Dropped Files | ZeroBOX

Name	b932150d30bdf953_hvpio.exe Submit file
Filepath	C:\ProgramData\Timeupper\HVPIO.exe
Size	49.5MB
Processes	288 (netTime.exe)
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`057c220cd8e30a58bfe30e117bebb550`
SHA1	`f5c7bd2cf6c409efcadff79f3e15285680c1fae1`
SHA256	`c39eeaaad788c14b1be0f0d2679bd7e01951e7765483c80d919a97180f0197c2`
CRC32	`E91C9B1A`
ssdeep	`24576:7bcADanwaoDgLRMlM1YKdS0zBfOnjDmNlqO/HUzbPpH:xanwXBdK40zBfOnjDmNlqO/UzbPZ`
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE64 - (no description) Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis

Name	d12347b839fe9ec1_590aee7bdd69b59b.customDestinations-ms~RF183166b.TMP Submit file
Filepath	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF183166b.TMP
Size	7.8KB
Processes	2596 (powershell.exe) 2552 (powershell.exe) 288 (netTime.exe)
Type	data
MD5	`e7901905cb6dccd7f4bfc91c2baf9fae`
SHA1	`b677a9837c4b3e6912d82b21b8214dbe474bf628`
SHA256	`d12347b839fe9ec151969690d24abdd66971437f3268a0ffbf81c47cfea4e652`
CRC32	`2BEFE177`
ssdeep	`96:4tuCeGCPDXBqvsqvJCwoFtuCeGCPDXBqvsEHyqvJCworDPtDHXyf2lUVul:4tvXoFtvbHnorxTyQ`
Yara	Antivirus - Contains references to security software Generic_Malware_Zero - Generic Malware
VirusTotal	Search for analysis