Dropped Files | ZeroBOX

Name	1bf556b80e71392f_logs.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\remcos\logs.dat
Size	572.0B
Processes	928 (RegAsm.exe)
Type	data
MD5	`a239836a516c602e9c4d6d2dfd879109`
SHA1	`aaaf901ea1572f2a0610a1be024cccb88a68803d`
SHA256	`1bf556b80e71392ffbd144afd10ffda22452ca6054e1e16b57940e2800607a38`
CRC32	`884E8624`
ssdeep	`12:IgIO4GDTUFL1UAUqGOQHqcWTVTLalAVw8D9FB9HMMB2rUU+1OoB0xLs:N4GDTo1UJqGOQKcoslAVw85FBX2wn6w`
Yara	None matched
VirusTotal	Search for analysis

Name	1f4ef936a54196c9_index.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Size	32.0KB
Type	Internet Explorer cache file version Ver 5.2
MD5	`a644f1eb0bb3bb9f46c85d5823341c9f`
SHA1	`c801227b1d336ab413d84a07189cf952a40fec48`
SHA256	`1f4ef936a54196c96bfaf23ad9107be05955bbc75d09bc24fc7d16ddd911e076`
CRC32	`F0E431F1`
ssdeep	`48:qAEEVULVln0btBfyEV2tWSlphRRwkPAMyaz4I0GNVVN:qAEEVIVlnc2H5KqBv4I00`
Yara	None matched
VirusTotal	Search for analysis

Name	49c4a85bce2fb8cb_d93f411851d7c929.customDestinations-ms~RF1adb80e.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1adb80e.TMP
Size	7.8KB
Processes	1612 (powershell.exe) 236 (powershell.exe)
Type	data
MD5	`4eba3b6a4f05a26106a2d772c79da044`
SHA1	`45ae375ea2f305e4409aabc22803cd1471f0983e`
SHA256	`49c4a85bce2fb8cb6db4279591d0966cbd2fb84bc43f252ee5ad14d3d615b2b5`
CRC32	`2DF7F691`
ssdeep	`96:YtuCaGCPDXBqvsqvJCwo9tuCaGCPDXBqvsEHyqvJCworM7HwxWlUVul:YtzXo9tzbHnornxo`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis