popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name c119a54b6bef3a48_9eZIe0olNJPSWeb Data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\9eZIe0olNJPSWeb Data
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 255929949dea51a2f43a1f40e63764ec
SHA1 8f32ab419264fdad05f4f3828db3c1cd38d919fd
SHA256 c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6
CRC32 F7A79605
ssdeep 96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/
Yara None matched
VirusTotal Search for analysis
Name 54cfed4f859d0ec3_9mO5Kbay0pLIHistory
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\9mO5Kbay0pLIHistory
Size 116.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 6f490da5428093674c9e609077dcdef2
SHA1 d77592944313656a90f359fea62921c20078ff19
SHA256 54cfed4f859d0ec37535b9f16acfe42cae6206fad4b1652c2a3d33d5acf636c7
CRC32 A046246D
ssdeep 48:T4ItVG+3C7nNfVcS2+VANULn36uw5NPM5ETQTpUPxK2PIs6kJL5R2+zaSZ00LTLU:ce/C7n/c0VANUjwQU+KraSZ00LTL0J
Yara None matched
VirusTotal Search for analysis
Name 402a5cb04c093bbd_6RDH5nMJZ2PrYI_Gu8d6O91.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\6RDH5nMJZ2PrYI_Gu8d6O91.zip
Size 1.4MB
Processes 1020 (sys.exe)
Type Zip archive data, at least v2.0 to extract
MD5 51fbf08f12e7eab6d445496225dead71
SHA1 3067149f43679b2f7c72d0f3d532161980600e79
SHA256 402a5cb04c093bbd50ebe9f44ba408975c28d3e9b7163f9c31deffde6b1d5d63
CRC32 7B237A25
ssdeep 24576:bo+CsR5KdDqgMJcC5LZmbeCCmJmNREXImris3IqRYguGn/ehLZEVZBjvBrafQX:s+r7oqJcqZYCvNRE4mriZqRYgxeh2ZBj
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis
Name 241d9ac641858aa6_information.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobeML2ALAQJwRqK\information.txt
Size 3.4KB
Processes 1020 (sys.exe)
Type UTF-8 Unicode text, with CRLF, LF line terminators
MD5 c0a99bc8d05aa927c2bc9966aeed71cd
SHA1 41deb266381d63f984698cc622d7de4e54ecb85a
SHA256 241d9ac641858aa66fdc2cbc49eb2f221e429f9ae36bf3ab1f13042b68454531
CRC32 B4151E6E
ssdeep 96:xzBisrUFLeBmtfNPs86r0iAxv+mLqVnZJVuYU8rf2dIv2Ovhiax3:xdLoN+mtfNPN6ro2MS3
Yara None matched
VirusTotal Search for analysis
Name 4993311fc913771a_passwords.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobeML2ALAQJwRqK\passwords.txt
Size 4.8KB
Processes 1020 (sys.exe)
Type UTF-8 Unicode text, with CRLF, LF line terminators
MD5 b3e9d0e1b8207aa74cb8812baaf52eae
SHA1 a2dce0fb6b0bbc955a1e72ef3d87cadcc6e3cc6b
SHA256 4993311fc913771acb526bb5ef73682eda69cd31ac14d25502e7bda578ffa37c
CRC32 FDAE46B8
ssdeep 48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
Yara None matched
VirusTotal Search for analysis
Name 8916fb1d76be83e4_IWPfiAXUTJTSformhistory.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\IWPfiAXUTJTSformhistory.sqlite
Size 192.0KB
Type SQLite 3.x database, user version 4, last written using SQLite version 3031001
MD5 6b9c2ac2b5025e180231d8d38ece698c
SHA1 36f5cfe6ac59aaa7d7173555edeef5caa9bf61c6
SHA256 8916fb1d76be83e42cd2f7b41ee06706fe0adb936259ed7a7daa4dbcb4c51fcb
CRC32 95ACFD74
ssdeep 12:DBl/lkf12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLlI1x7WxHaiSlMxosJF/Ezo
Yara None matched
VirusTotal Search for analysis
Name 5f622a2bfeb83b59_thunderbird_g8t0pe67.default-release.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobeML2ALAQJwRqK\Cookies\Thunderbird_g8t0pe67.default-release.txt
Size 361.0B
Processes 1020 (sys.exe)
Type ASCII text, with CRLF line terminators
MD5 95dff27b67a96f98827e72f9330eb164
SHA1 2d86a3aca1d9a7c16127a333fe642cae08cea0c8
SHA256 5f622a2bfeb83b597d9556ffc8bc107e219eb6ab2ef3cff2d4428e5048ebddad
CRC32 4C9B7FD3
ssdeep 6:JiKjaphXX7aQ2vSI95Bj9GfBHthf+CthfMl0kq/H+LkiKjaphXXrSdrNBPPi1H:J/EhXraQ2v795BxGfBHff+CffMOkqP0J
Yara None matched
VirusTotal Search for analysis
