Cuckoo Sandbox

Name	76460c88b0cfa710_system restore.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\System Restore.exe
Size	92.4KB
Processes	1320 (27ca24b85741b7e0acbc20894bcde101e2b391e496006db6cb7e35ead147bcbd.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`39986b099eb7e9c876573a2f01737169`
SHA1	`e7a9231bca1931f76af2cd42a1897d7d204bbe03`
SHA256	`76460c88b0cfa710825e14d25d3e4ce4f6fa286ebf91cc7329fe6b707a7d93d0`
CRC32	`2E1179CA`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	55bdae6f51cb9ff4_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	92.4KB
Processes	1364 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`5909dd2ab7024ea381756dfb3b22b8b8`
SHA1	`fc918839026e32b5639ae83cf7143581596eec6a`
SHA256	`55bdae6f51cb9ff43cf09eda0983a8b6b28b26aa58e7b74c24c777126ed6d64b`
CRC32	`C9AAD723`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files