Dropped Files | ZeroBOX

Name	ac1d71edea5e3e9f_xclient.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\XClient.exe
Size	134.0KB
Processes	872 (svchost.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c07546595e442004cc042bdccc7be9dd`
SHA1	`219348130f2eed38854b9e4dd4c0d61cda48622c`
SHA256	`ac1d71edea5e3e9fa8fe77fc5a7d77a18ee571caf95efbe4dca33dc93a06b941`
CRC32	`47AD0F29`
ssdeep	`3072:u0T7QYapPI4BlImYX27T7QYapPI4BlImYX:u0T7QYsPI4cmYwT7QYsPI4cmY`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3a255c0024916f19_590aee7bdd69b59b.customDestinations-ms~RF170c0d1.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF170c0d1.TMP
Size	7.8KB
Processes	2472 (powershell.exe) 2652 (powershell.exe)
Type	data
MD5	`6fd29def73b2779e0ae71c4eecd304f7`
SHA1	`4ba660e4db856e04eb93a01c59ee764259ec55e7`
SHA256	`3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6`
CRC32	`1F966CD8`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis