Dropped Files | ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Dropped Files | ZeroBOX

Name	349416140075a41f_fsf-{0e1eee64-e8c6-4e2a-9759-63cf07fd8988}.fsf Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF
Size	114.0B
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`2b28dd372cef777c0e9c6abb956085cc`
SHA1	`8be44a0a3ffa5ce6bae6407d06673e46efb47359`
SHA256	`349416140075a41facee18b4024de2f9148684fe6a1b7b9ec51bd1304d96d735`
CRC32	`2C831EFF`
ssdeep	`3:yVlgsRlzYWLNkhlUXRYRlK2Gl6SDHn+7lWUC/l276:yPblz7uz+YDK2Ghe7lWUCt22`
Yara	None matched
VirusTotal	Search for analysis

Name	e7c30dabe126b23b_centraltable.accdb Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\CentralTable.accdb
Size	472.0KB
Processes	2280 (WINWORD.EXE)
Type	Microsoft Access Database
MD5	`b72a46773279d852c16c878d2dedaa8e`
SHA1	`e1352495cfc7e56de511c60599a7314b5c2eb2cc`
SHA256	`e7c30dabe126b23bc783a7c0804e0b69ce1aa02745af446b205ae354be090d0f`
CRC32	`7E375C86`
ssdeep	`384:WGzgYZCO/ISF2I7ITRuAFHC0uQ5NKdmVZO4FJZ:F1CuTD7KRuUpjjKshZ`
Yara	None matched
VirusTotal	Search for analysis

Name	eaf9cdc741596275_centraltable.ini Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\CentralTable.ini
Size	36.0B
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`1f830b53ca33a1207a86ce43177016fa`
SHA1	`bdf230e1f33afba5c9d5a039986c6505e8b09665`
SHA256	`eaf9cdc741596275e106dddcf8aba61240368a8c7b0b58b08f74450d162337ef`
CRC32	`BA4496DE`
ssdeep	`3:5NixJlElGUR:WrEcUR`
Yara	None matched
VirusTotal	Search for analysis

Name	e73d9fab37cd6bf9_centraltable.laccdb Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\CentralTable.laccdb
Size	128.0B
Processes	2280 (WINWORD.EXE) 2544 (MSOSYNC.EXE)
Type	data
MD5	`0c2be3153a6602550b658e4bb5f073d5`
SHA1	`3fe515761d3c3744fcb12b10de15e0d94ed36ba9`
SHA256	`e73d9fab37cd6bf9f8a66e6de08e8178a7d5b5d7ee7bd314f7a25132b17ec5f8`
CRC32	`D05CFEE4`
ssdeep	`3:IkFafOkFaV:zQu`
Yara	None matched
VirusTotal	Search for analysis

Name	7cd848a3d4126a43_fsd-{9b8d342f-d924-4b1f-9b1d-bfd95bbafb71}.fsd Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{9B8D342F-D924-4B1F-9B1D-BFD95BBAFB71}.FSD
Size	128.0KB
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`ae040071b5963c615741ac80abae6cda`
SHA1	`e43ff6590b298e8d47c4e6cefd4cdf2d1c65f7a5`
SHA256	`7cd848a3d4126a436d1fe1100b877c6bf9dc03aace3c028fee56050513035077`
CRC32	`38EC2F35`
ssdeep	`24:I37/aM0B3cFIak6OUjUjzUHiIlxgUG0UizvXUiURyBUjrJ2LKXKtYU+B4UqEdm4D:I37gBFzWY0XEyvL+P7z7vlLsxRLsx`
Yara	None matched
VirusTotal	Search for analysis

Name	8e0b796cb145a531_fsd-cnry.fsd Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
Size	128.0KB
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`45b83d1e26f0f76ed8016c932b5ce5dd`
SHA1	`ee08fe0de3a314a9451ddf727fd000ef2b5c70cc`
SHA256	`8e0b796cb145a531cb48e006753c3500fe46ba0ac61d3b3916222b17fb53c56f`
CRC32	`9148D147`
ssdeep	`48:I3IMBgG8RSObInyhdVy1RsFZRtR7Gs0fGr3oYn0R9Dn0R9:KIM58VbInyhjy1OZfXY+310D0`
Yara	None matched
VirusTotal	Search for analysis

Name	c3b8ce68f6a4eb77_fsd-cnry.fsd Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Office\15.0\OfficeFileCache\FSD-CNRY.FSD
Size	128.0KB
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`6275e8a7e6b46e5dbfd936cb1d4888fe`
SHA1	`1c21b0bc934f275559fa71b69c32325e5180733e`
SHA256	`c3b8ce68f6a4eb77a8cfe530938566acae58772b8d33445ca59afd170eb5d725`
CRC32	`4D4D30EB`
ssdeep	`48:I3XHyBCKdYDm9bVHnOkODPBGBab/lIsV7r35SGyMBSfEPSfE:K3KCaYi9pHO9BUarH3BBS8PS8`
Yara	None matched
VirusTotal	Search for analysis

Name	4826c0d860af884d_~wrs{498be60c-a047-444a-93ab-389d64ee0690}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{498BE60C-A047-444A-93AB-389D64EE0690}.tmp
Size	1.0KB
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`5d4d94ee7e06bbb0af9584119797b23a`
SHA1	`dbb111419c704f116efa8e72471dd83e86e49677`
SHA256	`4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1`
CRC32	`23C03491`
ssdeep	`3:ol3lYdn:4Wn`
Yara	None matched
VirusTotal	Search for analysis

Name	1e0f4e72ebb1291e_~$urt fine.doc Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\~$urt Fine.doc
Size	162.0B
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`c4f00e2f429067806e77b608432d9242`
SHA1	`c2ff62149bdbd32a2c144869766d93151a48ea6c`
SHA256	`1e0f4e72ebb1291e4f493c14f12424ec4197a4329749f09d3aa2c5b45abca535`
CRC32	`E06B5201`
ssdeep	`3:yW2lWRdaWoW6L7ACXK76llcItqSe4hF3t/:y1lWmWoWm02K76lBqlsF31`
Yara	None matched
VirusTotal	Search for analysis

Name	5c632292394979eb_wellcome[1].htm Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\wellcome[1].htm
Size	7.1KB
Processes	2280 (WINWORD.EXE)
Type	HTML document, ASCII text, with very long lines
MD5	`cdd33ffa502cbffec6e64c4574846a89`
SHA1	`4e57b2d731513551b26f684b3d2871eb0f8cc14d`
SHA256	`5c632292394979ebf07b47cc5f9dd62a04c53cff3f6c85fa26d259612d010f75`
CRC32	`0B08BD50`
ssdeep	`48:Ye+xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ6xuQ68:vUP+miLSAwD`
Yara	Win_Trojan_Formbook_Zero - Used Formbook MS_MSDT_Vulnerability - Microsoft Support Diagnostic Tool (MSDT) Vulnerability
VirusTotal	Search for analysis

Name	2b840d77ee68ea8d_~wrs{2e52a0ff-e321-44f3-8c73-2cb59db44767}.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2E52A0FF-E321-44F3-8C73-2CB59DB44767}.tmp
Size	1.5KB
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`616a7ad00d0249b9b2c7858bc32d7694`
SHA1	`1d8036a57215742e2ad6fc4851e1bb7b8187b783`
SHA256	`2b840d77ee68ea8df656edae92f10b4c744651ff8abefc59da304f0910973b9e`
CRC32	`547E7741`
ssdeep	`6:olgI5lNcY2Iel5E7l8iIjJymN/wPxZfrmN:4v2iBUJyxZfi`
Yara	None matched
VirusTotal	Search for analysis

Name	b633483f29b2ce91_~$normal.dotm Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm
Size	162.0B
Processes	2280 (WINWORD.EXE)
Type	data
MD5	`c60bcfb4c77472e00167d9abc0e85405`
SHA1	`22f925566c70c6bfbe7a18f24553fa1cb06c369b`
SHA256	`b633483f29b2ce916a9d74d7f52440bf785d4f213203f4e7e814638516bb0392`
CRC32	`33EA3FBA`
ssdeep	`3:yW2lWRdaWoW6L7ACXK76llcItqSe4hVt:y1lWmWoWm02K76lBqlsVt`
Yara	None matched
VirusTotal	Search for analysis