Summary

Category	Machine	Started	Completed
ARCHIVE	s1_win7_x6402	July 6, 2021, 3:28 p.m.	July 6, 2021, 3:29 p.m.

Archive wetransfer-29ee54/MsMpEng.exe @ muestra.zip

Size	21.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8cc83221870dd07144e63df594c391d9`
SHA1	`3d409b39b8502fcd23335a878f2cbdaf6d721995`
SHA256	`33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a`
SHA512	`e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c`
CRC32	`4178D62C`
ssdeep	`384:NDr3WIqWJ1q//0GftpBjRwtxO4HRN7uJlYaibn6:FLe8ifJkuUaY6`
PDB Path	MsMpEng.pdb
Yara	PE_Header_Zero - PE File Signature Antivirus - Contains references to security software IsPE32 - (no description)

MsMpEng.exe "C:\Users\test22\AppData\Local\Temp\wetransfer-29ee54\MsMpEng.exe"
3972
- netsh.exe netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
  6204

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameW July 6, 2021, 3:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 6, 2021, 3:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 6, 2021, 3:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 6, 2021, 3:28 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW July 6, 2021, 3:28 p.m.	computer_name: TEST22-PC	1	1

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleA July 6, 2021, 3:28 p.m.	buffer: No rules match the specified criteria. console_handle: 0x00000007	1	1	0

This executable has a PDB path (1 event)

pdb_path

MsMpEng.pdb

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 6, 2021, 3:28 p.m.	stacktrace: IWICColorContext_InitializeFromMemory_Proxy+0x37187 windowscodecs+0xd8660 @ 0x737e8660 WICConvertBitmapSource+0x2472b WICMapGuidToShortName-0x10e74 windowscodecs+0x8f797 @ 0x7379f797 DllGetClassObject+0x12362 WICSerializeMetadataContent-0x7277 windowscodecs+0x23362 @ 0x73733362 DllGetClassObject+0x118b1 WICSerializeMetadataContent-0x7d28 windowscodecs+0x228b1 @ 0x737328b1 DllGetClassObject+0x11788 WICSerializeMetadataContent-0x7e51 windowscodecs+0x22788 @ 0x73732788 DllGetClassObject+0x12659 WICSerializeMetadataContent-0x6f80 windowscodecs+0x23659 @ 0x73733659 DllGetClassObject+0x8e24 WICSerializeMetadataContent-0x107b5 windowscodecs+0x19e24 @ 0x73729e24 DllGetClassObject+0x8c6d WICSerializeMetadataContent-0x1096c windowscodecs+0x19c6d @ 0x73729c6d iconcodecservice+0x14c8 @ 0x73e614c8 SetKeyboardState+0xe587 CliImmSetHotKey-0x52d4 user32+0x4fa39 @ 0x755efa39 LookupIconIdFromDirectoryEx+0x362 DdeCreateDataHandle-0x622 user32+0x2f316 @ 0x755cf316 CopyImage+0x4f SetWindowPlacement-0x5e user32+0x24a58 @ 0x755c4a58 CopyImage+0xa3 SetWindowPlacement-0xa user32+0x24aac @ 0x755c4aac DdeConnectList+0xcec GetKeyNameTextW-0xc20 user32+0x5fb81 @ 0x755ffb81 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a GetThemeBool+0x84e GetThemeTextExtent-0x1b5f uxtheme+0x16e9f @ 0x73e86e9f GetThemeBool+0x8c0 GetThemeTextExtent-0x1aed uxtheme+0x16f11 @ 0x73e86f11 SystemParametersInfoW+0x40 GetWindowThreadProcessId-0xa1 user32+0x19113 @ 0x755b9113 0x3a50da 0x3a3e85 0x3a4879 0x280106 ServiceCrtMain-0x189 mpsvc+0x1107 @ 0x74431107 ServiceCrtMain-0xb mpsvc+0x1285 @ 0x74431285 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc0000002 exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 7203356 registers.edi: 6004424 registers.eax: 7203356 registers.ebp: 7203436 registers.edx: 7097 registers.ebx: 4094 registers.esi: 6003776 registers.ecx: 7098	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

July 6, 2021, 3:28 p.m.

stacktrace:

IWICColorContext_InitializeFromMemory_Proxy+0x37187 windowscodecs+0xd8660 @ 0x737e8660
WICConvertBitmapSource+0x2472b WICMapGuidToShortName-0x10e74 windowscodecs+0x8f797 @ 0x7379f797
DllGetClassObject+0x12362 WICSerializeMetadataContent-0x7277 windowscodecs+0x23362 @ 0x73733362
DllGetClassObject+0x118b1 WICSerializeMetadataContent-0x7d28 windowscodecs+0x228b1 @ 0x737328b1
DllGetClassObject+0x11788 WICSerializeMetadataContent-0x7e51 windowscodecs+0x22788 @ 0x73732788
DllGetClassObject+0x12659 WICSerializeMetadataContent-0x6f80 windowscodecs+0x23659 @ 0x73733659
DllGetClassObject+0x8e24 WICSerializeMetadataContent-0x107b5 windowscodecs+0x19e24 @ 0x73729e24
DllGetClassObject+0x8c6d WICSerializeMetadataContent-0x1096c windowscodecs+0x19c6d @ 0x73729c6d
iconcodecservice+0x14c8 @ 0x73e614c8
SetKeyboardState+0xe587 CliImmSetHotKey-0x52d4 user32+0x4fa39 @ 0x755efa39
LookupIconIdFromDirectoryEx+0x362 DdeCreateDataHandle-0x622 user32+0x2f316 @ 0x755cf316
CopyImage+0x4f SetWindowPlacement-0x5e user32+0x24a58 @ 0x755c4a58
CopyImage+0xa3 SetWindowPlacement-0xa user32+0x24aac @ 0x755c4aac
DdeConnectList+0xcec GetKeyNameTextW-0xc20 user32+0x5fb81 @ 0x755ffb81
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x773b011a
GetThemeBool+0x84e GetThemeTextExtent-0x1b5f uxtheme+0x16e9f @ 0x73e86e9f
GetThemeBool+0x8c0 GetThemeTextExtent-0x1aed uxtheme+0x16f11 @ 0x73e86f11
SystemParametersInfoW+0x40 GetWindowThreadProcessId-0xa1 user32+0x19113 @ 0x755b9113
0x3a50da
0x3a3e85
0x3a4879
0x280106
ServiceCrtMain-0x189 mpsvc+0x1107 @ 0x74431107
ServiceCrtMain-0xb mpsvc+0x1285 @ 0x74431285
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc0000002
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 7203356
registers.edi: 6004424
registers.eax: 7203356
registers.ebp: 7203436
registers.edx: 7097
registers.ebx: 4094
registers.esi: 6003776
registers.ecx: 7098

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 6, 2021, 3:28 p.m.	process_identifier: 3972 region_size: 139264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 6, 2021, 3:28 p.m.	total_number_of_free_bytes: 13294247936 free_bytes_available: 13294247936 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates (office) documents on the filesystem (17 events)

file	c:\Users\test22\documents\readme.xls
file	c:\Users\test22\documents\FOwRatdvSt.docm
file	c:\Users\test22\documents\WmXfDlmbAt.doc
file	c:\Users\test22\documents\JDHeJjBWHuxqp.doc
file	c:\Users\test22\documents\readme.doc
file	c:\Users\test22\documents\ONyeiyAHXnG.docx
file	c:\Users\test22\documents\axTZwDBeUngqBG.ppt
file	c:\Users\test22\documents\cXMLMLMlMJidCP.doc
file	c:\Users\test22\documents\vnpUaorzBEBgyViL.docx
file	c:\Users\test22\documents\FAaWoqRZplEQFsGvV.docm
file	c:\Users\test22\documents\ZLvqpaZroyQCwP.doc
file	c:\Users\test22\documents\WoSfQMEZfy.docx
file	c:\Users\test22\documents\aBZxXjvFkBlS.docx
file	c:\Users\test22\documents\sXXNuJFeLxhA.docx
file	c:\Users\test22\documents\ATwjKHHgPIXqpQbCw.doc
file	c:\Users\test22\documents\sByekmDWYN.docm
file	c:\Users\test22\documents\xblQlHqHToenR.docx

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (16 events)

Time & API	Arguments	Status	Return
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: SearchIndexer.exe process_identifier: 2548	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: thunderbird.exe process_identifier: 3960	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: pw.exe process_identifier: 5008	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: audiodg.exe process_identifier: 7936	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: splwow64.exe process_identifier: 3928	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: SearchProtocolHost.exe process_identifier: 3816	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: SearchFilterHost.exe process_identifier: 7776	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: mobsync.exe process_identifier: 6916	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: pw.exe process_identifier: 3268	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: taskhost.exe process_identifier: 6464	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: cmd.exe process_identifier: 5780	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: conhost.exe process_identifier: 6604	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: pw.exe process_identifier: 7388	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: slui.exe process_identifier: 2864	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: netsh.exe process_identifier: 6204	1	1
Process32NextW July 6, 2021, 3:28 p.m.	snapshot_handle: 0x0000026c process_name: conhost.exe process_identifier: 7636	1	1

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: flags: 4 oldfilepath_r: C:\Users\test22\AppData\Local\Temp\wetransfer-29ee54\MsMpEng.exe newfilepath: oldfilepath: C:\Users\test22\AppData\Local\Temp\wetransfer-29ee54\MsMpEng.exe	1	1	0

Potentially malicious URLs were found in the process memory dump (50 out of 3899 events)

url	https://developer.mozilla.org/docs/Web/CSS/color
url	https://github.com/facebook/react/issues/7253
url	https://redux.js.org/api-reference/store
url	https://github.com/v8/v8/blob/6.0.122/test/mjsunit/fast-prototype.js
url	http://www.timeanddate.com/time/zones/hast)
url	http://creativecommons.org/ns
url	https://developer.mozilla.org/docs/Tools/Debugger/Using_the_Debugger_map_scopes_feature?utm_source=devtools
url	https://identity.mozilla.com/cmd/open-uri
url	https://developer.mozilla.org/docs/Web/CSS/margin-block
url	https://developer.mozilla.org/docs/Web/CSS/border-bottom-color
url	https://www.reddit.com/
url	https://bugzilla.mozilla.org/show_bug.cgi?id=599971
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1209588
url	https://searchfox.org/mozilla-central/source/devtools/client/themes/variables.css
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1164243
url	http://support.microsoft.com/kb/2430460
url	https://te.wikipedia.org/w/api.php?action=opensearch
url	https://istumbler.net/).
url	https://bugzilla.mozilla.org/show_bug.cgi?id=421993
url	http://developer.mozilla.org/en/Localization_and_Plurals
url	https://bugs.chromium.org/p/v8/issues/detail?id=90
url	https://mozilla.github.io/basket-example/
url	https://html.spec.whatwg.org/multipage/browsers.html
url	https://mozilla.org/MPL/2.0/.
url	http://www.openh264.org/faq.html
url	https://chromereleases.googleblog.com/2016/06/chrome-for-android-update.html
url	https://firefox-source-docs.mozilla.org/
url	https://developer.mozilla.org/docs/Web/CSS/widows
url	https://github.com/mozilla/readability
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1529126
url	https://bugzilla.mozilla.org/show_bug.cgi?id=755443
url	http://www.microsoft.com/hk/hkscs
url	https://outlook.office365.com/SMTP.Send
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1330483
url	http://www.alanwood.net/unicode/fonts.html
url	https://chromereleases.googleblog.com/2018/07/stable-channel-update-for-desktop.html
url	https://developer.apple.com/library/content/releasenotes/General/WhatsNewInSafari/Articles/Safari_9_0.html
url	https://www.pazaruvaj.com/CategorySearch.php
url	https://developer.mozilla.org/docs/Web/CSS/mask-mode
url	https://web.skype.com/
url	https://et.wikipedia.org/wiki/Eri:Otsimine?search=
url	https://github.com/Modernizr/Modernizr/wiki/HTML5-Cross-browser-Polyfills
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1603001
url	https://developer.mozilla.org/docs/Web/CSS/box-flex
url	https://developer.mozilla.org/docs/Web/CSS/block-size
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1479009
url	https://bugzilla.mozilla.org/show_bug.cgi?id=690184
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1483995
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1516131
url	https://bugzilla.mozilla.org/show_bug.cgi?id=1554097

Yara rule detected in process memory (39 events)

description	Virtual currency	rule	Virtual_currency_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over IRC Network	rule	Network_IRC
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Install itself for autorun at Windows startup	rule	Persistence
description	Communication using DGA	rule	Network_DGA
description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Communications over FTP	rule	Network_FTP
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	File Downloader	rule	Network_Downloader
description	Communications over P2P network	rule	Network_P2P_Win
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 6, 2021, 3:28 p.m.	status_code: 0x00000000 process_identifier: 3960 process_handle: 0x00000284		0	0
NtTerminateProcess July 6, 2021, 3:28 p.m.	status_code: 0x00000000 process_identifier: 3960 process_handle: 0x00000284	1	0	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Attempts to stop active services (2 events)

Time & API	Arguments	Status	Return	Repeated
ControlService July 6, 2021, 3:28 p.m.	service_handle: 0x0059de50 service_name: aelookupsvc control_code: 1	1	1	0
ControlService July 6, 2021, 3:28 p.m.	service_handle: 0x0059de78 service_name: cryptsvc control_code: 1	1	1	0

Operates on local firewall's policies and settings (1 event)

cmdline

netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes

Attempts to detect Cuckoo Sandbox through the presence of a file (2 events)

file	c:\Python27\agent.pyw
file	c:\tmpzdcjvb\analyzer.py

Expresses interest in specific running processes (1 event)

process: potential process injection target

explorer.exe

url	https://check.torproject.org/api/ip

Appends a known multi-family ransomware file extension to files that have been encrypted (50 out of 78 events)

file	c:\Python27\tcl\tcl8.5\encoding\macUkraine.enc
file	c:\Python27\tcl\tcl8.5\encoding\big5.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp936.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp1250.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp869.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-5.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp1252.enc
file	c:\Python27\tcl\tcl8.5\encoding\macGreek.enc
file	c:\Python27\tcl\tcl8.5\encoding\macCroatian.enc
file	c:\Python27\tcl\tcl8.5\encoding\koi8-r.enc
file	c:\Python27\tcl\tcl8.5\encoding\ascii.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp865.enc
file	c:\Python27\tcl\tcl8.5\encoding\jis0201.enc
file	c:\Python27\tcl\tcl8.5\encoding\macCentEuro.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp850.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp1251.enc
file	c:\Python27\tcl\tcl8.5\encoding\koi8-u.enc
file	c:\Python27\tcl\tcl8.5\encoding\euc-jp.enc
file	c:\Python27\tcl\tcl8.5\encoding\jis0208.enc
file	c:\Python27\tcl\tcl8.5\encoding\macDingbats.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-1.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp950.enc
file	c:\Python27\tcl\tcl8.5\encoding\gb12345.enc
file	c:\Python27\tcl\tcl8.5\encoding\ebcdic.enc
file	c:\Python27\tcl\tcl8.5\encoding\macIceland.enc
file	c:\Python27\tcl\tcl8.5\encoding\macCyrillic.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp862.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso2022-kr.enc
file	c:\Python27\tcl\tcl8.5\encoding\jis0212.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp864.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-16.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp1256.enc
file	c:\Python27\tcl\tcl8.5\encoding\macJapan.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp1253.enc
file	c:\Python27\tcl\tcl8.5\encoding\symbol.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp855.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp852.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp866.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-3.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-10.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso2022.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-4.enc
file	c:\Python27\tcl\tcl8.5\encoding\euc-cn.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-7.enc
file	c:\Python27\tcl\tcl8.5\encoding\iso8859-6.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp863.enc
file	c:\Python27\tcl\tcl8.5\encoding\tis-620.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp874.enc
file	c:\Python27\tcl\tcl8.5\encoding\gb2312-raw.enc
file	c:\Python27\tcl\tcl8.5\encoding\cp1254.enc

Performs 4790 file moves indicative of a ransomware file encryption process (50 out of 4790 events)

