Cuckoo Sandbox

Name	0534b9c7e2d52b79_system restore.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\System Restore.exe
Size	446.8KB
Processes	2496 (07fcf32f96aba31f_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`68a78c1933fe589d1698eee41c9059b2`
SHA1	`4fba741d406c47b33b146cc490d487ac72acd877`
SHA256	`0534b9c7e2d52b792c26c474eed43658d6e51d8917a71433789969c48aac76b3`
CRC32	`C8E865A7`
ssdeep	`None`
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	a9c534bba20be2f7_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	446.8KB
Processes	2728 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`d6b5c3632bcec926f01e0292ae568940`
SHA1	`8a8ba8d5054485449d3f7e076d04e8afcb55b213`
SHA256	`a9c534bba20be2f740945ac03a3daa27352db9cf7ac8d491329a37a0348cbc56`
CRC32	`ED2D9161`
ssdeep	`None`
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files