Dropped Files | ZeroBOX

Name	3a255c0024916f19_590aee7bdd69b59b.customDestinations-ms~RF139b524.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF139b524.TMP
Size	7.8KB
Processes	2316 (powershell.exe) 2776 (powershell.exe)
Type	data
MD5	`6fd29def73b2779e0ae71c4eecd304f7`
SHA1	`4ba660e4db856e04eb93a01c59ee764259ec55e7`
SHA256	`3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6`
CRC32	`1F966CD8`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	9bdc8fb2ecb47adc_new.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\new.exe
Size	123.5KB
Processes	1720 (new.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`0179eec24965822ea41af4447d767961`
SHA1	`563ca9e6b8cf27afecde67852becba702b8a611c`
SHA256	`9bdc8fb2ecb47adc2e5cf1c3bbe407d7edd5309e747020007388e70eee9065b6`
CRC32	`63DAB659`
ssdeep	`3072:Q9Hu0lRqu1NNZjdZbATSMwOVJ3pj45ah:Q9rP1v9zbI5xMa`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check
VirusTotal	Search for analysis