Dropped Files | ZeroBOX

Name	d6431d5645fffd05_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	1932 (powershell.exe)
Type	data
MD5	`260d23ce04a8f8555a73b7d2dc15e911`
SHA1	`ebad746fb7de847c50f7502a44f6e35534733efd`
SHA256	`d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588`
CRC32	`11D6B213`
ssdeep	`96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF1cb8842.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1cb8842.TMP
Size	7.8KB
Type	data
MD5	`b0c9ff441742f3847ea27da9dee7f2cd`
SHA1	`c42a1eb32ba953a0ce5d8635caabf71b5b281495`
SHA256	`a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4`
CRC32	`0BBCAB1A`
ssdeep	`96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	9d51b34a2ef488e9_wininiti.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Hidden\system32\wininiti.exe
Size	6.1MB
Processes	1932 (powershell.exe)
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`e6d556b999ff69f3ba4165053429adf3`
SHA1	`15e4e46a7c419e523bd6c93ee42278f5c51ceb33`
SHA256	`9d51b34a2ef488e96d948b090963d78f7ee375dc1f4723e51ce3d5c26801dcfb`
CRC32	`8C1D5224`
ssdeep	`98304:8fRIJX2GRBhlXNGRTvcyYHXLvZ2+4Ogs5kNBMyDEZsqW64PYxemf3p3BcuM6nkpY:88/vhQMOq7WjPAeyxBcubMfhq`
Yara	PE_Header_Zero - PE File Signature XMRig_Miner_IN - XMRig Miner Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file
VirusTotal	Search for analysis

Name	c188e86f54843fc6_rundll39.exe Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Hidden\system32\rundll39.exe
Size	4.8MB
Processes	1932 (powershell.exe)
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`a7d826bf33220f0f9da9357416ff27ca`
SHA1	`16f0bba1fab5cae5663fbe4ba3f11d08bc0a6e79`
SHA256	`c188e86f54843fc6f187d63a9c1f9327d1fff8167a9d5404661e1a6b78e3824f`
CRC32	`3E200FAD`
ssdeep	`49152:4nE6e65048hV5K6fY/fbDAr4IacxRg2w5E/OqNq1tEHkXi0C:c59MfsbDAMPnE/O9tAci0`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file
VirusTotal	Search for analysis