popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name d6431d5645fffd05_d93f411851d7c929.customdestinations-ms
Submit file
Filepath c:\users\test22\appdata\roaming\microsoft\windows\recent\customdestinations\d93f411851d7c929.customdestinations-ms
Size 7.8KB
Processes 2104 (powershell.exe)
Type data
MD5 260d23ce04a8f8555a73b7d2dc15e911
SHA1 ebad746fb7de847c50f7502a44f6e35534733efd
SHA256 d6431d5645fffd05a23166d630253bc7ce8c099cf6e9c956f8ae5e1249ee8588
CRC32 11D6B213
ssdeep 96:ctuCeGCPDXBqvsqvJCwo5tuCeGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:ctvXo5tvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name a9220271c0eb79e5_d93f411851d7c929.customDestinations-ms~RF214c76b.TMP
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF214c76b.TMP
Size 7.8KB
Type data
MD5 b0c9ff441742f3847ea27da9dee7f2cd
SHA1 c42a1eb32ba953a0ce5d8635caabf71b5b281495
SHA256 a9220271c0eb79e5750e0d0e62058ecac560e09cdf9e82ef61aeeabada5d48a4
CRC32 0BBCAB1A
ssdeep 96:RutuCOGCPDXBqvsqvJCwo+utuCOGCPDXBqvsEHyqvJCworSP7Hwxf2lUVul:UtvXoxtvbHnorrxQ
Yara
  • Antivirus - Contains references to security software
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 413852f536628cfa_F56GKLK7U4
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\F56GKLK7U4
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 91a39ee5267872c5a86c0b791bfd0fe0
SHA1 3ee10302a6d40c7aa02afe01d36498f1b27f7895
SHA256 413852f536628cfad0f6be985e814443f8a2bbdcfd55994aff9a561fbad68fe1
CRC32 B431A379
ssdeep 24:TL2C0RlPbXaFpEO5bNmISHdL6UwcOxvo5:TYLOpEO5J/KdGU1Eo5
Yara None matched
VirusTotal Search for analysis
Name c810a7589a228352_sqlite3.def
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\sqlite3.def
Size 4.8KB
Processes 2424 (netbtugc.exe)
Type ASCII text
MD5 de71633de073966eb5d5f787eac989bb
SHA1 dd110a7666977b763f1cb540745d928a02a3aaca
SHA256 c810a7589a228352269413cc503647df82b4320b7c0b596a15d2842dac7f843a
CRC32 23111930
ssdeep 96:GcuN4gR+7Oc0XRMcCM3KVGOF95BlMtvrmNHY0ac:E4Q+7Oc0JKVBF95EvrmNHcc
Yara None matched
VirusTotal Search for analysis
Name 77e14caae3daf05c_rooma.exe
Submit file
Filepath C:\Users\test22\AppData\Roaming\rooma.exe
Size 264.5KB
Processes 2104 (powershell.exe) 2424 (netbtugc.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1dcce19e1a6306424d073487af821ff0
SHA1 9de500775811f65415266689cbdfd035e167f148
SHA256 77e14caae3daf05c1f5a6a3d10e4936cc58944d6ae9ec6943b1be6d995e94b5c
CRC32 656091CE
ssdeep 6144:ZhKO/bBUzpHw6Zw4KKmnZlypy0s1LNbDlLJkEU:ZhKYd8HthKKNy0sX1HU
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
VirusTotal Search for analysis
Name 1b755cc3093dd45a_sqlite3.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\sqlite3.dll
Size 810.2KB
Processes 2424 (netbtugc.exe)
Type PE32 executable (DLL) (console) Intel 80386, for MS Windows
MD5 c6ec991471d42128268ea10236d9cdb8
SHA1 d569350d02db6a118136220da8de40a9973084f1
SHA256 1b755cc3093dd45a0df857854aedfeb3c8f3622cff5bc491f2d492ebfa3ef8e0
CRC32 9AD4A356
ssdeep 24576:P5Ojm8loqaH3loJ6HyMn+ekHRT8bfENtXOv:PmSqaHyJ6HyM+ekHRT83
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 824fae3331b95e2f_F56GKLK7U4
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\F56GKLK7U4
Size 40.0KB
Type SQLite 3.x database, last written using SQLite version 3033000
MD5 41c19a9e8541fcb934c13c075bf47721
SHA1 648a7622d533d79b9a0bb31dc370134ec3a75ed7
SHA256 824fae3331b95e2f88ca60c87a6c9569086906ec76fc1db8d6dee9adddc4e80c
CRC32 560F7642
ssdeep 48:+35TqYzDGF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:Ulce7mlcwilGc7Ha3f+u
Yara None matched
VirusTotal Search for analysis