31ac14d25502e7bda578ffa37c
CRC32 FDAE46B8
ssdeep 48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
Yara None matched
VirusTotal Search for analysis
Name 1ba0f6d640a3ce32_7cbgof8w.txt
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\7CBGOF8W.txt
Size 128.0B
Processes 3064 (iexplore.exe)
Type ASCII text
MD5 2743d8ccdc61929acc7e8bd97db6a727
SHA1 8f5efcc80d746ff9f6f3fa0ef3fd6c6af1fe97b9
SHA256 1ba0f6d640a3ce321326df23ebc0e778fc407bfd2939326dacba1919ba3ac072
CRC32 8BA17A85
ssdeep 3:LDM8vUZlqzlxnnDf3dO2dImJ3uJcSMOsRX1YQMcP/n:Lg+qslhnDf3dZIA+SVxx1W4
Yara None matched
VirusTotal Search for analysis
Name 2bd879d3e79a2f11_{11b0722e-ceb0-11ee-948e-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{11B0722E-CEB0-11EE-948E-94DE278C3274}.dat
Size 9.5KB
Processes 2988 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 845fb79ec48e53cdbaa94879ff132e55
SHA1 8a709f56424151545416e9f60f94786eb1cfac56
SHA256 2bd879d3e79a2f11ca5e8c7bc2f1e10c48d50401cf6beaaa76837e48236bc086
CRC32 589FD416
ssdeep 192:z3HdQ6t3UQAd3HEdQZ3HdQn3HdQR3HdQWRWf43HdQp:e6jAZsS0YQ
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 6de38e01b5897ec7_explorgu.job
Submit file
Filepath C:\Windows\Tasks\explorgu.job
Size 274.0B
Processes 2704 (cHXwqlMWUMGBBwN9hxfj.exe)
Type VAX-order 68k Blit mpx/mux executable
MD5 942b2d06d898e4f40c0968fccde54830
SHA1 1459eae7aadd289c45d3d02beec39c3e763713cc
SHA256 6de38e01b5897ec7602ec892004a4b254937559775d891e721f295eab34eed42
CRC32 369BB3EF
ssdeep 6:9UMfXE/Xm/UEZ+lX1yrlbtI4y0ljX5lEt0:D/kW/Q1yrM4VjLEt0
Yara None matched
VirusTotal Search for analysis
Name 16187ff9b5096b21_D87fZN3R3jFeplaces.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\D87fZN3R3jFeplaces.sqlite
Size 5.0MB
Type SQLite 3.x database, user version 69, last written using SQLite version 3038003
MD5 837705c24eaa032145b6f82119af4eea
SHA1 7d38a13b37105ef0f6c24c585de581949616f32c
SHA256 16187ff9b5096b217d405d1492c115a096f8d63d72befbf5851e19b61581f857
CRC32 8BF87D31
ssdeep 192:StsqHQnwkYjcoBMc+uK6ik4QtjJz3ig48pp0:StsbwVTBMc+uK6ikPpJz3E8
Yara None matched
VirusTotal Search for analysis
Name 4d52d2c3a2668c40_rage131mp.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\rage131MP.tmp
Size 13.0B
Processes 2548 (reals.exe) 2932 (PDbNNj6OmrILaV3JtHH1.exe) 2056 (a77VWg3R2bV_Qy103LSX.exe)
Type ASCII text, with no line terminators
MD5 adf30ded9e5b91146a03e1afb07d3c7c
SHA1 05b5992c9e098a62cea8e835763dee2540ce3b8f
SHA256 4d52d2c3a2668c40887a8e6aced8bc9c81bbb6a237be355a15cab091aa154678
CRC32 C8E709BF
ssdeep 3:L3STHdRQU:Lg92U
Yara None matched
VirusTotal Search for analysis
Name 8c8a79ebc4c63f01_information.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobeuMNHkTdTYfan\information.txt
Size 2.8KB
Processes 2548 (reals.exe)
Type ASCII text, with CRLF, LF line terminators
MD5 53e730b5fa47e41f494b14f378653462
SHA1 14af764c4092b2d74507b41fd5130fd7166284bd
SHA256 8c8a79ebc4c63f01d2e4c0359013a45a7fcd03cd1ee9829455566550f523162d
CRC32 41C1A683
ssdeep 48:xqe7btaFcnOwTF/SOQ4cydMtffVPh3RxoGE+ruTBAT+iaGaHa/y+WRhatp++CZGR:xqevrDF9BmtfNP/EpTabFuatp+9Mdjwk
Yara None matched
VirusTotal Search for analysis
Name dc81ca38d201df65_jlzfi3mombv1vbp25nbj.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\jlzfI3MOMBv1vbp25nBj.exe
Size 896.5KB
Processes 2548 (reals.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ac4b42fecbc881643762335738679af8
SHA1 a7f0f297eab73d6891eede5deeed4e95a66a0653
SHA256 dc81ca38d201df65ffa96e5ef690553a8daeb7d0f756c8d200a24577b43afcca
CRC32 4D7763DB
ssdeep 12288:BqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaNTa:BqDEvCTbMWu7rQYlBQcBiT6rprG8aJa
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 6da5620880159634_favicon[1].ico
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\favicon[1].ico
Size 5.3KB
Type MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
CRC32 6F59F9C6
ssdeep 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
Yara
  • icon_file_format - icon file format
VirusTotal Search for analysis
Name 69e0f1a31f800374_0Y5zv7eONNHE6Ebh73i5R3x.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\0Y5zv7eONNHE6Ebh73i5R3x.zip
Size 1.6KB
Processes 2548 (reals.exe)
Type Zip archive data, at least v2.0 to extract
MD5 9796f2e7fe57eb2c904a29ecd8a4eb91
SHA1 9518d32357492ad38f0605476bb1cff2be288e58
SHA256 69e0f1a31f8003744c7df0fbcc7696f14ad12e051f999aec54fdd0a9e9d39ea9
CRC32 E42DBD33
ssdeep 48:9QzvG/Y3f5UC86JfqsmQHaY0LLOtn3KJ6OYw:6zewf6USVk/0LLOt3KJ7
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 5ee454eb05fcbbc0_02zdBXl47cvzHistory
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\02zdBXl47cvzHistory
Size 120.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 64202674f6acaafa94c3390b0cc720b9
SHA1 38c8537feccfaabb095805d290af69272aeb32f1
SHA256 5ee454eb05fcbbc0ac1ff5662ba2be1f22688ddb97d3cc357d4da5cff5b5e5e9
CRC32 3685166F
ssdeep 48:TGjDU66tTKfxNPp+suktLReRK+NaUvdWSZ00LTL0drQHHp7C5fVcS2+VANUXq6uG:BeJQpWSZ00LTL0QCbc0VANPjwQU+
Yara None matched
VirusTotal Search for analysis
Name 482fed1a79de8171_accounts_google_com[1].htm
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\accounts_google_com[1].htm
Size 329.0B
Processes 3064 (iexplore.exe)
Type gzip compressed data, last modified: Fri Jan 19 20:33:04 1996, from TOPS/20
MD5 272c0292045b051231365e28d2396370
SHA1 6dbbd562f5f8e07c67bb4187c92d8d9bfa263723
SHA256 482fed1a79de8171720acef0bf4aace88d8d9903a6fce879f05eb5ee8b32fff2
CRC32 F69CAC56
ssdeep 6:XtZTC/VGTGTGTGUlU8SXCtnx2vPjUe+VZ/tif5YcADh/EpMyztr:XDG2UXCtnKPozTixnANEpMo
Yara None matched
VirusTotal Search for analysis
Name 512e4e95427a8c66_5lop_S5WM5ERCookies
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\5lop_S5WM5ERCookies
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f4c540f52d5c08d24a79805eda1d7abf
SHA1 22be46826df7693f58736adb232ab2da790f2571
SHA256 512e4e95427a8c66b2993b27bb23d99cdab2ebd6e9e8937c7f6a39ed8c6a5b94
CRC32 95C9FB3A
ssdeep 24:TLmg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fB34444z:T5/ecVTgPOpEveoJZFrU1cQB34444z
Yara None matched
VirusTotal Search for analysis
Name 58fe4cc494d80e87_recoverystore.{11b0722d-ceb0-11ee-948e-94de278c3274}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{11B0722D-CEB0-11EE-948E-94DE278C3274}.dat
Size 4.5KB
Processes 2988 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 4e19f34fcde0c55bd5b9c7e0b38b85be
SHA1 c422e94b69f8362875e071c2fd1e247d6a04b59c
SHA256 58fe4cc494d80e87ea05c5f9eaa07ee81e25d318ddd9608660cfc48a0be2c0f6
CRC32 A972771D
ssdeep 12:rlfF2eQrEg5+IaCrI0F7+F2qrEg5+IaCrI0F7ugQNlTqbaxaH0gWONlTqbaxaH0W:rqeQ5/1q5/3QNlW9H0NONlW9H0dY
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 7466901e6c141968_edgems131.lnk
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk
Size 1.1KB
Processes 2548 (reals.exe)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Sun Feb 18 13:50:13 2024, mtime=Sun Feb 18 13:50:13 2024, atime=Sun Feb 18 13:50:13 2024, length=1856000, window=hide
MD5 2943f365e9e6b3e4f5f2b330f85c2ea6
SHA1 2e66a77982807b1c0bb6ae0fbf53e1ec13bcd90d
SHA256 7466901e6c14196899d31efe2111904663fd086c02ee6e3aac03b849c3b610f0
CRC32 CDA2629F
ssdeep 12:8iVgTEk64cZCrR8EvSW3/OXR+/Y/4mX3KgLg3k56HcdRCg3BizCCOLMClo3Z1zsJ:8GkHsERd7iR5CgCcdRczNRCMO6Pyd
Yara
  • lnk_file_format - Microsoft Windows Shortcut File Format
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_02zdBXl47cvzcookies.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\02zdBXl47cvzcookies.sqlite
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 1beb05868ce93bcc_IE9CompatViewList[1].xml
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\IE9CompatViewList[1].xml
Size 141.8KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 9b63e0fb3785ffa49686dd75e303d177
SHA1 e3992de5a1b8f58a11a52ad71f275ae413927eb4
SHA256 1beb05868ce93bcc8fafc46adccdda6d104f3c6f6c6ed454d8a6c0c208d9bd0e
CRC32 F778EDEF
ssdeep 3072:AoSMrEDL1FwhdFFaz6l8vHG+TbFPAzepobjyG7I1K1IB2+Tir8v1IG9aIedyPcFC:dSMrEDL1FwhdFFaz6l8vHG+TbFPAzepR
Yara None matched
VirusTotal Search for analysis
Name bbc59eb43822e646_Ei8DrAmaYu9KLogin Data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\Ei8DrAmaYu9KLogin Data
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 53ea322f91d6f0de8448b68583284d22
SHA1 b6c835867fbf7e432b834f7366eb0407f3eebbfa
SHA256 bbc59eb43822e64660cc4ccbca37d6dc016eaa9b85b2c6f5b40826bb03188b34
CRC32 CA013001
ssdeep 24:LLY10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6ocW:4z+JH3yJUheCVE9V8MX0PFlNU12W
Yara None matched
VirusTotal Search for analysis
Name 40815f35c7fbd011_y3p6n3ne22r3bfousyqb.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\y3p6n3ne22r3BFOUsYqb.exe
Size 1.7MB
Processes 2548 (reals.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 388bba79f6f752af26dcde3362e19d65
SHA1 e0e5db7a33b6362ddddbb6c0391009e8090aaa7a
SHA256 40815f35c7fbd011b97830aad703a6bc08019e488b25f6cab50b20665732d26d
CRC32 EDA2CE20
ssdeep 24576:Tgq2fz0Yalm+IiuJk/2pKrRsth5Jhi3g3QFlvRXcW1Q39NEEyryzlhYrQ17bF9E5:VCz2lUjcrRstNhibLRX/K39vYQ+
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 32e984b563d146a5_pdbnnj6omrilav3jthh1.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\PDbNNj6OmrILaV3JtHH1.exe
Size 2.3MB
Processes 2548 (reals.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 6ab2a78aae271db3e351306287a5c375
SHA1 64ef8d205478aaf9f89db4cf1881d5e4539a5ede
SHA256 32e984b563d146a56c1ea6f44a30a308d97bf2c0b9ba8cec571a436f13317592
CRC32 6EE7D59E
ssdeep 49152:ovebcjiyE79ApTZTBO8l2V7T8xrwDDuMFc+PUsr1wnuTh3AeabSnD5:msQiyExApFxYZTD3Fc+8sp1WvSnD
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name e6e5ac329d9c9714_explorgu.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\00c07260dc\explorgu.exe
Size 1.8MB
Processes 2704 (cHXwqlMWUMGBBwN9hxfj.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f6f057e1052b1dee9717083d57c7ffb9
SHA1 aa6ca7858abdc35715d0ae474a7dbf894f6a942d
SHA256 e6e5ac329d9c9714ba66ef40e33892c498fdc5ee19da8d8ba3e4fdea3e7f9e36
CRC32 19D015B0
ssdeep 49152:4JM6EiOwPLIh3OXMWmxVMpMnxwYZhLKamy6jw:2XPLtkxwqmaB2
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
VirusTotal Search for analysis
Name 9a8ea0e2df7554c5_D87fZN3R3jFeWeb Data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\D87fZN3R3jFeWeb Data
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 0539a773e44d21a84fd97fee0dffd4a3
SHA1 5904058c20aad54c552edc57826babd36ab61149
SHA256 9a8ea0e2df7554c57fb4ee6a8a12782f5a2474a3e4c23dc61e4768631dc4eb9f
CRC32 964BC0B2
ssdeep 96:P0CWo3dOOctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:PXt769TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis