Dropped Files | ZeroBOX

Name	29ae7b30ed8394c5_AdvancedRun.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\AdvancedRun.exe
Size	88.9KB
Processes	2444 (app.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`17fc12902f4769af3a9271eb4e2dacce`
SHA1	`9a4a1581cc3971579574f837e110f3bd6d529dab`
SHA256	`29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b`
CRC32	`CC276C7F`
ssdeep	`1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis

Name	051c25533196c3f2_590aee7bdd69b59b.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size	7.8KB
Processes	1448 (powershell.exe)
Type	data
MD5	`d79807ed8729967b4091b9e368528c68`
SHA1	`50fdbe50c113c10ab297c263af02d74b695e6cf8`
SHA256	`051c25533196c3f287d9aa9da48831edfb819c5a6f1528a4ba5f9245e55f1c94`
CRC32	`2C990062`
ssdeep	`96:IhtuCKGCPDXBqvsqvJCwoThtuCKGCPDXBqvsEHyqvJCworXtDHXyOlUVul:IhtzXoThtzbHnor9TyA`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis

Name	2be3eeb1671cf621__ilhfpjcnwnajcrpxnvjafck.vbs Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\_Ilhfpjcnwnajcrpxnvjafck.vbs
Size	184.0B
Processes	2444 (app.exe)
Type	ASCII text, with no line terminators
MD5	`b156f8da176c57fe4c548158a8d13893`
SHA1	`40328089f3c43ee8ae7c8194169e35aab1de9c11`
SHA256	`2be3eeb1671cf6217e80d3d00d4271b4a5894c96b8714441c960c02e0756b9e6`
CRC32	`AD3AD8F0`
ssdeep	`3:FER/n0eFHgSSJJF2uV1HeGAFddGeWLCXknRAumWxpcL4EaKC5SufyM1K/RFofD6t:FER/lFHsCu/eGgdEYmRAumQpcLJaZ5S3`
Yara	None matched
VirusTotal	Search for analysis