Dropped Files | ZeroBOX

Name	f066e78d891e3694_tmpEAC6.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmpEAC6.tmp
Size	1.6KB
Processes	1468 (s68r0hZ49vns9tk.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`25067bb3fdcf0ed22321b673a3cf6e14`
SHA1	`b0ee19a0f577744e0d3c310c32655f4723e1527e`
SHA256	`f066e78d891e3694d227298c33311e24203598b11bef6dce5ff8d6e850fe6fe2`
CRC32	`B40E24FD`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBotn:cbhf7IlNQQ/rydbz9I3YODOLNdq3g`
Yara	None matched
VirusTotal	Search for analysis

Name	48899f3f038a01c3_jrmucabt.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\JRmUcaBt.exe
Size	1015.5KB
Processes	1468 (s68r0hZ49vns9tk.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`081bff782d62aebc69b61009e6000ab8`
SHA1	`239816564ee5dc51ac037ae8a56a4c01de482057`
SHA256	`48899f3f038a01c3dcf2d263e0232ccc3c44fff9635165f894d7da232e625bf1`
CRC32	`8393658B`
ssdeep	`24576:mi82oLAKjjo4FLJfatx1A35OObeu5uFM7+U5j3N/:mvjZF1cxy0Obv5uFXUR9/`
Yara	Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis