Dropped Files | ZeroBOX

Name	13b7e2f6efa880ed_~$agram-118.doc Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\~$agram-118.doc
Size	162.0B
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`f143aa93e7cd9e6c2117d3f41e962abd`
SHA1	`c2560e0fdb1cc338bccc0446637a08b11fd80145`
SHA256	`13b7e2f6efa880ed3cba3a61fa359b898c3ff4c4a269e79914c33417b6306716`
CRC32	`BAE3993A`
ssdeep	`3:yW2lWRdCyW6L7sl7lJK7fZllOHItDeHytqaX:y1lWGyWmovK7hllO4CStqaX`
Yara	None matched
VirusTotal	Search for analysis

Name	3c5df9f53ba26d65_~$normal.dotm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size	162.0B
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`ea43a36136a9a4929a8122cb78f46310`
SHA1	`e81447f8b57acdd003f40bcfb5d285b298fee8b9`
SHA256	`3c5df9f53ba26d6586153530231542634c005a98b42dc19d6a34d329ef59ec7c`
CRC32	`0012FAF8`
ssdeep	`3:yW2lWRdCyW6L7sl7lJK7fZllOHItDeHyRGn:y1lWGyWmovK7hllO4CSRG`
Yara	None matched
VirusTotal	Search for analysis

Name	e722561d0dd3e3dc_msforms.exd Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\VBE\MSForms.exd
Size	143.8KB
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`67fddb5cc47dac09b37c345d43ed9339`
SHA1	`568f67fd49d2cdddb4378f817097af71d2e56a7f`
SHA256	`e722561d0dd3e3dc902841c3d39826fdaca2a79273ed51a5b334149bc862f84c`
CRC32	`F4E25524`
ssdeep	`1536:CkCL3FNSc8SetKB96vQVCjumVMOej6mXmYarrJQcd1FaLcmB:CRJNSc83tKBAvQVCGOtmXmLpLmB`
Yara	None matched
VirusTotal	Search for analysis

Name	4826c0d860af884d_~wrs{4d490a57-dc6f-457e-b316-ea7d4931cbbc}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4D490A57-DC6F-457E-B316-EA7D4931CBBC}.tmp
Size	1.0KB
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`5d4d94ee7e06bbb0af9584119797b23a`
SHA1	`dbb111419c704f116efa8e72471dd83e86e49677`
SHA256	`4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1`
CRC32	`23C03491`
ssdeep	`3:ol3lYdn:4Wn`
Yara	None matched
VirusTotal	Search for analysis