Dropped Files | ZeroBOX

Name	e3b0c44298fc1c14___tmp_rar_sfx_access_check_13261093 Empty file or file not found
Filepath	C:\Windows\Temp\__tmp_rar_sfx_access_check_13261093
Size	0.0B
Type	empty
MD5	`d41d8cd98f00b204e9800998ecf8427e`
SHA1	`da39a3ee5e6b4b0d3255bfef95601890afd80709`
SHA256	`e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
CRC32	`00000000`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	fcdab9639af874cb_2.exe Submit file
Filepath	C:\Windows\Temp\2.exe
Size	435.5KB
Processes	2568 (66e9c0921c144_111.exe#111)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`1f3cfcf8aad3e5e3164405d272aa213e`
SHA1	`96f1c646d19deab4ff071fbc6b3c73c87ce56e49`
SHA256	`fcdab9639af874cba780e20c21a9bc662b160dc313ddb75e5f82f779f1680101`
CRC32	`CD3F5CE7`
ssdeep	`6144:MDKW1Lgbdl0TBBvjc/2LBslU004yXs9bh1O5us/tkGGIpn4x3tp8:ah1Lk70Tnvjc+q07XsnI52n8`
Yara	Malicious_Library_Zero - Malicious_Library MALWARE_Win_VT_RedLine - Detects RedLine infostealer PE_Header_Zero - PE File Signature UltraVNC_Zero - UltraVNC IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis

Name	f3327793e3fd1f3f_TmpF491.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\TmpF491.tmp
Size	2.6KB
Processes	2820 (2.exe)
Type	data
MD5	`1420d30f964eac2c85b2ccfe968eebce`
SHA1	`bdf9a6876578a3e38079c4f8cf5d6c79687ad750`
SHA256	`f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9`
CRC32	`24D8A5AF`
ssdeep	`48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g`
Yara	None matched
VirusTotal	Search for analysis

Name	5669998000fdc457_1.exe Submit file
Filepath	C:\Windows\Temp\1.exe
Size	323.4KB
Processes	2568 (66e9c0921c144_111.exe#111)
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a0c6989730b44ee30722feccd86d946b`
SHA1	`4ef62e701352c7dfdf0807460dc4bb3c22be67f0`
SHA256	`5669998000fdc457a919dea600b100809d0bb5681cbca6a67b544307233b5915`
CRC32	`8644EDBB`
ssdeep	`6144:KF0iDT0uzcvXjGQfp1Shf0J4eKC+2Lojfckt6QLniqtBZ2AWwZB24kAscHjs34ha:KF0iPDcffXLqdtpLiqtBZ2AdLdkAssjA`
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis