Dropped Files | ZeroBOX

Name	80a9bbe9c115392d_~$nvoice.wbk Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\~$nvoice.wbk
Size	162.0B
Processes	3016 (WINWORD.EXE)
Type	data
MD5	`5dc50bc30664e236c6a1a90204dd1f5b`
SHA1	`87849ce098ca2ed2bd8b8d2fb9955624da090731`
SHA256	`80a9bbe9c115392d78b6194d394ca594d5eee6bdf97dae6e655bbffc6c9d64e5`
CRC32	`FE5DBEBF`
ssdeep	`3:yW2lWRdvL7YMlbK7lZ7l:y1lWnlxK73R`
Yara	None matched
VirusTotal	Search for analysis

Name	4826c0d860af884d_~wrs{bb579189-be2b-4c20-80fa-041bda7dbedf}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BB579189-BE2B-4C20-80FA-041BDA7DBEDF}.tmp
Size	1.0KB
Processes	3016 (WINWORD.EXE)
Type	data
MD5	`5d4d94ee7e06bbb0af9584119797b23a`
SHA1	`dbb111419c704f116efa8e72471dd83e86e49677`
SHA256	`4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1`
CRC32	`23C03491`
ssdeep	`3:ol3lYdn:4Wn`
Yara	None matched
VirusTotal	Search for analysis

Name	b94d63d5a5bc4597_~$normal.dotm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size	162.0B
Processes	3016 (WINWORD.EXE)
Type	data
MD5	`065071323ed6d1b6ea7980dc7d9d3f76`
SHA1	`600804b6debf471838f8a42c707fc73213bde375`
SHA256	`b94d63d5a5bc4597066cbc7843e863afbd601e75cde946ae5a59fe84b628ff95`
CRC32	`89F0E588`
ssdeep	`3:yW2lWRdvL7YMlbK7l:y1lWnlxK7`
Yara	None matched
VirusTotal	Search for analysis

Name	1d2f7f4fb0d23c22_~wrs{37c9334e-0c87-4340-8a51-544a83382ac3}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{37C9334E-0C87-4340-8A51-544A83382AC3}.tmp
Size	13.5KB
Processes	3016 (WINWORD.EXE)
Type	data
MD5	`567f6154747484b7a0a45c15ddd43182`
SHA1	`34a32b47520217b8eb6df3910e463d3306f7c931`
SHA256	`1d2f7f4fb0d23c22a3583dbeb49f754e39fd975fc6987962116a2177118c6572`
CRC32	`612DC2FF`
ssdeep	`192:PXHk64d5cdGERtMI/+TFPGwxxFwUoChMSaLYInPb5DKJguAFiWM9:/HH47cYEYQ+dHhowMSaEInj9kgLiZ9`
Yara	None matched
VirusTotal	Search for analysis