Dropped Files | ZeroBOX

Name	22e55a154209025c_gshqii.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\gsHQIi.exe
Size	629.0KB
Processes	1896 (ac.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`077acaba7ab3d2fd714034725a01aad8`
SHA1	`db00a0ac662d0e51b5d6cd6a501d05d2bd88e53d`
SHA256	`22e55a154209025c55a6a4683572f1e90808bf49ba5c22ba96d32aabb6ac3e7d`
CRC32	`8A3C0B16`
ssdeep	`12288:+WKQ+m/5AWKLrL2uSeewwrXf5tl03WhSOTracDYFSGpFE:X5LK4eeXLgWgOqcDYFSGpF`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	947cfd5b4557d786_tmpE48C.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmpE48C.tmp
Size	1.6KB
Processes	1896 (ac.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`b89d68d8af3e8d1f45898b0aa1ea5f3c`
SHA1	`8864f3a4000d09ddfd3110de2bb02b75043fe787`
SHA256	`947cfd5b4557d7862e2a85381d713886b2257a3e477739750acf2cc28a4806f6`
CRC32	`9D90D3B8`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBttn:cbhf7IlNQQ/rydbz9I3YODOLNdq3B`
Yara	None matched
VirusTotal	Search for analysis