Dropped Files | ZeroBOX

Name	ed6cec5e106abc56_tmp50BB.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmp50BB.tmp
Size	1.5KB
Processes	2316 (Order Sheet.exe)
Type	XML 1.0 document, ASCII text
MD5	`f002013092e70314adecbdcb2158c46d`
SHA1	`d0fb7c42d0d61eda8d3dd593297669bc4115f19f`
SHA256	`ed6cec5e106abc563bb523ae04516c40bce18f5ba0ad3518676d419847375afc`
CRC32	`17D92D8B`
ssdeep	`24:2di4+S2qhH/1ny1mEUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtKxvn:cgefAYrFdOFzOzN33ODOiDdKrsuTev`
Yara	None matched
VirusTotal	Search for analysis

Name	883730603d691d94_run.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\017BD04F-B3BF-45B6-8167-9E8F41FF87BF\run.dat
Size	8.0B
Processes	2980 (Order Sheet.exe)
Type	data
MD5	`b471c6c2bdd809c7f3c58aebd2cec17a`
SHA1	`981be0b6543937ab3831b936dc729dbf0983398d`
SHA256	`883730603d691d94803dec27639fb969836481d9f8ebf7037db0cc6cfb2a97a8`
CRC32	`36F067BE`
ssdeep	`3:nM:M`
Yara	None matched
VirusTotal	Search for analysis

Name	a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF93cf1c.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF93cf1c.TMP
Size	7.8KB
Processes	2728 (powershell.exe) 2788 (powershell.exe)
Type	data
MD5	`b0c9ff441742f3847ea27da9dee7f2cd`
SHA1	`c42a1eb32ba953a0ce5d8635caabf71b5b281495`
SHA256	`a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4`
CRC32	`0BBCAB1A`
ssdeep	`96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis