popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a770ecba3b08bbab_freebl3.dll
Submit file
Filepath C:\ProgramData\freebl3.dll
Size 326.5KB
Processes 3624 (Mfipdre.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ef2834ac4ee7d6724f255beaf527e635
SHA1 5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256 a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
CRC32 B698D0CA
ssdeep 6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name c40bb03199a2054d_vcruntime140.dll
Submit file
Filepath C:\ProgramData\vcruntime140.dll
Size 81.8KB
Processes 3624 (Mfipdre.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
CRC32 9BB5124B
ssdeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsConsole - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name 43536adef2ddcc81_softokn3.dll
Submit file
Filepath C:\ProgramData\softokn3.dll
Size 141.5KB
Processes 3624 (Mfipdre.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 a2ee53de9167bf0d6c019303b7ca84e5
SHA1 2a3c737fa1157e8483815e98b666408a18c0db42
SHA256 43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
CRC32 760685C5
ssdeep 3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name 3fe6b1c54b8cf28f_mozglue.dll
Submit file
Filepath C:\ProgramData\mozglue.dll
Size 134.0KB
Processes 3624 (Mfipdre.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
CRC32 E28A5E21
ssdeep 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_registry - Affect system registries
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name 334e69ac9367f708_msvcp140.dll
Submit file
Filepath C:\ProgramData\msvcp140.dll
Size 429.8KB
Processes 3624 (Mfipdre.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
CRC32 97BCF588
ssdeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsConsole - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name e2935b5b28550d47_nss3.dll
Submit file
Filepath C:\ProgramData\nss3.dll
Size 1.2MB
Processes 3624 (Mfipdre.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
CRC32 9F24F4E3
ssdeep 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS
  • cred_ff - Steal Firefox credential
  • win_mutex - Create or check mutex
  • win_token - Affect system token
  • win_files_operation - Affect private profile
  • Str_Win32_Winsock2_Library - Match Winsock 2 API library declaration
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check
  • HasDigitalSignature - DigitalSignature Check
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check
VirusTotal Search for analysis
Name b0c7e6712ecbf97a_sqlite3.dll
Submit file
Filepath C:\ProgramData\sqlite3.dll
Size 318.0B
Processes 3624 (Mfipdre.exe)
Type HTML document, ASCII text
MD5 fa172c77abd7b03605d83cd1ae373657
SHA1 9785fb3254695c25c621eb4cd81cf7a2a3c8258f
SHA256 b0c7e6712ecbf97a1e3a14f19e3aed5dbd6553f21a2852565bfc5518925713db
CRC32 86D43E00
ssdeep 6:pn0+Dy9xwIgsozEr6VyF02xxdGzsQWrbEHcLgWugszvjsKtgsg93wzRbKqD:J0+oxBgsozR4F0+dgsQoIfWugszvjsKn
Yara None matched
VirusTotal Search for analysis