Dropped Files | ZeroBOX

Name	01bed6a67aa394c7_9c1b01825a19c268.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\9c1b01825a19c268.customdestinations-ms
Size	6.9KB
Processes	2212 (powershell.exe)
Type	data
MD5	`7c27731e1e370f1cccbb93d4b5077f73`
SHA1	`1af34ed54ee8f8d0e70fc5d94b90d2b979642b3f`
SHA256	`01bed6a67aa394c75928770b54b03272881eacdb65695a63d7d3c106daed5673`
CRC32	`8FFAB7DB`
ssdeep	`48:NsJRTvrXDrpRXdJ95sJRTvrXDrpRlEHydJ9obqKSb3+SogZolxgUQlUVul:a/z/fo/z/hEHGuVS7HwxWlUVul`
Yara	None matched
VirusTotal	Search for analysis

Name	6c2823c8c32e25f2_thomas[1].hta Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\thomas[1].hta
Size	56.1KB
Processes	156 (mshta.exe)
Type	HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5	`5ee0717be491e47a97affc5d4bc8d206`
SHA1	`75517f884aa0939945d50181a9116b33afd7b053`
SHA256	`6c2823c8c32e25f2bd3b363460fd2a45e49da6bb683c9de58f1ba30fb71812f9`
CRC32	`1B4D449B`
ssdeep	`768:jaaYhlmBrbO/HdofLAH7HkRYoYfDt5ELy6NpjdkhYVd9:jv0lmZO/9oTWEKoYfDt5EWaZykd9`
Yara	None matched
VirusTotal	Search for analysis

Name	a9b1dc8eaa5fcd00_d93f411851d7c929.customDestinations-ms~RF14ad77e.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14ad77e.TMP
Size	7.8KB
Processes	1196 (powershell.exe) 1220 (powershell.exe) 2564 (powershell.exe)
Type	data
MD5	`c1d8708bab1e838a2deda26d58bb8d42`
SHA1	`95d39e75a804752961c139bb6c0b67f84f685035`
SHA256	`a9b1dc8eaa5fcd0034694cf9742ae915a5932142a1477c3ab6fada45d98750b2`
CRC32	`E71AF2A2`
ssdeep	`96:QtuC6GCPDXBqvsqvJCwoFtuC6GCPDXBqvsEHyqvJCworFS7HwxWlUVul:QtbXoFtbbHnor/xo`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis