Dropped Files | ZeroBOX

Name	f825dd89181e7435_d93f411851d7c929.customDestinations-ms~RF2006d84.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2006d84.TMP
Size	7.8KB
Processes	2600 (powershell.exe) 3684 (powershell.exe)
Type	data
MD5	`61d3b003e73f968491bb9de05318fcbd`
SHA1	`abb40732bf72a072c5b176449fdb8f1c56383e03`
SHA256	`f825dd89181e743525684aff8d99cc6d78046e461147c33b6f7a182b98c58ea9`
CRC32	`76116DE9`
ssdeep	`96:wtuCiGCPDXBqvsqvJCwoNtuCiGCPDXBqvsEHyqvJCworc7HwxGlUVul:wt7XoNt7bHnorXxY`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis

Name	9a29420db5ee554b_run.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size	8.0B
Processes	4168 (Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe)
Type	data
MD5	`48c836db2faaed0988f77064aad45029`
SHA1	`2bbc41c2776c61e6fb8b655ef92aee41c1e591a3`
SHA256	`9a29420db5ee554b2d6e3433180690f4c87b2bc184674cd1707fea4961197d1a`
CRC32	`B4BA2BAF`
ssdeep	`3:8:8`
Yara	None matched
VirusTotal	Search for analysis

Name	5a21fb94dbde265d_tmpC216.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmpC216.tmp
Size	1.6KB
Processes	8212 (Purchase ORDER For Corugated sheet 675432098 Purchase ORDER DOCUMENT.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`36c6bf1d6a693cc9650b8c56bdfa06d7`
SHA1	`583ae9d0f305ae0943a554023c6c0d0a6706570e`
SHA256	`5a21fb94dbde265dab5baa95434c0aee9feeb84d4da0ba949fd060efe6e7f84e`
CRC32	`C0223647`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBZNtn:cbhf7IlNQQ/rydbz9I3YODOLNdq3L`
Yara	None matched
VirusTotal	Search for analysis