Dropped Files | ZeroBOX

Name	f4d28cf0f12006f9_590aee7bdd69b59b.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size	7.8KB
Processes	3008 (powershell.exe)
Type	data
MD5	`b770148dd160455bac8fe186a882733d`
SHA1	`f41e6e10cf42b4aa831f43abfb27c031bf0f3d4a`
SHA256	`f4d28cf0f12006f93de9b6181d36369c8d85b6021f830ea407d76585cbda8b1e`
CRC32	`94B533F7`
ssdeep	`96:EtuCojGCPDXBqvsqvJCwoJtuCojGCPDXBqvsEHyqvJCwor3tDHXyGlUVul:Etu6XoJtu6bHnordTyY`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	a738f6016086abdd_runtime broker Submit file
Filepath	C:\Users\test22\AppData\Roaming\Runtime Broker\Runtime Broker
Size	4.8MB
Processes	2788 (update.exe)
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`b4aa27a1339c69d99121a4fe4fac94f7`
SHA1	`72cd9ebfd59e9c5a45c22dd5f6aa8d4cb9ba9d26`
SHA256	`a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6`
CRC32	`047DF69C`
ssdeep	`98304:8G3SCYgrWa7NdvOXayO6+iv8vnMSd0gXZvflZ1FdGJCbGr:FcgrWa7j4JN+iv8XZvjdGJiG`
Yara	UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description)
VirusTotal	Search for analysis