Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
09.19 02:09
66ea645129e6a_jacobs.exe
09.19 11:09
clip64.dll
09.19 11:09
cred64.dll
09.19 10:09
vsfdajg16.exe
09.19 10:09
QuickBooks_Setup.msi
09.19 10:09
QuickBooks_Desktop_Set...
09.19 10:09
game.exe
09.19 10:09
vlsadg.exe
09.19 10:09
lnfsda.exe
09.19 10:09
66eaadab755d2_installs...

Latest News
09.20 07:09
Unravelling the World ...
09.20 07:09
European, Latin Americ...
09.20 07:09
OpenAI to Decide Which...
09.20 07:09
September 20, 2024
09.20 06:09
Stocks Hit Highs and A...
09.20 06:09
Fake GitHub Site Targe...
09.20 06:09
Vanilla Tempest levera...
09.20 06:09
Exploding Pagers Sound...
09.20 06:09
The time I almost got ...
09.20 05:09
High-risk vulnerabilit...

Dropped Files | ZeroBOX

Name	ca6fb0a62174ced8_7853768.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\7853768.exe
Size	106.5KB
Processes	2220 (UGloryStp.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`99d5457bb72ed6c353595e20b1e20267`
SHA1	`9616199a48917be415e27a43ff7e7b31acc85d43`
SHA256	`ca6fb0a62174ced80b8e2dccacf10f402246c5a817adc4462656fd991deb902c`
CRC32	`9DDD02E3`
ssdeep	`3072:ZaeV9lQYG0xDAe0d383Yw3TVnzXPIvRIg/xDMi/DS:r9lNDq89TVnzXQV/dM5`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description)
VirusTotal	Search for analysis

Name	a770ecba3b08bbab_freebl3.dll Submit file
Filepath	C:\ProgramData\56\freebl3.dll
Size	326.5KB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ef2834ac4ee7d6724f255beaf527e635`
SHA1	`5be8c1e73a21b49f353c2ecfa4108e43a883cb7b`
SHA256	`a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`
CRC32	`B698D0CA`
ssdeep	`6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	38c389720b75365f_6F5FA250A2C92B7FCE4BE32F0B6006E4.txt Submit file
Filepath	C:\ProgramData\56\6F5FA250A2C92B7FCE4BE32F0B6006E4.txt
Size	72.0KB
Type	SQLite 3.x database, last written using SQLite version 3021000
MD5	`c480140ee3c5758b968b69749145128d`
SHA1	`035a0656bc0d1d376dfc92f75fa664bdf71b3e4d`
SHA256	`38c389720b75365fcb080b40f7fdc5dc4587f4c264ec4e12a22030d15709e4a9`
CRC32	`954A724F`
ssdeep	`96:f0CWo3dOEctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:fXtd69TYndTJMb3j0`
Yara	None matched
VirusTotal	Search for analysis

Name	c40bb03199a2054d_vcruntime140.dll Submit file
Filepath	C:\ProgramData\56\vcruntime140.dll
Size	81.8KB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`7587bf9cb4147022cd5681b015183046`
SHA1	`f2106306a8f6f0da5afb7fc765cfa0757ad5a628`
SHA256	`c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`
CRC32	`9BB5124B`
ssdeep	`1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF`
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	43536adef2ddcc81_softokn3.dll Submit file
Filepath	C:\ProgramData\56\softokn3.dll
Size	141.5KB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`a2ee53de9167bf0d6c019303b7ca84e5`
SHA1	`2a3c737fa1157e8483815e98b666408a18c0db42`
SHA256	`43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`
CRC32	`760685C5`
ssdeep	`3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3fe6b1c54b8cf28f_mozglue.dll Submit file
Filepath	C:\ProgramData\56\mozglue.dll
Size	134.0KB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8f73c08a9660691143661bf7332c3c27`
SHA1	`37fa65dd737c50fda710fdbde89e51374d0c204a`
SHA256	`3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`
CRC32	`E28A5E21`
ssdeep	`3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	16574f51785b0e2f_sqlite3.dll Submit file
Filepath	C:\ProgramData\56\sqlite3.dll
Size	630.5KB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`e477a96c8f2b18d6b5c27bde49c990bf`
SHA1	`e980c9bf41330d1e5bd04556db4646a0210f7409`
SHA256	`16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`
CRC32	`9F30A75E`
ssdeep	`12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	334e69ac9367f708_msvcp140.dll Submit file
Filepath	C:\ProgramData\56\msvcp140.dll
Size	429.8KB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`109f0f02fd37c84bfc7508d4227d7ed5`
SHA1	`ef7420141bb15ac334d3964082361a460bfdb975`
SHA256	`334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`
CRC32	`97BCF588`
ssdeep	`12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI`
Yara	Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	6ec867dc1caa77ec_8CEFCBFF062629D553D9CB904F658697.txt Submit file
Filepath	C:\ProgramData\56\8CEFCBFF062629D553D9CB904F658697.txt
Size	18.0KB
Type	SQLite 3.x database, last written using SQLite version 3021000
MD5	`f3a100cba30b2a07a7af8886e439024e`
SHA1	`a454cca0db028b4d0fb29fa932c9056519efe2cf`
SHA256	`6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc`
CRC32	`72CF6AF8`
ssdeep	`24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW`
Yara	None matched
VirusTotal	Search for analysis

Name	e2935b5b28550d47_nss3.dll Submit file
Filepath	C:\ProgramData\56\nss3.dll
Size	1.2MB
Processes	2572 (3673298.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`bfac4e3c5908856ba17d41edcd455a51`
SHA1	`8eec7e888767aa9e4cca8ff246eb2aacb9170428`
SHA256	`e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`
CRC32	`9F24F4E3`
ssdeep	`24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)
VirusTotal	Search for analysis

Name	745fb5cdb7785a91_5665 Submit file
Filepath	C:\ProgramData\5665
Size	1.5MB
Processes	2572 (3673298.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`ef64f9930e6d75985a8017651361a979`
SHA1	`14950364623a2e9ccdd6b9cab8929a89c0ca058f`
SHA256	`745fb5cdb7785a916e2e2d28bffae4a3cad7e2e8e467c74c7dfb768c6900ef35`
CRC32	`8399F969`
ssdeep	`24576:Eh274wwI8J2z8YoxQEtZAoC407IDVp8SuUYx9iuctkOcaNNAWmWuYIvbZoJuYZ:E08SRt9IDEjcm3INAmFIvdoJZZ`
Yara	None matched
VirusTotal	Search for analysis

Name	26820c3fcdf4d27b_3673298.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\3673298.exe
Size	127.5KB
Processes	2220 (UGloryStp.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ca4f6a1e399968f9573f05c2192f1b3a`
SHA1	`6d2d8d95e3e0dbc21863a8c6cc9aa2500e920032`
SHA256	`26820c3fcdf4d27ba6e4a970fb42b66db4d56c6bd6aac9138b250378f3f99f50`
CRC32	`9966BF7B`
ssdeep	`3072:sSb0IVnmlN4EY2mnqlRlvlctUympQKW66/:ssPVm0F2mn8Nc+pQX6C`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) Generic_Malware_Zero - Generic Malware IsPE32 - (no description)
VirusTotal	Search for analysis