Dropped Files | ZeroBOX

Name	37b54a4ff04cd7aa_tmp7E0D.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp7E0D.tmp
Size	1.6KB
Processes	4244 (wmin.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`243709cc365c3b201a91628897fc6b40`
SHA1	`99ecf75ca0e6ac77f4f22eb5e514a66b12d5b489`
SHA256	`37b54a4ff04cd7aaf038011a3af71940b4c583c4c4ad2f1f09d50f745c875a2a`
CRC32	`B6B1D0F7`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBj1tn:cbhf7IlNQQ/rydbz9I3YODOLNdq3V`
Yara	None matched
VirusTotal	Search for analysis

Name	d0af68df07b9f56b_eoajyvzzhqirs.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\eoAjYVzzhqirs.exe
Size	652.0KB
Processes	4244 (wmin.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`806ba19af21c27492a4e92e38d64c634`
SHA1	`b162b6e426d0342b8aa61e68b2021c22aa7f1975`
SHA256	`d0af68df07b9f56b092301f3a4cc7d3465ec03bd79943a2cc07e72eefe1c8d21`
CRC32	`2C4CBBF9`
ssdeep	`12288:lGI4Rqeue+FxWK3GQmXIH1W0LFsbV8Ffvx7O47OBT1qwAT9aTo:lGIkue+FxWK3GAH1LpFfNOi8TzAT9aU`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasDebugData - DebugData Check Win32_Trojan_PWS_Azorult_Net_1_Zero - Win32 Trojan PWS .NET Azorult Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis