popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 41529057159d9d36_IE_books.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\IE\IE_books.txt
Size 2.3KB
Processes 2560 (Pillager32.exe)
Type UTF-8 Unicode text, with CRLF line terminators
MD5 02d9c77a21192620031d3427a7d0e9c4
SHA1 933bab1498b94785f0cb93f53ae877029d4e14df
SHA256 41529057159d9d363d3be72e87a33376a0212f3a3ceb9877444a3e3ab55678cf
CRC32 FB5E2175
ssdeep 48:o9ADCvN/irPjsRkrZL68A1D4AH4fqczK4rsiyHluFxZ7Radwp2bmA+GC:oa2VKrIRyZrOMAYfqczlrFKlqzFyEgH2
Yara None matched
VirusTotal Search for analysis
Name 45c79d94cdbe3860_FireFox_history.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\FireFox\FireFox_history.txt
Size 406.0B
Processes 2560 (Pillager32.exe)
Type ASCII text, with CRLF line terminators
MD5 482a9e58d6ddb814615bc1d8343ee028
SHA1 60ef73d3e02d45bf27846a458f7582134722abb0
SHA256 45c79d94cdbe386096cfd76502cdb515de1bdc463a65833c3fffe2326bd4e765
CRC32 4715ECDB
ssdeep 12:2w93sMwDw93szwvaacAhZmK8Do2DAR8DBOeD36Dm:2wxsMGwxsaKD7D3DBzDKDm
Yara None matched
VirusTotal Search for analysis
Name 16187ff9b5096b21_tmpF127.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpF127.tmp
Size 5.0MB
Type SQLite 3.x database, user version 69, last written using SQLite version 3038003
MD5 837705c24eaa032145b6f82119af4eea
SHA1 7d38a13b37105ef0f6c24c585de581949616f32c
SHA256 16187ff9b5096b217d405d1492c115a096f8d63d72befbf5851e19b61581f857
CRC32 8BF87D31
ssdeep 192:StsqHQnwkYjcoBMc+uK6ik4QtjJz3ig48pp0:StsbwVTBMc+uK6ikPpJz3E8
Yara None matched
VirusTotal Search for analysis
Name ebca9e12dc9fbbd6_IE_history.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\IE\IE_history.txt
Size 251.0B
Processes 2560 (Pillager32.exe)
Type UTF-8 Unicode text, with CRLF line terminators
MD5 6eee60f1df2bf52f9016d787ab01c323
SHA1 cb306bb4e0e9f91e4776b2398e6595e05035fab0
SHA256 ebca9e12dc9fbbd605f65cd6f03220487ad3660952ff34d98ffd041bb07ab74b
CRC32 0DF46CA4
ssdeep 6:2luBCaQD2DNVW0m/EWOLIwBGwnAuXRKKAWAscnC5V6bC503uOvn:2EC9DYWV4GkJ1JAsAwflOv
Yara None matched
VirusTotal Search for analysis
Name 3a77b4c9154fc896_ScreenShot0.jpg
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\ScreenShot\ScreenShot0.jpg
Size 36.8KB
Processes 2560 (Pillager32.exe)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5 e3fcfc0d686a1b1576698cc7219a2d7f
SHA1 484c5a8e8552334692c713c8685e8d7df5cf91ee
SHA256 3a77b4c9154fc896dbc939fd27d58b834bdc339701acb69915ecd2dd1b840239
CRC32 86E312FA
ssdeep 384:0JaiPLkC8gli1Ia1Czho/r/HUZz/DIxk/DenRsE3oEpPsLCPMPayM+YRJcJeX:0ArhOzhoD/agxfRLTPMPRM+YHcsX
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name 7160e4b3b8745a33_InstalledApp.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\InstalledApp\InstalledApp.txt
Size 1014.0B
Processes 2560 (Pillager32.exe)
Type UTF-8 Unicode text, with CRLF line terminators
MD5 e05dfc57c98173f8be98308b9765431f
SHA1 cd8ad302621f442209358888dcc416f3342434d2
SHA256 7160e4b3b8745a339d70d506f3d62348838728a5c8c8a9b722d0c8cb3c45104e
CRC32 A1D3A386
ssdeep 24:E5kA/W1BIz+3ZrcaPEUsIWyO/Rm8AuPUiZ:+D/amz+3ZrcaPEUsIWX/Rm8AuPpZ
Yara None matched
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_tmpF0F7.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpF0F7.tmp
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 1ef6a468d424c7af_IE_passwords.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\IE\IE_passwords.txt
Size 53.0B
Processes 2560 (Pillager32.exe)
Type ASCII text, with no line terminators
MD5 87880abf0b960bc97af68c02595f8068
SHA1 3a62c3b453df14de698834d174b0924c1f10905b
SHA256 1ef6a468d424c7af404ee55c713a8b75b7b3ec451aff241aa7fc2b4dbec884d0
CRC32 AFB52F4B
ssdeep 3:6CrIFTIAFwEzXB5a4MIG6:6CkF7lXva4MIB
Yara None matched
VirusTotal Search for analysis
Name 692ab22902bbd348_FireFox_books.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\FireFox\FireFox_books.txt
Size 270.0B
Processes 2560 (Pillager32.exe)
Type ASCII text, with CRLF line terminators
MD5 0f5d12619c9d2ca5444313eb5bddc029
SHA1 b949a19a8b5f20f68aede547eb034c4e030071d8
SHA256 692ab22902bbd34879f658a2e4957735467d3b0eb4994849d68a55e625493727
CRC32 47726168
ssdeep 6:2wBLIKsiugYi8Wwd6aacABXZmK8OLcivHWOLcitRVWOLcilNdIRAv:2w93szwvaacAhZmK8Do2DAR8DBOv
Yara None matched
VirusTotal Search for analysis
Name d010d68144e682c0_pillager.zip
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager.zip
Size 31.1KB
Processes 2560 (Pillager32.exe)
Type Zip archive data, at least v2.0 to extract
MD5 a60bcc05adb1fe4d4fd1516ceb40092d
SHA1 2a59f8efe6b65482a307808f4d93464e1e765673
SHA256 d010d68144e682c0794fa8b8e859117f311eabf6f00c859c815d1ab9ab5b5bc6
CRC32 95B714CA
ssdeep 768:4d0DydHf7C9pBOtiGDspKESomiF2ErValETH5:4d0DaipBOUhpKESoEErVBV
Yara
  • zip_file_format - ZIP file format
VirusTotal Search for analysis