Dropped Files | ZeroBOX

Name	a9220271c0eb79e5_d93f411851d7c929.customdestinations-ms Submit file
Filepath	c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size	7.8KB
Processes	2476 (powershell.exe)
Type	data
MD5	`b0c9ff441742f3847ea27da9dee7f2cd`
SHA1	`c42a1eb32ba953a0ce5d8635caabf71b5b281495`
SHA256	`a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4`
CRC32	`0BBCAB1A`
ssdeep	`96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	812db6e274f72121_null Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\null
Size	1.6KB
Processes	3000 (Windows Helper.exe)
Type	ASCII text, with CRLF line terminators
MD5	`1eef03b4f612c2245c44cf1a63018fa9`
SHA1	`d9364eab4210d3133e2526810e2ba06c08dd40b1`
SHA256	`812db6e274f72121b9e5a2e1d2893270b5b921dc14a59ff949d637554a3ed456`
CRC32	`1C000AF7`
ssdeep	`24:hT5AgpN0yDZIV3OL/Qy8/Xmq2amxmgnwVu2XqUh7VubIrC:h1fpPw3y/78/Xmq9Sm0wgoh7qIG`
Yara	None matched
VirusTotal	Search for analysis

Name	e8b2a8d0c3444c53_windows helper.exe Submit file
Filepath	C:\Users\test22\AppData\Roaming\Windows Folder\Windows Helper.exe
Size	7.8MB
Processes	2312 (Fixer.exe)
Type	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5	`c717c47941c150f867ce6a62ed0d2d35`
SHA1	`f568eb59fd37b2fe37db730292594d875d3a11e8`
SHA256	`e8b2a8d0c3444c53f143d0b4ba87c23dd1b58b03fd0a6b1bcd6e8358e57807f1`
CRC32	`2BC8F0BC`
ssdeep	`98304:7f4ix3tX2mzKHmCTBk1XoHtLgF9o11clR73DArjRjjoHuLc2orGpV7bAUI9+dcGL:7AiLLcg2FiF1E+AsDm1y8n`
Yara	Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file
VirusTotal	Search for analysis