Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	24922db2148ca3d3_faawoqrzpleqfsgvv.docm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\FAaWoqRZplEQFsGvV.docm
Size	273.3KB
Processes	8636 (serv.exe)
Type	data
MD5	`19b0656634435462e896fef744aa57e7`
SHA1	`95ffda562ba8403f95a4a9c62835998f25098aee`
SHA256	`24922db2148ca3d3dd35d6b7d6faeeba2d560637007c80833cb31e7b3aedd2e8`
CRC32	`4B19E78A`
ssdeep	`6144:MhnRaQKsSbHY9fFFd4nIjAnBbP9mUcsOrxQLPGhVX1:MYQKsSbH49AIMndP9mUcsOrUAF`
Yara	None matched
VirusTotal	Search for analysis

Name	4cd8ead364436c8e_rqkrdtpjokbtm.rtf Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\RqkrdTPJoKBTM.rtf
Size	880.5KB
Processes	8636 (serv.exe)
Type	data
MD5	`f45281b74f6b85980c15038f0fa2a659`
SHA1	`d5dff383e5d0520507e7d5d4450db8d9e1a682b7`
SHA256	`4cd8ead364436c8e7d3a10faef65d94ef467688632fd9564fef5e008a9b270f8`
CRC32	`AE792451`
ssdeep	`24576:4USlPLsgW60gqgjaGWyfOJczDEoEUm8GrBidZ29wjC:4nw80ySuAwbrgwe`
Yara	None matched
VirusTotal	Search for analysis

Name	b9357b440255928f_hvmhmattiph.docx Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\hvMhMATtiPh.docx
Size	381.3KB
Processes	8636 (serv.exe)
Type	data
MD5	`92b0d39b577a2815bdd2917654ed31f6`
SHA1	`3dc8f3c5de700ec132eb92be7bd4a4bef4bb8807`
SHA256	`b9357b440255928fc05dcf16285603c79f099b519a389c21bcec07a68dbc33bf`
CRC32	`F520A326`
ssdeep	`6144:1ia247cDQTx8h7hsVKtwvgxbVETxdOgn+MJC0W76uhQc220e+wDAjDekhg1BuoTB:oa247cc9LK2wxETugn+Ji20n/jDeUeHl`
Yara	None matched
VirusTotal	Search for analysis

Name	59908b471631a426_xtgoutelmxzuthf.rtf Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\xTgoutelmxZUthF.rtf
Size	542.0KB
Processes	8636 (serv.exe)
Type	data
MD5	`2d80b016e7bfa57c26c056f8e9b8a453`
SHA1	`3f9fe4cfdde345d293337af485492612f99c7dc4`
SHA256	`59908b471631a4262ba147f7f133618343630a64b3e49a11123616b3c7f62bf9`
CRC32	`DEDF1EE4`
ssdeep	`12288:WEgsC9TgENOtvYiObhpRH6L7pxv1HzylgtAUCWcT76K5:A98EQtsbjRHQpPHzy2tHuSm`
Yara	None matched
VirusTotal	Search for analysis

Name	ff006c86b5ec033f_Files.zip~RF1492356.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files.zip~RF1492356.TMP
Size	24.0B
Processes	8636 (serv.exe)
Type	Zip archive data (empty)
MD5	`98a833e15d18697e8e56cdafb0642647`
SHA1	`e5f94d969899646a3d4635f28a7cd9dd69705887`
SHA256	`ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c`
CRC32	`612F49D6`
ssdeep	`3:pjt/lC:NtU`
Yara	None matched
VirusTotal	Search for analysis

Name	20d95e2088d0956a_wmxfdlmbat.doc Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\WmXfDlmbAt.doc
Size	341.2KB
Processes	8636 (serv.exe)
Type	data
MD5	`c4fe0231a62ac1a333491872bae8a596`
SHA1	`6d6c9e16945247efc5d7440fa2d3fd6d50d586b2`
SHA256	`20d95e2088d0956af485f33b94fd4ba158bb966b20b418a46f21abea25d384ef`
CRC32	`8B32DD6E`
ssdeep	`6144:+ZQVO2O3G8ta1by2rpvlUb8E1ESV0YAROya86FSJxPgxHGS2vv6kHQsK7:wQcT3Lib95l08KEqLTFSAxHGvCmE`
Yara	None matched
VirusTotal	Search for analysis

Name	892b1a7d5f022759_qaxytxewuxzprzy.rtf Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\QAXyTXeWuxZprZY.rtf
Size	678.2KB
Processes	8636 (serv.exe)
Type	data
MD5	`ea1492ef0406e545a2e2581829163d45`
SHA1	`02a498220bcdea29f1ef9010caa9c2a219ff7b48`
SHA256	`892b1a7d5f02275906d80346f3dbf8f192a08d5dfdb337bf45c428ab8e8b92ff`
CRC32	`DDDAA1F1`
ssdeep	`12288:rEGawY9BhBkdwjHq+osdil+PgylFdmpsMRLyZEIKliwMbsgfExgjfNrgLHSCQAP:rwZ9BPkdwjHq+4l7CFd2ATwM52gDJPCn`
Yara	None matched
VirusTotal	Search for analysis

Name	6835f8c4e7b16494_gxefffgqwhrjd.rtf Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\gxeffFGQwhrjD.rtf
Size	954.0KB
Processes	8636 (serv.exe)
Type	data
MD5	`d3ee1bfb072f0c78ff1a3a1dcf96ac8d`
SHA1	`87e92f6b8c56d81385c03445427376d91d7f3f74`
SHA256	`6835f8c4e7b164945d3d2e64c18648cc6a15a50dc22c4a62bdb7e5f4ccef718e`
CRC32	`E1C0A99E`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	f16ed6f7ff049e79_onyeiyahxng.docx Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\ONyeiyAHXnG.docx
Size	898.8KB
Processes	8636 (serv.exe)
Type	data
MD5	`1c3a0afd5428ea2b1e11aeea596d2dbc`
SHA1	`e41928731b20b7420e6f1cceaaec451e400cac43`
SHA256	`f16ed6f7ff049e79be0a98206dfad09ccf349ae89161d16b17de023e43db177f`
CRC32	`CA3EE9A8`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	937056fc36d5ebb5_zsvgcyocxlkypotpz.doc Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\ZsVGCYOCXLKYPOTPZ.doc
Size	514.5KB
Processes	8636 (serv.exe)
Type	data
MD5	`d7910451b7a2c8be39e1466d6f1b5ddb`
SHA1	`806340b07ef507c5a0ddaf1e7f8e24d03dcca664`
SHA256	`937056fc36d5ebb5d39ecb1a76bc53b4c87fb24ef5e05db4755ab745a1b4ffc3`
CRC32	`023135C6`
ssdeep	`12288:kri6IML+0YBWWV8citH8/ACJlPw3gU8O5J50uX9TMoJgD:krJTL6VvitH8/9w3gU57ZVMbD`
Yara	None matched
VirusTotal	Search for analysis

Name	1613dfca627df925_jsgirplhspm.txt Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\jsGIrPlHsPM.txt
Size	152.3KB
Processes	8636 (serv.exe)
Type	data
MD5	`678f200bbdcbd766738c556fc32a58d8`
SHA1	`d04d2b7feb4ae5217b2e506b7029d2932a1b897d`
SHA256	`1613dfca627df92567ddad65992d171f58ce44f6606f6ce6a72b0d0d17641912`
CRC32	`D85EC086`
ssdeep	`3072:TUzncZdDUeK0wBA1fwBwwLjbI3czjlpIpLdxgQ5SGP8RSn5DD+ZhTCn69ABgd:gwT8IRQlipLzSFcnFDiFSA`
Yara	None matched
VirusTotal	Search for analysis

Name	cde468f4deeca2b2_fowratdvst.docm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\FOwRatdvSt.docm
Size	625.2KB
Processes	8636 (serv.exe)
Type	data
MD5	`68e1490fdc2af0fc3c5e8ad37db6d53a`
SHA1	`93a4a61f5703069393623bc4e89d1fe36023af3c`
SHA256	`cde468f4deeca2b2040a03d9b62840c1b524e311ad240b906980f2810693d2cd`
CRC32	`C0D062E5`
ssdeep	`12288:1WSE1iMAghMcFabgqQ5MMFOoIO7K+BifDmJyOusrE1qyyJj9DKnTNUzhTYpM:1RE1tfhMekgvMYOo97K+5sOusrECdKJQ`
Yara	None matched
VirusTotal	Search for analysis

Name	f7a73ab6af16f6f7_atwjkhhgpixqpqbcw.doc Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\ATwjKHHgPIXqpQbCw.doc
Size	885.7KB
Processes	8636 (serv.exe)
Type	data
MD5	`cab9ead02dd73038c3b38e6e1e809629`
SHA1	`89d84eb971b789dc922880ce0b5b805cfeddeac8`
SHA256	`f7a73ab6af16f6f760f6a5b1a82669c41736f85c537bb2134370738272d51b3a`
CRC32	`9BFEB3BD`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	12ddde9668290cf1_files.zip Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files.zip
Size	5.2MB
Processes	8636 (serv.exe)
Type	Zip archive data, at least v2.0 to extract
MD5	`fb3c53fd5f501c39a67253995c6bc9a8`
SHA1	`84ceb6682c3941be8a9628258a269f981a891fb6`
SHA256	`12ddde9668290cf135de66fd7f208126013315e96a516370b0dfc3d24d40fd3c`
CRC32	`ADDD5D2F`
ssdeep	`98304:T77t/l7bEU59UAe1boqo7Jc+4uquEq0YRX3wj5kFN6wVDiHbATkajXtUMxR:Tn5lHEU59ruboRtqtls3wjeLMgXtv`
Yara	None matched
VirusTotal	Search for analysis

Name	79f6c5e4f3a10812_zymqviojrv.rtf Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\ZyMQVIOJRV.rtf
Size	256.9KB
Processes	8636 (serv.exe)
Type	data
MD5	`3ebb204274a423d7ce60e83ca86c5346`
SHA1	`24dd70a81dfcff49010806ee561eb6488f15e41c`
SHA256	`79f6c5e4f3a1081263ffe683c9bbe5d2634edd984cc70f9d2dea9e77c108d05b`
CRC32	`5E47E4A6`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	f528ec6ebffb101f_jdhejjbwhuxqp.doc Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\JDHeJjBWHuxqp.doc
Size	230.1KB
Processes	8636 (serv.exe)
Type	data
MD5	`2eba488d541f8f3fda77fabd130bef16`
SHA1	`5875ae06399d39f787a38738aaebecf8d873ef74`
SHA256	`f528ec6ebffb101f76457eef88e295b7ca290d134e5386907cda333d77c1c617`
CRC32	`03EF1FA4`
ssdeep	`6144:3axipu7kSy7EuiI4j3nhsY3QiIfWnEOY/p:qxipu7zux4rhsY3QiIfWpYR`
Yara	None matched
VirusTotal	Search for analysis

Name	9e6e4772050998a5_readme.xls Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\readme.xls
Size	10.0B
Processes	8636 (serv.exe)
Type	ASCII text, with no line terminators
MD5	`eb6b6c90251ab33cee784713c451e6d8`
SHA1	`451685e9efac4a6dc1fee73ec53ffb6b2c4c38b5`
SHA256	`9e6e4772050998a5c0dc3c61acf3dab0a7e594566171fa5746d6b62f9598efb6`
CRC32	`22598B08`
ssdeep	`3:IS:7`
Yara	None matched
VirusTotal	Search for analysis

Name	12c78c9260e3a063_cxmlmlmlmjidcp.doc Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\cXMLMLMlMJidCP.doc
Size	975.8KB
Processes	8636 (serv.exe)
Type	data
MD5	`cbd0b8b7f8282d062ec9d05ca4c1e662`
SHA1	`065d880f19ac4cd67504037614eaee8f4059cb15`
SHA256	`12c78c9260e3a063b73d0e1b782f249ea8fa75e8c7541c589d67449ef8828428`
CRC32	`16A9FB54`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis

Name	bcd837a5cd3f2231_edzypzbsmdbxj.docx Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\EdZYPZbSmDbxJ.docx
Size	175.8KB
Processes	8636 (serv.exe)
Type	data
MD5	`0b6d0ee7bd9d48a86e1c9b4ba1f9f779`
SHA1	`6920b558ba107cba7d12ed1ca0521cc9c3ff367c`
SHA256	`bcd837a5cd3f22318d2bdf62c3009bd447d1ad630965bbab0adf36567c7b556e`
CRC32	`19488A7F`
ssdeep	`3072:X4TrgIHLVNDmHd6gfW+5hSp+nmN3Ze6HFV5f0oanvJQD2gqqON6MM6:X4TJHLrDmHMgfnvSve6Hr5KJQD2gXMp`
Yara	None matched
VirusTotal	Search for analysis

Name	88e65aa69858b179_cjgznzwbcxyhnbkzq.txt Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\CJgZNzWBCXYHnBkZq.txt
Size	31.3KB
Processes	8636 (serv.exe)
Type	data
MD5	`78af5f2f35746bdaa5499e29daca737d`
SHA1	`7ac488b31b66b81fcd7711453acc6efede1aaf32`
SHA256	`88e65aa69858b179558b77e4542670d29399e83fb04dd4f207cbe9ca8ddf3d13`
CRC32	`71A2CC37`
ssdeep	`768:2zA1C82+UYugHPAH/Ug2+I7TcJTvfFAzl6vj+vFepKb:2MCaUYhIUgus9vdAzl6vjOb`
Yara	None matched
VirusTotal	Search for analysis

Name	c3eebed723a5a587_dbjuzopwaeuhmr.docx Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\dBJUZopwAEUHMr.docx
Size	488.0KB
Processes	8636 (serv.exe)
Type	data
MD5	`f5df012ee3928f9720fdbaa55e13cc03`
SHA1	`e07d26b59219a53862b056c7e9636bb0e9670fb1`
SHA256	`c3eebed723a5a5877190936d3fe7db177bbc78b566d6c8355cf30c4203fcf821`
CRC32	`D40B91FF`
ssdeep	`12288:tRAEKY0NcYlxxVAH2ToBml1pGqp+H5IPX+y9iP:tRCc6xVgK1pG0PF98`
Yara	None matched
VirusTotal	Search for analysis

Name	8d56ea9b06933282_recommended.4nn Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\recommended.4NN
Size	49.0B
Processes	8636 (serv.exe)
Type	ASCII text, with CRLF line terminators
MD5	`18dd4466fbd31987aaaf75dbff2bceed`
SHA1	`e8ca528a5f6beaf2d03e4682cf39416be3eeb2e7`
SHA256	`8d56ea9b0693328266fc3dfe3a5156102030e7e83c7a515466c8bde27e4aadc4`
CRC32	`B3D0916E`
ssdeep	`3:jSIuHXFelnBOQ:j7uHXFelnB5`
Yara	None matched
VirusTotal	Search for analysis

Name	4acabf712361cecc_sbyekmdwyn.docm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\Files\sByekmDWYN.docm
Size	687.0KB
Processes	8636 (serv.exe)
Type	data
MD5	`b02d99e427bcbb0cde5927694a35dc61`
SHA1	`dbd860832b102d5c0ecadfd652d04595236225d9`
SHA256	`4acabf712361ceccfa30cfe858d8641751f3357b552438fcb4ed7b7e5466738a`
CRC32	`D679D58F`
ssdeep	`3::`
Yara	None matched
VirusTotal	Search for analysis