popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 7adf42fb9234399b_cc11b995f2a76da408ea6a601e682e64743153ad
Submit file
Filepath C:\PerfLogs\Admin\cc11b995f2a76da408ea6a601e682e64743153ad
Size 765.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 246135e6015d414f071da5141cd7224d
SHA1 e5bf9413eb45f1730c0215b697f3315e3ca321aa
SHA256 7adf42fb9234399beb06bc5fea0f049656762e0894215fb202cb330f636c3473
CRC32 B1B4DD82
ssdeep 12:A5AXab7W1h0eR1dLFwP2wCIHgGpjNCaBbpsupqfDh7YAJkomLU0+AFhH0NK8RbMN:FXqcKeTk2oHPXWNmL0AFhHua
Yara None matched
VirusTotal Search for analysis
Name 17ae72f0045d4f69_101b941d020240259ca4912829b53995ad543df6
Submit file
Filepath C:\Python27\libs\101b941d020240259ca4912829b53995ad543df6
Size 653.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 e4e630d873aadc22e24ef20f61b222f6
SHA1 1090e0da4bc4d94c901e0eae5ab860480151b60b
SHA256 17ae72f0045d4f69d6b888ae1af99fdf6c20391c6ab0420c800c56b42d82919d
CRC32 722B629B
ssdeep 12:jTLJNLjhEsvZH5qpj30yjabTBc/p08JFf+f5vTevv8+vWHM/l2EI4:jn/Ljhj7ij33aZc/p0tftav5Ws/l+4
Yara None matched
VirusTotal Search for analysis
Name b8545e516aabe69f_wpC7TVl2rc.bat
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\wpC7TVl2rc.bat
Size 192.0B
Processes 1604 (Desktop.exe) 2840 (cmd.exe)
Type DOS batch file, ASCII text, with CRLF line terminators
MD5 f42b1e0621b7bc944aba147adf25025f
SHA1 84f68051609e712b0f4bfdc6fb5c1aff8b227ec3
SHA256 b8545e516aabe69f9e220f90d516c5aaacad084b27de8c6f6d2fd45583a7b9a4
CRC32 315C7FDA
ssdeep 3:mKDDVNGvTVLqFvEROrePmWxpcL4E2J5xAIkfn9mQRNCSB8bBktKcKZG1mWxpcL4Y:hCRLqFcROr2mQpcLJ23fkEQO/KOZG1mR
Yara None matched
VirusTotal Search for analysis
Name d96e651841734ad1_24dbde2999530ef5fd907494bc374d663924116c
Submit file
Filepath C:\Users\24dbde2999530ef5fd907494bc374d663924116c
Size 629.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 48836846688be9f6d934ccd722602760
SHA1 5fcc519905414c2c0350a9a3b84bf564b0edfd94
SHA256 d96e651841734ad19ec3043b9cab61d746934549b744cd7c1c6e5a6d50e490ed
CRC32 87995304
ssdeep 12:OCnLgLVgkCORw9YqXK7hxiI79kw/XiPlDOvXnFuWWMGJBTpH+ziVlPSAlYwdiK:BLgphC+w9YR7hL79ko6lCvXFZWRBleza
Yara None matched
VirusTotal Search for analysis
Name 305f7665750ce000_1173b9a28a9c103b586dae1ddec66bd944183bce
Submit file
Filepath C:\Python27\Scripts\1173b9a28a9c103b586dae1ddec66bd944183bce
Size 220.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with no line terminators
MD5 dcf93c6a8b6b61abace7537916886c4c
SHA1 227767c9ff9f8183a53b99be9c24b83fd06744df
SHA256 305f7665750ce0001703bf9020c524380396fca45b04b12af033b0fe0f90d255
CRC32 6A9853D2
ssdeep 3:5mdY23VXZXNZ4ZGJKcLNsjQDK5cnTnXyO9xU9n82hs5K91uzzTg1Qs38p/p9B4AM:i37bLxEfBhqKru3T2MpV4HLuvNlUoRRa
Yara None matched
VirusTotal Search for analysis
Name ff6e19eb0757ceec_088424020bedd6b28ac7fd22ee35dcd7322895ce
Submit file
Filepath C:\Windows\SysWOW64\PhotoScreensaver\088424020bedd6b28ac7fd22ee35dcd7322895ce
Size 979.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 91daef6653d682c6096c370a95320bc8
SHA1 4d5e60a5b4cc933187525fa11b729e4a9a857817
SHA256 ff6e19eb0757ceec5ae3203ef9a976143f2251af1c3edc59855622f871a27cba
CRC32 209B48C4
ssdeep 24:38gnlEhoYSmp/OwydbMnbW9/A8Djitie3KQ6V:3vlEhom/OwydbM2LjitRb+
Yara None matched
VirusTotal Search for analysis
Name 75f769403f49dfc5_b75386f1303e64d8139363b71e44ac16341adf4e
Submit file
Filepath C:\Windows\SysWOW64\NlsLexicons004c\b75386f1303e64d8139363b71e44ac16341adf4e
Size 78.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with no line terminators
MD5 8575a45141cd6da3e3ad9540e11d7520
SHA1 f3d9b75bb2b4611d7e3fd87683c7860e6e6881ae
SHA256 75f769403f49dfc5e1407970b06cdcfb0c32cbb114d1aa24db0023d03c8a08c1
CRC32 1B98BE91
ssdeep 3:F993b5EAW29mRk6NRr:xb53W5+6NN
Yara None matched
VirusTotal Search for analysis
Name 3ab850d582976fd9_winlogon.exe
Submit file
Filepath C:\PerfLogs\Admin\winlogon.exe
Size 3.6MB
Processes 1604 (Desktop.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f31199c1fccb1fe693824f89573e4194
SHA1 6e73fec1f0db28a7cde303a1bddf3f0d1fc26e1b
SHA256 3ab850d582976fd9c1bb14c1c50cffa66e9fd6e55fc27a704f01c45d1bc251dc
CRC32 271BA116
ssdeep 98304:GUFI1/p+td2Uf1u1xBKlhVr+4k0fBtkAV8JqhBnO/EuYVKPFswc:D6Uf1u1HKnVrTNBtkbqC8FKKwc
Yara
  • IsPE32 - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Is_DotNET_EXE - (no description)
  • themida_packer - themida packer
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 0c31dc6670b64ce7_886983d96e3d3e31032c679b2d4ea91b6c05afef
Submit file
Filepath C:\Windows\SysWOW64\nlsbres\886983d96e3d3e31032c679b2d4ea91b6c05afef
Size 794.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with very long lines, with no line terminators
MD5 471c190593035ea2b075384a5611fbeb
SHA1 1b06090b250adf9285615bb32ca05edb7e81daf9
SHA256 0c31dc6670b64ce7f14364493d73e9bea7167582e7513e3d67c78035f279b57c
CRC32 F5910F6C
ssdeep 24:Oa6hyVrHAM1vJxVnUD+8zf93J69y28+x3LClq:OaKy1HAMdJxVnENJ69vxmlq
Yara None matched
VirusTotal Search for analysis
Name e0ece8e1885fd13e_NNoOJB7QK2
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\NNoOJB7QK2
Size 25.0B
Processes 1604 (Desktop.exe)
Type ASCII text, with no line terminators
MD5 3ccc0c136c31bc1abf0a469afe0a3d82
SHA1 8253bef1284c5eecab04d5911381391d49f95665
SHA256 e0ece8e1885fd13e2c020622bbb57a07bd61852334bdfe7bb64d20fb0a4dd7b5
CRC32 D933DE1C
ssdeep 3:5h2:T2
Yara None matched
VirusTotal Search for analysis