Time & API	Arguments	Status	Return
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\readme.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\readme.txt newfilepath: c:\readme.txt.400e2 oldfilepath: c:\readme.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\gpki\gpki.cer.400e2 flags: 2 oldfilepath_r: \\?\c:\gpki\gpki.cer newfilepath: c:\GPKI\gpki.cer.400e2 oldfilepath: c:\GPKI\gpki.cer	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\agent.pyw.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\agent.pyw newfilepath: c:\Python27\agent.pyw.400e2 oldfilepath: c:\Python27\agent.pyw	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\LICENSE.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\LICENSE.txt newfilepath: c:\Python27\LICENSE.txt.400e2 oldfilepath: c:\Python27\LICENSE.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\NEWS.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\NEWS.txt newfilepath: c:\Python27\NEWS.txt.400e2 oldfilepath: c:\Python27\NEWS.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\README.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\README.txt newfilepath: c:\Python27\README.txt.400e2 oldfilepath: c:\Python27\README.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\sandbox\DONT-USE.TXT.400e2 flags: 2 oldfilepath_r: \\?\c:\sandbox\DONT-USE.TXT newfilepath: c:\Sandbox\DONT-USE.TXT.400e2 oldfilepath: c:\Sandbox\DONT-USE.TXT	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\tmpzdcjvb\analyzer.py.400e2 flags: 2 oldfilepath_r: \\?\c:\tmpzdcjvb\analyzer.py newfilepath: c:\tmpzdcjvb\analyzer.py.400e2 oldfilepath: c:\tmpzdcjvb\analyzer.py	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\tmpzdcjvb\analysis.conf.400e2 flags: 2 oldfilepath_r: \\?\c:\tmpzdcjvb\analysis.conf newfilepath: c:\tmpzdcjvb\analysis.conf.400e2 oldfilepath: c:\tmpzdcjvb\analysis.conf	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt newfilepath: c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.400e2 oldfilepath: c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\util\pafish.log.400e2 flags: 2 oldfilepath_r: \\?\c:\util\pafish.log newfilepath: c:\util\pafish.log.400e2 oldfilepath: c:\util\pafish.log	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\util\vm_setting.reg.400e2 flags: 2 oldfilepath_r: \\?\c:\util\vm_setting.reg newfilepath: c:\util\vm_setting.reg.400e2 oldfilepath: c:\util\vm_setting.reg	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\click\ZeroAI_Click.pyw.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\click\ZeroAI_Click.pyw newfilepath: c:\Python27\click\ZeroAI_Click.pyw.400e2 oldfilepath: c:\Python27\click\ZeroAI_Click.pyw	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\winsound.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\winsound.pyd newfilepath: c:\Python27\DLLs\winsound.pyd.400e2 oldfilepath: c:\Python27\DLLs\winsound.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\unicodedata.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\unicodedata.pyd newfilepath: c:\Python27\DLLs\unicodedata.pyd.400e2 oldfilepath: c:\Python27\DLLs\unicodedata.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_bsddb.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_bsddb.pyd newfilepath: c:\Python27\DLLs\_bsddb.pyd.400e2 oldfilepath: c:\Python27\DLLs\_bsddb.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_ctypes_test.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_ctypes_test.pyd newfilepath: c:\Python27\DLLs\_ctypes_test.pyd.400e2 oldfilepath: c:\Python27\DLLs\_ctypes_test.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_elementtree.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_elementtree.pyd newfilepath: c:\Python27\DLLs\_elementtree.pyd.400e2 oldfilepath: c:\Python27\DLLs\_elementtree.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_msi.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_msi.pyd newfilepath: c:\Python27\DLLs\_msi.pyd.400e2 oldfilepath: c:\Python27\DLLs\_msi.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_multiprocessing.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_multiprocessing.pyd newfilepath: c:\Python27\DLLs\_multiprocessing.pyd.400e2 oldfilepath: c:\Python27\DLLs\_multiprocessing.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_sqlite3.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_sqlite3.pyd newfilepath: c:\Python27\DLLs\_sqlite3.pyd.400e2 oldfilepath: c:\Python27\DLLs\_sqlite3.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_testcapi.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_testcapi.pyd newfilepath: c:\Python27\DLLs\_testcapi.pyd.400e2 oldfilepath: c:\Python27\DLLs\_testcapi.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\abstract.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\abstract.h newfilepath: c:\Python27\include\abstract.h.400e2 oldfilepath: c:\Python27\include\abstract.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\asdl.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\asdl.h newfilepath: c:\Python27\include\asdl.h.400e2 oldfilepath: c:\Python27\include\asdl.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\ast.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\ast.h newfilepath: c:\Python27\include\ast.h.400e2 oldfilepath: c:\Python27\include\ast.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bitset.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bitset.h newfilepath: c:\Python27\include\bitset.h.400e2 oldfilepath: c:\Python27\include\bitset.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bufferobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bufferobject.h newfilepath: c:\Python27\include\bufferobject.h.400e2 oldfilepath: c:\Python27\include\bufferobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\boolobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\boolobject.h newfilepath: c:\Python27\include\boolobject.h.400e2 oldfilepath: c:\Python27\include\boolobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bytearrayobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bytearrayobject.h newfilepath: c:\Python27\include\bytearrayobject.h.400e2 oldfilepath: c:\Python27\include\bytearrayobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bytesobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bytesobject.h newfilepath: c:\Python27\include\bytesobject.h.400e2 oldfilepath: c:\Python27\include\bytesobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bytes_methods.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bytes_methods.h newfilepath: c:\Python27\include\bytes_methods.h.400e2 oldfilepath: c:\Python27\include\bytes_methods.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\cellobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\cellobject.h newfilepath: c:\Python27\include\cellobject.h.400e2 oldfilepath: c:\Python27\include\cellobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\ceval.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\ceval.h newfilepath: c:\Python27\include\ceval.h.400e2 oldfilepath: c:\Python27\include\ceval.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\classobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\classobject.h newfilepath: c:\Python27\include\classobject.h.400e2 oldfilepath: c:\Python27\include\classobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\doc\python2718.chm.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\doc\python2718.chm newfilepath: c:\Python27\Doc\python2718.chm.400e2 oldfilepath: c:\Python27\Doc\python2718.chm	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\cobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\cobject.h newfilepath: c:\Python27\include\cobject.h.400e2 oldfilepath: c:\Python27\include\cobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\code.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\code.h newfilepath: c:\Python27\include\code.h.400e2 oldfilepath: c:\Python27\include\code.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\codecs.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\codecs.h newfilepath: c:\Python27\include\codecs.h.400e2 oldfilepath: c:\Python27\include\codecs.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\compile.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\compile.h newfilepath: c:\Python27\include\compile.h.400e2 oldfilepath: c:\Python27\include\compile.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\complexobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\complexobject.h newfilepath: c:\Python27\include\complexobject.h.400e2 oldfilepath: c:\Python27\include\complexobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\cStringIO.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\cStringIO.h newfilepath: c:\Python27\include\cStringIO.h.400e2 oldfilepath: c:\Python27\include\cStringIO.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\datetime.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\datetime.h newfilepath: c:\Python27\include\datetime.h.400e2 oldfilepath: c:\Python27\include\datetime.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\descrobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\descrobject.h newfilepath: c:\Python27\include\descrobject.h.400e2 oldfilepath: c:\Python27\include\descrobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\dictobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\dictobject.h newfilepath: c:\Python27\include\dictobject.h.400e2 oldfilepath: c:\Python27\include\dictobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\dtoa.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\dtoa.h newfilepath: c:\Python27\include\dtoa.h.400e2 oldfilepath: c:\Python27\include\dtoa.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\enumobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\enumobject.h newfilepath: c:\Python27\include\enumobject.h.400e2 oldfilepath: c:\Python27\include\enumobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\errcode.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\errcode.h newfilepath: c:\Python27\include\errcode.h.400e2 oldfilepath: c:\Python27\include\errcode.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\eval.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\eval.h newfilepath: c:\Python27\include\eval.h.400e2 oldfilepath: c:\Python27\include\eval.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\fileobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\fileobject.h newfilepath: c:\Python27\include\fileobject.h.400e2 oldfilepath: c:\Python27\include\fileobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\floatobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\floatobject.h newfilepath: c:\Python27\include\floatobject.h.400e2 oldfilepath: c:\Python27\include\floatobject.h	1	1

Appends a new file extension or content to 4790 files indicative of a ransomware file encryption process (50 out of 4790 events)

Time & API	Arguments	Status	Return
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\readme.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\readme.txt newfilepath: c:\readme.txt.400e2 oldfilepath: c:\readme.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\gpki\gpki.cer.400e2 flags: 2 oldfilepath_r: \\?\c:\gpki\gpki.cer newfilepath: c:\GPKI\gpki.cer.400e2 oldfilepath: c:\GPKI\gpki.cer	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\agent.pyw.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\agent.pyw newfilepath: c:\Python27\agent.pyw.400e2 oldfilepath: c:\Python27\agent.pyw	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\LICENSE.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\LICENSE.txt newfilepath: c:\Python27\LICENSE.txt.400e2 oldfilepath: c:\Python27\LICENSE.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\NEWS.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\NEWS.txt newfilepath: c:\Python27\NEWS.txt.400e2 oldfilepath: c:\Python27\NEWS.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\README.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\README.txt newfilepath: c:\Python27\README.txt.400e2 oldfilepath: c:\Python27\README.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\sandbox\DONT-USE.TXT.400e2 flags: 2 oldfilepath_r: \\?\c:\sandbox\DONT-USE.TXT newfilepath: c:\Sandbox\DONT-USE.TXT.400e2 oldfilepath: c:\Sandbox\DONT-USE.TXT	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\tmpzdcjvb\analyzer.py.400e2 flags: 2 oldfilepath_r: \\?\c:\tmpzdcjvb\analyzer.py newfilepath: c:\tmpzdcjvb\analyzer.py.400e2 oldfilepath: c:\tmpzdcjvb\analyzer.py	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\tmpzdcjvb\analysis.conf.400e2 flags: 2 oldfilepath_r: \\?\c:\tmpzdcjvb\analysis.conf newfilepath: c:\tmpzdcjvb\analysis.conf.400e2 oldfilepath: c:\tmpzdcjvb\analysis.conf	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.400e2 flags: 2 oldfilepath_r: \\?\c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt newfilepath: c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt.400e2 oldfilepath: c:\util\mini-KMS_Activator_v1.1_Office.2010.VL.ENG.txt	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\util\pafish.log.400e2 flags: 2 oldfilepath_r: \\?\c:\util\pafish.log newfilepath: c:\util\pafish.log.400e2 oldfilepath: c:\util\pafish.log	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\util\vm_setting.reg.400e2 flags: 2 oldfilepath_r: \\?\c:\util\vm_setting.reg newfilepath: c:\util\vm_setting.reg.400e2 oldfilepath: c:\util\vm_setting.reg	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\click\ZeroAI_Click.pyw.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\click\ZeroAI_Click.pyw newfilepath: c:\Python27\click\ZeroAI_Click.pyw.400e2 oldfilepath: c:\Python27\click\ZeroAI_Click.pyw	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\winsound.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\winsound.pyd newfilepath: c:\Python27\DLLs\winsound.pyd.400e2 oldfilepath: c:\Python27\DLLs\winsound.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\unicodedata.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\unicodedata.pyd newfilepath: c:\Python27\DLLs\unicodedata.pyd.400e2 oldfilepath: c:\Python27\DLLs\unicodedata.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_bsddb.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_bsddb.pyd newfilepath: c:\Python27\DLLs\_bsddb.pyd.400e2 oldfilepath: c:\Python27\DLLs\_bsddb.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_ctypes_test.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_ctypes_test.pyd newfilepath: c:\Python27\DLLs\_ctypes_test.pyd.400e2 oldfilepath: c:\Python27\DLLs\_ctypes_test.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_elementtree.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_elementtree.pyd newfilepath: c:\Python27\DLLs\_elementtree.pyd.400e2 oldfilepath: c:\Python27\DLLs\_elementtree.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_msi.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_msi.pyd newfilepath: c:\Python27\DLLs\_msi.pyd.400e2 oldfilepath: c:\Python27\DLLs\_msi.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_multiprocessing.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_multiprocessing.pyd newfilepath: c:\Python27\DLLs\_multiprocessing.pyd.400e2 oldfilepath: c:\Python27\DLLs\_multiprocessing.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_sqlite3.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_sqlite3.pyd newfilepath: c:\Python27\DLLs\_sqlite3.pyd.400e2 oldfilepath: c:\Python27\DLLs\_sqlite3.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\dlls\_testcapi.pyd.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\dlls\_testcapi.pyd newfilepath: c:\Python27\DLLs\_testcapi.pyd.400e2 oldfilepath: c:\Python27\DLLs\_testcapi.pyd	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\abstract.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\abstract.h newfilepath: c:\Python27\include\abstract.h.400e2 oldfilepath: c:\Python27\include\abstract.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\asdl.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\asdl.h newfilepath: c:\Python27\include\asdl.h.400e2 oldfilepath: c:\Python27\include\asdl.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\ast.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\ast.h newfilepath: c:\Python27\include\ast.h.400e2 oldfilepath: c:\Python27\include\ast.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bitset.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bitset.h newfilepath: c:\Python27\include\bitset.h.400e2 oldfilepath: c:\Python27\include\bitset.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bufferobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bufferobject.h newfilepath: c:\Python27\include\bufferobject.h.400e2 oldfilepath: c:\Python27\include\bufferobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\boolobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\boolobject.h newfilepath: c:\Python27\include\boolobject.h.400e2 oldfilepath: c:\Python27\include\boolobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bytearrayobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bytearrayobject.h newfilepath: c:\Python27\include\bytearrayobject.h.400e2 oldfilepath: c:\Python27\include\bytearrayobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bytesobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bytesobject.h newfilepath: c:\Python27\include\bytesobject.h.400e2 oldfilepath: c:\Python27\include\bytesobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\bytes_methods.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\bytes_methods.h newfilepath: c:\Python27\include\bytes_methods.h.400e2 oldfilepath: c:\Python27\include\bytes_methods.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\cellobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\cellobject.h newfilepath: c:\Python27\include\cellobject.h.400e2 oldfilepath: c:\Python27\include\cellobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\ceval.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\ceval.h newfilepath: c:\Python27\include\ceval.h.400e2 oldfilepath: c:\Python27\include\ceval.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\classobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\classobject.h newfilepath: c:\Python27\include\classobject.h.400e2 oldfilepath: c:\Python27\include\classobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\doc\python2718.chm.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\doc\python2718.chm newfilepath: c:\Python27\Doc\python2718.chm.400e2 oldfilepath: c:\Python27\Doc\python2718.chm	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\cobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\cobject.h newfilepath: c:\Python27\include\cobject.h.400e2 oldfilepath: c:\Python27\include\cobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\code.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\code.h newfilepath: c:\Python27\include\code.h.400e2 oldfilepath: c:\Python27\include\code.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\codecs.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\codecs.h newfilepath: c:\Python27\include\codecs.h.400e2 oldfilepath: c:\Python27\include\codecs.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\compile.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\compile.h newfilepath: c:\Python27\include\compile.h.400e2 oldfilepath: c:\Python27\include\compile.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\complexobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\complexobject.h newfilepath: c:\Python27\include\complexobject.h.400e2 oldfilepath: c:\Python27\include\complexobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\cStringIO.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\cStringIO.h newfilepath: c:\Python27\include\cStringIO.h.400e2 oldfilepath: c:\Python27\include\cStringIO.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\datetime.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\datetime.h newfilepath: c:\Python27\include\datetime.h.400e2 oldfilepath: c:\Python27\include\datetime.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\descrobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\descrobject.h newfilepath: c:\Python27\include\descrobject.h.400e2 oldfilepath: c:\Python27\include\descrobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\dictobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\dictobject.h newfilepath: c:\Python27\include\dictobject.h.400e2 oldfilepath: c:\Python27\include\dictobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\dtoa.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\dtoa.h newfilepath: c:\Python27\include\dtoa.h.400e2 oldfilepath: c:\Python27\include\dtoa.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\enumobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\enumobject.h newfilepath: c:\Python27\include\enumobject.h.400e2 oldfilepath: c:\Python27\include\enumobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\errcode.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\errcode.h newfilepath: c:\Python27\include\errcode.h.400e2 oldfilepath: c:\Python27\include\errcode.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\eval.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\eval.h newfilepath: c:\Python27\include\eval.h.400e2 oldfilepath: c:\Python27\include\eval.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\fileobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\fileobject.h newfilepath: c:\Python27\include\fileobject.h.400e2 oldfilepath: c:\Python27\include\fileobject.h	1	1
MoveFileWithProgressW July 6, 2021, 3:28 p.m.	newfilepath_r: \\?\c:\python27\include\floatobject.h.400e2 flags: 2 oldfilepath_r: \\?\c:\python27\include\floatobject.h newfilepath: c:\Python27\include\floatobject.h.400e2 oldfilepath: c:\Python27\include\floatobject.h	1	1

Archive wetransfer-29ee54/MsMpEng.exe @ muestra.zip

Summary

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All