popup
Dropped Files | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Dropped Files

Name 8666abea958f4bb5_fsd-{389671bc-de2d-40cb-ae07-bedd0fdc7a74}.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{389671BC-DE2D-40CB-AE07-BEDD0FDC7A74}.FSD
Size 128.0KB
Processes 3048 (WINWORD.EXE)
Type data
MD5 29192fdead3b5ecadd048792d2d47b3b
SHA1 0b43ab3ce505e73dcb4e2c6d776d22a595502b7c
SHA256 8666abea958f4bb57f6beec1e29192a3889a4f151ae7d8775a28b2d9fa3f1866
CRC32 7BE6EB20
ssdeep 96:K04y15Y5elF3VvH5qs48eILRcoGYQMOhvTAYcj8IT5cnAQU:HhSelFjq1ILDGYQzhvTbcj8ITCnAQU
Yara None matched
VirusTotal Search for analysis
Name d23842dc2f2e1d28_fsf-ctbl.fsf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF
Size 114.0B
Processes 3048 (WINWORD.EXE)
Type data
MD5 53cf5eb58598dd829c27a57378c65477
SHA1 4a1e2393f0c451240136698192ab958d24e980ae
SHA256 d23842dc2f2e1d2835c978ac19cefa42575d086e7d58a3824242f0b14222e88b
CRC32 3D52D3CD
ssdeep 3:yVlgsRlzNlt90kgXhs0SlkOVIS9lgVb7xNYt276:yPblzNHkdS+OqSAVMt22
Yara None matched
VirusTotal Search for analysis
Name 4826c0d860af884d_~wrs{4f61640f-1987-4b52-bdaa-a3b8f2d777b2}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{4F61640F-1987-4B52-BDAA-A3B8F2D777B2}.tmp
Size 1.0KB
Processes 3048 (WINWORD.EXE)
Type data
MD5 5d4d94ee7e06bbb0af9584119797b23a
SHA1 dbb111419c704f116efa8e72471dd83e86e49677
SHA256 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1
CRC32 23C03491
ssdeep 3:ol3lYdn:4Wn
Yara None matched
VirusTotal Search for analysis
Name 30d58e3fe0529d8b_fsf-{0e1eee64-e8c6-4e2a-9759-63cf07fd8988}.fsf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
Size 114.0B
Processes 3048 (WINWORD.EXE)
Type data
MD5 086a3cf147b26b3fba177d2ed644425d
SHA1 d93a3de04ad96ec425dd41617bce2eb5009f4dfa
SHA256 30d58e3fe0529d8b37088825574099fd26371d13ffea2e6e91ae6a9e706a0ab7
CRC32 316406E3
ssdeep 3:yVlgsRlzvlwgRJFQI1K0dWgX3P0lHSc7276:yPblzvlVRJuIkUUyO22
Yara None matched
VirusTotal Search for analysis
Name cb99a23b51ba436e_ztnu9wps.dll
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\ztNU9wPs.dll
Size 40.0KB
Processes 3048 (WINWORD.EXE)
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 d7e9217c2bcf1e8519458cca63f2b69f
SHA1 a4b9eee0344aadf5bc328546874ecd59b463826c
SHA256 cb99a23b51ba436e783f4f115d8f01327703d606b9edde2d8b7054cd7953a8be
CRC32 8E29F820
ssdeep 768:iBOLZWpqDH0uD7YyolR29AxfmjlIft/JKn:6OMGm29AlIIl/JE
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_DLL - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
VirusTotal Search for analysis
Name 883b49e953c7861b_knolls[1]
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\knolls[1]
Size 114.5KB
Processes 3048 (WINWORD.EXE)
Type Rich Text Format data, version 1, unknown character set
MD5 ea6f3e8c2fa7c995a607224038b7f63a
SHA1 0d77b8383b3a0630757c4543d8d7ab40aecb7635
SHA256 883b49e953c7861b3d1a854ae7b10c93a135898fda6198d5fdfedfa185808c92
CRC32 CB5D593A
ssdeep 1536:qsBa9WZU0C30cUMmKUyc61XH6QTKHQKCXna1k7n/TwPhg6Lqjc:qsSp5vhQq4
Yara
  • Rich_Text_Format_Zero - Rich Text Format Signature Zero
VirusTotal Search for analysis
Name a8a1e7272024fa09_fsd-cnry.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Size 128.0KB
Processes 3048 (WINWORD.EXE)
Type data
MD5 65c9b99fe2fa91dd9d9070828b4a7dec
SHA1 14d9c087b067396bbc11d72b431af8f1f835ee8d
SHA256 a8a1e7272024fa0948df516386d0952a213d06e51816bc76b06d824d7d4d9890
CRC32 AA5C507E
ssdeep 48:I38kwBykxCKXCKHLE0CKYbk2VrxChsICuM7aUQIrKwUxTITsH:KM5xJXJrE0JY4KCaUiaUQg+JEsH
Yara None matched
VirusTotal Search for analysis
Name 59fc4cb4e8268040_~$an0001.doc
Submit file
Filepath C:\Users\test22\AppData\Local\Temp\~$an0001.doc
Size 162.0B
Processes 3048 (WINWORD.EXE)
Type data
MD5 502639f819abe96cd2dd9d0c41e505ba
SHA1 019750ab46050da7bbf985ee337e8577a9bfe76a
SHA256 59fc4cb4e8268040b6900f02c393996133bbe752aab0c55e978715af88387c9e
CRC32 5F48B8C0
ssdeep 3:yW2lWRdvL7YMlbK7g7lxIt50iSjlVtDmXyXhn:y1lWnlxK7ghqqF6ixn
Yara None matched
VirusTotal Search for analysis
Name eb3b3fdd1b4229e8_fsd-cnry.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD
Size 128.0KB
Processes 3048 (WINWORD.EXE)
Type data
MD5 e3e81d2e331af9cd4b602108d35f62ff
SHA1 adbf2862194c8d9d7683aa7ce725c5a324c0a280
SHA256 eb3b3fdd1b4229e8c81ff6e40dc8b888beb266fcccd2c650122705e8d7de17a8
CRC32 4D860E59
ssdeep 96:Khmks3JdtiCGilAB+pxrsfUhTEsC7HC7XH:GtsT8CGyAB+pxrsMhwsC7HC7X
Yara None matched
VirusTotal Search for analysis
Name ac5f55a119b8894f_e0d7677a.wmf
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E0D7677A.wmf
Size 162.0B
Processes 3048 (WINWORD.EXE)
Type Targa image data - Map - RLE 18 x 65536 x 0 "\005"
MD5 a53ff3b2b74b0493cd2dd5351bcb2760
SHA1 982c525be61d9769829d2f0a94db5d61d95ba050
SHA256 ac5f55a119b8894f347a6e85328d4a1e7ba350e0d4ea98ce1d3b2f95faecb5f2
CRC32 8F730840
ssdeep 3:Vmcll/6/lyll6/lollvlgiolog/lLneVOoEXaQNGbV91/l/eXavt/y:MUl/6t2oto90ogtqAozQNGbVPQXC1y
Yara None matched
VirusTotal Search for analysis
Name 6e36c9ed64ff02aa_~wrs{097c9d28-ad7a-4b5d-826b-7d8dc71971e6}.tmp
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{097C9D28-AD7A-4B5D-826B-7D8DC71971E6}.tmp
Size 1.5KB
Processes 3048 (WINWORD.EXE)
Type data
MD5 d9c7d64a153ccc9fcee463a4a33996a2
SHA1 25d75aae0081f08e508bbe71958efbd9a477cc24
SHA256 6e36c9ed64ff02aae4c54d97288fb12278e63a27f9624212afc1c2f3f71d16ed
CRC32 EBFC6B34
ssdeep 12:hKPHMWwAwNN8MClMdc1MClXZlgX8pKYP7ogJGztl8O:hK/MWwAQaMClMu1MClXZlgX8xpJs
Yara None matched
VirusTotal Search for analysis
Name d516a371b6fc0a52_~$normal.dotm
Submit file
Filepath C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size 162.0B
Processes 3048 (WINWORD.EXE)
Type data
MD5 56a4532b2fc2cf6fd4ec62a29758d231
SHA1 60f68bd8ac5b3f7290daa236bebd5f9c0f1510fd
SHA256 d516a371b6fc0a5270a1323f271bc2a36bc34f9cf06c783a642020c0da8948c3
CRC32 E93E4529
ssdeep 3:yW2lWRdvL7YMlbK7g7lxIt50iSjlVtNmk/tyXhn:y1lWnlxK7ghqqFNT/tyxn
Yara None matched
VirusTotal Search for analysis
Name 0d396d6e3c0a327f_fsd-{36d15ed8-a81d-461d-9898-ef6204946678}.fsd
Submit file
Filepath C:\Users\test22\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{36D15ED8-A81D-461D-9898-EF6204946678}.FSD
Size 128.0KB
Processes 3048 (WINWORD.EXE)
Type data
MD5 986171f4499bde6bc5a00736ca239702
SHA1 870219a2790a151d974518f8b34ba8f7fe245bc8
SHA256 0d396d6e3c0a327f817ac0a4bf8aeadd17cff369dd021ff7ecb4fcb432708a4a
CRC32 FA0BDCD2
ssdeep 48:I36gkHrBrm83qV+fCPGZQ9XDSgLdhTl+/xhCOqO3:K6FpnCQ7C1g
Yara None matched
VirusTotal Search for analysis