Dropped Files | ZeroBOX

Name	a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF4b07c3.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF4b07c3.TMP
Size	7.8KB
Type	data
MD5	`b0c9ff441742f3847ea27da9dee7f2cd`
SHA1	`c42a1eb32ba953a0ce5d8635caabf71b5b281495`
SHA256	`a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4`
CRC32	`0BBCAB1A`
ssdeep	`96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	f15bea6165ea8a91_d93f411851d7c929.customDestinations-ms~RF4b1204.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF4b1204.TMP
Size	7.8KB
Processes	2316 (powershell.exe) 2452 (powershell.exe) 2176 (None)
Type	data
MD5	`85d20cfe77f8df6d70e026c5db2a82e0`
SHA1	`a92248d5d7a8852f3eb4f20b85fa02f4ed3cc4be`
SHA256	`f15bea6165ea8a91480b353354c490d2772c769a61e801fd697afd2e6da21926`
CRC32	`F4C91BC2`
ssdeep	`96:ktuCeGCPDXBqvsqvJCwoJtuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ktvXoJtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	456b19ba141bbb57_017bd04fb3bf45b681679e8f41ff87bf.json Submit file
Filepath	C:\Users\Public\Documents\017BD04FB3BF45B681679E8F41FF87BF.json
Size	2.2KB
Processes	2176 (None)
Type	ASCII text, with very long lines, with no line terminators
MD5	`1f3abbac864008ff7a183360b0dffb7e`
SHA1	`66adab0d1ddf8fc50c7b76e88fbe9e0f811f921f`
SHA256	`456b19ba141bbb57d2ccc988fa6baa70317fe499445f09b1d1ae5c8bd325d7a8`
CRC32	`644F8466`
ssdeep	`48:YZvuq6Zuff84WtjIq8HiKC2vH/BWOwv0ssShngotVSflFnyDJnkuXsBI:6mq6cVWJIvCdg0sflyX8u`
Yara	None matched
VirusTotal	Search for analysis

Name	cfaf0c04cd850384_mta1.exe Submit file
Filepath	C:\ProgramData\sY2NsQjNsETOsATOsIDOsUWOsIWOsMDOsU2NsUWO\MTA1.exe
Size	128.0MB
Processes	2176 (None) 2316 (powershell.exe) 2452 (powershell.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4767e3c856cb558cdbf898702b4f3d37`
SHA1	`887ffa445fb003d7b6824d21d25b792f36509237`
SHA256	`dee133dc96c0b7a476e6a078ef52a093aaa16ea1c5bda06f33b7181bd224700f`
CRC32	`542198A4`
ssdeep	`3145728:NYZfp6hh+gd01AywYRojKneKC3WKp0CQNLhpi:KZB6h8yyZijKXC3WYb8LhQ`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)
VirusTotal	Search for analysis