Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	2b00fc4f541ac10c_freebl3.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\freebl3.dll
Size	326.5KB
Processes	2804 (aspnet_compiler.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`ef12ab9d0b231b8f898067b2114b1bc0`
SHA1	`6d90f27b2105945f9bb77039e8b892070a5f9442`
SHA256	`2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7`
CRC32	`4DE53F71`
ssdeep	`6144:u8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPbjm:ubG7F35BVh8yIZqn6vm`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	fb419a60305f1735_mozglue.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\mozglue.dll
Size	134.0KB
Processes	2804 (aspnet_compiler.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`75f8cc548cabf0cc800c25047e4d3124`
SHA1	`602676768f9faecd35b48c38a0632781dfbde10c`
SHA256	`fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0`
CRC32	`0E1302FA`
ssdeep	`3072:4kdWyaKm15vd/q/Py9UbfkVgxp1qt/t3PvT4UD2JJJvPBrSezRy:Fdtm15vtSfkVgxp12/t3PLxD2JJJvPQZ`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description)
VirusTotal	Search for analysis

Name	c40bb03199a2054d_vcruntime140.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\vcruntime140.dll
Size	81.8KB
Processes	2804 (aspnet_compiler.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`7587bf9cb4147022cd5681b015183046`
SHA1	`f2106306a8f6f0da5afb7fc765cfa0757ad5a628`
SHA256	`c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d`
CRC32	`9BB5124B`
ssdeep	`1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	aa8c6dfd7a53e4e4_pjieHrK.tmp Submit file
Filepath	C:\Users\test22\AppData\Roaming\pjieHrK.tmp
Size	228.2KB
Type	UTF-8 Unicode text, with very long lines, with no line terminators
MD5	`211b97f75eeaf7c339331e4517360d9f`
SHA1	`32b2370763a1fdcc10d1bb67d36ea7b4ad0e677e`
SHA256	`aa8c6dfd7a53e4e4588822d5ed2f2b0982fbad22f73569cd44473b607283275b`
CRC32	`6C5AED94`
ssdeep	`6144:DEenE5aINjhmAUhv+B/1q8Pi2G+D8VbnRl:DbINjhmAuvK/YoVLDOD`
Yara	None matched
VirusTotal	Search for analysis

Name	334e69ac9367f708_msvcp140.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\msvcp140.dll
Size	429.8KB
Processes	2804 (aspnet_compiler.exe)
Type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5	`109f0f02fd37c84bfc7508d4227d7ed5`
SHA1	`ef7420141bb15ac334d3964082361a460bfdb975`
SHA256	`334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4`
CRC32	`97BCF588`
ssdeep	`12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	824fae3331b95e2f_eADvDAG.tmp Submit file
Filepath	C:\Users\test22\AppData\Roaming\eADvDAG.tmp
Size	40.0KB
Type	SQLite 3.x database, last written using SQLite version 3033000
MD5	`41c19a9e8541fcb934c13c075bf47721`
SHA1	`648a7622d533d79b9a0bb31dc370134ec3a75ed7`
SHA256	`824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c`
CRC32	`560F7642`
ssdeep	`48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u`
Yara	None matched
VirusTotal	Search for analysis

Name	78758bf7f3b3b5e3_nss3.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\nss3.dll
Size	1.2MB
Processes	2804 (aspnet_compiler.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`d7858e8449004e21b01d468e9fd04b82`
SHA1	`9524352071ede21c167e7e4f106e9526dc23ef4e`
SHA256	`78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db`
CRC32	`5E37D562`
ssdeep	`24576:Ab5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRpMxkxo:+zW5ygDwnEZIYkjgWjblMSRpMqm`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	bb3ff746471116c6_softokn3.dll Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\softokn3.dll
Size	141.5KB
Processes	2804 (aspnet_compiler.exe)
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`471c983513694ac3002590345f2be0da`
SHA1	`6612b9af4ff6830fa9b7d4193078434ef72f775b`
SHA256	`bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f`
CRC32	`AEBEA9BF`
ssdeep	`3072:0Af6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWPqeFYMMa:J6PbsF4CoT2OeN43Ma`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis