popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name b02ef4fb7bf66fb6_~wrs{775fac43-fb2c-4e9b-b3e3-31e65b09f0c7}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{775FAC43-FB2C-4E9B-B3E3-31E65B09F0C7}.tmp
Size 1.5KB
Processes 2320 (WINWORD.EXE)
Type data
MD5 3580a905396bee2bd85c4982d3450dc8
SHA1 7c73f57e10a8989bcbc2749128588d455e0b60f4
SHA256 b02ef4fb7bf66fb665f41e57d5a84bdeb6815a21f18649eaa3d0753b53a09a73
CRC32 403D200B
ssdeep 3:Yzyxwnml0baZ4PON8DCBPl4lPltl/7Dll3/J/Y/4444444ulllFlxtQEn:YmWmG2GW2GJGGME
Yara None matched
VirusTotal Search for analysis
Name 3f6f791b060bc96a_4c43b416.wmf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4C43B416.wmf
Size 1.6MB
Processes 2320 (WINWORD.EXE)
Type ms-windows metafont .wmf
MD5 e5da9d6ac3fbb913fc7ae28bc9134843
SHA1 02fdeb86a2f40c7fd829e7710b14ec30f72e2527
SHA256 3f6f791b060bc96a74a2d8c8bd2c434ee40ca351717711e628a36a7369b5f86c
CRC32 D3F83946
ssdeep 1536:YTM8WCgcFrlwsI+y34UDfgVxu4D23Rn87Xx5JV4tWvUKBxXL8+l1NvG/bYWdj0PI:YYoyJgs7IXZ1Dx1Z3AL7RtBp
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{d4b36279-fb31-474b-88a9-0263d0aec11b}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D4B36279-FB31-474B-88A9-0263D0AEC11B}.tmp
Size 1.0KB
Processes 2320 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name 0ef5e316a7703b43_c533094.wmf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C533094.wmf
Size 160.0B
Processes 2320 (WINWORD.EXE)
Type Targa image data - Map - RLE 9 x 65536 x 0 +1 "\004"
MD5 342fb08544ed8cee728438459a0c23d4
SHA1 fac76559b9108e2730b35a0eb153354d14aa4649
SHA256 0ef5e316a7703b43768fd5944ea4477f7164384469aac9e5aed358fd63d3c01f
CRC32 6D387FD6
ssdeep 3:Vmvs2/l6ktK0Xg/lrll5llB3l/cklC5dl/Kdl5kriU2riPl+7wkAllll:MvFYkK0XgtFwssS5pck7wztl
Yara None matched
VirusTotal Search for analysis
Name e640b7530080d02a_~$5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$5%85%b3%e4%ba%8e%e5%bc%80%e5%b1%95%e8%b4%a2%e5%8a%a1%e4%b8%93%e9%a1%b9%e6%a3%80%e6%9f%a5%e7%9a%84%e9%80%9a%e7%9f%a5.doc
Size 162.0B
Processes 2320 (WINWORD.EXE)
Type data
MD5 146b5cbf71602df3c1516a5224ca0789
SHA1 1d5aaff58ee10ae0674794cee1924b8d8b284f85
SHA256 e640b7530080d02ae7bb2155552acc108683885dc13387792d3b70caaaa936a0
CRC32 C5267D86
ssdeep 3:yW2lWRdaf/W6L7EK1XK79UbgFItaOlEvl/:y1lWuXWmYKdK72MWaOkt
Yara None matched
VirusTotal Search for analysis
Name 6f1b272fdcd6282c_msforms.exd
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\Word8.0\MSForms.exd
Size 162.8KB
Processes 2320 (WINWORD.EXE)
Type data
MD5 68adc1609d71e8a4916f9a014814b3a0
SHA1 741b8c85803ee5c4f623869a2fe547a312a6d13f
SHA256 6f1b272fdcd6282c58432ea2c29048cdea91a6149b358ded9b97abec638d95fd
CRC32 0C4C4242
ssdeep 1536:IQWugL6wNSc8SetKB4YuiMOqQ/WVMO+O9sOHK7K2xBmsqsDPza7vKp:I+gjNSc83tKBduiMnWOXTK7K1Kp
Yara None matched
VirusTotal Search for analysis
Name ed70d69f28c6a0ab_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 2320 (WINWORD.EXE)
Type data
MD5 725d3ac5c75bfb6c367204128878b8b9
SHA1 7be00598fa916dabe90b797037ba0aa28b4a6339
SHA256 ed70d69f28c6a0abb4d9c88ceed5be246ea8083b592fa2f3ef93ecb0b66ef668
CRC32 EB97319A
ssdeep 3:yW2lWRdaf/W6L7EK1XK79UbgFItaOlEEllll:y1lWuXWmYKdK72MWaOhll/
Yara None matched
VirusTotal Search for analysis
Name 25de975189d4a803_~wrs{60c61b32-bbc2-43b5-a4f6-be13f5bb8201}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{60C61B32-BBC2-43B5-A4F6-BE13F5BB8201}.tmp
Size 1.5KB
Processes 2320 (WINWORD.EXE)
Type data
MD5 3a68c0259dd1a77beb30980db5cd557c
SHA1 c3dbc1ecef40c0c617ce9dc70e0e08f1a8058e7a
SHA256 25de975189d4a80349a1f652ec11205d2a5a9207547955c5e75172a72dfa022d
CRC32 7C110AC8
ssdeep 6:IiiiiiiiiiI4/9+Qc8++lPkalT4Mu8lPloBl/i5:W49+QG+3/z5
Yara None matched
VirusTotal Search for analysis
Name 7006308141c60538_39aadac8.wmf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\39AADAC8.wmf
Size 1.6MB
Processes 2320 (WINWORD.EXE)
Type ms-windows metafont .wmf
MD5 aac13daa435fa1192ba0475568742f22
SHA1 653766013830cebcf8d9789cfb3c7f6dc0ed10be
SHA256 7006308141c6053808e4ed038ef4e9e7c1280970bd51bf69bf15fab4e029faac
CRC32 37F36B39
ssdeep 1536:+NTM8WCgcFrlwsI+y34UDfgVxu4D23Rn87Xx5JV4tWvUKBxXL8+l1NvG/bYWdj0Q:IYoyJgs7IXZ1Dx1Z3AL7RtBp
Yara None matched
VirusTotal Search for analysis