Dropped Files | ZeroBOX

Name	43b0a392b9430b05_conf.ps1 Submit file
Filepath	C:\ProgramData\WindowsAppCertification\conf.ps1
Size	141.0B
Processes	3048 (wscript.exe)
Type	ASCII text, with CRLF line terminators
MD5	`e7bc2bf18507ece0d33c269745799ea2`
SHA1	`9d5e5ca09679befa851a24703d166b75f82af940`
SHA256	`43b0a392b9430b05e63b6a1f1294790ecd09871c38c935e79249099bd2923a06`
CRC32	`DAB965CD`
ssdeep	`3:BHNTtmAcLhzAK5DwMMtZJu2NAaBrC2dvnCyDMJQsv:RNAzD5d2BB+2dav`
Yara	None matched
VirusTotal	Search for analysis

Name	72eaa01b05e0984f_runps.vbs Submit file
Filepath	C:\ProgramData\WindowsAppCertification\runps.vbs
Size	240.0B
Processes	3048 (wscript.exe)
Type	ASCII text, with CRLF line terminators
MD5	`85315e193d3b0740c400d5dec1fe58f8`
SHA1	`4b8ef79c32cdf151dbadf1d2effdc3f5537c255a`
SHA256	`72eaa01b05e0984f714d8b698380cb193757f06d033abdec1bcd4f68c88c07e3`
CRC32	`B6E09851`
ssdeep	`6:9cNAWdgUc+blFETmi4ngQ8nytGQO0cbnG4nggRLj3:9vWdU+blFE5ZQ8nGHpcjGZc`
Yara	Antivirus - Contains references to security software
VirusTotal	Search for analysis

Name	e0c44fbbc32524ea_winappversion.ini Submit file
Filepath	C:\ProgramData\WindowsAppCertification\winappversion.ini
Size	293.0B
Processes	3048 (wscript.exe)
Type	ASCII text, with CRLF line terminators
MD5	`a69a5e9780d9f7a93b5ba64884c20643`
SHA1	`53e675ee091ed901cec3f94430efe3b6f674c459`
SHA256	`e0c44fbbc32524ea4d79137967dcf5e370704eedef3e7d9d128fdad8ceebe052`
CRC32	`A6D3D95E`
ssdeep	`6:9cNAWdgUc+blFETGUhaxQZkefBC6noa4ngg7RV4ng7:9vWdU+blFERaxdSBC6noaZYRVZ7`
Yara	None matched
VirusTotal	Search for analysis