Dropped Files | ZeroBOX

Name	593d669cbd2bff95_tmpE2C5.tmp.bat Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\tmpE2C5.tmp.bat
Size	175.0B
Processes	508 (Adobe_PhotoshopSetups.exe) 3004 (cmd.exe)
Type	DOS batch file, ASCII text, with CRLF line terminators
MD5	`4075185b1d3202b8722f27322ab50a35`
SHA1	`ca0db494ed97b82f7304066aa75efefdeab34787`
SHA256	`593d669cbd2bff959fdcb6fa875d9dfa0c1f67b3bd4f9fee0432935b379d4424`
CRC32	`4591436C`
ssdeep	`3:mKDDCMNqTtv3DmWxpcL4E2J5xAIJkHeNKL0QVWLKDwU1hGDmWxpcL4E2J5xAInT1:hWKqTtLmQpcLJ23fJkHeZQHDNemQpcL+`
Yara	None matched
VirusTotal	Search for analysis

Name	2e59e087ffa5b49b_Adobe_PhotoshopSetups.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\Adobe_PhotoshopSetups.exe
Size	490.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9fff72f95c07e3922b9a34d51723f586`
SHA1	`a745b32c9456b83eb449757b89bb971804514ba9`
SHA256	`2e59e087ffa5b49b5c6096f419277c5e3ddad7163f3ba5d3075bd61a1015613c`
CRC32	`BC8A699C`
ssdeep	`6144:VAyr4xR5em8y2ZPPMeDEoLR1P5r++E1iLy+F2:pExjemkCHlz`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software NorthKorea_Zero - Maybe it's North Korea File Is_DotNET_EXE - (no description) IsPE32 - (no description)
VirusTotal	Search for analysis

Name	3a255c0024916f19_590aee7bdd69b59b.customDestinations-ms~RF950068.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF950068.TMP
Size	7.8KB
Processes	2584 (powershell.exe) 2756 (powershell.exe)
Type	data
MD5	`6fd29def73b2779e0ae71c4eecd304f7`
SHA1	`4ba660e4db856e04eb93a01c59ee764259ec55e7`
SHA256	`3a255c0024916f19c5b3f5d4aa5cde453cc5d90b0784a15f0456e57e71a764b6`
CRC32	`1F966CD8`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:ctvXo5tvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis