popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 6f182ad0adc84516_~wrs{1b0e5190-7f9f-480b-a9d6-223fe9ba12ed}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{1B0E5190-7F9F-480B-A9D6-223FE9BA12ED}.tmp
Size 13.0KB
Processes 940 (WINWORD.EXE)
Type data
MD5 d2653486f260cd349e968f7e57329c8d
SHA1 56d02f2917d32399489e68b2620abd0712057dcb
SHA256 6f182ad0adc845162dcd1242d4b1dd52932b82833f493eaaf42c620145c15cce
CRC32 39B77FCF
ssdeep 384:eRTsADlWM6ygTTpfEEBRxVhRSv84dvXyB:YEM5gBvBRtV4lXyB
Yara None matched
VirusTotal Search for analysis
Name 053e144da1f029b3_fsf-{0e1eee64-e8c6-4e2a-9759-63cf07fd8988}.fsf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
Size 114.0B
Processes 940 (WINWORD.EXE)
Type data
MD5 378a455712b1fe29567faf344ebd2afa
SHA1 958bb40081becfeb315edac532aacff6e9bec26c
SHA256 053e144da1f029b3f32518eaefbd02118351b2d9d354566d4d8d01c4eceea3a2
CRC32 E0B4C73B
ssdeep 3:yVlgsRlzlcJeIBKULlpUSHlRlnjWlhV+OlWlgpl276:yPblzGcIIUR6SxCl6OMlgL22
Yara None matched
VirusTotal Search for analysis
Name eed12e4d97276a38_centraltable.accdb
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\CentralTable.accdb
Size 472.0KB
Processes 940 (WINWORD.EXE) 2556 (MSOSYNC.EXE)
Type Microsoft Access Database
MD5 e1b74bdf1c8b55ca771ca83800d3f836
SHA1 61627a702331c067d1fb3a9f8c469ea42d3321c8
SHA256 eed12e4d97276a381b9cba422918087f8cabd4836c09dc6d399e1f4ccdd036e2
CRC32 F355C3DC
ssdeep 384:WGvHJra6jISFKI7ITRuAFiMAismNuC3mVZO4FzZ:FhrDjT37KRutEssuCqbZ
Yara None matched
VirusTotal Search for analysis
Name ed04a7f2b89437b7_index.dat
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 196.0B
Processes 940 (WINWORD.EXE)
Type ASCII text, with CRLF line terminators
MD5 769d28a25e19e80c0390035e2e2c224f
SHA1 998c3e361b69c13c81edde7ea4506627253ce69f
SHA256 ed04a7f2b89437b7569e2a2e79761d9bdf4a86019be3e9466c3dc37b82adc993
CRC32 CEFF9EAD
ssdeep 3:bDuMJlwcXAlWCic6zKVI6V6NVQ6KhRxDUjMEMWqJHp6rp2mX1zfUMMQ1bdLJy:bCkAk/zKV16Ni6KhRxDUjMW92NQ1J9y
Yara None matched
VirusTotal Search for analysis
Name 482b956cbec97be5_weriiuiuetirefdguiertiudfgiiu[1].doc
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\weriiuiuetirefdguiertiudfgiiu[1].doc
Size 23.0KB
Processes 940 (WINWORD.EXE)
Type data
MD5 3ec71f52fa8513019b6711672666639e
SHA1 da9001f63057619f9bac3b7af80b34e9ce8124d5
SHA256 482b956cbec97be57187bd2d384f2a1005175159af8f323b07104f1cb5ea368d
CRC32 8DEDD34B
ssdeep 384:vQ1Jz0ti+8VVk2CZwwF8/M/3SkHWLYZOcOfBXgoBZbFdbVx2:Y1JIajk2CZwg8sC4oeLO9g41FdBx2
Yara
  • MS_RTF_Suspicious_documents - Suspicious documents using RTF document OLE object
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero
VirusTotal Search for analysis
Name eaf9cdc741596275_centraltable.ini
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\CentralTable.ini
Size 36.0B
Processes 940 (WINWORD.EXE)
Type data
MD5 1f830b53ca33a1207a86ce43177016fa
SHA1 bdf230e1f33afba5c9d5a039986c6505e8b09665
SHA256 eaf9cdc741596275e106dddcf8aba61240368a8c7b0b58b08f74450d162337ef
CRC32 BA4496DE
ssdeep 3:5NixJlElGUR:WrEcUR
Yara None matched
VirusTotal Search for analysis
Name e73d9fab37cd6bf9_centraltable.laccdb
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\CentralTable.laccdb
Size 128.0B
Processes 940 (WINWORD.EXE) 2556 (MSOSYNC.EXE)
Type data
MD5 0c2be3153a6602550b658e4bb5f073d5
SHA1 3fe515761d3c3744fcb12b10de15e0d94ed36ba9
SHA256 e73d9fab37cd6bf9f8a66e6de08e8178a7d5b5d7ee7bd314f7a25132b17ec5f8
CRC32 D05CFEE4
ssdeep 3:IkFafOkFaV:zQu
Yara None matched
VirusTotal Search for analysis
Name 4c894095851d274d_~$241.docx
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$241.docx
Size 162.0B
Processes 940 (WINWORD.EXE)
Type data
MD5 a69e92439e1090b957562e116a5c7b14
SHA1 79743ae68f69c7aaab21487120dc88721a54563c
SHA256 4c894095851d274d52c097ecdd4fb718625e02471e11605170f9f18115f57226
CRC32 E2DE33C3
ssdeep 3:yW2lWRdN0/tGoW6L7fdXK7YI0huIth9l3w0Qkzllln:y1lW6/tGoWmZXK7Y1hV7l3w0xzllln
Yara None matched
VirusTotal Search for analysis
Name 3ced11c437241bfe_fsd-cnry.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\FSD-CNRY.FSD
Size 128.0KB
Processes 940 (WINWORD.EXE)
Type data
MD5 9b82d14f4c0927b7b3df421be1029a12
SHA1 6db435ceb589e2f891a7e145a589ffa541ea00a9
SHA256 3ced11c437241bfeaa0acd90be69a2bd2e6603e26f98ee313b5bb47b207b5291
CRC32 C8B862E4
ssdeep 48:I31B3h1hx2hTm6khBctqIwn0ai5pFNocTFr36GxHJizJi:KvqyN2ai57V3JJizJi
Yara None matched
VirusTotal Search for analysis
Name fb3829fdcd24749b_fsd-{67b396ad-4b14-4e31-848f-bd20a13e0bb1}.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{67B396AD-4B14-4E31-848F-BD20A13E0BB1}.FSD
Size 128.0KB
Processes 940 (WINWORD.EXE)
Type data
MD5 c6a855cc4175e0a6b6e8e1f209fc1283
SHA1 5444ed6176432400e3ec68d8153365a2ba2a1a5a
SHA256 fb3829fdcd24749b2805000dcd6badea93689aa9f0fcb615da0dffc2ee2c2b1e
CRC32 4027D99F
ssdeep 24:I368kaM0B3cpK9+S0fspLMj798fXARlHSNZ6fn8tARJOiae9nT9VSG656ym4zl+S:I3pBswbBe6AvU4iAT4qnT9py7z75KoK
Yara None matched
VirusTotal Search for analysis
Name 3cc3a9b9dd0f2744_weriiuiuetirefdguiertiudfgiiu.doc.url
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\weriiuiuetirefdguiertiudfgiiu.doc.url
Size 125.0B
Processes 940 (WINWORD.EXE)
Type MS Windows 95 Internet shortcut text (URL=<http://1755848840/_______0o0-_0_________00o0_______0oo_______o0o_/weriiuiuetirefdguiertiudfgiiu>), ASCII text, with CRLF line terminators
MD5 555f2aa82c6d93851d3e82279da47c3d
SHA1 7e1860dd2163f9432ffbd52c44b9bc3180b19415
SHA256 3cc3a9b9dd0f27449a364d1c50ba9b46811763a40051f0670b7979daa506c1d2
CRC32 366F3B10
ssdeep 3:HRAbABGQYm/BQMnhKVI6V6NVQ6KhRxYMUMMQ1bdy:HRYFVm/BQMnhKV16Ni6KhRxYBNQ1Jy
Yara None matched
VirusTotal Search for analysis
Name 54eecb7f3248681e________0o0-_0_________00o0_______0oo_______o0o_ on 1755848840.url
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\_______0o0-_0_________00o0_______0oo_______o0o_ on 1755848840.url
Size 92.0B
Processes 940 (WINWORD.EXE)
Type MS Windows 95 Internet shortcut text (URL=<http://1755848840/_______0o0-_0_________00o0_______0oo_______o0o_/>), ASCII text, with CRLF line terminators
MD5 93165c5d2f503d50c20b84a4d54fcf15
SHA1 04a1aea55ff1f13c912133d15ec22192e724c0d2
SHA256 54eecb7f3248681efafc73cc8299b3d967b2c25a7184eae2d7ff77a997c5213b
CRC32 1F2E7AD7
ssdeep 3:HRAbABGQYm/BQMnhKVI6V6NVQ6KhRxQ:HRYFVm/BQMnhKV16Ni6KhRxQ
Yara None matched
VirusTotal Search for analysis
Name 833359557e8a4db6_fsd-cnry.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Size 128.0KB
Processes 940 (WINWORD.EXE)
Type data
MD5 5948901775e94dd66ffd2429506e6d9e
SHA1 9bca3447fbf24f5863179e6567c59a5961e566bc
SHA256 833359557e8a4db608ef9c5ee2aa6ff68d8246fa059d52264100edcde2b48028
CRC32 DC7080AE
ssdeep 192:1Ch6q5+uSrWvX/dl2reaUW1ci6yKZiwoAT08kq4S9iwoAT08kq4S:GgYd
Yara None matched
VirusTotal Search for analysis
Name 5bac5c16a7e20d30_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 940 (WINWORD.EXE)
Type data
MD5 8db55e7e7add6d419bdb59bb091418ea
SHA1 991375df74da8485474e8f4b64e46befe1775ddd
SHA256 5bac5c16a7e20d302d2b7e56004f9b5ff9d634df5d747ecca8a60cd8b7a3c23a
CRC32 0F58A9F6
ssdeep 3:yW2lWRdN0/tGoW6L7fdXK7YI0huIth9l3w07Xn:y1lW6/tGoWmZXK7Y1hV7l3w0rn
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{be4cdc89-8279-41d0-b946-07cb50716005}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BE4CDC89-8279-41D0-B946-07CB50716005}.tmp
Size 1.0KB
Processes 940 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name 0877a3fc43a5f341_~wrs{c4e2f51f-da36-49fc-b9d5-108ccc5c54a4}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C4E2F51F-DA36-49FC-B9D5-108CCC5C54A4}.tmp
Size 1.0KB
Processes 940 (WINWORD.EXE)
Type dBase III DBT, version number 0, next free block index 7536653
MD5 28adf62789fd86c3d04877b2d607e000
SHA1 a62f70a7b17863e69759a6720e75fc80e12b46e6
SHA256 0877a3fc43a5f341429a26010ba4004162fa051783b31b8dd8056eca046cf9e2
CRC32 8E6A7128
ssdeep 3:Ghl/dlYdn:Gh2n
Yara None matched
VirusTotal Search for analysis