Dropped Files | ZeroBOX

Name	c43f913e75a18bcd_windowsautoupdate.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\WindowsAutoUpdate.exe
Size	4.3MB
Processes	156 (1.exe)
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`3f005ce85f08a09e93679254e35df782`
SHA1	`e0ac1e6e68a1a79edd16215447a6c8c3ab068b5d`
SHA256	`c43f913e75a18bcddedf040beec903b94336734537ca6816d8174e8237822870`
CRC32	`7C3FBD76`
ssdeep	`49152:m6+OL0vnSGYGY+9C4OXk9PhRBPhILfF/QxamXYOCs5EbNfylJTEXKobB1:m7jHTXXREYJgXK`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer Antivirus - Contains references to security software
VirusTotal	Search for analysis

Name	3a255c0024916f19_590aee7bdd69b59b.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size	7.8KB
Processes	2112 (powershell.exe)
Type	data
MD5	`6fd29def73b2779e0ae71c4eecd304f7`
SHA1	`4ba660e4db856e04eb93a01c59ee764259ec55e7`
SHA256	`3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6`
CRC32	`1F966CD8`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis