| Name | 016b443391531dc4_k1.zip |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\K1.zip |
| Size | 2.8MB |
| Processes | 2972 (powershell.exe) |
| Type | Zip archive data, at least v2.0 to extract |
| MD5 | eb834c6eb71e2a950f9123b506ab4763 |
| SHA1 | f988558aad4ae5cd322ea3402278d47ddb48d75a |
| SHA256 | 016b443391531dc4a9bac3127fe82d6149b14ee529ff448de8d60c9868b74602 |
| CRC32 | 0FA99A43 |
| ssdeep | 49152:lm0aitd+JLyeh79YQ+7svv3ujDg8tozVUaIiArjdaCbkq6CYKW7BSIV0:g0Z+td91IsHCdSz+pifCbkIeBFV0 |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | ff2c19c915b7fcca_k2.zip |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\K2.zip |
| Size | 519.9KB |
| Processes | 2972 (powershell.exe) |
| Type | Zip archive data, at least v2.0 to extract |
| MD5 | a5822a72e170943c40a3c2229026d18b |
| SHA1 | 3970e8c6b9ec1fc18c11025959391c693368f057 |
| SHA256 | ff2c19c915b7fccafe84c1c69f6637914b0f1df866e17bf948b5cb6c16dbf32c |
| CRC32 | 9FC1DA40 |
| ssdeep | 12288:Vxxoh2MmIDRb0P2Et5Blsm3PCi7wl12LEDZfg8fJtQO:Xmh0mRgbtflZyxtxfJZ |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | d9ff134f98128064_town[1] |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\town[1] |
| Size | 100.9KB |
| Processes | 2820 (mshta.exe) |
| Type | data |
| MD5 | 5c1660ddd59c2fbb9127296dca34371d |
| SHA1 | 4791b00ef22cde64ba06961cd8a4847badb090af |
| SHA256 | d9ff134f9812806471944dffc329905141823361d904323b2150208e19352c11 |
| CRC32 | 0DA03504 |
| ssdeep | 768:tm0hJqRFkzmdDzUdEyECK2SSyyhEbpkaf0nQV7/s1G:00hwR+zwz3yE15SRKpkaf0Qi1G |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | ff29db73598f5789_961ead56b197aa92.customdestinations-ms |
|---|---|
| Filepath | c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\961ead56b197aa92.customdestinations-ms |
| Size | 5.1KB |
| Processes | 2664 (powershell.exe) |
| Type | data |
| MD5 | 24b79ad2d0c65b79dfb803efb8a09dd2 |
| SHA1 | 091079f59971f6d14036cdb827f239402bccdbac |
| SHA256 | ff29db73598f5789c7a51827af65f743d810e01bff03eaa47edf847170d7ce15 |
| CRC32 | 44EAC061 |
| ssdeep | 48:GVsHlR5KacHJpRpyJ+VsHlR5KacHJpRpycEHnQbuM4b3+SogZolxwUQlUVul:Lr4dHyJDr4dHycEHnQj47HwxGlUVul |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms |
|---|---|
| Filepath | c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms |
| Size | 7.8KB |
| Processes | 2972 (powershell.exe) |
| Type | data |
| MD5 | 81ca4510272caf505e8091e9a28cb716 |
| SHA1 | 71414aeec9f1e4a6f5a461b01700cc9cc992cd9e |
| SHA256 | b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf |
| CRC32 | FC31E90F |
| ssdeep | 96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY |
| Yara |
|
| VirusTotal | Search for analysis |