Dropped Files | ZeroBOX

Name	f9349585a2393d43_ekrwu4nb9qyu5fn7uzbx25lw.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\ekRWU4NB9qyU5fN7uzBX25lW.exe
Size	494.0KB
Processes	1108 (china.png)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`28345a7bb63babaf99e760965ce493b7`
SHA1	`7e752390f6ebca4e1e8889302549be4dd0845f62`
SHA256	`f9349585a2393d4378e283e73fc48d04941666ec0ccae4dd2fb68c2cad7ac9a1`
CRC32	`1DB82DEF`
ssdeep	`12288:qpHLo/ADRUoBhT3d7ybbicrZumiAgp+zjgm6sFuMLGx:SroGRU+Fu+clhl/JVuMSx`
Yara	win_registry - Affect system registries win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check
VirusTotal	Search for analysis

Name	0142015d022fa13c_btq6kn1grdbtoer7smqayqlw.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\bTq6kn1GRdbtOEr7sMqAyqlw.exe
Size	4.3KB
Processes	1108 (china.png)
Type	HTML document, ASCII text
MD5	`fc98607dd5de9a373ba2f061c8a2c6fd`
SHA1	`8892a51e2dd14e23958dbac4f6919f0b7130a5ef`
SHA256	`0142015d022fa13c41d9392194cd38e541d7fdc323972375f364821a8d3e6454`
CRC32	`4C139700`
ssdeep	`96:1j9jwIjYjyDK/DZD8jH+k1CZBvJADh/pRswsgszbGD:1j9jhjYjWK/lyH+kMBRADh/pmwsgsfGD`
Yara	None matched
VirusTotal	Search for analysis

Name	801e5bf688d60c53_lugfnt4l8cfqzmtna7j0mffw.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\lUgfnt4L8CfqzmTNA7J0mFFw.exe
Size	4.3KB
Processes	1108 (china.png)
Type	HTML document, ASCII text
MD5	`4a29fc168763a3f4b43de09c317cac78`
SHA1	`811f1d11e4441f88144eafd9f501d9edb9076d1f`
SHA256	`801e5bf688d60c53c5500950e51782d68ab5182cf0f2545f1dece30d042b92ed`
CRC32	`246667A9`
ssdeep	`96:1j9jwIjYjyDK/DZD8jH+k1CZBvJADh/pRsasgszbGD:1j9jhjYjWK/lyH+kMBRADh/pmasgsfGD`
Yara	None matched
VirusTotal	Search for analysis