Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	2244b4dc9afc6cfa_clip64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
Size	89.0KB
Processes	2712 (pdates.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`2392b231cf4a80739b5cb09bf808127d`
SHA1	`41b5cf81c50884954911d96444fe83cfd0da465b`
SHA256	`2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f`
CRC32	`16AB7A40`
ssdeep	`1536:Oo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUabaB89p:OoUCWbBNpplToUs1uNhj25LJUQaB89p`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win_Amadey_Zero - Amadey bot IsPE32 - (no description)
VirusTotal	Search for analysis

Name	9697c311649991da_ohcompetitive.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ohcompetitive.exe
Size	15.0KB
Processes	2748 (an.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0d017f7f9508ae53de2a266572b33b99`
SHA1	`a60fd09f1f435a6ae8a8127ddedf02d2c2a180ef`
SHA256	`9697c311649991daaf3c30b025cef3eb50b084eeb9f6b5bab7b296e96b5ef058`
CRC32	`F37C2382`
ssdeep	`384:H5gmBcQORffWaO/iV19jldaaeiEDlMCgPl+:H5gmaQI3daVirCgk`
Yara	Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	e8fb27aecb4a5063_raman.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\1000012051\raman.exe
Size	1.4MB
Processes	2712 (pdates.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f113913b1fed45145f205fb3d808bf68`
SHA1	`5ef133c680797182140b5c7b658905d87516f730`
SHA256	`e8fb27aecb4a5063758d283cc5f6295a9cf5b425575d13179f726ad0f4f6659b`
CRC32	`FCA4BD23`
ssdeep	`24576:8cbD/e1EBLHWrvapFOxbfgaPsjBEkmUyqpXvntFCFSBLwCRZ5LNNgBD2gC1oM3X:8cbi6qapSfgfjBEkBdP3VBv3gBDM1oMH`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	bc9c7fddecb84f17_pdates.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\925e7e99c5\pdates.exe
Size	225.4KB
Processes	2596 (b6358658.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c1f47b74da41c3defdcd28d8f8d2ec26`
SHA1	`23846f6dc3b45311d8b0b89068ea41470287ac07`
SHA256	`bc9c7fddecb84f17c7b6463435d393df48ebc66379465833f1fc3e2b31d6fc8a`
CRC32	`677EB0B6`
ssdeep	`3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Win_Amadey_Zero - Amadey bot IsPE32 - (no description)
VirusTotal	Search for analysis

Name	e3b0c44298fc1c14___tmp_rar_sfx_access_check_32551593 Empty file or file not found
Filepath	C:\Users\test22\AppData\Local\Temp\__tmp_rar_sfx_access_check_32551593
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	246145282fe8b481_k1het.2 Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\k1het.2
Size	1.2MB
Processes	3044 (raman.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`fcf0628a7f273cbc18af34d22beeda4a`
SHA1	`f576adff80c6b349bf8c7a7a1471d380e582b214`
SHA256	`246145282fe8b4819e1e47dd367b5338b382811e89451f946498047e5d0dd678`
CRC32	`30548E5A`
ssdeep	`24576:qf5WrpgpFOlbH8aP8jXEomU+ipXvHPFCN8zbKwhZ5LDlCDOg6bo:rgpIH81jXEoBz/NFzBUDobo`
Yara	IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	563930e022089390_foto5566.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\1000009051\foto5566.exe
Size	389.5KB
Processes	2712 (pdates.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`35a7914233bf4998afd3af7b9a89d453`
SHA1	`1e0e393d59fdde5f4d4dd70fc403c20fa5c299b9`
SHA256	`563930e022089390a462a66ce668bd9dbdd815dab07e3e5fcea139b7662a1881`
CRC32	`96BFDB33`
ssdeep	`6144:KHy+bnr+xp0yN90QERCrtc2tzHn26JCor8DPXfroNTcgtDX2SgBZ+t43D6wjpJwt:VMrVy90/EDy6DSPkxFXLgBYC3RwfF`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet IsPE32 - (no description)
VirusTotal	Search for analysis

Name	364d8dcd82e7a475_ohcompettitive.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ohcompettitive.exe
Size	15.0KB
Processes	2748 (an.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`4d5f7960d715a6c04f1388fb49521f81`
SHA1	`b34d1039f013fff49d3f4ff568f960da6cd3f5a7`
SHA256	`364d8dcd82e7a47564a4d3aa2a676013d2f5eb5f3a72f97e56d5fd5657cdf96d`
CRC32	`1333228F`
ssdeep	`384:BgmBcQORffJoOoiV19jTddaeo2A2gilC0:BgmaQHyddaD12gl0`
Yara	IsPE64 - (no description) Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	03afb988f3eec62c_cred64.dll Submit file
Filepath	C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
Size	273.0B
Processes	2712 (pdates.exe)
Type	HTML document, ASCII text
MD5	`9851b884bf4aadfade57d911a3f03332`
SHA1	`aaadd1c1856c22844bb9fbb030cf4f586ed8866a`
SHA256	`03afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f`
CRC32	`685C995D`
ssdeep	`6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIR+knaCyjEcXaoD:J0+oxBeRmR9etdzRxGezH0qaCtma+`
Yara	None matched
VirusTotal	Search for analysis

Name	d24cac5596825fe9_an.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\1000011051\an.exe
Size	162.0KB
Processes	2712 (pdates.exe)
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`691a54b032d616e5f9303557ffd49add`
SHA1	`f1361a480c7171adc2c0e370e0c31b3c7758d18f`
SHA256	`d24cac5596825fe9f802f9aa40201452c16f40fea1b4c46b5a23423c13d7f180`
CRC32	`AD915A7D`
ssdeep	`3072:sahKyd2n31D5GWp1icKAArDZz4N9GhbkrNEk1bQiu0T:sahODp0yN90QEKL`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
VirusTotal	Search for analysis

Name	0b3bb5c5bc4fe192_fotod250.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\1000010051\fotod250.exe
Size	390.0KB
Processes	2712 (pdates.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`86b721deb6e8e920580045814bc992b3`
SHA1	`62ed0fa711978bf0bc6d5b6b00b610b47289fab8`
SHA256	`0b3bb5c5bc4fe19293428ea1951af8c3dd9ae3d8039ddceac8965ac8ab416964`
CRC32	`B501BD6E`
ssdeep	`6144:KAy+bnr+pp0yN90QE+kU/QYuPVptzER6q0hevmeVQQxN2IWHKja:8Mrhy90e5UfhenN2IWHKja`
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet IsPE32 - (no description)
VirusTotal	Search for analysis