Dropped Files | ZeroBOX

Name	b3d510ef04275ca8_holderwb.txt Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\holderwb.txt
Size	2.0B
Processes	2840 (vbc.exe) 1148 (nwaba.exe)
Type	Little-endian UTF-16 Unicode text, with no line terminators
MD5	`f3b25701fe362ec84616a93a45ce9998`
SHA1	`d62636d8caec13f04e28442a0a6fa1afeb024bbb`
SHA256	`b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209`
CRC32	`88F83096`
ssdeep	`3:Qn:Qn`
Yara	None matched
VirusTotal	Search for analysis

Name	a51eb251f696457a_holdermail.txt Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\holdermail.txt
Size	435.0B
Processes	2408 (vbc.exe) 1148 (nwaba.exe)
Type	ASCII text, with CRLF line terminators
MD5	`453a6b7949477c770a13cfa7e6bcbb6f`
SHA1	`387ae697aff4261e610c8a47182c430b4f5e4d5a`
SHA256	`a51eb251f696457a0ea5efa1291069f2857a5209a1434b42b1c31959fb015564`
CRC32	`4BB1D58F`
ssdeep	`6:QAXvqKwHNx7hzIRMCADAwzRZvSAmY/SPIFvBnDWncnDWAwb:Qqwz5UMCADzRAGaetyngyAwb`
Yara	None matched
VirusTotal	Search for analysis

Name	bd2db000659ef6ce_pidloc.txt Submit file
Filepath	C:\Users\test22\AppData\Roaming\pidloc.txt
Size	44.0B
Processes	1148 (nwaba.exe)
Type	ASCII text, with no line terminators
MD5	`ff05be37b35098c84b15313416ce5112`
SHA1	`5c161ca1c01124fdafbb91adb1b328921cddbb28`
SHA256	`bd2db000659ef6ce05e35ddfda25151a72be5b96af0752f230ebc11213984f5d`
CRC32	`BCDAB4E9`
ssdeep	`3:oNmWxpcL4E2J5xAIXEJn:oNmQpcLJ23fXWn`
Yara	None matched
VirusTotal	Search for analysis

Name	542cacae1d41132a_pid.txt Submit file
Filepath	C:\Users\test22\AppData\Roaming\pid.txt
Size	4.0B
Processes	1148 (nwaba.exe)
Type	ASCII text, with no line terminators
MD5	`df0aab058ce179e4f7ab135ed4e641a9`
SHA1	`3c457ce18c2e37a4437e0201076ad638367ef0ea`
SHA256	`542cacae1d41132ac9e10320dc19210336f60ee3b2d5bb64838eff7556132823`
CRC32	`DF528416`
ssdeep	`3:N7n:Bn`
Yara	None matched
VirusTotal	Search for analysis