Dropped Files | ZeroBOX

Name	96afcbae373a08f6_{071fc16e-27fc-11ec-9d79-94de278c3274}.dat Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{071FC16E-27FC-11EC-9D79-94DE278C3274}.dat
Size	4.5KB
Processes	1196 (iexplore.exe)
Type	Composite Document File V2 Document, Cannot read section info
MD5	`bf740ed3500abc3c5c433fd1619e946b`
SHA1	`d21310f3f932b29593e0b5f2d4c359d5fe36790e`
SHA256	`96afcbae373a08f608fae301364834f89ec5ccdcf3d0314031a0a108b56bd92e`
CRC32	`B391DC32`
ssdeep	`12:rlxAFgrEgm8GL7KFBoxrEgm8GP7qsANl26abax1NlkfRbaxQI6:rnG8uxG8CANlIoNlA`
Yara	Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal	Search for analysis

Name	55799d0224210738_recoverystore.{071fc16d-27fc-11ec-9d79-94de278c3274}.dat Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{071FC16D-27FC-11EC-9D79-94DE278C3274}.dat
Size	5.0KB
Processes	1196 (iexplore.exe)
Type	Composite Document File V2 Document, Cannot read section info
MD5	`631f44fa97a380568866531b23c390d3`
SHA1	`d8181296afe20de619b4ec6feece73b6d862a9d6`
SHA256	`55799d02242107380a615bfa4273c38f38c3194883005c450741b1bfd19e029a`
CRC32	`3844C201`
ssdeep	`12:rlfF2CBrEg5+IaCrI0CI7eF28ryXTrEgmZ+IaCrI0CIc8GmRVOeMiqI771NlTqbj:rqS5/fIiTG5/k85jBM+NlWqMNlWq`
Yara	Microsoft_Office_File_Zero - Microsoft Office File
VirusTotal	Search for analysis

Name	437252ce5e183e89_vbc[1].exe Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\vbc[1].exe
Size	321.5KB
Processes	1772 (iexplore.exe)
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`8c7ed5bf68dd9a6f76be57eb9ab80ae7`
SHA1	`8df269fec5c9c0fd05bb468b6ee2fd077e570639`
SHA256	`437252ce5e183e89ff25e5634c411583de24829219901bf884f762351c8b6ec2`
CRC32	`146A4526`
ssdeep	`6144:K69L7Z0DQ+3HwOEz2J9bv1ABmYhKUxHvbBM/3Q8+YcA5fu1Hh7PucMfW6n:AkoU2JddABzK6zqA8lcAMlp69`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
VirusTotal	Search for analysis