Dropped Files | ZeroBOX

Name	70a606ea757c2392_590aee7bdd69b59b.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
Size	7.8KB
Processes	2888 (powershell.exe)
Type	data
MD5	`76b31c5fc230fc779684bc6a42ac6cc0`
SHA1	`fbdd6d2e351e25f5a4ab3943717b2ebf5a88797a`
SHA256	`70a606ea757c239289a131eb2dfb4a38e9613df8ba15b13d54233608557f5726`
CRC32	`7FBEF17C`
ssdeep	`96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCworu54tDHXySxlUVul:EtCgXoRtCgbHnor5TyA`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	543991ca8d1c6511_zemana.sys Submit file
Filepath	C:\Zemana.sys
Size	198.9KB
Processes	2652 (UMR.exe)
Type	PE32+ executable (native) x86-64, for MS Windows
MD5	`21e13f2cb269defeae5e1d09887d47bb`
SHA1	`16d7ecf09fc98798a6170e4cef2745e0bee3f5c7`
SHA256	`543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91`
CRC32	`E9C7BB58`
ssdeep	`3072:uIYCsz96ZvVJ9b9sJCfShQ0/COLYYfUFtKXFZHOaIKyAYrPcQL9Rsm:uhCS8Bh3SaeCWYE1Oncovsm`
Yara	OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature IsPE64 - (no description) Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis