Cuckoo Sandbox

Name	cc1063d70799c1d6_system restore.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\System Restore.exe
Size	92.3KB
Processes	1372 (44a0f356759d65a2_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`7704027d3db41e4f219ba5e25cd3d31c`
SHA1	`f618c7c51c82bbd4fb1ccea123c9a0147d37f8cb`
SHA256	`cc1063d70799c1d6320db8371d4c1dc0cb36bdb3ec877f6434ab4ebfb986620f`
CRC32	`80ECEDD5`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	a607a480b0660d75_system restore.exe Download Submit file
Filepath	C:\System Restore.exe
Size	92.3KB
Processes	692 (System Restore.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`b3ff4f259135a7ba2c0425138f295927`
SHA1	`4b4220bc38cb69c5ff300a35a1be65fe7586115c`
SHA256	`a607a480b0660d75c1366e259de7e17f532aad05fc9fd8f21cff87720632868e`
CRC32	`992200EF`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files