popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 340c8464c2007ce3_cred64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 162.0B
Processes 2216 (oneetx.exe)
Type HTML document, ASCII text, with CRLF line terminators
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
CRC32 CC58D737
ssdeep 3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
Yara None matched
VirusTotal Search for analysis
Name b8c8aedd84c36385_clip64.dll
Submit file
Filepath C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 89.0KB
Processes 2216 (oneetx.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8451a2c5daa42b25333b1b2089c5ea39
SHA1 700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256 b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
CRC32 05D62A3B
ssdeep 1536:Bo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7faB89p:BoUCWbBNpplToUs1uNhj25LJUDaB89p
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
VirusTotal Search for analysis
Name 4b093d11af74e1fa_fotocr23.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000015051\fotocr23.exe
Size 769.5KB
Processes 2216 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 300631f915099502545d8d76f1f800d9
SHA1 1ddfc2ba777f2a449f9dd4c2732f9f3152c93e6e
SHA256 4b093d11af74e1fa128d7645cc0e85a98deec92ca34ef0e3d5d6774cb0528db0
CRC32 3C51C272
ssdeep 12288:SMrPy90sDWkw395csJqo6ftCFCh4kKxOCea6QUQZd0SRsOEbQ78f:NyJDWt5VclTHCea6FQZHRe48f
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 31a154b1a548d9f5_m2013582.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP005.TMP\m2013582.exe
Size 213.7KB
Processes 2388 (y0947959.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b67a3e65ad7b49dccde95914a6198df2
SHA1 bf651bd0de7abc175e4421b96f33ab26000c0dc8
SHA256 31a154b1a548d9f57beb2ebbc9f3aa6901ce2402c2897d39c7d0d052b7360f95
CRC32 64AAB5CA
ssdeep 3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name 2dbcee36d79f8497_y0947959.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP004.TMP\y0947959.exe
Size 488.0KB
Processes 1264 (fotocr23.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 610278c3e9e170ae625f7c4eee5110e4
SHA1 38b97bdfa915f0ad7f859eab8297660d8921cfc3
SHA256 2dbcee36d79f8497a9a2bba1b54ac09d3ab22f52d21eca2d6e454bbf6b5ef1e9
CRC32 54990BEC
ssdeep 12288:fMr8y90cSB6fHCkChDzKlO8ea5QAdhdQ:TynHfg/8ea5ZdhG
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 9b7ee11b341c2a62_l6155040.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP006.TMP\l6155040.exe
Size 168.1KB
Processes 2692 (y8067720.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 5e008d74d376661dc96d94186316d310
SHA1 9eb13b135ddc3d7d2482eb5429ef63bd84403563
SHA256 9b7ee11b341c2a629a70ee3757be3343678a190d1eea75cf3aa72280df14b146
CRC32 D000847E
ssdeep 1536:/9OLnP5teqhVZCGW5WwPwf8WTaj3zJJeunCxwSTGqVS5Wbu1RGwqHd384wYkp8eK:/8T3Ei8Wej9gWqVSYQRqHd388e8h3
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • ConfuserEx_Zero - Confuser .NET
VirusTotal Search for analysis
Name 390de8e584898581_n4498555.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP004.TMP\n4498555.exe
Size 286.5KB
Processes 1264 (fotocr23.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f44cbe20478245d86a4a9e23c14e89e5
SHA1 c58837b039ce6701e21fa24cc19ded303fbbcd5f
SHA256 390de8e58489858130953f052105a9656e250e594def4c32672fcf97ad91f520
CRC32 69DB8A56
ssdeep 6144:jDKW1Lgbdl0TBBvjc/gtnGnINzvTI1rbYwZ:3h1Lk70Tnvjco46zvirbhZ
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • UltraVNC_Zero - UltraVNC
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 96a4f5a4adcd9b9d_foto0174.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\1000014051\foto0174.exe
Size 770.0KB
Processes 2216 (oneetx.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ab0a41d1533fe160276f00a9ae11fdf0
SHA1 75182202c4832a8deb00026ea26b0d801d3f6d16
SHA256 96a4f5a4adcd9b9d8faead444c6132ba129f3c993b63bfab33495013465819cb
CRC32 C661C371
ssdeep 12288:bMr9y90aVfHjKyNLLNlevwmUVjEMR1kG2HXTH4kYeooqUKYOzpH2bKuK:SyFfDKYzeazt0RBNzBK
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 9a9db30ba757d584_y8067720.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP005.TMP\y8067720.exe
Size 316.0KB
Processes 2388 (y0947959.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a5c39861500c28805e6ade5c84f92ad5
SHA1 d132861bc0906ce6bd65c4222ae53fdb24251592
SHA256 9a9db30ba757d584222fa4ab88b6873356c849e54cffa8d799e5b7ffe07ec8e4
CRC32 E9996819
ssdeep 6144:Kjy+bnr+Bp0yN90QED6vZrMgX3eYK41E8OBURKaJWW:5MrZy90hmN3rKWOmEakW
Yara
  • UPX_Zero - UPX packed file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Malicious_Library_Zero - Malicious_Library
  • CAB_file_format - CAB archive file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal Search for analysis
Name 129fff14b19d1d35_oneetx.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\c3912af058\oneetx.exe
Size 213.6KB
Processes 800 (c9339938.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b4214d8a45e0c240750b62f557c693cd
SHA1 43ef98902647c7c8b1b1650e29afada54b53545e
SHA256 129fff14b19d1d35af7dd73511d51509d5c96b21de0ba0f5366f0f0e937d9d0f
CRC32 4EB8D2F8
ssdeep 3072:mhMCsw9/w+A4cwP+5OzutpHKGruONM4QuZA+67bi83eILfbq5kmh:5Cswq+AXYu7HGOSuZAlAILjq
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
VirusTotal Search for analysis
Name a511ae2083565f7f_k8115396.exe
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\IXP006.TMP\k8115396.exe
Size 184.5KB
Processes 2692 (y8067720.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d4c640fb500618ad6c9fc5fe7d3e784d
SHA1 850df0880e1685ce709b44afbbb365cab4f0fec4
SHA256 a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b
CRC32 856CD999
ssdeep 3072:1DKW1LgppLRHMY0TBfJvjcTp5XmvTJT00K9ItKcHxaAixOiw:1DKW1Lgbdl0TBBvjc/mvTJKmjxue
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Malicious_Library_Zero - Malicious_Library
  • UltraVNC_Zero - UltraVNC
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis