Dropped Files | ZeroBOX

Name	6ec867dc1caa77ec_Gmfh.po.tmp Submit file
Filepath	C:\Users\test22\AppData\Roaming\Gmfh.po.tmp
Size	18.0KB
Type	SQLite 3.x database, last written using SQLite version 3021000
MD5	`f3a100cba30b2a07a7af8886e439024e`
SHA1	`a454cca0db028b4d0fb29fa932c9056519efe2cf`
SHA256	`6ec867dc1caa77ecfd8e457d464b6bebc3be8694b4c88734fa83d197c0b214cc`
CRC32	`72CF6AF8`
ssdeep	`24:LLI10KL7G0TMJHUyyJtmCm0XKY6lOKQAE9V8MffD4fOzeCmly6Uwc6KaW:oz+JH3yJUheCVE9V8MX0PFlNU1faW`
Yara	None matched
VirusTotal	Search for analysis

Name	409186d21c7ed0ea_EpvIIqv.tmp Submit file
Filepath	C:\Users\test22\AppData\Roaming\EpvIIqv.tmp
Size	173.9KB
Type	ASCII text, with very long lines, with no line terminators
MD5	`28a533942aab6fb3d66f76caa867618e`
SHA1	`f98da69b7345fcbaaaa1fc0c62fa7cf7493a0cf6`
SHA256	`409186d21c7ed0ea21b6f598ba3f9f3ba2a8f078c94ce03b14cf5ab77a769ef1`
CRC32	`DE8D906C`
ssdeep	`3072:kG4h+sTIVZfS/7BmpH+753klu9kOblyiq6heT67fAA7pdcM:HOliZfrp+SYemrA0`
Yara	NPKI_Zero - File included NPKI
VirusTotal	Search for analysis

Name	5e9dfc573b259ab2_d93f411851d7c929.customDestinations-ms~RF19b467f.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19b467f.TMP
Size	7.8KB
Processes	2256 (powershell.exe) 2324 (powershell.exe)
Type	data
MD5	`acd520c239a93bd377c9fc6c2ca2f9b3`
SHA1	`1a73fda5fe76b5b67d4e6bc5cbe230137c5f4430`
SHA256	`5e9dfc573b259ab20496e34c95f5cea18b070f4bf4073ffa1672b541463137c6`
CRC32	`A3AB8525`
ssdeep	`96:wtuCojGCPDXBqvsqvJCwoltuCojGCPDXBqvsEHyqvJCworc7HwxGlUVul:wtu6Xoltu6bHnorXxY`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis