popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 54f511647ae61371_fqxx3.url
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\fQXx3.url
Size 45.0B
Processes 2776 (WINWORD.EXE)
Type MS Windows 95 Internet shortcut text (URL=<http://bit.do/fQXx3>), ASCII text, with CRLF line terminators
MD5 26a8966aec53d996343e80bdcece0a7d
SHA1 9281fd417dc0c090871bf4927a69d02b5188d547
SHA256 54f511647ae6137154846c96a1556a77685d4f21c33eeaf7817b102f92efb3a4
CRC32 077755E9
ssdeep 3:HRAbABGQYm/hQ1uey:HRYFVm/hCy
Yara None matched
VirusTotal Search for analysis
Name 5102633fe1beb1d6_fqxx3[1].htm
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\fQXx3[1].htm
Size 312.0B
Processes 2776 (WINWORD.EXE)
Type HTML document, ASCII text
MD5 58c90caa173f9144eb6adba712d74d2d
SHA1 f9c150ff6b5b4c551088baee8fd2995698d6ba8f
SHA256 5102633fe1beb1d68642bb64269b30c4b1eeb3d3a4715b223e51f282aa8f10c9
CRC32 7D6AA5E3
ssdeep 6:pn0+Dy9xwol6hEr6VX16hu9nPiJ4fyoNUKRSXnbFEcXaoD:J0+ox0RJWWPHfyoNhAXnyma+
Yara None matched
VirusTotal Search for analysis
Name 44341b6ddcae078d_~$afo.docx
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$afo.docx
Size 162.0B
Processes 2776 (WINWORD.EXE)
Type data
MD5 8621c8082a8d6da7b3c575b98d87ed11
SHA1 4d3d9bfd86271347466997b2886a8c83ee7fb6e7
SHA256 44341b6ddcae078d8750e74bf22d81b5824a5e4ba3742d01dadadb59d3d2a4da
CRC32 5E66ABDF
ssdeep 3:yW2lWRdvL7YMlbK7lZxnI4:y1lWnlxK73xnI4
Yara None matched
VirusTotal Search for analysis
Name 5198fa0f5db0645b_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 2776 (WINWORD.EXE)
Type data
MD5 8eb7ef27966ff233cf87b14b723ff88a
SHA1 8c0734adcb7a05ccf6d588c3a11749fd6c902126
SHA256 5198fa0f5db0645b75383f7ff4a2a183b1233d88fa1585d3b72289901f4338ae
CRC32 8D0535B5
ssdeep 3:yW2lWRdvL7YMlbK7l0:y1lWnlxK7S
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{b22c7ac1-da6c-4b00-8db4-138bfead1d2f}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B22C7AC1-DA6C-4B00-8DB4-138BFEAD1D2F}.tmp
Size 1.0KB
Processes 2776 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name fa7dd8045b475352_~wrs{8a6d1837-f014-4a91-be85-a35407ca9839}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{8A6D1837-F014-4A91-BE85-A35407CA9839}.tmp
Size 4.0KB
Processes 2776 (WINWORD.EXE)
Type data
MD5 fddfacad5324e3b3ff838357cc60cc80
SHA1 8def3d39e3876acfcc613363ff96cbb9d97062c3
SHA256 fa7dd8045b475352ae7597ee6a232f4568fd6ed64e3baf8c0f853f359d86e0f7
CRC32 B16DF887
ssdeep 48:Ibashk0aipcikdQyIul+ZGoOTleuZzVHALEAlrxrzwD5lUK+MlNyJo2PUr:Iba7iwTIuE50wuJHufxrzwdln+yuUr
Yara None matched
VirusTotal Search for analysis
Name 5c4d0919d66abbb5_index.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 72.0B
Processes 2776 (WINWORD.EXE)
Type ASCII text, with CRLF line terminators
MD5 c2d1a62d3a6e8b0c9d3679f6483d4f59
SHA1 78903ed0ab322f54c145516292d9d9021631ab5b
SHA256 5c4d0919d66abbb59d174500f7fc6da30faba8183b113461aca13c5cb90db349
CRC32 F5712590
ssdeep 3:bDuMJlbciEMhSXfQFLkb:bCQVDhkf4kb
Yara None matched
VirusTotal Search for analysis
Name 5c53b5fe6e9b0b79_23.95.122.53에 있는 pawpaw.url
Submit file
Size 53.0B
Type MS Windows 95 Internet shortcut text (URL=<http://23.95.122.53/pawpaw/>), ASCII text, with CRLF line terminators
MD5 dbd2be150cb07dd6b787a2bebfc66ece
SHA1 c10c01e3ea30caa96734daf0d9d65eddf070afb8
SHA256 5c53b5fe6e9b0b79bbbba14e44bb8ed224dad3c000ab1e476deac23923f94204
CRC32 E96EA8C8
ssdeep 3:HRAbABGQYm/ehLOXfOE+D:HRYFVm/K4fyD
Yara None matched
VirusTotal Search for analysis
Name e5c5b9bb8eb4e8e8_a[1].doc
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTDTA402\a[1].doc
Size 6.9KB
Processes 2776 (WINWORD.EXE)
Type ISO-8859 text, with very long lines, with CRLF, CR, LF line terminators
MD5 6da2c4e91c3afddf10f7f9cce9836638
SHA1 6b7a1b8be1c7bb0599979fedc972f7bad8a255fa
SHA256 e5c5b9bb8eb4e8e812d0e61184f66d4c5bfb7eb14e33def200783451be054078
CRC32 6EFD02B2
ssdeep 96:6H+wtjuRgEYvv6mHEIq0Jp9PMSbEbagTKenvgPdujHc4pYy8ZTTSj7BDM88r52PF:6ewMgEY3+IFPMSbEbaORUdu9oZsRM819
Yara
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero
VirusTotal Search for analysis
Name 0877a3fc43a5f341_~wrs{c34d87ec-0471-4684-b992-ae3dca60fd0f}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C34D87EC-0471-4684-B992-AE3DCA60FD0F}.tmp
Size 1.0KB
Processes 2776 (WINWORD.EXE)
Type dBase III DBT, version number 0, next free block index 7536653
MD5 28adf62789fd86c3d04877b2d607e000
SHA1 a62f70a7b17863e69759a6720e75fc80e12b46e6
SHA256 0877a3fc43a5f341429a26010ba4004162fa051783b31b8dd8056eca046cf9e2
CRC32 8E6A7128
ssdeep 3:Ghl/dlYdn:Gh2n
Yara None matched
VirusTotal Search for analysis