Dropped Files | ZeroBOX

Name	b7c225ef3cc3e875_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	2552 (powershell.exe)
Type	data
MD5	`81ca4510272caf505e8091e9a28cb716`
SHA1	`71414aeec9f1e4a6f5a461b01700cc9cc992cd9e`
SHA256	`b7c225ef3cc3e87506150eb140e7b9cc127a3469c50a808854acac71a53d98bf`
CRC32	`FC31E90F`
ssdeep	`96:EtuCcBGCPDXBqvsqvJCwoRtuCcBGCPDXBqvsEHyqvJCwor/47HwxGlUVul:EtCgXoRtCgbHnorLxY`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	7e47bcb383783a85_nums.vbs Submit file
Filepath	C:\Windows\Temp\nums.vbs
Size	422.0B
Processes	2552 (powershell.exe)
Type	ASCII text, with CRLF line terminators
MD5	`fe71e84d826e568fb59858c87d53d966`
SHA1	`22908517cf6fb78884f8396df877a88140183de6`
SHA256	`7e47bcb383783a85a27b91e7a862ccf291f9c836a708c784e9a1bb081f88f014`
CRC32	`BB184951`
ssdeep	`12:UhhUfOHjRZkAOo6GlIFeHzFkYPyPyLuB9:Uh/vkn5d2kyyX`
Yara	None matched
VirusTotal	Search for analysis

Name	c5784e5fa4ee85aa_app.url Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\App.url
Size	55.0B
Processes	2552 (powershell.exe)
Type	MS Windows 95 Internet shortcut text (URL=<file:///C:\Windows\Temp\nums.vbs>), ASCII text
MD5	`c8196307957323991f3ed0c3bbb0396b`
SHA1	`327fad6c0a8949dc0e64769f9fe4a0ed694af17c`
SHA256	`c5784e5fa4ee85aa1ead86a16c22fb2f56f32694cc6890bb2118c10bfdd4940a`
CRC32	`A8F6DDAD`
ssdeep	`3:HRAbABGQF0tsMsB0W:HRYF1GMsBv`
Yara	url_file_format - Microsoft Windows Internet Shortcut File Format
VirusTotal	Search for analysis