Dropped Files | ZeroBOX

Name	5a219a59dddfc7f0_svchost64.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\svchost64.exe
Size	138.0KB
Processes	2332 (crock.exe) 1556 (cmd.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`dcb4b25c427f6f177b2548b4607a2bc0`
SHA1	`e9cff09a5b701d029e700b2a1d94827d2b193f68`
SHA256	`5a219a59dddfc7f04727b3ce435a70c7be99452e8ebc43fe51821b23db8c9e05`
CRC32	`46851033`
ssdeep	`3072:AbHyPHtP7wl8oVHybxto2TCU+lsWtkyGXgpsJoJxaFmSBLAB4yU:ADylP7wl8mSbno2TCU+lsWtkyGXgHxag`
Yara	Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
VirusTotal	Search for analysis

Name	f4d28cf0f12006f9_590aee7bdd69b59b.customDestinations-ms~RF21c19bf.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF21c19bf.TMP
Size	7.8KB
Processes	1204 (powershell.exe) 1868 (powershell.exe)
Type	data
MD5	`b770148dd160455bac8fe186a882733d`
SHA1	`f41e6e10cf42b4aa831f43abfb27c031bf0f3d4a`
SHA256	`f4d28cf0f12006f93de9b6181d36369c8d85b6021f830ea407d76585cbda8b1e`
CRC32	`94B533F7`
ssdeep	`96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCwor3tDHXyGlUVul:Etu6XoJtu6bHnordTyY`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis