Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 02:11
RuntimeBrikon.exe
11.13 02:11
cred.dll
11.13 01:11
MJPVgHw.exe
11.13 01:11
clip.dll
11.11 10:11
bxn.exe
11.11 10:11
glued.hta
11.11 10:11
MONDAYconstraints.vbs
11.11 10:11
tartarises.vbs
11.11 10:11
xwo.exe
11.11 10:11
comehomeconstraints.vbs

Latest News
11.13 02:11
크리엠, 고체 애사비 ‘링글스’ 신제품 런칭
11.13 02:11
Joint RustyStealer, Ym...
11.13 02:11
Highly targeted GootLo...
11.13 02:11
노바벨, THE F&C와 전략적 ...
11.13 02:11
알렉산더, THE F&C와 파트너...
11.13 01:11
망고플레이·위드브레인, 봉사 활동 MOU 체결
11.13 01:11
Vietnam Tech Champion ...
11.13 01:11
Prosus Gains $2 Billio...
11.13 01:11
Bei diesem neuen Mathe...
11.13 12:11
안랩, 디지털포렌식 챌린지 2024에서 ...

Dropped Files | ZeroBOX

Name	4cc2f239f8838c6e_temp Submit file
Filepath	C:\ProgramData\631334624406054\temp
Size	40.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`2a51cf5f096c5924c7f47732d12e7c92`
SHA1	`6fcb446f6e2af378bb6aae032d58fbf939c98826`
SHA256	`4cc2f239f8838c6ec8297440c1455f09491854bcc3ac644fbcb53fe42dfb6ee2`
CRC32	`E70F8913`
ssdeep	`48:O3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:kSe7mlcwilGc7Ha3f+u`
Yara	None matched
VirusTotal	Search for analysis

Name	a770ecba3b08bbab_freebl3.dll Submit file
Filepath	C:\ProgramData\freebl3.dll
Size	326.5KB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ef2834ac4ee7d6724f255beaf527e635`
SHA1	`5be8c1e73a21b49f353c2ecfa4108e43a883cb7b`
SHA256	`a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`
CRC32	`B698D0CA`
ssdeep	`6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	88f9dc0b9a633e43_temp Submit file
Filepath	C:\ProgramData\631334624406054\temp
Size	512.0KB
Type	SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5	`dd47ebe6866ad2ab59d0caa1de28d09e`
SHA1	`afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663`
SHA256	`88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3`
CRC32	`8DEE9EEA`
ssdeep	`24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm`
Yara	None matched
VirusTotal	Search for analysis

Name	fd4c9fda9cd3f9ae_temp-shm Submit file
Filepath	C:\ProgramData\631334624406054\temp-shm
Size	32.0KB
Type	data
MD5	`b7c14ec6110fa820ca6b65f5aec85911`
SHA1	`608eeb7488042453c9ca40f7e1398fc1a270f3f4`
SHA256	`fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb`
CRC32	`DDC506B6`
ssdeep	`3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX`
Yara	None matched
VirusTotal	Search for analysis

Name	c40bb03199a2054d_vcruntime140.dll Submit file
Filepath	C:\ProgramData\vcruntime140.dll
Size	81.8KB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`7587bf9cb4147022cd5681b015183046`
SHA1	`f2106306a8f6f0da5afb7fc765cfa0757ad5a628`
SHA256	`c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`
CRC32	`9BB5124B`
ssdeep	`1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF`
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	43536adef2ddcc81_softokn3.dll Submit file
Filepath	C:\ProgramData\softokn3.dll
Size	141.5KB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`a2ee53de9167bf0d6c019303b7ca84e5`
SHA1	`2a3c737fa1157e8483815e98b666408a18c0db42`
SHA256	`43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`
CRC32	`760685C5`
ssdeep	`3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3fe6b1c54b8cf28f_mozglue.dll Submit file
Filepath	C:\ProgramData\mozglue.dll
Size	134.0KB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8f73c08a9660691143661bf7332c3c27`
SHA1	`37fa65dd737c50fda710fdbde89e51374d0c204a`
SHA256	`3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`
CRC32	`E28A5E21`
ssdeep	`3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	5e411f36b3a6bc62_Google Chrome_Default.txt Submit file
Filepath	C:\ProgramData\631334624406054\cookies\Google Chrome_Default.txt
Size	339.0B
Processes	3176 (oxcxcvhgfc.exe)
Type	ASCII text, with CRLF line terminators
MD5	`5ede65a1bb8817ae21d95167d81faf26`
SHA1	`35a4e9b7513d52225e4f5fbe38cdaedbd2defd12`
SHA256	`5e411f36b3a6bc62de53db70d488c149a0dc9c56f604fd2abde01ae920276c0d`
CRC32	`431BD5AC`
ssdeep	`6:PkopYj36ruIX0x8ptTUL2Scq0finQHPzWc3rOjlQLEv3rdu:copYD6RXs8PY5cqLnOb7OjlQ4v7du`
Yara	None matched
VirusTotal	Search for analysis

Name	16574f51785b0e2f_sqlite3.dll Submit file
Filepath	C:\ProgramData\sqlite3.dll
Size	630.5KB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`e477a96c8f2b18d6b5c27bde49c990bf`
SHA1	`e980c9bf41330d1e5bd04556db4646a0210f7409`
SHA256	`16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`
CRC32	`9F30A75E`
ssdeep	`12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	ffb18189c8e04084_temp Submit file
Filepath	C:\ProgramData\631334624406054\temp
Size	36.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`c19826403c4c8e5086a8d49e37c94838`
SHA1	`4d19768231a3373fb0fa91d5513e21ad772b137b`
SHA256	`ffb18189c8e040846bba547b243fda347516329d58a44b26fd8616549249e077`
CRC32	`36EBD488`
ssdeep	`48:ToLOpEO5J/KdGU1/X2ydikE6HDHCp0mSzW34KXEw:ENwudLE6jOSzLw`
Yara	None matched
VirusTotal	Search for analysis

Name	334e69ac9367f708_msvcp140.dll Submit file
Filepath	C:\ProgramData\msvcp140.dll
Size	429.8KB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`109f0f02fd37c84bfc7508d4227d7ed5`
SHA1	`ef7420141bb15ac334d3964082361a460bfdb975`
SHA256	`334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`
CRC32	`97BCF588`
ssdeep	`12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI`
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	84e0a4c57eb39f2c_system.txt Submit file
Filepath	C:\ProgramData\631334624406054\system.txt
Size	2.2KB
Processes	3176 (oxcxcvhgfc.exe)
Type	ASCII text, with CRLF line terminators
MD5	`6ca5134d502daca02edd298e381c65ca`
SHA1	`c6d495d890f3e85cb5a81a729ddb4f4f1980fb18`
SHA256	`84e0a4c57eb39f2cf0d59dce0e41f6b08b863ed4a816a9b25de3b52803efd6eb`
CRC32	`29043AD3`
ssdeep	`48:nRU1taFFGrSzNc048GGBuwHLM+YZ0352Bf5774mRNMPpX:nRe2Qe547GBuwHLMX2352Bf5774mRixX`
Yara	None matched
VirusTotal	Search for analysis

Name	3601a18e61f79061_screenshot.jpg Submit file
Filepath	C:\ProgramData\631334624406054\screenshot.jpg
Size	22.0KB
Processes	3176 (oxcxcvhgfc.exe)
Type	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5	`fd8d68df61459fe080a5a2b521ba1725`
SHA1	`e844beaceb5046805e6584841d5df8319f71c16f`
SHA256	`3601a18e61f7906146c245e8d546c72bad52ec9747d580790604b168263e2d9b`
CRC32	`56C1CA79`
ssdeep	`192:pCzay86L/MbtH2mBSCqNxEr/RRRxMS4x9f8y+AiXjg:4586L/MbtjLDMX9WZjg`
Yara	JPEG_Format_Zero - JPEG Format
VirusTotal	Search for analysis

Name	bc8fd1d6202d9616__6313346244.zip Submit file
Filepath	C:\ProgramData\631334624406054\_6313346244.zip
Size	12.0KB
Processes	3176 (oxcxcvhgfc.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`8bce087ed94c9ecdf6a9027c91b24615`
SHA1	`16f378bfb5469b7de0b248e96f3c6e02303e9ffa`
SHA256	`bc8fd1d6202d96166975b5db312d5efebac8776822cd7ac07803b74fa321fa98`
CRC32	`4C69672C`
ssdeep	`384:CPRxlkN9Acznu7zHXPJMMB0q96bxMSNgJRBP:CPRxCzbqvHX74gJRBP`
Yara	None matched
VirusTotal	Search for analysis

Name	b2a7bd71194667c2__6313346244.zip Submit file
Filepath	C:\ProgramData\631334624406054\_6313346244.zip
Size	11.3KB
Processes	3176 (oxcxcvhgfc.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`cf6a96829fab519553932f47b95e8805`
SHA1	`1cc51a394b4865a055a36583e19b60490cfdbbd6`
SHA256	`b2a7bd71194667c2b316a0acfdb9493485a4234fe7711255e0d9abf8231bf0ad`
CRC32	`F97A78AF`
ssdeep	`192:OuuMJGlnxkKeTN9rsQUMzeSlQgVtOzNUyD5ZwcPVNvMMhreQGq962CxMSNgu8RL+:CPRxlkN9Acznu7zHXPJMMB0q96bxMSNJ`
Yara	None matched
VirusTotal	Search for analysis

Name	e2935b5b28550d47_nss3.dll Submit file
Filepath	C:\ProgramData\nss3.dll
Size	1.2MB
Processes	3176 (oxcxcvhgfc.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`bfac4e3c5908856ba17d41edcd455a51`
SHA1	`8eec7e888767aa9e4cca8ff246eb2aacb9170428`
SHA256	`e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`
CRC32	`9F24F4E3`
ssdeep	`24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	8916fb1d76be83e4_temp Submit file
Filepath	C:\ProgramData\631334624406054\temp
Size	192.0KB
Type	SQLite 3.x database, user version 4, last written using SQLite version 3031001
MD5	`6b9c2ac2b5025e180231d8d38ece698c`
SHA1	`36f5cfe6ac59aaa7d7173555edeef5caa9bf61c6`
SHA256	`8916fb1d76be83e42cd2f7b41ee06706fe0adb936259ed7a7daa4dbcb4c51fcb`
CRC32	`95ACFD74`
ssdeep	`12:DBl/lkf12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLlI1x7WxHaiSlMxosJF/Ezo`
Yara	None matched
VirusTotal	Search for analysis

Name	5ad0490faea6d64c_oxcxcvhgfc.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\oxcxcvhgfc.exe
Size	583.0KB
Processes	5628 (axcxcvhgfc.exe) 6304 (cmd.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f8e766e4d22bc299950f6a4d23c824cc`
SHA1	`7bcb244302d6454b4a9157f666d06f939cb9f059`
SHA256	`5ad0490faea6d64cadcd056c27e1de689d0531ec438bf86b2caa5ff06c7db3f5`
CRC32	`C742CA5D`
ssdeep	`12288:4WXmUV0JFdju6/LJqLPWo2u/6EvzCMop3i0Fge:cI8dJDJi7LopS0Fg`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description)
VirusTotal	Search for analysis

Name	6c5bdba65823d907_temp Submit file
Filepath	C:\ProgramData\631334624406054\temp
Size	80.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`2879b25c64012e6d19d0d34da682dcdd`
SHA1	`554af0d1d9d3c0daf0567f75128426c48ad7f3c5`
SHA256	`6c5bdba65823d9079daae7ca8fe953fbdea165742db98a7e4f0de3e5c2252758`
CRC32	`EF73B05C`
ssdeep	`96:ZBv7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9uE:ZBMOUNlCTJMb3rEDFAl67/`
Yara	None matched
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14_temp-wal Empty file or file not found
Filepath	C:\ProgramData\631334624406054\temp-wal
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	915dd6370c01bf55_Thunderbird_g8t0pe67.default-release.txt Submit file
Filepath	C:\ProgramData\631334624406054\cookies\Thunderbird_g8t0pe67.default-release.txt
Size	357.0B
Processes	3176 (oxcxcvhgfc.exe)
Type	ASCII text, with CRLF line terminators
MD5	`5e52ae0ab76f7db35d0873b986c1c3f7`
SHA1	`7e49b5cbe09da1b7d044cd84231830a707662845`
SHA256	`915dd6370c01bf552b13c3a6f9b268fb6c7aaf4a06a258ed7ecfe661db2471e2`
CRC32	`2DDF4481`
ssdeep	`6:JihKT6lphXX7aQ2vSI95Bj9GfBHthf+CthfMl0kq/H+LkihKT6lphXXrSdrNBPPm:JZohXraQ2v795BxGfBHff+CffMOkqP0b`
Yara	None matched
VirusTotal	Search for analysis