Name | d6431d5645fffd05_d93f411851d7c929.customDestinations-ms~RFcb3a6d.TMP |
---|---|
Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFcb3a6d.TMP |
Size | 7.8KB |
Processes | 2332 (powershell.exe) 2436 (powershell.exe) |
Type | data |
MD5 | 260d23ce04a8f8555a73b7d2dc15e911 |
SHA1 | ebad746fb7de847c50f7502a44f6e35534733efd |
SHA256 | d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588 |
CRC32 | 11D6B213 |
ssdeep | 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ |
Yara |
|
VirusTotal | Search for analysis |
Name | f0cd78f49b07c9e0_ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs |
---|---|
Filepath | C:\Users\test22\AppData\Local\Temp\ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs |
Size | 1.9KB |
Processes | 1156 (wscript.exe) |
Type | ASCII text, with very long lines |
MD5 | e4e303a73c998fee585236687a14d97e |
SHA1 | 9611cd07a3f764b9625bd9e81ebf015ce4681132 |
SHA256 | f0cd78f49b07c9e04535a3903dccd5b6e8b73ddaff2522fcc7a8c326840bf237 |
CRC32 | 874CA919 |
ssdeep | 48:Y0BD+FDLkhGL/rq0U0BD+FBgv0BD+FbLLkN0BD+FB30BD+F/9mv0BD+FHj:eXsS/rqpBgHbvCF/9YHj |
Yara | None matched |
VirusTotal | Search for analysis |
Name | a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RFcb3433.TMP |
---|---|
Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFcb3433.TMP |
Size | 7.8KB |
Type | data |
MD5 | b0c9ff441742f3847ea27da9dee7f2cd |
SHA1 | c42a1eb32ba953a0ce5d8635caabf71b5b281495 |
SHA256 | a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4 |
CRC32 | 0BBCAB1A |
ssdeep | 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ |
Yara |
|
VirusTotal | Search for analysis |