popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 1964710bc970a45c_kill.bat
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\kill.bat
Size 67.0B
Processes 1932 (5_6232986114823555269.exe)
Type ASCII text, with CRLF line terminators
MD5 726d7c3de305b23f9343f987e40d366f
SHA1 16647d939d7059400cfc675eb09c8c530f8d6319
SHA256 1964710bc970a45c261bd74df63981684822e72f2c744c4690b1a86e787d36d6
CRC32 D68AFB01
ssdeep 3:nnWTQGWAdAoKAnWIMAltn:nWTQGL/WW
Yara None matched
VirusTotal Search for analysis
Name 39e7de847c9f731e_down[2]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\down[2]
Size 748.0B
Type PNG image data, 15 x 15, 8-bit colormap, non-interlaced
MD5 c4f558c4c8b56858f15c09037cd6625a
SHA1 ee497cc061d6a7a59bb66defea65f9a8145ba240
SHA256 39e7de847c9f731eaa72338ad9053217b957859de27b50b6474ec42971530781
CRC32 B475DDD7
ssdeep 12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name e3b0c44298fc1c14_nshC05D.tmp
Empty file or file not found
Filepath C:\Users\test22\AppData\Local\Temp\nshC05D.tmp
Size 0.0B
Type empty
MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
CRC32 00000000
ssdeep 3::
Yara None matched
VirusTotal Search for analysis
Name 93a1041991a5510c_{0d60e402-ebbb-11ed-91c7-080027c2f7b0}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0D60E402-EBBB-11ED-91C7-080027C2F7B0}.dat
Size 4.5KB
Processes 2284 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 65ad4d471b2d45956f4b39a0a539015b
SHA1 0442ea50fa4858366cbe842117a8caf2c0b4d7ea
SHA256 93a1041991a5510c9dcd7ad06c8f16b1dca70bc1ef92ed94462734c2b3a1aaac
CRC32 8B3D29E5
ssdeep 12:rl0ZGFSrEgmfF06FvDrEgmfh0qgNNlTVbaxLNlX9baxxDLINm:reGrGmNNlp+NlNkU
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 10fe1d7788d9a779_dnserror[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\dnserror[1]
Size 5.8KB
Type HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 67bbf4af23868b17115e91fc0f35b5d9
SHA1 f43e2691fa1d733fdfc6dc7c280a659af3bc8dc2
SHA256 10fe1d7788d9a779bcaaeb53f879c6254425e4b64a84b24bbbc099cd7be99058
CRC32 099D8EAD
ssdeep 48:uqUPsV4VWBXvXS4nZ1a5TI7HW/Tu21kpd87KZA9f+upbthDb6Xuzut7Cih0:uOpiEQKHT272axfnRzkh0
Yara None matched
VirusTotal Search for analysis
Name b9f89025be0d5829_recoverystore.{0d60e401-ebbb-11ed-91c7-080027c2f7b0}.dat
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0D60E401-EBBB-11ED-91C7-080027C2F7B0}.dat
Size 4.5KB
Processes 2284 (iexplore.exe)
Type Composite Document File V2 Document, Cannot read section info
MD5 06011f39cf9f7d97cddedfd894dcee03
SHA1 060a10ea381e8c8f46065a5db42f77e76321efc4
SHA256 b9f89025be0d582958bd7ffe6ff2859b4adca5baa5b874f3b79a0ebc688c2722
CRC32 50B2CC17
ssdeep 12:rlfF2prEg5+IaCrI0F7+F2aUrEg5+IaCrI0F7ugQNlTqbax4wNlTqbax4:rqp5/1J5/3QNlWENlW
Yara
  • Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal Search for analysis
Name 2e7cbb274b70aa6f_favcenter[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\favcenter[1]
Size 687.0B
Type PNG image data, 16 x 16, 8-bit colormap, non-interlaced
MD5 79afa8ab0ff40639c6fb752e88e60ee1
SHA1 c940d08bfeb8a7012f9340c9c4821c8f59b7d38f
SHA256 2e7cbb274b70aa6f564088cb1b58029907b836e73119da8398687ae766b124c7
CRC32 55DFB61F
ssdeep 12:6v/7tWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW2cd//8NOR4JOzPi+oNoF2mcHhC2V:DWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWo
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 6c3c1986f231973a_noConnect[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\noConnect[1]
Size 5.3KB
Type PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
MD5 7686f6957ab9b36be2ebba88772a1541
SHA1 27089f8c09e41fdc4c994f8a5a5b115058479def
SHA256 6c3c1986f231973a68ddbacfd2a40408c8766bb18851c1a80e121f08f9bcf4de
CRC32 CA869C92
ssdeep 96:x4xOKDm0AK8naEFgkQgWmwep7eyaHNdj1BQp3VaYuV5pLeOMnCi:x4xOuuK8nNFgyW3eJe9HzjfQpI5p7md
Yara
  • PNG_Format_Zero - PNG Format
VirusTotal Search for analysis
Name 7cbb3f382970b9b8_newtonsoft.json.dll
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll
Size 690.8KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 da5033255da26654935f7840def3c6a0
SHA1 f420e2935ec83c15fdf642c1d02e42fabe53a774
SHA256 7cbb3f382970b9b830529cb943f83ff35d817ba45f4d260b9330fe8f5095b277
CRC32 3A301187
ssdeep 12288:vBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUk:vBjk38WuBcAbwoA/BkjSHXP36RMGR
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_DLL - (no description)
  • IsDLL - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name bd6ce61bd6e77337_win.txt
Submit file
Filepath C:\Users\win.txt
Size 1.3KB
Processes 2164 (LuckyWheel.exe)
Type ASCII text, with very long lines, with CRLF line terminators
MD5 b67e2033f2800951463e0b17d7baeebd
SHA1 3e308af65db6c235e9a2054729577be3388cfa4d
SHA256 bd6ce61bd6e77337e18d0931957c4e46971a74a91285db0c0fd531202709c9bc
CRC32 F5201B7C
ssdeep 24:YdCsgeJe5X53BrI5OQBKrt5LDINmBp5Dw16aNtdGgd5a39060IYRZcA9sXa3o5DF:YdCcJe1rI3GttcIm16aNHHoywYztSX8s
Yara None matched
VirusTotal Search for analysis
Name 3b6a5cb2a3c09181_System.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nshC05E.tmp\System.dll
Size 11.0KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 cf85183b87314359488b850f9e97a698
SHA1 6b6c790037eec7ebea4d05590359cb4473f19aea
SHA256 3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac
CRC32 2681E335
ssdeep 96:3IsUxO9udx4qYp7AJb76BykUbQMtHUOA5Iv+RnsrqeXV+d1g2IW9t2c+cEwF9oug:YVL7ikJb76BQUoUm+RnyXVYO2RvHoug
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name d3ac8d5db7a6fd80_windowsservices.exe
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\WindowsServices.exe
Size 15.8KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 332fe4462b3c1fe60239772e81008311
SHA1 a3f4ef8eeb31e0e5b9877754d2e7d594b0d92d48
SHA256 d3ac8d5db7a6fd808795222d0cebce7e9115344a761dca09d92bc36ff2d38b07
CRC32 A7BFCC81
ssdeep 384:9ID9CteXlmFU6TlRBfTWsvMINyb8E9VFDPxSk4kG:9IDuRHtEJPxc
Yara
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 00a6465e2347daee_luckywheel.exe
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe
Size 71.3KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 6133f69f01608a83451e9b418348f1b0
SHA1 b2dc516d30d97a3221b8c726d5b619955305d3b5
SHA256 00a6465e2347daee6b6e00cf5d14740519a9520dfa0dafde076fdc2696414a14
CRC32 4F53FECF
ssdeep 1536:j7SGJpfA29lENZq1zz1hb4otVvKbQ4NnzcP9IzlzCQgSNY+3Px1y:yotVvKbQcnzcP9IzlzCQjNY+fxU
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
VirusTotal Search for analysis
Name c2689ba1f66066af_KillProcDLL.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nshC05E.tmp\KillProcDLL.dll
Size 4.0KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
CRC32 4D400138
ssdeep 48:a7+k73bgAa4QYAg3c2hdmskKX9ZOk4IHxov1F7ym7p5rAGJcFuEv7O3kT:y7b+4Lnms5ZGhtlyZ2I7O3kT
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 2dbdb3abd5652302_UserInfo.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\nshC05E.tmp\UserInfo.dll
Size 4.0KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 d41cf0e4d88c60408f3d5b97f49d40c0
SHA1 1aa117b1ef998993f495833a08dd8cb12356be0f
SHA256 2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9
CRC32 9800678B
ssdeep 48:qKw4n2rZ4vuXXqQr1wH+zL/o0o/X/3MVyjlZSU15gaoFU:5Z4ZxKQruHkJwvcVyL4FU
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 1471693be91e53c2_background_gradient[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\background_gradient[1]
Size 453.0B
Type JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
MD5 20f0110ed5e4e0d5384a496e4880139b
SHA1 51f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA256 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
CRC32 C2D0CE77
ssdeep 6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
Yara
  • JPEG_Format_Zero - JPEG Format
VirusTotal Search for analysis
Name 6de598428c334097_IE9CompatViewList[1].xml
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\IE9CompatViewList[1].xml
Size 141.7KB
Type XML 1.0 document, ASCII text, with CRLF line terminators
MD5 c236e316e1b9ac60ce15dac7bcb8b2de
SHA1 1e240ed5f7cbc3dc8cd2397c7151a0d7e5f173c2
SHA256 6de598428c334097a21eb2dd5963c190fc5f80a6289bce205ded0466393745a4
CRC32 8B345ADA
ssdeep 3072:toSMrEDL1FwhdFFaz6l8vHG+TbFPAzepobjyG7I1K1IB2+Tir8v1IG9aIedyPcFC:mSMrEDL1FwhdFFaz6l8vHG+TbFPAzepR
Yara None matched
VirusTotal Search for analysis
Name 091a8c575b8a3f6e_adsstraypopup.dll
Submit file
Filepath C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll
Size 55.3KB
Processes 1932 (5_6232986114823555269.exe)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8c92e0740a0d72ee81f113ef625c984e
SHA1 ecf277620678359023e2a6f6842a117b666e4321
SHA256 091a8c575b8a3f6e88b682c9f9aa1388ff8ff0d03c15eb97bdb043901e1f639e
CRC32 5388D686
ssdeep 768:mPfUW8k9tt8r2+UR659Ry7DWqfK9H9vf7af7zYcHe+Z6EJPxq6:mnUVk9+2d65XyPWJN1iK+pPxq6
Yara
  • UPX_Zero - UPX packed file
  • Is_DotNET_DLL - (no description)
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
VirusTotal Search for analysis
Name 41e3f69ecc09290e_httpErrorPagesScripts[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\httpErrorPagesScripts[1]
Size 5.4KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 dea81ac0a7951fb7c6cae182e5b19524
SHA1 8022d0b818a0aea1af61346d86e6c374737bc95a
SHA256 41e3f69ecc09290ebc49be16d2415036ddb2f7a4b868eef4091d0b5a301762fe
CRC32 5E7F4A18
ssdeep 96:JCc1g1V1riA1CiOcitXred1cILqcpOnZ1g1V1OWnvvqt:xmjriGCiOciwd1BPOPmjOWnvC
Yara None matched
VirusTotal Search for analysis
Name 18ae9d76727c45a5_errorPageStrings[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\errorPageStrings[1]
Size 2.0KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 867666e4f73a755e0c135ce4e90de230
SHA1 a7b1d23f1d2ef9de6b149925147d44076e17fcb3
SHA256 18ae9d76727c45a577073bfc8d8914fedccfcf43b5afeeaf26737448712334e3
CRC32 D8C63FA6
ssdeep 48:z9UUiqu6xl8W22751dwvRHERyRyntQRXP6KtU5SwVze/6e/+Ng7FU50U5ZF0:z9UUiqRxqH211CvRHERyRyntQRXP6C8o
Yara None matched
VirusTotal Search for analysis
Name 8d018639281b33da_ErrorPageTemplate[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\ErrorPageTemplate[1]
Size 2.1KB
Type UTF-8 Unicode (with BOM) text, with CRLF line terminators
MD5 f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1 f4eda06901edb98633a686b11d02f4925f827bf0
SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
CRC32 E6FF242A
ssdeep 24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
Yara None matched
VirusTotal Search for analysis