Dropped Files | ZeroBOX

Name	60de5bef1efff151_notepad.js Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\notepad.js
Size	17.8KB
Processes	2736 (powershell.exe)
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`b2c47a2918eef35baf623e2e42c5b694`
SHA1	`453a9aae4458b0bef7d6d8d04418b6ca20b9b647`
SHA256	`60de5bef1efff151b9db261a3dd6a9d36ac722d9ed1cd099530a20ec8a6025bb`
CRC32	`D5DF01D1`
ssdeep	`96:VjLsUsZI+PMAm3g2NeH2Fyev29dop0YGr38MRfIsaBlxXa5SXfMIMXD0Y5SXfC7G:tVN+05g2NE2zApW`
Yara	None matched
VirusTotal	Search for analysis

Name	a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF193f62f.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF193f62f.TMP
Size	7.8KB
Processes	2736 (powershell.exe) 2180 (powershell.exe)
Type	data
MD5	`b0c9ff441742f3847ea27da9dee7f2cd`
SHA1	`c42a1eb32ba953a0ce5d8635caabf71b5b281495`
SHA256	`a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4`
CRC32	`0BBCAB1A`
ssdeep	`96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	5295544f63ac91e1_logs.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\remcos\logs.dat
Size	148.0B
Processes	212 (notepad.exe)
Type	data
MD5	`6f2ea8512762e53b3ea8e78ed32fc752`
SHA1	`580d1dfd1be280ebed9368102c310892489164ae`
SHA256	`5295544f63ac91e1923bc87e5eafe0d2b10361918e26e96380eed7850261a192`
CRC32	`86938871`
ssdeep	`3:rklKlSlPfUlTlNNfQCl55JWRal2Jl+7R0DAlBG4LNQblovDl9il:IlK4lHUlpNNICl55YcIeeDAlybW/G`
Yara	None matched
VirusTotal	Search for analysis