Dropped Files | ZeroBOX

Name	acda5e5d08cd8a26_tmp31F3.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp31F3.tmp
Size	1.6KB
Processes	2060 (plain.txt)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`1282279c24d1aba07aa5977ca32f2615`
SHA1	`4a1f91a538cc563a5c0ac8855f53703519f0b1f0`
SHA256	`acda5e5d08cd8a261dc82a4ccde062cca5ea32874a89429930f6c3515cf3d79c`
CRC32	`CBAAAB5C`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBctn:cbhf7IlNQQ/rydbz9I3YODOLNdq38`
Yara	None matched
VirusTotal	Search for analysis

Name	ea5c46c989d46367_d93f411851d7c929.customDestinations-ms~RF1cbf98a.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1cbf98a.TMP
Size	7.8KB
Processes	2788 (powershell.exe) 2996 (powershell.exe)
Type	data
MD5	`faed47fd8f345d57eccff8b99d3f21fa`
SHA1	`2bb129fe2938e8cfb49b29e00b4e426cc4682ced`
SHA256	`ea5c46c989d463676db524b6f528ec8db44629be6bb801b8c54e487754f11102`
CRC32	`5EB47B78`
ssdeep	`96:YtuCuGCPDXBqvsqvJCwo9tuCuGCPDXBqvsEHyqvJCworo7HwxWlUVul:YtPXo9tPbHnorTxo`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis

Name	ea5c46c989d46367_d93f411851d7c929.customDestinations-ms~RF1cbf98b.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1cbf98b.TMP
Size	7.8KB
Processes	2996 (powershell.exe) 2848 (powershell.exe)
Type	data
MD5	`faed47fd8f345d57eccff8b99d3f21fa`
SHA1	`2bb129fe2938e8cfb49b29e00b4e426cc4682ced`
SHA256	`ea5c46c989d463676db524b6f528ec8db44629be6bb801b8c54e487754f11102`
CRC32	`5EB47B78`
ssdeep	`96:YtuCuGCPDXBqvsqvJCwo9tuCuGCPDXBqvsEHyqvJCworo7HwxWlUVul:YtPXo9tPbHnorTxo`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis