popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a770ecba3b08bbab_freebl3.dll
Submit file
Filepath C:\ProgramData\freebl3.dll
Size 326.5KB
Processes 2332 (GodK6jam0J2bDZkC.exe) 1304 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ef2834ac4ee7d6724f255beaf527e635
SHA1 5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256 a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
CRC32 B698D0CA
ssdeep 6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name e6f06a55babc49d6_017bd04f-b3bf-45b6-8167-9e8f41ff87bf3957973965.zip
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\017bd04f-b3bf-45b6-8167-9e8f41ff87bf3957973965.zip
Size 13.1KB
Processes 2332 (GodK6jam0J2bDZkC.exe)
Type Zip archive data, at least v2.0 to extract
MD5 214d932eab00e75515e2f2fff2b9912f
SHA1 477773a88ae7a45e7710ac364b69b0fdcdd63d68
SHA256 e6f06a55babc49d6c42c32a258bdf400b455d62e40dddcc7bc9130a579e88e1f
CRC32 14F08AF7
ssdeep 192:gXIQSO5lTuX+tgN3FJT72YsGbvht6+y3UKd585TikzM/A1mUAR8qmQUSi:gXfTuuKNDTH3vhc+eDXD/kmlVUSi
Yara None matched
VirusTotal Search for analysis
Name 6ec867dc1caa77ec_temp
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\temp
Size 18.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 f3a100cba30b2a07a7af8886e439024e
SHA1 a454cca0db028b4d0fb29fa932c9056519efe2cf
SHA256 6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc
CRC32 72CF6AF8
ssdeep 24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW
Yara None matched
VirusTotal Search for analysis
Name c40bb03199a2054d_vcruntime140.dll
Submit file
Filepath C:\ProgramData\vcruntime140.dll
Size 81.8KB
Processes 2332 (GodK6jam0J2bDZkC.exe) 1304 (cmd.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
CRC32 9BB5124B
ssdeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name e3b0c44298fc1c14_Google Chrome_Default.txt
Empty file or file not found
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\Autofill\Google Chrome_Default.txt
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 43536adef2ddcc81_softokn3.dll
Submit file
Filepath C:\ProgramData\softokn3.dll
Size 141.5KB
Processes 2332 (GodK6jam0J2bDZkC.exe) 1304 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 a2ee53de9167bf0d6c019303b7ca84e5
SHA1 2a3c737fa1157e8483815e98b666408a18c0db42
SHA256 43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
CRC32 760685C5
ssdeep 3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 3fe6b1c54b8cf28f_mozglue.dll
Submit file
Filepath C:\ProgramData\mozglue.dll
Size 134.0KB
Processes 2332 (GodK6jam0J2bDZkC.exe) 1304 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
CRC32 E28A5E21
ssdeep 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 334e69ac9367f708_msvcp140.dll
Submit file
Filepath C:\ProgramData\msvcp140.dll
Size 429.8KB
Processes 2332 (GodK6jam0J2bDZkC.exe) 1304 (cmd.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
CRC32 97BCF588
ssdeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 6f878c485ee7d776_temp
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\temp
Size 120.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 7cd1f915719aa3f01dcb5d1d04018ba0
SHA1 6e50a73815aae25bd6295d7240d517f0758b94be
SHA256 6f878c485ee7d776face2b6f0f72d6b2b383041ce5abd23ee5948d987afa9c64
CRC32 AA763EF2
ssdeep 48:T1HW6tdfxNPp+suktLReRK+NaUvdWSZ00LTL0drQHHp7C5fVcS2+VANUXq6uw5Nb:DJQpWSZ00LTL0QCbc0VANPjwQU+
Yara None matched
VirusTotal Search for analysis
Name 3b046d30dc2e6021_temp
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\temp
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 e185515780e9dcb21c3262899c206308
SHA1 230714474693919d93949ab5a291f7ec02fd286f
SHA256 3b046d30dc2e6021be55d1bd47c2a92970856526c021df5de6e4ea3c4144659b
CRC32 25EF2A64
ssdeep 24:TLNg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fBvlllYu:TC/ecVTgPOpEveoJZFrU1cQBvlllY
Yara None matched
VirusTotal Search for analysis
Name b0a9673e25b0915d_Default.zip
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\Files\Default.zip
Size 158.0B
Processes 2332 (GodK6jam0J2bDZkC.exe)
Type Zip archive data, at least v2.0 to extract
MD5 023ed88c7dc17f053db974042560a41a
SHA1 5334647902b0830e0507bc725a6acf3d933aca37
SHA256 b0a9673e25b0915db4836c67c4fb4bb2890f0c859f5fd03357044e358a2f0aad
CRC32 CDB42416
ssdeep 3:vhj3lzptrpdclcBnSmmOwpx9eEtptrpdclElktfAPhB+l2lTln:5jLt9mlMTm7Ldbt9mlFtfiB+lCp
Yara None matched
VirusTotal Search for analysis
Name 63e246a3000fb2ed_screenshot.jpg
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\screenshot.jpg
Size 23.0KB
Processes 2332 (GodK6jam0J2bDZkC.exe)
Type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5 0a75d1134b05de021a260e6288cb7c9b
SHA1 a7e9d34f2be99b9cb27604f5f9bf8253ce22c467
SHA256 63e246a3000fb2eda3590b023b3024b3f464f21868235b361b24f1f3990a55ad
CRC32 8F607FC6
ssdeep 384:0JaAaAIDjWFO3/vqcZdEydk4IEKbcEkdj:0AKInWUPvxlNAi5
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name e2935b5b28550d47_nss3.dll
Submit file
Filepath C:\ProgramData\nss3.dll
Size 1.2MB
Processes 2332 (GodK6jam0J2bDZkC.exe) 1304 (cmd.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
CRC32 9F24F4E3
ssdeep 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 38c389720b75365f_temp
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\temp
Size 72.0KB
Type SQLite 3.x database, last written using SQLite version 3021000
MD5 c480140ee3c5758b968b69749145128d
SHA1 035a0656bc0d1d376dfc92f75fa664bdf71b3e4d
SHA256 38c389720b75365fcb080b40f7fdc5dc4587f4c264ec4e12a22030d15709e4a9
CRC32 954A724F
ssdeep 96:f0CWo3dOEctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:fXtd69TYndTJMb3j0
Yara None matched
VirusTotal Search for analysis
Name 421de3e1abdd3307_GodK6jam0J2bDZkC.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\GodK6jam0J2bDZkC.exe
Size 624.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 80be083d6e199ea9ac0391d791379440
SHA1 363e9e7abf44aa88b18952e2d6247aa84b27cfb7
SHA256 421de3e1abdd3307f05eb1d1900f0e5e12e99794f51fb14fffee3aa5427e3f03
CRC32 BF88BB20
ssdeep 12288:VPaYUeh6oGci940+hbwozJup8tGeFE+QpK6OUdnUYRJF93Ophc41UYNbh9FKuLRl:VPOHEi9bozJD9WvK3UdnUEvd+c4XNE7M
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 15394c299e683227_information.txt
Submit file
Filepath C:\ProgramData\FAXNIEGG2XB3DGNPLZJUUA127\files\information.txt
Size 2.9KB
Processes 2332 (GodK6jam0J2bDZkC.exe)
Type ASCII text, with CRLF line terminators
MD5 1446ffbc1f350e1608a219bc1c2b61f8
SHA1 c91d2e60310f89729e56dfea3486ecd587bbed2e
SHA256 15394c299e683227e3e383060ed29eb57762bb844840e8089b93a3e1a4f97882
CRC32 C662DC99
ssdeep 48:tgbtaFdRnt0UF/SO04cyyYMRfwxe8j2ipZQdB1hatp++CZGdjwLFj5ZigRnQPp3:t6CPFxBZ96I6Hatp+9MdjwLFj5ZigRQl
Yara None matched
VirusTotal Search for analysis