Dropped Files | ZeroBOX

Name	b8af6e26de4f04a6_590aee7bdd69b59b.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size	7.8KB
Processes	2804 (powershell.exe)
Type	data
MD5	`c4472d1731b82d4cc5239b5b480ef076`
SHA1	`535e9d0be2e2c1c716324d1bad01a66f4482cd29`
SHA256	`b8af6e26de4f04a63a062924790138782910222442cbe1411776a385489f5240`
CRC32	`12C35980`
ssdeep	`96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwori4tDHXy6lUVul:EtCgXoRtCgbHnorlTyc`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	543991ca8d1c6511_zemana.sys Submit file
Filepath	C:\Zemana.sys
Size	198.9KB
Processes	2560 (Asd11.exe)
Type	PE32+ executable (native) x86-64, for MS Windows
MD5	`21e13f2cb269defeae5e1d09887d47bb`
SHA1	`16d7ecf09fc98798a6170e4cef2745e0bee3f5c7`
SHA256	`543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91`
CRC32	`E9C7BB58`
ssdeep	`3072:uIYCsz96ZvVJ9b9sJCfShQ0/COLYYfUFtKXFZHOaIKyAYrPcQL9Rsm:uhCS8Bh3SaeCWYE1Oncovsm`
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description) Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis