popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 84c76feb1bba0c4f_recoverystore.{c1e48ae9-e022-11ed-91c7-080027c2f7b0}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C1E48AE9-E022-11ED-91C7-080027C2F7B0}.dat
Size 4.5KB
Processes 2288 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 1587a19d272a582687682d78bd771571
SHA1 db52a3a5b19f5f10291698f12fdda55e4ffc12cf
SHA256 84c76feb1bba0c4f13f27f4db24a7d27cd3eb644fbc6b63be759b7b95a18d83f
CRC32 1557A594
ssdeep 12:rlfF2ArEg5+IaCrI0F7+F2EUJrEg5+IaCrI0F7ugQNlTqbaxDMbNlTqbaxDMBH:rqA5/1EUJ5/3QNlWaMbNlWaM
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 1964710bc970a45c_kill.bat
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\kill.bat
Size 67.0B
Processes 1488 (InstalCap129.exe)
Type ASCII text, with CRLF line terminators
MD5 726d7c3de305b23f9343f987e40d366f
SHA1 16647d939d7059400cfc675eb09c8c530f8d6319
SHA256 1964710bc970a45c261bd74df63981684822e72f2c744c4690b1a86e787d36d6
CRC32 D68AFB01
ssdeep 3:nnWTQGWAdAoKAnWIMAltn:nWTQGL/WW
Yara None matched
VirusTotal Search for analysis
Name 39e7de847c9f731e_down[2]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\down[2]
Size 748.0B
Type PNG image data, 15 x 15, 8-bit colormap, non-interlaced
MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
CRC32 B475DDD7
ssdeep 12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 4ed4b789048ef7c0_{c1e48aea-e022-11ed-91c7-080027c2f7b0}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C1E48AEA-E022-11ED-91C7-080027C2F7B0}.dat
Size 4.5KB
Processes 2288 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 d2023ba6285558012b788508ce78440a
SHA1 405743f8dc5f23c8e39a9c41c678e952d92a7867
SHA256 4ed4b789048ef7c0107cfc86bdb57ce30d614e2096c6753123ae3d668f8a5e1c
CRC32 7424E073
ssdeep 12:rl0ZGFHmrEgmf506FRDrEgmfh0qgNNlTVbaxLNlb9baxu5Lh:ryGJGmNNlp+NlZx
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 10fe1d7788d9a779_dnserror[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\dnserror[1]
Size 5.8KB
Type HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 67bbf4af23868b17115e91fc0f35b5d9
SHA1 f43e2691fa1d733fdfc6dc7c280a659af3bc8dc2
SHA256 10fe1d7788d9a779bcaaeb53f879c6254425e4b64a84b24bbbc099cd7be99058
CRC32 099D8EAD
ssdeep 48:uqUPsV4VWBXvXS4nZ1a5TI7HW/Tu21kpd87KZA9f+upbthDb6Xuzut7Cih0:uOpiEQKHT272axfnRzkh0
Yara None matched
VirusTotal Search for analysis
Name ff1d3374ba65efc8_luckywheel.exe
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe
Size 71.3KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ad0fae3ce90330539b1b2c1c0099413a
SHA1 a426043079df5cdff3fd3e3eebd308c0578aa81e
SHA256 ff1d3374ba65efc8c8a262df619a4416b48235ef9b15dc80a30248384fc222a1
CRC32 6AD10E08
ssdeep 1536:M7SGJpfA29oENZq1zz1hsJCu+7CbJfNnzcP9IzlzCU4OY+CPxq:MCu+7CbJlnzcP9IzlzCUnY+Oxq
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name 851ce1013420608b_Math.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsaC02F.tmp\Math.dll
Size 66.0KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 32f26ffa5c4d87c2074f95114bafe34b
SHA1 250d984cd9042d558b3e7a9f6835840cfe88de2e
SHA256 851ce1013420608baa53301de5302fbc1b772c5ac4be30df684d2ed9306ba7e7
CRC32 33267849
ssdeep 1536:tP43W1MUl6koam+2MwRmLeqFVvboUhZjITt:twI6kJVsU7ct
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nskC01E.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nskC01E.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 2e7cbb274b70aa6f_favcenter[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\favcenter[1]
Size 687.0B
Type PNG image data, 16 x 16, 8-bit colormap, non-interlaced
MD5 79afa8ab0ff40639c6fb752e88e60ee1
SHA1 c940d08bfeb8a7012f9340c9c4821c8f59b7d38f
SHA256 2e7cbb274b70aa6f564088cb1b58029907b836e73119da8398687ae766b124c7
CRC32 55DFB61F
ssdeep 12:6v/7tWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW2cd//8NOR4JOzPi+oNoF2mcHhC2V:DWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWo
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 6c3c1986f231973a_noConnect[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\noConnect[1]
Size 5.3KB
Type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
MD5 7686f6957ab9b36be2ebba88772a1541
SHA1 27089f8c09e41fdc4c994f8a5a5b115058479def
SHA256 6c3c1986f231973a68ddbacfd2a40408c8766bb18851c1a80e121f08f9bcf4de
CRC32 CA869C92
ssdeep 96:x4xOKDm0AK8naEFgkQgWmwep7eyaHNdj1BQp3VaYuV5pLeOMnCi:x4xOuuK8nNFgyW3eJe9HzjfQpI5p7md
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 3b6a5cb2a3c09181_System.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsaC02F.tmp\System.dll
Size 11.0KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
CRC32 2681E335
ssdeep 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name b1726a2424c6046c_windowsservices.exe
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\WindowsServices.exe
Size 15.8KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 4a2bf6186cf2a3ed615818c2bcad3cc1
SHA1 1297ad695b91a8aae908b743a0f16406b71711cc
SHA256 b1726a2424c6046cc3d14de79767c0dbbc2fe13082db3d5cc44f87885b52cfe6
CRC32 8CBF4EFF
ssdeep 384:fID9CteXlmFU6TlRBfTWsvMINyb8E9VFDPxSkJq:fIDuRHtEJPxU
Yara
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name c2689ba1f66066af_KillProcDLL.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsaC02F.tmp\KillProcDLL.dll
Size 4.0KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
CRC32 4D400138
ssdeep 48:a7+k73bgAa4QYAg3c2hdmskKX9ZOk4IHxov1F7ym7p5rAGJcFuEv7O3kT:y7b+4Lnms5ZGhtlyZ2I7O3kT
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 2dbdb3abd5652302_UserInfo.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nsaC02F.tmp\UserInfo.dll
Size 4.0KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 d41cf0e4d88c60408f3d5b97f49d40c0
SHA1 1aa117b1ef998993f495833a08dd8cb12356be0f
SHA256 2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9
CRC32 9800678B
ssdeep 48:qKw4n2rZ4vuXXqQr1wH+zL/o0o/X/3MVyjlZSU15gaoFU:5Z4ZxKQruHkJwvcVyL4FU
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 1471693be91e53c2_background_gradient[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\background_gradient[1]
Size 453.0B
Type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
MD5 20f0110ed5e4e0d5384a496e4880139b
SHA1 51f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA256 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
CRC32 C2D0CE77
ssdeep 6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name 6de598428c334097_IE9CompatViewList[1].xml
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\IE9CompatViewList[1].xml
Size 141.7KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 c236e316e1b9ac60ce15dac7bcb8b2de
SHA1 1e240ed5f7cbc3dc8cd2397c7151a0d7e5f173c2
SHA256 6de598428c334097a21eb2dd5963c190fc5f80a6289bce205ded0466393745a4
CRC32 8B345ADA
ssdeep 3072:toSMrEDL1FwhdFFaz6l8vHG+TbFPAzepobjyG7I1K1IB2+Tir8v1IG9aIedyPcFC:mSMrEDL1FwhdFFaz6l8vHG+TbFPAzepR
Yara None matched
VirusTotal Search for analysis
Name 7b97bd6176b98c5d_newtonsoft.json.dll
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll
Size 690.8KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c748f82584423805b9c3f65d368d0da6
SHA1 cfca5ebd7dd8c4e9ef0807fc5c78de499e298e59
SHA256 7b97bd6176b98c5d68f5e90ba9b043c9c988fb932a6d953a30f2622d19f64904
CRC32 956ED151
ssdeep 12288:WBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUNd:WBjk38WuBcAbwoA/BkjSHXP36RMGS
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_DLL - (no description)
  • IsDLL - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 58f5ea864b9625fb_win.txt
Submit file
Filepath C:\Users\win.txt
Size 1.4KB
Processes 2164 (LuckyWheel.exe)
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 f31ec1c993cf745a6ef9bd643ca7293e
SHA1 d51d13de46493fb0bd0b7465ce2a0b92daabcf25
SHA256 58f5ea864b9625fb3e114c759e5e5451a2743a71c774f065cc43e84906820093
CRC32 0450C148
ssdeep 24:YdCsgeJe5hsXg53vrWhQBKmt5LDINfUlQ2ZoCaNtdGgd5a39060IuqLB9sXa3o51:YdCcJe/NrW+BttcsLdaNHHoywZBSX80B
Yara None matched
VirusTotal Search for analysis
Name 41e3f69ecc09290e_httpErrorPagesScripts[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\httpErrorPagesScripts[1]
Size 5.4KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 dea81ac0a7951fb7c6cae182e5b19524
SHA1 8022d0b818a0aea1af61346d86e6c374737bc95a
SHA256 41e3f69ecc09290ebc49be16d2415036ddb2f7a4b868eef4091d0b5a301762fe
CRC32 5E7F4A18
ssdeep 96:JCc1g1V1riA1CiOcitXred1cILqcpOnZ1g1V1OWnvvqt:xmjriGCiOciwd1BPOPmjOWnvC
Yara None matched
VirusTotal Search for analysis
Name 55500b33b33924ec_adsstraypopup.dll
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll
Size 55.3KB
Processes 1488 (InstalCap129.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 70a32060d62ef3deea9b6379d0d9cf88
SHA1 d6318cbf4adcb05231b2c47c09ce1e98ba75eb28
SHA256 55500b33b33924ec35754cb25f72cc5bac3ade0d68234212bb5c6b72c5c8cdb0
CRC32 9E4BE782
ssdeep 768:OPfUW8k9tt8r2+UR659Ry7DsqfK9H9Sf7WmrzYcHe+Z+EJPxu:OnUVk9+2d65XyPsJNqX6+NPxu
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_DLL - (no description)
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 18ae9d76727c45a5_errorPageStrings[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\errorPageStrings[1]
Size 2.0KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 867666e4f73a755e0c135ce4e90de230
SHA1 a7b1d23f1d2ef9de6b149925147d44076e17fcb3
SHA256 18ae9d76727c45a577073bfc8d8914fedccfcf43b5afeeaf26737448712334e3
CRC32 D8C63FA6
ssdeep 48:z9UUiqu6xl8W22751dwvRHERyRyntQRXP6KtU5SwVze/6e/+Ng7FU50U5ZF0:z9UUiqRxqH211CvRHERyRyntQRXP6C8o
Yara None matched
VirusTotal Search for analysis
Name 8d018639281b33da_ErrorPageTemplate[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\ErrorPageTemplate[1]
Size 2.1KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
CRC32 E6FF242A
ssdeep 24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
Yara None matched
VirusTotal Search for analysis