Name ffb53991332e21ef_rage2123mp.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\rage2123MP.tmp
Size 13.0B
Processes 1020 (sys.exe) 2916 (YaV8gLRiIlNUtsLgaT72.exe)
Type ASCII text, with no line terminators
MD5 a08298bea6d5684136265144d2771e5f
SHA1 387bdf2b0ed7470e7c81d013aba292b86b49698d
SHA256 ffb53991332e21ef4fae5b1cbf6a0af859ac4fd0e96fdd19dad794f110427da8
CRC32 363E0427
ssdeep 3:L7XfdFW:XXW
Yara None matched
VirusTotal Search for analysis
Name c9cd46971ed4e66e_screenshot.png
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\adobeML2ALAQJwRqK\screenshot.png
Size 1.4MB
Processes 1020 (sys.exe)
Type PNG image data, 1024 x 768, 8-bit/color RGBA, non-interlaced
MD5 1298d33997a4e26aef44c3400ae4e63b
SHA1 6a379505188fbf493c5127d42281f5e658d7df88
SHA256 c9cd46971ed4e66efc9cb7b58d256d013d81f64c6cd15b617f782216bde72978
CRC32 73085F82
ssdeep 24576:IqUc08ir/YMak6iHtbli2uBWB6JYARoMMB7a/YG9cKMPFIF7qSdFVQmr2yS3FdK:s/DYMakvblinBYGoMeYsU+SdFVQcTS3i
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name b3dfa692f7da19ee_D87fZN3R3jFeplaces.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\D87fZN3R3jFeplaces.sqlite
Size 5.0MB
Type SQLite 3.x database, user version 69, last written using SQLite version 3038003
MD5 c395620f9a8337341636a78a98f5b3d9
SHA1 97700ec4db7362e02a56df5e70dd828ad9823d24
SHA256 b3dfa692f7da19eede9aa2fe2ac76052cfaa32a7d30cc53b88ea5ef23ec32624
CRC32 476CDB88
ssdeep 192:StsqHQnwkYjcoBMc+uySBQies13A29D+oBpp0:StsbwVTBMc+uySOiJ3Z
Yara None matched
VirusTotal Search for analysis
Name edb006e05cfa8501_MPXjJY7TkT2sCookies
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\MPXjJY7TkT2sCookies
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 3f5ca3e29b1b60e298aeca0a32164c03
SHA1 f9b5ee59c31a3b06a6b8e476b22d2d7cf1fa8b66
SHA256 edb006e05cfa85015aa76c758d6298c279fd318cff0dbb286927c7ad45105488
CRC32 E1ACA097
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis
Name 824fae3331b95e2f_O36PpcTJHbhGLogin Data
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\O36PpcTJHbhGLogin Data
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_02zdBXl47cvzcookies.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\02zdBXl47cvzcookies.sqlite
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 2cd378dd3e9c3ddb_yav8glriilnutslgat72.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\YaV8gLRiIlNUtsLgaT72.exe
Size 1.0MB
Processes 1020 (sys.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 a4702dad93dc851947aa6bd7b9652c46
SHA1 99f23b3077fa0f57c3c0cb95341adf38fdeb6142
SHA256 2cd378dd3e9c3ddb6196c7c8a9dc1c88ecf74b2371f1394bd01ff37857a8c7d5
CRC32 63B40CF6
ssdeep 24576:SyvFWZZO/TzAEuDtTVAxn+NZh0ocqB8J+zFX/DZCtkY:Tn+NZGolS+5/caY
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 88f9dc0b9a633e43_KvHrxJ77cmUgcookies.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\KvHrxJ77cmUgcookies.sqlite
Size 512.0KB
Type SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5 dd47ebe6866ad2ab59d0caa1de28d09e
SHA1 afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663
SHA256 88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3
CRC32 8DEE9EEA
ssdeep 24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm
Yara None matched
VirusTotal Search for analysis
Name 169c04331f72fe4a_QdX9ITDLyCRBplaces.sqlite
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\heidiML2ALAQJwRqK\QdX9ITDLyCRBplaces.sqlite
Size 5.0MB
Type SQLite 3.x database, user version 53, last written using SQLite version 3031001
MD5 f77930486de1b1bb4b397d5d8f3cd124
SHA1 e3f5727a0774c7cba17f0b10569012dcea24cb55
SHA256 169c04331f72fe4ae9958da09e1b28ec5910f7ea523d6105b7e4ad521b2baaee
CRC32 D85072F9
ssdeep 96:Dm8j5PnH6xY2Wi+67tH2iB4q2xfX7ZbiZzdFzb4PPwI3A7:l5/IYOTAlQzdFzaDm
Yara None matched
VirusTotal Search for analysis