Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.20 09:11
mainbas.bat
11.20 09:11
dll007.dll
11.20 09:11
exe004.exe
11.20 09:11
exe010.exe
11.20 09:11
blecher.exe
11.20 09:11
GetAdapterInfo.exe
11.20 09:11
dll004.dll
11.20 09:11
dll008.dll
11.20 09:11
bestthingsalwaysgetbes...
11.20 09:11
DKM-9067291.pdf.lnk

Latest News
11.20 11:11
Trump’s Second Term: W...
11.20 11:11
Black Friday Scammers ...
11.20 11:11
Who’s managing cyberse...
11.20 11:11
“Sad announcement” ema...
11.20 11:11
Rapid7 Extends AWS Sup...
11.20 11:11
“Sad announcement” ema...
11.20 11:11
MicroStrategy Raises C...
11.20 11:11
Ghost Tap: Hackers Exp...
11.20 11:11
Custom I2P RAT “I2Parc...
11.20 10:11
Update now! Apple conf...

Dropped Files | ZeroBOX

Name	1f9ce51663421a30_tyjigybwjylnokucizpstzjwazconsoleapp18.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Tyjigybwjylnokucizpstzjwazconsoleapp18.exe
Size	609.5KB
Processes	2844 (asdfg.exe)
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8a1593e3f73a5d753950ae385e6d069f`
SHA1	`71171b68859bdc504bb7428f6a92562ffbeee5d9`
SHA256	`1f9ce51663421a302c5627f4a0ed07e23af1424f863308e328227194a2523bfa`
CRC32	`2A8418CB`
ssdeep	`12288:6joqGRJORziayAClMuxe90hvax4/VPPYcYRzqTGHhYTWfxyn:cvijM+rpaUPYcYZuWfxy`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	a770ecba3b08bbab_freebl3.dll Submit file
Filepath	C:\ProgramData\freebl3.dll
Size	326.5KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ef2834ac4ee7d6724f255beaf527e635`
SHA1	`5be8c1e73a21b49f353c2ecfa4108e43a883cb7b`
SHA256	`a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba`
CRC32	`B698D0CA`
ssdeep	`6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	ef8b5e59d3e59bba_system.txt Submit file
Filepath	C:\ProgramData\880523887698104\system.txt
Size	2.1KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	ASCII text, with CRLF line terminators
MD5	`91891a285964c3296045961c571e94d4`
SHA1	`e544763d24f19174861343d4d16bdc2f2ee3cf88`
SHA256	`ef8b5e59d3e59bba1fc44c4becac07b44c4494720206ecf68f0bb343dfcfeea6`
CRC32	`A7B92054`
ssdeep	`48:nRU1taFFGrSzNcGl6SwHLM+YZ0352Bf5774mRNMPpX:nRe2QeRVwHLMX2352Bf5774mRixX`
Yara	None matched
VirusTotal	Search for analysis

Name	6ec867dc1caa77ec_temp Submit file
Filepath	C:\ProgramData\880523887698104\temp
Size	18.0KB
Type	SQLite 3.x database, last written using SQLite version 3021000
MD5	`f3a100cba30b2a07a7af8886e439024e`
SHA1	`a454cca0db028b4d0fb29fa932c9056519efe2cf`
SHA256	`6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc`
CRC32	`72CF6AF8`
ssdeep	`24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW`
Yara	None matched
VirusTotal	Search for analysis

Name	c40bb03199a2054d_vcruntime140.dll Submit file
Filepath	C:\ProgramData\vcruntime140.dll
Size	81.8KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`7587bf9cb4147022cd5681b015183046`
SHA1	`f2106306a8f6f0da5afb7fc765cfa0757ad5a628`
SHA256	`c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`
CRC32	`9BB5124B`
ssdeep	`1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14_Google Chrome_Default.txt Empty file or file not found
Filepath	C:\ProgramData\880523887698104\autofill\Google Chrome_Default.txt
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	43536adef2ddcc81_softokn3.dll Submit file
Filepath	C:\ProgramData\softokn3.dll
Size	141.5KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`a2ee53de9167bf0d6c019303b7ca84e5`
SHA1	`2a3c737fa1157e8483815e98b666408a18c0db42`
SHA256	`43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083`
CRC32	`760685C5`
ssdeep	`3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	e8757c05f1ec8fb3_ilzzmljftcwfeldyujdcyqy.vbs Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Ilzzmljftcwfeldyujdcyqy.vbs
Size	127.0B
Processes	2844 (asdfg.exe)
Type	ASCII text, with no line terminators
MD5	`5506863968ec8681333080f9782254b5`
SHA1	`449432273c0627bdee7324957783f1402263cb10`
SHA256	`e8757c05f1ec8fb3b2c669cb94bdf2469a9eadd1b8374925057609ab0b4ccd65`
CRC32	`3D90E5BB`
ssdeep	`3:FER/n0eFHHomWxpcL4E2J5xAIcFGKOTMIbjdOMFjM:FER/lFHImQpcLJ23fcFdOMI9pZM`
Yara	None matched
VirusTotal	Search for analysis

Name	3fe6b1c54b8cf28f_mozglue.dll Submit file
Filepath	C:\ProgramData\mozglue.dll
Size	134.0KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`8f73c08a9660691143661bf7332c3c27`
SHA1	`37fa65dd737c50fda710fdbde89e51374d0c204a`
SHA256	`3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd`
CRC32	`E28A5E21`
ssdeep	`3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	16574f51785b0e2f_sqlite3.dll Submit file
Filepath	C:\ProgramData\sqlite3.dll
Size	630.5KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`e477a96c8f2b18d6b5c27bde49c990bf`
SHA1	`e980c9bf41330d1e5bd04556db4646a0210f7409`
SHA256	`16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660`
CRC32	`9F30A75E`
ssdeep	`12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) IsDLL - (no description)
VirusTotal	Search for analysis

Name	334e69ac9367f708_msvcp140.dll Submit file
Filepath	C:\ProgramData\msvcp140.dll
Size	429.8KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`109f0f02fd37c84bfc7508d4227d7ed5`
SHA1	`ef7420141bb15ac334d3964082361a460bfdb975`
SHA256	`334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`
CRC32	`97BCF588`
ssdeep	`12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI`
Yara	PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
VirusTotal	Search for analysis

Name	3b046d30dc2e6021_temp Submit file
Filepath	C:\ProgramData\880523887698104\temp
Size	36.0KB
Type	SQLite 3.x database, last written using SQLite version 3021000
MD5	`e185515780e9dcb21c3262899c206308`
SHA1	`230714474693919d93949ab5a291f7ec02fd286f`
SHA256	`3b046d30dc2e6021be55d1bd47c2a92970856526c021df5de6e4ea3c4144659b`
CRC32	`25EF2A64`
ssdeep	`24:TLNg/5UcJOyTGVZTPaFpEvg3obNmCFk6Uwcc85fBvlllYu:TC/ecVTgPOpEveoJZFrU1cQBvlllY`
Yara	None matched
VirusTotal	Search for analysis

Name	d262fbed9803de90_Vcinpeamqerjfxlsvutgosconsoleapp11.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Vcinpeamqerjfxlsvutgosconsoleapp11.exe
Size	393.5KB
Processes	2264 (Tyjigybwjylnokucizpstzjwazconsoleapp18.exe) 3004 (cmd.exe)
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`99e3b588033258cb52bdd0f56b58a2e7`
SHA1	`d4f14a37264f21522010bc2cd91cc2d81e7e9297`
SHA256	`d262fbed9803de908040fb4e7d6bc446786acc95d207db1ba3800e85435d3a62`
CRC32	`EC5BCCEF`
ssdeep	`6144:j9HHBhD2zlM3FGmty2bZccfN3bJancO76zkigDDkjGcUzV5Rc:JHHrKM1GmlcibJanc+BeGJxz`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	fbe7b948695d47b4_ksyuxjtrazuidxiqmg.vbs Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Ksyuxjtrazuidxiqmg.vbs
Size	123.0B
Processes	2264 (Tyjigybwjylnokucizpstzjwazconsoleapp18.exe)
Type	ASCII text, with no line terminators
MD5	`3fdaabd223e5bd6ba4bb4a5c9bb279c0`
SHA1	`dd1095e7a6f43c8b26ade85b7dcfd271aaa1af1e`
SHA256	`fbe7b948695d47b4dd069fef162d04c1e2a0c9ce1386b7008aab27bda8716111`
CRC32	`0C29F9A8`
ssdeep	`3:FER/n0eFHHomWxpcL4E2J5xAIleUydM2oZACHMFjM:FER/lFHImQpcLJ23fleUOM2JZM`
Yara	None matched
VirusTotal	Search for analysis

Name	e2935b5b28550d47_nss3.dll Submit file
Filepath	C:\ProgramData\nss3.dll
Size	1.2MB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`bfac4e3c5908856ba17d41edcd455a51`
SHA1	`8eec7e888767aa9e4cca8ff246eb2aacb9170428`
SHA256	`e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78`
CRC32	`9F24F4E3`
ssdeep	`24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH`
Yara	Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) IsDLL - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	4fcd08aeecabfa59__8805238876.zip Submit file
Filepath	C:\ProgramData\880523887698104\_8805238876.zip
Size	10.2KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`71b5cb0311564566173e0bc33548c586`
SHA1	`027f5b32cbf399e889bc89e2af109d67ec61571a`
SHA256	`4fcd08aeecabfa5984f7a156735d5a20cb8af43ea1abfed4bf531b5c13eb3521`
CRC32	`2441FC53`
ssdeep	`192:00vGJGlnxkKeTN9rsQUMzeSlQgN61x6XRTFvFPK5NCV+JAUoQecHJwHa0D:VVRxlkN9AcznuvLyA5YVfQrHea0D`
Yara	None matched
VirusTotal	Search for analysis

Name	38c389720b75365f_temp Submit file
Filepath	C:\ProgramData\880523887698104\temp
Size	72.0KB
Type	SQLite 3.x database, last written using SQLite version 3021000
MD5	`c480140ee3c5758b968b69749145128d`
SHA1	`035a0656bc0d1d376dfc92f75fa664bdf71b3e4d`
SHA256	`38c389720b75365fcb080b40f7fdc5dc4587f4c264ec4e12a22030d15709e4a9`
CRC32	`954A724F`
ssdeep	`96:f0CWo3dOEctAYyY9MsH738Hsa/NTIdE8uKIaPdUDFBlrrVY/qBOnx4yWTJereWbY:fXtd69TYndTJMb3j0`
Yara	None matched
VirusTotal	Search for analysis

Name	f8084a32b3fb03af_screenshot.jpg Submit file
Filepath	C:\ProgramData\880523887698104\screenshot.jpg
Size	21.7KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5	`d1a473256e63a73d6400b377aa380558`
SHA1	`54dca307d1fffb1c3b8f974292fbea5a59c4adc0`
SHA256	`f8084a32b3fb03afc8d06c18366bf7a18257ab67aae6c044fb8ff527401b2155`
CRC32	`A3F44545`
ssdeep	`192:pCzay86L/MbtH2mBSCUiEVq3RRRxM+/6kb2iFcLp+iXbmZb:4586L/MbtjZLM+ykKtv6`
Yara	JPEG_Format_Zero - JPEG Format
VirusTotal	Search for analysis

Name	fa924f7a7cf92792__8805238876.zip Submit file
Filepath	C:\ProgramData\880523887698104\_8805238876.zip
Size	10.6KB
Processes	2260 (Vcinpeamqerjfxlsvutgosconsoleapp11.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`a011ccfdbb4ba76dd2adf7fce1f59af7`
SHA1	`4889c6c1803347de0f1b8137c9cc9078d62fc32d`
SHA256	`fa924f7a7cf927922a7f9bd767f6c2707628b04fe34422d94269169628ed6120`
CRC32	`DA23C8A0`
ssdeep	`192:00vGJGlnxkKeTN9rsQUMzeSlQgN61x6XRTFvFPK5NCV+JAUoQecHJwHa03J1ie:VVRxlkN9AcznuvLyA5YVfQrHea03J1ie`
Yara	None matched
VirusTotal	Search for analysis