popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name a770ecba3b08bbab_freebl3.dll
Submit file
Filepath C:\ProgramData\freebl3.dll
Size 326.5KB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 ef2834ac4ee7d6724f255beaf527e635
SHA1 5be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256 a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
CRC32 B698D0CA
ssdeep 6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name e3b0c44298fc1c14_cookies.sqlite-wal
Empty file or file not found
Filepath C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\g8t0pe67.default-release\cookies.sqlite-wal
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name c40bb03199a2054d_vcruntime140.dll
Submit file
Filepath C:\ProgramData\vcruntime140.dll
Size 81.8KB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 7587bf9cb4147022cd5681b015183046
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
CRC32 9BB5124B
ssdeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name fd4c9fda9cd3f9ae_cookies.sqlite-shm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Thunderbird\Profiles\g8t0pe67.default-release\cookies.sqlite-shm
Size 32.0KB
Type data
MD5 b7c14ec6110fa820ca6b65f5aec85911
SHA1 608eeb7488042453c9ca40f7e1398fc1a270f3f4
SHA256 fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb
CRC32 DDC506B6
ssdeep 3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
Yara None matched
VirusTotal Search for analysis
Name 43536adef2ddcc81_softokn3.dll
Submit file
Filepath C:\ProgramData\softokn3.dll
Size 141.5KB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 a2ee53de9167bf0d6c019303b7ca84e5
SHA1 2a3c737fa1157e8483815e98b666408a18c0db42
SHA256 43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
CRC32 760685C5
ssdeep 3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name e5c7931e871678ae_H4ECB16P
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\H4ECB16P
Size 36.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 8e36f9cfbb4e98a1ea4cb31b1dfd18ba
SHA1 271e10b8bb5623e6552f2be568b01ae93b3e5a3a
SHA256 e5c7931e871678ae9bf44ed496a03ba8524a3d7600a44b29a60847ddda90eb86
CRC32 C73EAD8F
ssdeep 24:TLea0RlPbXaFpEO5bNmISHdL6UwcOxvyUU3Z:TYLOpEO5J/KdGU1EyU2Z
Yara None matched
VirusTotal Search for analysis
Name 3fe6b1c54b8cf28f_mozglue.dll
Submit file
Filepath C:\ProgramData\mozglue.dll
Size 134.0KB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8f73c08a9660691143661bf7332c3c27
SHA1 37fa65dd737c50fda710fdbde89e51374d0c204a
SHA256 3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
CRC32 E28A5E21
ssdeep 3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 16574f51785b0e2f_sqlite3.dll
Submit file
Filepath C:\ProgramData\sqlite3.dll
Size 630.5KB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 e477a96c8f2b18d6b5c27bde49c990bf
SHA1 e980c9bf41330d1e5bd04556db4646a0210f7409
SHA256 16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
CRC32 9F30A75E
ssdeep 12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 334e69ac9367f708_msvcp140.dll
Submit file
Filepath C:\ProgramData\msvcp140.dll
Size 429.8KB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 109f0f02fd37c84bfc7508d4227d7ed5
SHA1 ef7420141bb15ac334d3964082361a460bfdb975
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
CRC32 97BCF588
ssdeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 79f06415909bec7e_18.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\18.exe
Size 1.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5389b036dc60417f5d0df36e82131b63
SHA1 4e5783866336c1ed8d4b1955d5538ab25e348941
SHA256 79f06415909bec7ef3aff251d728968654f8cc0e4a108f29a606acd5d677ce40
CRC32 C89C6DA5
ssdeep 3072:CORDINSkUIWnxw8CmtqvylJ10nkcvryr5dqT0NMdIp2uogBpUDZyL+UoPxwAnjac:Ti+qg0vryiT0NMd+2u/NLGb
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 824fae3331b95e2f_WB1DJE3E
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\WB1DJE3E
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis
Name e2935b5b28550d47_nss3.dll
Submit file
Filepath C:\ProgramData\nss3.dll
Size 1.2MB
Processes 2620 (18.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 bfac4e3c5908856ba17d41edcd455a51
SHA1 8eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256 e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
CRC32 9F24F4E3
ssdeep 24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 1d144d1f8cc2f393_SRQ9HLXL
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\SRQ9HLXL
Size 116.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 00595bb72c984bfd54244a68bd13778a
SHA1 42e724acc86425668b186b7d838beb91f0fde8e5
SHA256 1d144d1f8cc2f393e0625fc3719cf63280d2a1abaf6374ba58046aac2dbb0a05
CRC32 2D6069F1
ssdeep 48:TK1t5Z3C7nNfVcS2+VANULn36uw5NPM5ETQTpUPxK2PIs6kJL5R2+zaSZ00LTL0J:KbC7n/c0VANUjwQU+KraSZ00LTL0J
Yara None matched
VirusTotal Search for analysis
Name 079473a1752fb5e1_U3O8GDBA
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\U3O8GDBA
Size 80.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 5f98cfac1d9c02587e0db4a6e5a20739
SHA1 be4f97d8544c22d01a1b941fe835d91ffc8a5efd
SHA256 079473a1752fb5e18f755627476b14192bb76894459f1430888e6ae3d07bd763
CRC32 B01FA20E
ssdeep 96:JBc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9ul:JBPOUNlCTJMb3rEDFA867/
Yara None matched
VirusTotal Search for analysis