Dropped Files | ZeroBOX

Name	0248deff83e7bff2_chordates Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\chordates
Size	234.5KB
Processes	1648 (notebyx.exe)
Type	data
MD5	`dd10ffdda96933cd0bc9fd454cf8eac0`
SHA1	`062f83720efca9b274216bb600c4606e71e389a8`
SHA256	`0248deff83e7bff2d0df0927a3672a17d1bca3fc3219170475335233acdebc65`
CRC32	`06D25926`
ssdeep	`6144:Q9tvxPBwuOt6OcOvwabvTDAWWWhGae2O5rx0Vk:Q9tvMjhnDeas5rxL`
Yara	None matched
VirusTotal	Search for analysis

Name	257cc67ae73c0ba1_autC08C.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\autC08C.tmp
Size	151.8KB
Processes	1648 (notebyx.exe)
Type	data
MD5	`1c70a8422ee1628c39ede641ad751c60`
SHA1	`e1c6aaae085425c37711c3ae0594b58966673660`
SHA256	`257cc67ae73c0ba16909ac15fe93e1ede8929650140fa9ef7d1fcbcbbf8ed5c0`
CRC32	`484A8F87`
ssdeep	`3072:AUE6XXJmfA5JswN1QW4HDESMChNKlfmCrAMkVFXviYgmYICG5xJ:tEcXJ00swN1QW4DMksfZruFqYgmYI3N`
Yara	None matched
VirusTotal	Search for analysis

Name	7a6c64255a6e3340_autC0AC.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\autC0AC.tmp
Size	15.1KB
Processes	1648 (notebyx.exe)
Type	data
MD5	`7d04c5f3b79c715db76f37e8fcbf967b`
SHA1	`759f640f2cc81788631304eea6184208006b9477`
SHA256	`7a6c64255a6e3340faeda5e702126f3bf71406238f1b9e3dbb0e5caf2bf9c8d0`
CRC32	`2704FCB9`
ssdeep	`384:R6fLPWze1ds0nVNyPHZF7TURJ6moILs9Lxyz:4Wy7VnVNy/ZFzxILOLxo`
Yara	None matched
VirusTotal	Search for analysis

Name	745b1f219c78cdd9_fondaco Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\fondaco
Size	196.0KB
Processes	1648 (notebyx.exe)
Type	ASCII text, with very long lines, with no line terminators
MD5	`65341ece21979b7ddcf1a19402e881c8`
SHA1	`a33aa70aed1f24edb428d3d5599c10a3b865f61b`
SHA256	`745b1f219c78cdd90123a8bae1b374fd76294389923e51155138969ab8c2ff96`
CRC32	`FE7C945B`
ssdeep	`24:2qkzQQzB+zKXA2zV/jj5aFTkjD5/a8wEEw+zzjaawgzz1QAwRzgdSgK+6eaSz/Kf:2`
Yara	Suspicious_Obfuscation_Script_2 - Suspicious obfuscation script (e.g. executable files)
VirusTotal	Search for analysis