Dropped Files | ZeroBOX

Name	f217f121bc0efa7b_tmpF929.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmpF929.tmp
Size	1.6KB
Processes	1768 (vbc.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`049c0320dfda28b61d34fdd722a74216`
SHA1	`12be80124afe25bcea9e89430bb6dd5b679ec31c`
SHA256	`f217f121bc0efa7b171cf61475fdb5e7246b0389752a396ba890bf6169efa137`
CRC32	`0AB87802`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBEJ1tn:cbhf7IlNQQ/rydbz9I3YODOLNdq3w`
Yara	None matched
VirusTotal	Search for analysis

Name	f4d28cf0f12006f9_590aee7bdd69b59b.customDestinations-ms~RF2db616.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2db616.TMP
Size	7.8KB
Processes	2044 (powershell.exe) 2952 (powershell.exe)
Type	data
MD5	`b770148dd160455bac8fe186a882733d`
SHA1	`f41e6e10cf42b4aa831f43abfb27c031bf0f3d4a`
SHA256	`f4d28cf0f12006f93de9b6181d36369c8d85b6021f830ea407d76585cbda8b1e`
CRC32	`94B533F7`
ssdeep	`96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCwor3tDHXyGlUVul:Etu6XoJtu6bHnordTyY`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	aaf15c974c8b1f11_vbc.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\vbc.exe
Size	786.5KB
Processes	2044 (powershell.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`1a3c74ff1002eb5d8121bedd3f5d3e9d`
SHA1	`965306a4bec6c97f6bc4d58da8a620255d4e9bd5`
SHA256	`aaf15c974c8b1f11afe1573018e944f1d63580ba3f5c145a310c025ddf0528b9`
CRC32	`1D221EF2`
ssdeep	`12288:ffh/V13hql0cDWx1mog97NBnzkBP2GmYzC0sRe+PuXmyFUBWFiE9Pw8BsGUdfkma:Lql0oyoLDIzkVPuXr9iE1w8sRnc9s`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
VirusTotal	Search for analysis