Dropped Files | ZeroBOX

Name	3392e8f472861d46_svchost64.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\svchost64.exe
Size	2.0MB
Processes	2100 (msedge.exe) 2380 (cmd.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`3a1e08a64cbc57ad9a3325c97085a4be`
SHA1	`797a543b54519bfd13926df594775f1113e71815`
SHA256	`3392e8f472861d46d0a80ab62ac0190fffc3f993c6482721009b8c57194d298c`
CRC32	`870A4DB1`
ssdeep	`49152:L1DMUM8Ev94cTnjG/OOOSD8sp3XI5L4BAjEkq+qxSPr/jU9y:CXbpTnq/iSfR42EEyL3m`
Yara	PE_Header_Zero - PE File Signature IsPE64 - (no description) Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Malicious_Packer_Zero - Malicious Packer
VirusTotal	Search for analysis

Name	9d3d13c55b2614c0_590aee7bdd69b59b.customDestinations-ms~RF19c0b27.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF19c0b27.TMP
Size	7.8KB
Processes	2880 (powershell.exe) 2404 (powershell.exe)
Type	data
MD5	`3eb6fb80f9dbbc1201de9e762252141b`
SHA1	`c6d1e6ea5f2fef6f4458695b8ed7586aed429f1c`
SHA256	`9d3d13c55b2614c0615acea119139123b2a29f2a0daded7edd5146e4614a78e6`
CRC32	`23B7285A`
ssdeep	`96:YtuCaGCPDXBqvsqvJCwo9tuCaGCPDXBqvsEHyqvJCwor/tDHXyWlUVul:YtzXo9tzbHnorlTyo`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis