Dropped Files | ZeroBOX

Name	9e6e4772050998a5_readme.txt Submit file
Filepath	C:\Users\test22\Desktop\readme.txt
Size	10.0B
Processes	2816 (Runtime Broker.exe)
Type	ASCII text, with no line terminators
MD5	`eb6b6c90251ab33cee784713c451e6d8`
SHA1	`451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5`
SHA256	`9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6`
CRC32	`22598B08`
ssdeep	`3:IS:7`
Yara	None matched
VirusTotal	Search for analysis

Name	a75ae4b200b84abe_runtime broker.exe Submit file
Filepath	C:\ProgramData\KMSAuto\Runtime Broker.exe
Size	128.0MB
Processes	2552 (CL.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9990adb4e9f33a6bc4dd9302c0fae38d`
SHA1	`6e99125913d3817d37c38f525f9db6cbd082c19d`
SHA256	`ce8f28e25c8d0c0947b9645d3a2009b10d34237c6e0df9da1fd9f1c378150c1a`
CRC32	`88E9707C`
ssdeep	`3145728:uSwCI/PMDFwgHvpLwom3IN835PNjL9JeRzCL/rHB+S6x:DwCIsRwEeLtJBBENCnHh6x`
Yara	UPX_Zero - UPX packed file NPKI_Zero - File included NPKI OS_Processor_Check_Zero - OS Processor Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	59aa5b7633387b35_CL.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\CL.exe
Size	615.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ed2a38021d3dcadca60d08163d1c7a31`
SHA1	`26b00f6ca1f4cfdc4b1aa5b72705953e31a6e639`
SHA256	`59aa5b7633387b351452b7f03f39083a79912e00098b51b7ac060b31df3572eb`
CRC32	`ACC00CE8`
ssdeep	`12288:Ho2QRXDD1yed0fsU4GSWgOvPESGj4s32xEdRCSTNjAZi96VG6wl:Ho2Q9NXw2/wPOjdGxYjpDEVU`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) IsPE32 - (no description) PE_Header_Zero - PE File Signature
VirusTotal	Search for analysis

Name	1c949f539d7707bb_tmp3DB0.tmp.bat Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp3DB0.tmp.bat
Size	156.0B
Processes	2552 (CL.exe) 2864 (cmd.exe)
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`69722b44cfb4ba8dfc1b006f4834fa6c`
SHA1	`5e9aa801d18fb843919753b4db5eef64b26dd087`
SHA256	`1c949f539d7707bb06f85643f00ebe5c0cc4e92cf76a5b28083453895afdfee3`
CRC32	`D5B1AAAE`
ssdeep	`3:mKDDCMNuwGv3DmWxpcL4E2J5xAIJmad9DwU1hGDmWxpcL4E2J5xAInTRI8xwZPy:hWKuZLmQpcLJ23fJmW9DNemQpcLJ23fr`
Yara	None matched
VirusTotal	Search for analysis