Dropped Files | ZeroBOX

Name	0035ffad3137230e_tmp7598.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp7598.tmp
Size	1.6KB
Processes	204 (REVISED CONTRACT.exe)
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`69f7106a255b46b8df0b83e2d10c8db1`
SHA1	`9af2bf2519dd3cfa290d1adfd05a4c71a86a7d54`
SHA256	`0035ffad3137230e53782d4f58a137aa9af076333c8f40ae24b985bf400fbac7`
CRC32	`4548C869`
ssdeep	`24:2dH4+SEqCH/7IlNMFQ/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBwyU7QItn:cbhf7IlNQQ/rydbz9I3YODOLNdq3O0u`
Yara	None matched
VirusTotal	Search for analysis

Name	043b6ec54651c475_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	2540 (powershell.exe)
Type	data
MD5	`a0fc8d4a2cf5a30130abeb6712fc7885`
SHA1	`b403b5b84863e5a3177175138c83ffb567b40e79`
SHA256	`043b6ec54651c475994d2865254b1b30862a2f3bd32593661c043fd2f48f9c7e`
CRC32	`449D5C65`
ssdeep	`96:ktuC+GCPDXBqvsqvJCwo5tuC+GCPDXBqvsEHyqvJCwor07HwxWlUVul:ktvXo5tvbHnorvxo`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	a1eb671b9c656702_run.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size	8.0B
Processes	2560 (REVISED CONTRACT.exe)
Type	Non-ISO extended-ASCII text, with no line terminators
MD5	`df9b1d6a0e3c120df87aac97d062bf45`
SHA1	`892f8f212fccdea25372d98b85e3ad8c5105e8ff`
SHA256	`a1eb671b9c6567026c0f303e9a4cf03d5e3adde42154696ba0f0401c63453dc4`
CRC32	`82CE2D83`
ssdeep	`3:Py:6`
Yara	None matched
VirusTotal	Search for analysis