Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	5dfd38c9a84532be_~wrs{ba19125e-4eec-4897-b415-94ea318a76f9}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BA19125E-4EEC-4897-B415-94EA318A76F9}.tmp
Size	1.5KB
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`1dfcb583ef2101158eef11169713fe5f`
SHA1	`09344e18c17fd18284e77b37ba568c675ff01f35`
SHA256	`5dfd38c9a84532bec35b04abf049e43716b93aca205e3c437e70cff852acf0b2`
CRC32	`EAEBCB40`
ssdeep	`3:FlgAg7NNKElClDK/ldl5vWGePllHl3lldfZl/BAlVzNZmElGwPxZlhRt3POD7jlF:fgFpUElClDK/CGePlIv54wPxZfODwi`
Yara	None matched
VirusTotal	Search for analysis

Name	0cfe9ed9f32d6628_~$normal.dotm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size	162.0B
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`56723e3a092ff9369f6714ddcf5cbdd4`
SHA1	`35746423685bb76a1314dcdf6e61994cfc3088b3`
SHA256	`0cfe9ed9f32d6628cec5ad9da05cc5def808063879c4aeb95ec2d105704b81b6`
CRC32	`77F65917`
ssdeep	`3:yW2lWRd+woW6L7imXldK7szaItrxmUhX:y1lWSwoWmeuldK7s9rgUx`
Yara	None matched
VirusTotal	Search for analysis

Name	bd338b6d0bed22d7_cf2b3bec.emf Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CF2B3BEC.emf
Size	4.9KB
Processes	1616 (WINWORD.EXE)
Type	Windows Enhanced Metafile (EMF) image data version 0x10000
MD5	`bb7722a0184f576e9d9f1f42d260cb43`
SHA1	`5679a52893aeb47774f47c9c3b352794bc6bee42`
SHA256	`bd338b6d0bed22d71d6232c4e20f610fc46a47721a9eeb2e57ad236b453462a8`
CRC32	`5678CC33`
ssdeep	`48:OMDLvNfGYQ6dsdBg6qjpLkwOEG6kpYjdHkpaayN:bnVfT9MBFq9gVU5EfyN`
Yara	None matched
VirusTotal	Search for analysis

Name	6b09e1c8fadb19fd_~$diplo.doc Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$diplo.doc
Size	162.0B
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`5ee63d4d9ac250f5a5027f236a6d26f6`
SHA1	`2c299709a8f0ce1ee4b1a8f7b8e0419f9e4b210e`
SHA256	`6b09e1c8fadb19fd6f45af3786be52010408ec4475bbe3797ad96d1498e6e8cf`
CRC32	`9DDEED07`
ssdeep	`3:yW2lWRd+woW6L7imXldK7szaItrxmQt:y1lWSwoWmeuldK7s9rgQt`
Yara	None matched
VirusTotal	Search for analysis

Name	4826c0d860af884d_~wrs{1198279c-9d07-43b1-9fd0-5f1046274332}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1198279C-9D07-43B1-9FD0-5F1046274332}.tmp
Size	1.0KB
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`5d4d94ee7e06bbb0af9584119797b23a`
SHA1	`dbb111419c704f116efa8e72471dd83e86e49677`
SHA256	`4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1`
CRC32	`23C03491`
ssdeep	`3:ol3lYdn:4Wn`
Yara	None matched
VirusTotal	Search for analysis

Name	0f9614b15c1d4679_index.dat Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size	120.0B
Processes	1616 (WINWORD.EXE)
Type	ASCII text, with CRLF line terminators
MD5	`7455090d1d76ef1ab9c632c91be5c116`
SHA1	`3426135fbf05ffed4ea64720bc915777c1faea81`
SHA256	`0f9614b15c1d4679fc17aee32f11b06d9e72adc78013beea9318415f2fed6d44`
CRC32	`6F214E83`
ssdeep	`3:bDuMJlwcXAlWCZUJK1nzCmxWqJHp6rp2mX1621nzCv:bCkAkgUJUnzK9sgnzs`
Yara	None matched
VirusTotal	Search for analysis

Name	0fe88681d7c6bcbe_diplo.doc.lnk Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\diplo.doc.LNK
Size	1.2KB
Processes	1616 (WINWORD.EXE)
Type	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 23 17:57:48 2021, mtime=Thu Sep 23 17:57:48 2021, atime=Thu Sep 23 17:57:48 2021, length=172544, window=hide
MD5	`6e3880108e116e1e1d33aec6cd8edd92`
SHA1	`193cf766157d4c5c92352f49bddb4654e648afb8`
SHA256	`0fe88681d7c6bcbe6932ee9cdf5eb2686705d3a94e721751b5b4dd919820f8bb`
CRC32	`5021FAEE`
ssdeep	`24:8ObhvyuvqVRdxzIoz9ml8zNYuTKqDCLPyeSR:8ovy4KXpS8pYuTKHyx`
Yara	Lnk_Format_Zero - LNK Format
VirusTotal	Search for analysis

Name	3b2297210cc80614_~$23_193403215579.doc Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\~$23_193403215579.doc
Size	162.0B
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`afdbf77354b09946e26c78202df4fb2d`
SHA1	`0bf45f3998b7a872b77833b1d74fe71b848cde65`
SHA256	`3b2297210cc80614988537b27e33fc542adda5c63ebda501a6a49d941fba4af1`
CRC32	`FCB8A4C8`
ssdeep	`3:yW2lWRd+woW6L7imXldK7szaItrxmYl/n:y1lWSwoWmeuldK7s9rgI/n`
Yara	None matched
VirusTotal	Search for analysis

Name	ef10b60ebe0d8db3_991e12fd.emf Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\991E12FD.emf
Size	4.9KB
Processes	1616 (WINWORD.EXE)
Type	Windows Enhanced Metafile (EMF) image data version 0x10000
MD5	`710e4d91678c5ae9dbf0aed585dc0554`
SHA1	`a1b682a2c5ee2b8ceed8a84f5943a2981abcbb01`
SHA256	`ef10b60ebe0d8db31064509384853b941f833c7c94816e55a62e98f72567f54b`
CRC32	`F17482A5`
ssdeep	`96:QzOhv2+tgPk7mS+Dan9MYpnY9GumWB6VR237gO4xwgnamn:QzOhe+tH7ADa9MsnYoMB6VR2Lwugnh`
Yara	None matched
VirusTotal	Search for analysis

Name	e545d395bb3fd971_~wrs{b674b9aa-116e-4ac7-869a-9ca0404e8036}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B674B9AA-116E-4AC7-869A-9CA0404E8036}.tmp
Size	2.0B
Processes	1616 (WINWORD.EXE)
Type	data
MD5	`32649384730b2d61c9e79d46de589115`
SHA1	`053d8d6ceeba9453c97d0ee5374db863e6f77ad4`
SHA256	`e545d395bb3fd971f91bf9a2b6722831df704efae6c1aa9da0989ed0970b77bb`
CRC32	`890098F7`
ssdeep	`3:X:X`
Yara	None matched
VirusTotal	Search for analysis