Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	69da7d5256d2d7a1_ipfnqrtllxd.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\IpfNqRTlLxd.exe
Size	1.0MB
Processes	2528 (Gck~09837636373-0938763.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`69db6af19fd456554ef4972e27de4b47`
SHA1	`62b65deaac9913a6c0f5c1a67c274bd335251a09`
SHA256	`69da7d5256d2d7a139ffddef3eb8e7e23c2bb412183f9c6345772eff95113b6f`
CRC32	`2972CE39`
ssdeep	`12288:Ce1FRgFiAwPIlCu+NEBp59jvT4Pl4Nwd6NGS0dT1Ma:Ce1SRlXZp/4P9d6Nz0`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3086d914f6b23268_tmp14D4.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp14D4.tmp
Size	1.3KB
Processes	236 (RegSvcs.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`8cad1b41587ced0f1e74396794f31d58`
SHA1	`11054bf74fcf5e8e412768035e4dae43aa7b710f`
SHA256	`3086d914f6b23268f8a12cb1a05516cd5465c2577e1d1e449f1b45c8e5e8f83c`
CRC32	`49853FE8`
ssdeep	`24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mXxtn:cbk4oL600QydbQxIYODOLedq3ZXj`
Yara	None matched
VirusTotal	Search for analysis

Name	0abb6b5110ca897a_tmp1188.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp1188.tmp
Size	1.6KB
Processes	2528 (Gck~09837636373-0938763.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`2c559f25ee500336c947d00497ff9b52`
SHA1	`84a1812a690e0ba03700c5d6fe2496f04f8cf861`
SHA256	`0abb6b5110ca897af08bb547f10ab6fbc28c005fc3b29668de408506da2b89c8`
CRC32	`D4161634`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBENtn:cbhf7IlNQQ/rydbz9I3YODOLNdq3Wn`
Yara	None matched
VirusTotal	Search for analysis

Name	d46e34924067eb07_task.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\task.dat
Size	57.0B
Processes	236 (RegSvcs.exe)
Type	ASCII text, with no line terminators
MD5	`08e799e8e9b4fda648f2500a40a11933`
SHA1	`ac76b5e20ded247803448a2f586731ed7d84b9f3`
SHA256	`d46e34924067eb071d1f031c0bc015f4b711edce64d8ae00f24f29e73ecb71db`
CRC32	`EEF8DB45`
ssdeep	`3:oMty8WddSWA1KMNn:oMLW6WA1j`
Yara	None matched
VirusTotal	Search for analysis

Name	1cbad6ed142a90c4_run.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size	8.0B
Processes	236 (RegSvcs.exe)
Type	data
MD5	`d8ef4eef143c09ccbaca11a4c81bac0e`
SHA1	`e2ac5ddcfede3d934ac0312d0e76e292c3a74b7b`
SHA256	`1cbad6ed142a90c4c843d57d8fc59536d3140dfaf5e1bc2633437ff97693c76c`
CRC32	`5D044B63`
ssdeep	`3:WR8:E8`
Yara	None matched
VirusTotal	Search for analysis

Name	bb9181b3935b8681_tmp15BF.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp15BF.tmp
Size	1.3KB
Processes	236 (RegSvcs.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`be81f72fa4dbc827132836ee2af92c96`
SHA1	`fe5ded04ab4932dea6cf414e9e4428f43da70d03`
SHA256	`bb9181b3935b8681a71b578f8166883e61380de6181df82d05f14829323fbf0f`
CRC32	`7AA438E3`
ssdeep	`24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0Rb5xtn:cbk4oL600QydbQxIYODOLedq3Sb5j`
Yara	None matched
VirusTotal	Search for analysis