Dropped Files | ZeroBOX
Name e545d395bb3fd971_~wrs{e1cb09ee-bab1-468e-bab0-a48f33ac5175}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E1CB09EE-BAB1-468E-BAB0-A48F33AC5175}.tmp
Size 2.0B
Processes 2364 (WINWORD.EXE)
Type data
MD5 32649384730b2d61c9e79d46de589115
SHA1 053d8d6ceeba9453c97d0ee5374db863e6f77ad4
SHA256 e545d395bb3fd971f91bf9a2b6722831df704efae6c1aa9da0989ed0970b77bb
CRC32 890098F7
ssdeep 3:X:X
Yara None matched
VirusTotal Search for analysis
Name 6faf3431cbabdcb8_~$14_718257604903.doc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$14_718257604903.doc
Size 162.0B
Processes 2364 (WINWORD.EXE)
Type data
MD5 7720c01e95d67083d7f13507fc7a9e6c
SHA1 b1244fb9e1c15d812a6045f1388f7c80da716076
SHA256 6faf3431cbabdcb8de59065761b162021a19104f7d36ae619ddecc8fd7053620
CRC32 B117E30E
ssdeep 3:yW2lWRdXlwoW6L7WjK7ZhiIt8bxEmtl:y1lWqoWm6K7p0tl
Yara None matched
VirusTotal Search for analysis
Name f21071d39f19d458_~wrs{c778751b-7089-4a7d-9ee7-709142b2541d}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C778751B-7089-4A7D-9EE7-709142B2541D}.tmp
Size 1.5KB
Processes 2364 (WINWORD.EXE)
Type data
MD5 a41a5f309a41b272042c6e578de6ab77
SHA1 00d621db249fe129fb9f534505fb611931fd96d4
SHA256 f21071d39f19d45817164b8e643fe2ab0acdabe5344257b1c844622775ca99c9
CRC32 D143B1D3
ssdeep 3:FlgAg7NNKElClDK/ldl5vWGePllHl3lldfZl/BAlVzNdqzNWnmPXwPxZlhRt3POT:fgFpUElClDK/CGePlIFnmPXwPxZfODwi
Yara None matched
VirusTotal Search for analysis
Name 5b2a5032b456cc79_reform.doc.lnk
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\reform.doc.LNK
Size 1.2KB
Processes 2364 (WINWORD.EXE)
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Sep 14 16:11:08 2021, mtime=Tue Sep 14 16:11:08 2021, atime=Tue Sep 14 16:11:08 2021, length=423424, window=hide
MD5 11fc5bcc3fe8a560d682a382910c50cf
SHA1 020cac8f86097c31de2529a102fc09f8a2eda7f9
SHA256 5b2a5032b456cc790b6b29332ccd78e76e930a4841d1531ae1b0e9f5eff30e03
CRC32 B69ABCB3
ssdeep 12:8mggXo1vyCPCH2fvqVPR8EvSobf6SLcpt9UTyr9Gil4KizCCOLAHSuTQiilhlzmM:8pvyuvqVRdxzIo+ahzNYuTuCLPyeSR
Yara
  • Lnk_Format_Zero - LNK Format
VirusTotal Search for analysis
Name 2e5bd44c4ec6bd82_index.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 122.0B
Processes 2364 (WINWORD.EXE)
Type ASCII text, with CRLF line terminators
MD5 338499d1eb18d346bc1d0064924a466b
SHA1 0df7cfe50b7d0ac4d787debba081394c83f0588a
SHA256 2e5bd44c4ec6bd82a40ec9bd13dbeb80a3ade6502fffbd6a244138f19633192b
CRC32 F4180D74
ssdeep 3:bDuMJlwcXAlWCP9XI1nzCmxWqJHp6rp2mX1FI1nzCv:bCkAk2CZzK9MZzs
Yara None matched
VirusTotal Search for analysis
Name 08aa048b68cfa2b9_92fe68c2.emf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\92FE68C2.emf
Size 4.9KB
Processes 2364 (WINWORD.EXE)
Type Windows Enhanced Metafile (EMF) image data version 0x10000
MD5 6d83f5dc778063f97f9e37f38b876e8f
SHA1 47845f603b0d34aef189f8c59e42b1d83c764c35
SHA256 08aa048b68cfa2b92d1daa7637c162f80796d66709664bffef4f241396c69061
CRC32 106D5775
ssdeep 48:k6ANkcxc7ngzi+fUzhtsaSVZNzB1sIS8sNIT0kjaNhN:kbrccxfUzhSjVCN
Yara None matched
VirusTotal Search for analysis
Name fe8c3ae486d10dff_~$reform.doc
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$reform.doc
Size 162.0B
Processes 2364 (WINWORD.EXE)
Type data
MD5 f6a3d0d2713fbece4b7de5486435f6c9
SHA1 27fbe100d9c13292002e2ca798bc8b68e6fd997d
SHA256 fe8c3ae486d10dffd3ce08b6b1db3a913717e1a3e3672868c00e9eb01dd5dcd3
CRC32 273A639B
ssdeep 3:yW2lWRdXlwoW6L7WjK7ZhiIt8bxjTzt:y1lWqoWm6K7pwTzt
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{b7c9ce4a-75e4-4028-93a4-420cdb79d0fb}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B7C9CE4A-75E4-4028-93A4-420CDB79D0FB}.tmp
Size 1.0KB
Processes 2364 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name 35eb2dc02d695234_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 2364 (WINWORD.EXE)
Type data
MD5 932debb145c58fbd6678d9ce344ccb06
SHA1 a2ba58124274f7181a2878d7ad78e3831e3450ac
SHA256 35eb2dc02d695234e3499c7595708ff9a909fa1cc9d8159365f569ab607993c0
CRC32 9507344F
ssdeep 3:yW2lWRdXlwoW6L7WjK7ZhiIt8bx1xltn:y1lWqoWm6K7pGxXn
Yara None matched
VirusTotal Search for analysis
Name b28e6506d981fde9_b8a8f485.emf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B8A8F485.emf
Size 4.9KB
Processes 2364 (WINWORD.EXE)
Type Windows Enhanced Metafile (EMF) image data version 0x10000
MD5 ad167e9b9bf95a12063e9289145bee60
SHA1 e9c9c952022bc4b62234b18e2afd52079a0839d8
SHA256 b28e6506d981fde9ac48f53513e15869b17de32c196a5977d72e4ce103f95093
CRC32 386C40A9
ssdeep 48:FXNAUxNrsdBg6qjpLkwOEG6kpYjdHkLWaKLLN:3bxN2BFq9gVU5EL6N
Yara None matched
VirusTotal Search for analysis