Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	42ef434d4f2fbb1d_fireplough.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\fireplough.exe
Size	435.2KB
Processes	2132 (igccu.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`8389ef289fda3d0c64e8b482f820b628`
SHA1	`c7bfc83d8c72eb8f275758d054e6c210148b0002`
SHA256	`42ef434d4f2fbb1d7dcc088b49c7fd18b15a5cc6871d3b03126071f2981de33f`
CRC32	`602C3F3D`
ssdeep	`12288:vYkufGTvuYov3DbKsR/ovffKW9iDU5QZcd:vYkuYorxR/oHW2d`
Yara	UPX_Zero - UPX packed file NSIS_Installer - Null Soft Installer Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	cd935c9250049958_ldtydipfry.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\nssC996.tmp\ldtydipfry.dll
Size	67.5KB
Processes	1020 (igccu.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`a81eefde47575416538049773614fc35`
SHA1	`c2ea8d66e9f1f768efaccfbd152e480a6b2373fc`
SHA256	`cd935c9250049958c47172a3051bc8dab1d20a667a07eb4fb72a665a56a74022`
CRC32	`9FB68BFA`
ssdeep	`1536:ibJgkf4IMyAkxLCPG/rqXfdrFjxTtB1B7NVe:iZpLCPPVrFZ/T7C`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14_nsdC985.tmp Empty file or file not found
Filepath	C:\Users\test22\AppData\Local\Temp\nsdC985.tmp
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	11416359cfbe1246_mykwhr.d Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\mykwhr.d
Size	456.3KB
Processes	1020 (igccu.exe)
Type	data
MD5	`d4b097a5ce8ad0bb811d53a11e26c016`
SHA1	`4a4c872f530f2afdcd3504575d90998d6ec4de7e`
SHA256	`11416359cfbe124603e1393273f3ee205ab3b0d548c83b54a5ffd9e2b77629ae`
CRC32	`6B6273BF`
ssdeep	`12288:tUF7jdnbOuX50kvGo9ER5zPbdltEJ4x74ahfDQ2ljDJbK4eZ17R:tUF7jpOIqkEPbHhnDQ21dba77R`
Yara	None matched
VirusTotal	Search for analysis

Name	4cce5f45f185524b_LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu
Size	1.2MB
Type	SQLite 3.x database, user version 30, last written using SQLite version 3031001
MD5	`fe169ca1afaa6be2776a175c90427b38`
SHA1	`72bb87cd1b2b000088d1ee4c14675b2c19de4aa9`
SHA256	`4cce5f45f185524b6c75c819ad5923d70dcb9662e833b5e1229022693f471235`
CRC32	`8B4FBD0F`
ssdeep	`96:D7/cYoynhZlbJPZOwr4oR84J4Aqx4ZA7O9jgv106WEWbEm2JioMetQ:3cYoEn/oGJYxapEWAm2J2`
Yara	None matched
VirusTotal	Search for analysis

Name	dcfcd16fbf0511d3_vbsqlite3.dll Submit file
Filepath	C:\Users\Public\Libraries\vbsqlite3.dll
Size	161.5KB
Processes	2132 (igccu.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`073a17b6cfb1112c6c838b2fba06a657`
SHA1	`a54bb22489eaa8c52eb3e512aee522320530b0be`
SHA256	`dcfcd16fbf0511d3f2b3792e5493fa22d7291e4bb2efbfa5ade5002a04fc2cab`
CRC32	`9619DAD7`
ssdeep	`3072:eNFwdmspaPg9g9oOavAQBNrPkVdc88GjU+vF6nuxRocX5GOOUleo+c:e8d1/w5KA81IJ8GpF6nuTmOOU`
Yara	UPX_Zero - UPX packed file IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	c119a54b6bef3a48_WebData Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\WebData
Size	80.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`255929949dea51a2f43a1f40e63764ec`
SHA1	`8f32ab419264fdad05f4f3828db3c1cd38d919fd`
SHA256	`c119a54b6bef3a48234950dc07fe70f73b69d1390ef0235e66481faa1048ead6`
CRC32	`F7A79605`
ssdeep	`96:5Bc7fYLKYZCIdE8XwUWaPdUDg738Hsa/NhuK0l0q8oc5PyWTJereWb3lxzasq9u4:5BPOUNlCTJMb3rEDFAa6E/`
Yara	None matched
VirusTotal	Search for analysis

Name	824fae3331b95e2f_LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\LogfirelocktMNgpOmjPLjJNonurlaNcvdcGgbBfbOgquipu
Size	40.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`41c19a9e8541fcb934c13c075bf47721`
SHA1	`648a7622d533d79b9a0bb31dc370134ec3a75ed7`
SHA256	`824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c`
CRC32	`560F7642`
ssdeep	`48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u`
Yara	None matched
VirusTotal	Search for analysis

Name	89c57cdff7f53e45_ThunderBirdContacts.txt Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\TEST22-PC-test22\ThunderBirdContacts.txt
Size	21.0B
Processes	2132 (igccu.exe)
Type	ASCII text, with CRLF line terminators
MD5	`aae099b12d63d4ff58e570ea2fdb126e`
SHA1	`72c2652e15cc35394dedefaeedfe711b159c0ecc`
SHA256	`89c57cdff7f53e45bfb5c04d9ed99c3ad4c182a503bba441ebbc4bb5de45f9bb`
CRC32	`99E67AA1`
ssdeep	`3:HvzIyHy:HvzID`
Yara	None matched
VirusTotal	Search for analysis