Dropped Files | ZeroBOX

Name	0862c633fcfd3a8e_postmon.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\postmon.exe
Size	490.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8bdd901591eb90456ad781e3c79bb4ad`
SHA1	`f9d03f993a454d3d0e69cf2159006e22da0397a2`
SHA256	`0862c633fcfd3a8e2e1a27e862845e98edc229ab892f3b6dde5184a3217f861f`
CRC32	`63540208`
ssdeep	`6144:smeQ8DZA76JirPX2xy1AOC5N6EsVHCJxXyIHIvSw0rKZgs93ACdLYfRkZlWRm:srQii7gG3EsVxsIvHggRYJkom`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3a255c0024916f19_590aee7bdd69b59b.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size	7.8KB
Processes	2220 (powershell.exe)
Type	data
MD5	`6fd29def73b2779e0ae71c4eecd304f7`
SHA1	`4ba660e4db856e04eb93a01c59ee764259ec55e7`
SHA256	`3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6`
CRC32	`1F966CD8`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis