Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	3086d914f6b23268_tmp13BB.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp13BB.tmp
Size	1.3KB
Processes	276 (RegSvcs.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`8cad1b41587ced0f1e74396794f31d58`
SHA1	`11054bf74fcf5e8e412768035e4dae43aa7b710f`
SHA256	`3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c`
CRC32	`49853FE8`
ssdeep	`24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mXxtn:cbk4oL600QydbQxIYODOLedq3ZXj`
Yara	None matched
VirusTotal	Search for analysis

Name	af0fcadd78486f49_udogcsmoe.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\UdoGcsmOe.exe
Size	1.4MB
Processes	544 (BTRU_0498763892I3HJ.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`6c095aa22ec999e590500d62c00cdcc2`
SHA1	`e8d031fb9e54602461348b5e572e398423dc85c5`
SHA256	`af0fcadd78486f49ae8f3dca872f0b7d29d8d79c1fe6a996f8a684f2df7f30a3`
CRC32	`EF8BEEA7`
ssdeep	`12288:m8L5wG6mWXZjCB8rwIKBMvtmoU8SfT2z3UL4UaawNz91Enk4:m8L55SXxhpiMl9SL2LUE1a80/`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	d46e34924067eb07_task.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\task.dat
Size	57.0B
Processes	276 (RegSvcs.exe)
Type	ASCII text, with no line terminators
MD5	`08e799e8e9b4fda648f2500a40a11933`
SHA1	`ac76b5e20ded247803448a2f586731ed7d84b9f3`
SHA256	`d46e34924067eb071d1f031c0bc015f4b711edce64d8ae00f24f29e73ecb71db`
CRC32	`EEF8DB45`
ssdeep	`3:oMty8WddSWA1KMNn:oMLW6WA1j`
Yara	None matched
VirusTotal	Search for analysis

Name	fad072431971555d_run.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size	8.0B
Processes	276 (RegSvcs.exe)
Type	Non-ISO extended-ASCII text, with no line terminators
MD5	`9f16f0891ba79e3a8d55da2b2cd62e42`
SHA1	`183d48bec16bbad3ec932fd87198d07f6aab6d37`
SHA256	`fad072431971555df20c9326c3fb2ff93c039214feba09cd0339fbb6fe488adb`
CRC32	`73F0F47B`
ssdeep	`3:H2Vn:q`
Yara	None matched
VirusTotal	Search for analysis

Name	bb9181b3935b8681_tmp1477.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp1477.tmp
Size	1.3KB
Processes	276 (RegSvcs.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`be81f72fa4dbc827132836ee2af92c96`
SHA1	`fe5ded04ab4932dea6cf414e9e4428f43da70d03`
SHA256	`bb9181b3935b8681a71b578f8166883e61380de6181df82d05f14829323fbf0f`
CRC32	`7AA438E3`
ssdeep	`24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0Rb5xtn:cbk4oL600QydbQxIYODOLedq3Sb5j`
Yara	None matched
VirusTotal	Search for analysis

Name	efbd3e70f8eb2388_tmp106F.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp106F.tmp
Size	1.6KB
Processes	544 (BTRU_0498763892I3HJ.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`5d013a5c293752d327e85a60484a5764`
SHA1	`57f9f5eaaeb7ead9b7f898599ab11e84850bd6e2`
SHA256	`efbd3e70f8eb23888fbdb785834e8063ff25d24b79b6bab39ff47427eb117eb0`
CRC32	`8EF825E5`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBmtn:cbhf7IlNQQ/rydbz9I3YODOLNdq3q`
Yara	None matched
VirusTotal	Search for analysis