popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name e3b0c44298fc1c14___tmp_rar_sfx_access_check_25749656
Empty file or file not found
Filepath C:\FontsavesInto\__tmp_rar_sfx_access_check_25749656
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name f91a106ad3e48562_5x6xhq8oosomjmo.bat
Submit file
Filepath C:\FontsavesInto\5X6xHq8OosomjmO.bat
Size 43.0B
Processes 1116 (loaddd.exe)
Type ASCII text, with no line terminators
MD5 69a93d9784094ed30087e525d8e5ca93
SHA1 e441ac2e33082d55745c23ff7d6eef726f6c716a
SHA256 f91a106ad3e48562b43ee4145edb307f4994eff2aac723032c45c838c9b15b58
CRC32 FEFFF1B3
ssdeep 3:I52peKoM6eKXADVQJn:IocKfKHJ
Yara None matched
VirusTotal Search for analysis
Name 570ce5c4b0b49b40_0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
Submit file
Filepath C:\FontsavesInto\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c
Size 634.0B
Processes 2772 (FontsavesIntorefperf.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 42b84e0a82675cd1cb0ab5375bb63a35
SHA1 ba117567353c608859da7711dd5e9857131735db
SHA256 570ce5c4b0b49b40527672d624ef74c3fbdb5e643ccdfa73ad83c04ea8ccafba
CRC32 0A02AB71
ssdeep 12:8l9pLAkbq2fzjKABAhVDR65aZ9ueZZRbHGaGpTDzITaG:8hLrfzJG65a7ueZZRaaGpTDz6aG
Yara None matched
VirusTotal Search for analysis
Name 16d74e63bd0f09ec_fontsavesintorefperf.exe
Submit file
Filepath C:\FontsavesInto\FontsavesIntorefperf.exe
Size 632.5KB
Processes 1116 (loaddd.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 6bea156153d2dcd0bb45e379333f8da8
SHA1 9383d9f769297fd43591390b9642d8b3ee6c47ec
SHA256 16d74e63bd0f09ecb21133532c18c3fbb6582b4696914277c0e7a986dd40a40d
CRC32 DFC2172B
ssdeep 6144:KlfaZT+VPUiBg2ihWkchpVX2uqgs1NORI2ShBhf5u20S9/NlPqvZIDuGRL8zG7kJ:mKhWkcbVXyNd2wHfoS/N09Oqn
Yara
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • keylogger - Run a keylogger
  • sniff_audio - Record Audio
  • PE_Header_Zero - PE File Signature Zero
  • IsPE32 - (no description)
  • IsNET_EXE - (no description)
  • IsWindowsGUI - (no description)
VirusTotal Search for analysis
Name 429991d06db79d9d_42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
Submit file
Filepath C:\util\ProcessMonitor\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af
Size 52.0B
Processes 2772 (FontsavesIntorefperf.exe)
Type ASCII text, with no line terminators
MD5 1b68fdc2d7e10845fb4e9de19cfecd2f
SHA1 3e5b8209245de042114c5167a8221b7099251318
SHA256 429991d06db79d9d8ba5843690df008bb095445568ed4aeefccf1dd3bf388e7e
CRC32 ED902CB3
ssdeep 3:eSXuTyKeXj:XXUyXXj
Yara None matched
VirusTotal Search for analysis
Name c05512b00b1f8bb7_b75386f1303e64d8139363b71e44ac16341adf4e
Submit file
Filepath C:\Windows\System32\iassdo\b75386f1303e64d8139363b71e44ac16341adf4e
Size 214.0B
Processes 2772 (FontsavesIntorefperf.exe)
Type ASCII text, with no line terminators
MD5 ead1b763d7cfd7f3e166f5d5171b1acd
SHA1 e69e15e0d1ed77087614bd289a7daa4e35817658
SHA256 c05512b00b1f8bb77030ee9134e8c322c9324e23749d928e87eb5c6aeaf8aca3
CRC32 04A98915
ssdeep 3:LBFPupGgbTTUXzlcJcNJR4w7vJy85Ae8yIGijhggSrjTdYEVGrhKVrcZDorn:FFmptcyJC74wReRy0VDSjdJVGr4V8D2
Yara None matched
VirusTotal Search for analysis
Name ac99dee81aaf0408_m8abj5fb2d94qk25gj.vbe
Submit file
Filepath C:\FontsavesInto\m8aBJ5FB2D94qk25GJ.vbe
Size 205.0B
Processes 1116 (loaddd.exe)
Type data
MD5 190d748d25680584fe1b63a74f480b29
SHA1 71e99245cb768b3d4fbcb532dbe0f9e48f46c4ff
SHA256 ac99dee81aaf04088144ec0926ff227e0ada78e2c4d1a4c0e6f5cd3106e69b21
CRC32 96EFF0EF
ssdeep 6:GxwqK+NkLzWbHE08nZNDd3RL1wQJRo1RB66ytScs:GkMCzWLE04d3XBJ21RryU
Yara None matched
VirusTotal Search for analysis
Name b802e4a8b00adaea_24dbde2999530ef5fd907494bc374d663924116c
Submit file
Filepath C:\Sandbox\test22\DefaultBox\drive\C\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\24dbde2999530ef5fd907494bc374d663924116c
Size 277.0B
Processes 2772 (FontsavesIntorefperf.exe)
Type ASCII text, with no line terminators
MD5 5b4333a1b7f49fb6ed6eab993b7b3ce5
SHA1 aee2e875f8638e9660dba119fe75bfd3a14cbf6b
SHA256 b802e4a8b00adaea6a466c633fafdaef125f404f68d77adaf06cf1b9cb501fe8
CRC32 F6CD1265
ssdeep 6:28/fZ9R6yPmORv76IbtPx5LkXpJU9tvxJfb+an27H29NVn1+:2SLRnP1J5b9x5LsTCvXbE2k
Yara None matched
VirusTotal Search for analysis
Name a50319e0ab4aa693_cc11b995f2a76da408ea6a601e682e64743153ad
Submit file
Filepath C:\Windows\System32\spbcd\cc11b995f2a76da408ea6a601e682e64743153ad
Size 858.0B
Processes 2772 (FontsavesIntorefperf.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 f19d535d4fb60e314de2e10bdd612a9e
SHA1 55b73793f917331145a2e7641d9b3a4d64b05204
SHA256 a50319e0ab4aa693b272bba86016ea214729bcdf2658c64372a5d2a49a632801
CRC32 D950177F
ssdeep 24:hIqdI4sgHsdDfcTxH6hDpcVOWh1QohD9ZtpaO8s:h84sgMdD+GdWTQohDjtwO8s
Yara None matched
VirusTotal Search for analysis