popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 45c79d94cdbe3860_firefox_history.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\FireFox\FireFox_history.txt
Size 406.0B
Processes 884 (Pillager.exe)
Type ASCII text, with CRLF line terminators
MD5 482a9e58d6ddb814615bc1d8343ee028
SHA1 60ef73d3e02d45bf27846a458f7582134722abb0
SHA256 45c79d94cdbe386096cfd76502cdb515de1bdc463a65833c3fffe2326bd4e765
CRC32 4715ECDB
ssdeep 12:2w93sMwDw93szwvaacAhZmK8Do2DAR8DBOeD36Dm:2wxsMGwxsaKD7D3DBzDKDm
Yara None matched
VirusTotal Search for analysis
Name c83e967b07f316c6_log
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG
Size 401.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 3beacfefa93213a5b78ed096422ad2ae
SHA1 8f6a88b85661e8aeffdea703296823b51680700f
SHA256 c83e967b07f316c696680cb1b5e24eb3f1d8d206e8ec61eac855cf1eaf329d86
CRC32 2971C9C3
ssdeep 12:ULk+vPOLM5KkkOrsFUtGLbZ/sLbNV54OLM5KkkOrzJ:ULFZ5Kk+gGLbaLbl+5Kkn
Yara
  • infoStealer_browser_b_Zero - browser info stealer
VirusTotal Search for analysis
Name f9d31b278e215eb0_manifest-000001
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41.0B
Processes 884 (Pillager.exe)
Type PGP\011Secret Key -
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
CRC32 7B501CA0
ssdeep 3:scoBAIxQRDKIVjn:scoBY7jn
Yara None matched
VirusTotal Search for analysis
Name 37e08f6c88cf8af9_ie_history.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\IE\IE_history.txt
Size 35.0B
Processes 884 (Pillager.exe)
Type ASCII text, with CRLF line terminators
MD5 3b9269c4e5fb99e5c590eba67b07db99
SHA1 88c607fc4e29284205a0840af02e4c3f4667cdb7
SHA256 37e08f6c88cf8af977d5836f7f4af8c423ed15e48633c595a91c9400bfdc25a7
CRC32 059B1004
ssdeep 3:N82Cu4MCvn:2luBCv
Yara None matched
VirusTotal Search for analysis
Name 0b8607fdf72f3e65_tmpE0B9.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpE0B9.tmp
Size 96.0KB
Type SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
CRC32 842B3569
ssdeep 12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO
Yara None matched
VirusTotal Search for analysis
Name 42a5ada994385f2c_000003.log
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Storage\leveldb\000003.log
Size 4.3KB
Processes 884 (Pillager.exe)
Type data
MD5 3ffe8b931bf829ffe90bf33d8b2c17c8
SHA1 fb94a3978a5edb8974adcd9625a62b3e18620714
SHA256 42a5ada994385f2caccc979f7beba688b8861a844c054d22bee0f91a72adfb08
CRC32 4154C7AA
ssdeep 48:S059tA5ajewwGFapGGw6F57HXT8dbOXnecO+Q4wn/gGjKuDPPe9Fw:45ayWFl657HXgdbOXnecO+QBn/gGjb
Yara None matched
VirusTotal Search for analysis
Name 79da0e95b23e5777_000003.log
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
Size 87.0B
Processes 884 (Pillager.exe)
Type data
MD5 e4a639b9d8bf7a90cc97bb4e05a36753
SHA1 676facdabf06e5f014e95218bfc02b8c18c39284
SHA256 79da0e95b23e5777bee595201fead887021d71ddaffa79dac8d5cf03a646b8cd
CRC32 C6C86CF0
ssdeep 3:wAdks//tvBd95MAcGW2K3u4ykGg:wev/tHvcBc4W
Yara None matched
VirusTotal Search for analysis
Name b3dfa692f7da19ee_tmpE166.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpE166.tmp
Size 5.0MB
Type SQLite 3.x database, user version 69, last written using SQLite version 3038003
MD5 c395620f9a8337341636a78a98f5b3d9
SHA1 97700ec4db7362e02a56df5e70dd828ad9823d24
SHA256 b3dfa692f7da19eede9aa2fe2ac76052cfaa32a7d30cc53b88ea5ef23ec32624
CRC32 476CDB88
ssdeep 192:StsqHQnwkYjcoBMc+uySBQies13A29D+oBpp0:StsbwVTBMc+uySOiJ3Z
Yara None matched
VirusTotal Search for analysis
Name 54cfed4f859d0ec3_tmpCE59.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpCE59.tmp
Size 116.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 6f490da5428093674c9e609077dcdef2
SHA1 d77592944313656a90f359fea62921c20078ff19
SHA256 54cfed4f859d0ec37535b9f16acfe42cae6206fad4b1652c2a3d33d5acf636c7
CRC32 A046246D
ssdeep 48:T4ItVG+3C7nNfVcS2+VANULn36uw5NPM5ETQTpUPxK2PIs6kJL5R2+zaSZ00LTLU:ce/C7n/c0VANUjwQU+KraSZ00LTL0J
Yara None matched
VirusTotal Search for analysis
Name 41529057159d9d36_ie_books.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\IE\IE_books.txt
Size 2.3KB
Processes 884 (Pillager.exe)
Type UTF-8 Unicode text, with CRLF line terminators
MD5 02d9c77a21192620031d3427a7d0e9c4
SHA1 933bab1498b94785f0cb93f53ae877029d4e14df
SHA256 41529057159d9d363d3be72e87a33376a0212f3a3ceb9877444a3e3ab55678cf
CRC32 FB5E2175
ssdeep 48:o9ADCvN/irPjsRkrZL68A1D4AH4fqczK4rsiyHluFxZ7Radwp2bmA+GC:oa2VKrIRyZrOMAYfqczlrFKlqzFyEgH2
Yara None matched
VirusTotal Search for analysis
Name 920be2dfc9fc8fc9_log.old
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Storage\leveldb\LOG.old
Size 162.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 ed57e0b849e428ec22865e3130ea71e9
SHA1 d9c6aa008718e74c2c30edfec5e216bf9181997d
SHA256 920be2dfc9fc8fc913f43461216955a782bb693dda8e27bd1675a5a29003492b
CRC32 AA23E6F0
ssdeep 3:tXmCIwEB+WMLKqFkPmWxpcL4E2J5iKKKc64E/0a2RKUDQTAPHAby5WIV//Uv:UCIwEBpM+q2PmQpcLJ23iKKdK8a2jMjX
Yara
  • infoStealer_browser_b_Zero - browser info stealer
VirusTotal Search for analysis
Name 81fcca89dcbd070e_log
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Storage\leveldb\LOG
Size 331.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 931555707ff991610689ac696178203e
SHA1 f4310944a48682f3c0edf4e6fd9132db17225750
SHA256 81fcca89dcbd070eb6ffc57b264fd45f7281579c00160bd2611ecd85787e73c5
CRC32 3477430C
ssdeep 6:UCIwxMM+q2PmQpcLJ23iKKdK8a2jMGIFUtqV7CIwxZZmwYV7CIwX5jMVkwOmQpc3:ULw2M+vPOLM5Kk8EFUtGLwb/sLwX1MVH
Yara
  • infoStealer_browser_b_Zero - browser info stealer
VirusTotal Search for analysis
Name edb006e05cfa8501_tmpCCC1.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpCCC1.tmp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 3f5ca3e29b1b60e298aeca0a32164c03
SHA1 f9b5ee59c31a3b06a6b8e476b22d2d7cf1fa8b66
SHA256 edb006e05cfa85015aa76c758d6298c279fd318cff0dbb286927c7ad45105488
CRC32 E1ACA097
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis
Name 7ea98a72179516b0_log
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG
Size 403.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 7b5fcfe9c5b4e5eed87459d2a6fb2793
SHA1 cfd94f00f5e26d2b673163c853c2aca231da08df
SHA256 7ea98a72179516b06357a26f2530ebc4950001a395db641ab1dbbfd122941211
CRC32 595B0477
ssdeep 12:ULbvPOLM5Kk8rcPXgFUtGL+/sLy54OLM5Kk8rcPXIVMJ:UL7Z5Kk8UXQgGLzL8+5Kk8UXIVo
Yara
  • infoStealer_browser_b_Zero - browser info stealer
VirusTotal Search for analysis
Name 824fae3331b95e2f_tmpCDDB.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\tmpCDDB.tmp
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name d2c0ececb979c423_log.old
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOG.old
Size 403.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 6466cb5c6b38bf6ad490900101f0682b
SHA1 b9315a0bd2e73fa6be8f7863e81479cf91f9bca0
SHA256 d2c0ececb979c4239ce24364a2f09d02edf98e5e112c65925ac56213b9ebea1f
CRC32 E34A9B4D
ssdeep 12:PKwVvPOLM5Kk8rcPXgFUtp/Kwg/P/wI54OLM5Kk8rcPXIVMJ:S6Z5Kk8UXQgs7+5Kk8UXIVo
Yara
  • infoStealer_browser_b_Zero - browser info stealer
VirusTotal Search for analysis
Name b93e3c3458beab75_chrome_extension.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Chrome_extension.txt
Size 482.0B
Processes 884 (Pillager.exe)
Type ASCII text, with CRLF line terminators
MD5 989b57e9d3724c86bb99988e6613a234
SHA1 42cc8aaa1bb8a744fc490ff49b59b1796f192719
SHA256 b93e3c3458beab75b7ba697fd1447ab19a0b914dd39e859fc538b0504563776e
CRC32 9317BFAF
ssdeep 6:EKmNPObNzzjQSxNcNzz81AuPBZNzzpONr0KMNzzPBtXqZNzzVHKuWJ36yZOckArc:x/NO85PxpGAxPbuVHXsgHAr/UyNfFOpv
Yara
  • Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal Search for analysis
Name 0f1bad70c7bd1e0a_current
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
CRC32 90EA72BE
ssdeep 3:1sjgWIV//Uv:1qIFUv
Yara None matched
VirusTotal Search for analysis
Name e692724dbe454a2f_log.old
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\Chrome\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old
Size 401.0B
Processes 884 (Pillager.exe)
Type ASCII text
MD5 e3bbb603bdd3f46be570faaf661876ef
SHA1 ee94a689f524d97e985ef897c190ff5e38716a89
SHA256 e692724dbe454a2f38bcae52035adfd4ae1e2493009797c797e7a0f609dc59f6
CRC32 5DF27977
ssdeep 12:c+YFvPOLM5KkkOrsFUtpM+YQ/PM+YY54OLM5KkkOrzJ:cvJZ5Kk+gOvFvC+5Kkn
Yara
  • infoStealer_browser_b_Zero - browser info stealer
VirusTotal Search for analysis
Name 692ab22902bbd348_firefox_books.txt
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Pillager\FireFox\FireFox_books.txt
Size 270.0B
Processes 884 (Pillager.exe)
Type ASCII text, with CRLF line terminators
MD5 0f5d12619c9d2ca5444313eb5bddc029
SHA1 b949a19a8b5f20f68aede547eb034c4e030071d8
SHA256 692ab22902bbd34879f658a2e4957735467d3b0eb4994849d68a55e625493727
CRC32 47726168
ssdeep 6:2wBLIKsiugYi8Wwd6aacABXZmK8OLcivHWOLcitRVWOLcilNdIRAv:2w93szwvaacAhZmK8Do2DAR8DBOv
Yara None matched
VirusTotal Search for analysis