Dropped Files | ZeroBOX

Name	1c80f750068ed4ca_yutreco Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\yutreco
Size	83.6KB
Processes	2232 (PowerRun.exe)
Type	ASCII text, with very long lines, with no line terminators
MD5	`0b1607979373b4ed50c6d0b89eb157ab`
SHA1	`7c2f77f58d5cfbbddd572cef7e23d537567a7942`
SHA256	`1c80f750068ed4ca51348b189016113559a740215c4ff6593156fd5225272690`
CRC32	`86B00634`
ssdeep	`768:Wt0svByusypFbpLWFI69U5h4CWE1Xe54aX/MnCc0o:Wt0svBy04FI69uhTWEq400Vt`
Yara	PowerShell_Script_MZ_Zero - PowerShell Script MZ [Zero]
VirusTotal	Search for analysis

Name	ae37fc676c01de53_powerrun.ini Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\PowerRun.ini
Size	3.4KB
Processes	2232 (PowerRun.exe)
Type	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
MD5	`bba3fe67fcb786bbd88ff83345fe13cf`
SHA1	`21f61faf7dff0eaa17897cd6b4474b2d7d7028f2`
SHA256	`ae37fc676c01de53265764c4f9172684f2404a86428d2af9f88b1db22a485b38`
CRC32	`63F8A057`
ssdeep	`96:nDw9qVKVbIFKO0ADZlWYwq2rSzBC3mPk3t0ZMDpn+s:D6qVKVdGwLGzBc5Vp5`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	e0fe5cc20fc6257d_aut6347.tmp Submit file
Filepath	C:\Users\test22\AppData\Local\Temp\aut6347.tmp
Size	25.3KB
Processes	2232 (PowerRun.exe)
Type	data
MD5	`1ae3520c92409d09b2596b55abcd1429`
SHA1	`89dcc61c00aa4244e166653dc31092350d868a66`
SHA256	`e0fe5cc20fc6257d8373a36cb2c87f4bd6ec9a97961ed0f795e48958e477fe78`
CRC32	`8252ADF2`
ssdeep	`768:OhWqXKnVQWML+mbwV1+TkL7sbHDM7QPdeF:OhJGVQW2T5HDRPdQ`
Yara	None matched
VirusTotal	Search for analysis