Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	d820603eb308a436_NRWjPwm77TXO Submit file
Filepath	C:\Users\test22\AppData\LocalLow\NRWjPwm77TXO
Size	12.0KB
Type	UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5	`0647d44f50372ccfa8f1e56b37e9fe76`
SHA1	`5e7fac4675932c1faa55f925c958ca1c75324a20`
SHA256	`d820603eb308a43651cc248106d188c1602f5de460de659300721f03cd863dbc`
CRC32	`A8996995`
ssdeep	`192:O6nHM58sK1zjyPySpI+JpVgxXhKQuylvICf/eEoBqIrv0bEHa+n:O6sPPZIcpmxO3BqIr0IH/n`
Yara	None matched
VirusTotal	Search for analysis

Name	7676b84b0cd7ecc9_index.html Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\index.html
Size	2.0KB
Processes	2816 (wfplwfs.exe)
Type	HTML document, UTF-8 Unicode text
MD5	`2ddda0af7a0d8df3b789cf28d6fd66ed`
SHA1	`2db7c96ce58b77c7c13cb38d99eac186e55302e3`
SHA256	`7676b84b0cd7ecc9950b094a01c8a384d62d6625b949e87ddf1ff3c3bc763b72`
CRC32	`65A27465`
ssdeep	`48:nXafrqPiIZLdeUvoJX+d3vgQ1/GO90OISThw:nXafrqPiIZ5eLJX+eQ1+E0Rghw`
Yara	None matched
VirusTotal	Search for analysis

Name	88f9dc0b9a633e43_2I9U844TH3w7 Submit file
Filepath	C:\Users\test22\AppData\LocalLow\2I9U844TH3w7
Size	512.0KB
Type	SQLite 3.x database, user version 11, last written using SQLite version 3031001
MD5	`dd47ebe6866ad2ab59d0caa1de28d09e`
SHA1	`afdf6eb7a01bb7ef4c9d768b65abbbeae5ba2663`
SHA256	`88f9dc0b9a633e43c6d2c6fae136e782c15aa38c1601dcff948987f1c2a391c3`
CRC32	`8DEE9EEA`
ssdeep	`24:DQHtJl32mNVpP965hKN0MG/lZpNjCKRIaU5BnCMOkC0JCpL3FYay:DQfrbWTTTqtStLm`
Yara	None matched
VirusTotal	Search for analysis

Name	9d02e952396bdff3_vcruntime140.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\vcruntime140.dll
Size	78.2KB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`1b171f9a428c44acf85f89989007c328`
SHA1	`6f25a874d6cbf8158cb7c491dcedaa81ceaebbae`
SHA256	`9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c`
CRC32	`C6B85AE4`
ssdeep	`1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	44be3153c15c2d18_softokn3.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\softokn3.dll
Size	248.4KB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`63a1fe06be877497c4c2017ca0303537`
SHA1	`f4f9cbd7066afb86877bb79c3d23eddaca15f5a0`
SHA256	`44be3153c15c2d18f49674a092c135d3482fb89b77a1b2063d01d02985555fe0`
CRC32	`73C5E146`
ssdeep	`6144:uI7A8DMhFE2PlKOcpHSvV6x/CHQyhvs277H0mhWGzTdtb2bbIFxW7zrM2ruyYz+h:uI7A8DMhFE2PlbcpSv0x/CJVUmhDzTvS`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	8916fb1d76be83e4_HXd3ov66G7OK Submit file
Filepath	C:\Users\test22\AppData\LocalLow\HXd3ov66G7OK
Size	192.0KB
Type	SQLite 3.x database, user version 4, last written using SQLite version 3031001
MD5	`6b9c2ac2b5025e180231d8d38ece698c`
SHA1	`36f5cfe6ac59aaa7d7173555edeef5caa9bf61c6`
SHA256	`8916fb1d76be83e42cd2f7b41ee06706fe0adb936259ed7a7daa4dbcb4c51fcb`
CRC32	`95ACFD74`
ssdeep	`12:DBl/lkf12Of5LZWfY0xpMujuHWMu6N2OHjWOzMbdym/eRgBoQFmgW2FOmO6Mz6LX:DLlI1x7WxHaiSlMxosJF/Ezo`
Yara	None matched
VirusTotal	Search for analysis

Name	c65b7afb05ee2b26_nss3.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\nss3.dll
Size	1.9MB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`f67d08e8c02574cbc2f1122c53bfb976`
SHA1	`6522992957e7e4d074947cad63189f308a80fcf2`
SHA256	`c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e`
CRC32	`5AD02FD1`
ssdeep	`49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	2db7fd3c9c3c4b67_msvcp140.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\msvcp140.dll
Size	438.8KB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`1fb93933fd087215a3c7b0800e6bb703`
SHA1	`a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb`
SHA256	`2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01`
CRC32	`946682DF`
ssdeep	`12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	e36099a8ffebc501_a03.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\a03.exe
Size	6.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`02eceb12980e60c1496eb6b9a02d3483`
SHA1	`fc391210da8753222ba357db7c70397dd73c396e`
SHA256	`e36099a8ffebc501c3d1b8325a103b62769c5ac2630989ea3ea66715022a062f`
CRC32	`B8948466`
ssdeep	`98304:z4S0clXTS9EIv1281Ey0l6iEz0JzA3+rBAlrHC3dNtCLChF:l/lX3I9R1EFlnxJzVA1ALI+hF`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer VMProtect_Zero - VMProtect packed file Raccoon_Stealer_1_Zero - Raccoon Stealer
VirusTotal	Search for analysis

Name	824fae3331b95e2f_T5Lz6Kr0woK4 Submit file
Filepath	C:\Users\test22\AppData\LocalLow\T5Lz6Kr0woK4
Size	40.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`41c19a9e8541fcb934c13c075bf47721`
SHA1	`648a7622d533d79b9a0bb31dc370134ec3a75ed7`
SHA256	`824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c`
CRC32	`560F7642`
ssdeep	`48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u`
Yara	None matched
VirusTotal	Search for analysis

Name	74cd8cebc022b06c_wfplwfs.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\wfplwfs.exe
Size	5.4MB
Processes	300 (a03.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ad08fb264dd83251bebda5b2c71871f0`
SHA1	`ca71a18d8a696031c016434de89c7a158e3a6052`
SHA256	`74cd8cebc022b06c2cb58d00eb7d4dedaa47442bd7011130302785a3533c03ae`
CRC32	`7D602A38`
ssdeep	`98304:u4S0clXTS9EIv1281Ey0l6iEz0JzA3+rBAlrHC3dNtCLCh:6/lX3I9R1EFlnxJzVA1ALI+h`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer VMProtect_Zero - VMProtect packed file
VirusTotal	Search for analysis

Name	8b1243b878bb6b57_1d896d6f4de8430f.job Submit file
Filepath	C:\Windows\Tasks\1d896d6f4de8430f.job
Size	476.0B
Processes	2816 (wfplwfs.exe)
Type	VAX-order 68k Blit mpx/mux executable
MD5	`b56392896df33050aa0585163203989e`
SHA1	`ae302ed73756fc05317f8fe9a681e885c272990b`
SHA256	`8b1243b878bb6b576a849d0d8a8ea9bca891635be83d54a5e12757c238716565`
CRC32	`297301D3`
ssdeep	`6:lgUrZXE/jm/UEZ+lX1t5N6tO8m/UEZ+lX1+lPL+SkE+MTBSclRMlTJzXlAca+wQ7:GUrlki/Q11/Q1UaQ1BZ7MTLwtVVBgB`
Yara	None matched
VirusTotal	Search for analysis

Name	c119a54b6bef3a48_61obo95dbf4H Submit file
Filepath	C:\Users\test22\AppData\LocalLow\61obo95dbf4H
Size	80.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`255929949dea51a2f43a1f40e63764ec`
SHA1	`8f32ab419264fdad05f4f3828db3c1cd38d919fd`
SHA256	`c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6`
CRC32	`F7A79605`
ssdeep	`96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/`
Yara	None matched
VirusTotal	Search for analysis

Name	0b8607fdf72f3e65_HHy51Bl48fvG Submit file
Filepath	C:\Users\test22\AppData\LocalLow\HHy51Bl48fvG
Size	96.0KB
Type	SQLite 3.x database, user version 12, last written using SQLite version 3038003
MD5	`d367ddfda80fdcf578726bc3b0bc3e3c`
SHA1	`23fcd5e4e0e5e296bee7e5224a8404ecd92cf671`
SHA256	`0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0`
CRC32	`842B3569`
ssdeep	`12:DQAwfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAwff32mNVpP965Ra8KN0MG/lO`
Yara	None matched
VirusTotal	Search for analysis

Name	21df0ff4710ab3ea_2.1.1.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\2.1.1.exe
Size	478.5KB
Processes	300 (a03.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`eb75a43690afdea95c83ba331de640b7`
SHA1	`b65715468e185c3b54b60e075459a5f8b6e9c0f7`
SHA256	`21df0ff4710ab3ea44a1950745f9c71f3098bce46c5b0a7e86ba2777810ae855`
CRC32	`ED5CA848`
ssdeep	`3072:J5HqXHmQESDeGF+hNnbP1vumSrUDTX3AzgsL0A1lr:JBuHZDINxIYy`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Raccoon_Stealer_1_Zero - Raccoon Stealer
VirusTotal	Search for analysis

Name	b41bd7c17b6bdfe6_logo.png Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\logo.png
Size	2.9KB
Processes	2816 (wfplwfs.exe)
Type	PNG image data, 222 x 48, 8-bit/color RGBA, non-interlaced
MD5	`561a5a310ac6505c1dc2029a61632617`
SHA1	`f267ab458ec5d0f008a235461e466b1fd3ed14ee`
SHA256	`b41bd7c17b6bdfe6ae0d0dbbb5ce92fd38c4696833ae3333a1d81cf7e38d6e35`
CRC32	`A427A4F5`
ssdeep	`48:1URrn/9eEsyo0EeDcQ4ltBljxjzQz4EJcDUe8E+afOp8L2rZ5lFw5CiSJzJ8Xp9T:2RZt7wurUCcE2DT8wZL2FkCVl8PRTJR1`
Yara	PNG_Format_Zero - PNG Format
VirusTotal	Search for analysis

Name	fd4c9fda9cd3f9ae_HHy51Bl48fvG-shm Submit file
Filepath	C:\Users\test22\AppData\LocalLow\HHy51Bl48fvG-shm
Size	32.0KB
Type	data
MD5	`b7c14ec6110fa820ca6b65f5aec85911`
SHA1	`608eeb7488042453c9ca40f7e1398fc1a270f3f4`
SHA256	`fd4c9fda9cd3f9ae7c962b0ddf37232294d55580e1aa165aa06129b8549389eb`
CRC32	`DDC506B6`
ssdeep	`3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX`
Yara	None matched
VirusTotal	Search for analysis

Name	308de7da302d3ecf_d8c5e4a16c2bea0e36baa2d018275111ff62fd09 Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\D8C5E4A16C2BEA0E36BAA2D018275111FF62FD09
Size	812.0B
Processes	300 (a03.exe)
Type	data
MD5	`1c3527f8fe5a24623bdd6ad96bf602fd`
SHA1	`bc988ad300ca4d581a7056bf8c342377d72d7c73`
SHA256	`308de7da302d3ecf499b6c140b11fb3d9db0d3b9515d8fa3dd0ce4a65659266c`
CRC32	`5F7886F7`
ssdeep	`24:Z6hR2MTR2d7NVM+uAR2CP0M9BHMvf9SJbsb:Z6WH1N2DAR2CP02xVg`
Yara	None matched
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14_HHy51Bl48fvG-wal Empty file or file not found
Filepath	C:\Users\test22\AppData\LocalLow\HHy51Bl48fvG-wal
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	4191faf7e5eb105a_mozglue.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\mozglue.dll
Size	612.4KB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`f07d9977430e762b563eaadc2b94bbfa`
SHA1	`da0a05b2b8d269fb73558dfcf0ed5c167f6d3877`
SHA256	`4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862`
CRC32	`ED48E95A`
ssdeep	`12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer
VirusTotal	Search for analysis

Name	fc136a4ba41345fc_ZRPcC1IdgP3f Submit file
Filepath	C:\Users\test22\AppData\LocalLow\ZRPcC1IdgP3f
Size	87.1KB
Processes	2128 (2.1.1.exe)
Type	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1024x768, frames 3
MD5	`652dca9386b24800c651eb8242ef2d2a`
SHA1	`620f424eda6518a801bc7ac1dcfe44e9d6a0f4c9`
SHA256	`fc136a4ba41345fc4a0e2b58798ce6bbdd6c78a6a4959f3712c346066dbb77f3`
CRC32	`A01B703A`
ssdeep	`1536:0lMwB+RzvApMZ5Tw9F+jIZCQ051T+B0MIT3AHr6H7n02G4gjUrBVPT9rG0:psoDA6Z5Tw9FMqCd5sIT3AHr6IygjUFT`
Yara	JPEG_Format_Zero - JPEG Format
VirusTotal	Search for analysis

Name	b2ae93d30c8beb0b_freebl3.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\freebl3.dll
Size	668.9KB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`15b61e4a910c172b25fb7d8ccb92f754`
SHA1	`5d9e319c7d47eb6d31aaed27707fe27a1665031c`
SHA256	`b2ae93d30c8beb0b26f03d4a8325ac89b92a299e8f853e5caa51bb32575b06c6`
CRC32	`906605E4`
ssdeep	`12288:0oUg2twzqWC4kBNv1pMByWk6TYnhCevOEH07OqHM65BaFBuY3NUNeCLIV/Rqnhab:0oUg2tJWC44WUuY3mMCLA/R+hw`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	741a816750ffd35e_qrcode.png Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\qrcode.png
Size	1.6KB
Processes	2816 (wfplwfs.exe)
Type	PNG image data, 300 x 300, 8-bit/color RGB, non-interlaced
MD5	`abcf7fd62d78b302475bac66fd1e2968`
SHA1	`fad0de7476d1cb563ffd3723dfc8f6dc9d7fbac4`
SHA256	`741a816750ffd35e3c4828cca24e90ffad946e040e11eca3c4a2ec2a1c74def4`
CRC32	`FCDF6C5A`
ssdeep	`24:HTGl04lZ9/YrueZrVFSsOIcqeEDkXcmUb7/oQq:8xYrRZrjr0f07AQq`
Yara	PNG_Format_Zero - PNG Format
VirusTotal	Search for analysis

Name	edb006e05cfa8501_11Q6jXj2SPOQ Submit file
Filepath	C:\Users\test22\AppData\LocalLow\11Q6jXj2SPOQ
Size	36.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`3f5ca3e29b1b60e298aeca0a32164c03`
SHA1	`f9b5ee59c31a3b06a6b8e476b22d2d7cf1fa8b66`
SHA256	`edb006e05cfa85015aa76c758d6298c279fd318cff0dbb286927c7ad45105488`
CRC32	`E1ACA097`
ssdeep	`24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5`
Yara	None matched
VirusTotal	Search for analysis

Name	cecf59649ccf1d76_WXqA2rbSaDqs Submit file
Filepath	C:\Users\test22\AppData\LocalLow\WXqA2rbSaDqs
Size	8.8KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`07951590532d8114ea1caca9ed7e0a39`
SHA1	`7a4bebc2f20ead9546fa5749aafe739ad5f551de`
SHA256	`cecf59649ccf1d7668ad3c7119bf9b380d6d5c339d7f0faeb2f29f163fd3f3ee`
CRC32	`E3F3A320`
ssdeep	`192:ZDnijRILMMdaWaLbFlp/PuFbylfFw8AxSwSO:pmsy7wIO`
Yara	None matched
VirusTotal	Search for analysis

Name	47b64311719000fa_sqlite3.dll Submit file
Filepath	C:\Users\test22\AppData\LocalLow\sqlite3.dll
Size	1.0MB
Processes	2128 (2.1.1.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`dbf4f8dcefb8056dc6bae4b67ff810ce`
SHA1	`bbac1dd8a07c6069415c04b62747d794736d0689`
SHA256	`47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68`
CRC32	`7926712E`
ssdeep	`24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis