popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

6.exe

PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 2, 2021, 9:17 a.m. Aug. 2, 2021, 9:19 a.m.
Size 67.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 598c53bfef81e489375f09792e487f1a
SHA256 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
CRC32 F84C2E03
ssdeep 1536:RzICS4AT6GxdEe+TOdincJXvKv8Zg3kl:qR7auJXSkZg3C
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
paymenthacks.com
A 206.188.197.206
206.188.197.206
IP Address Status Action
164.124.101.2 Active Moloch
206.188.197.206 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name:
0 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
bson_init_unfinished_data+0x158 bson_ensure_space-0x7e @ 0x744bea6f
bson_append_binary+0x112 bson_append_oid-0x7 @ 0x744bf4e7
log_wstring+0x282 log_explain-0x187 @ 0x74491c19
log_api+0x457 log_new_process-0x967 @ 0x7449274b
New_ntdll_NtWriteFile@36+0x1f1 New_ntdll_NtWriteVirtualMemory@20-0x3f @ 0x744b3b12
WriteFile+0xaa FlushFileBuffers-0xb7 kernelbase+0xd1c9 @ 0x754fd1c9
WriteFile+0x4a WriteConsoleA-0x30 kernel32+0x112cc @ 0x76e312cc
6+0xb61a @ 0xaab61a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76e333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77969ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77969ea5

exception.instruction_r: f3 a5 ff 24 95 b8 99 28 75 ff 24 8d c8 99 28 75
exception.symbol: malloc+0x9e _finite-0x65 msvcrt+0x9d8c
exception.instruction: movsd dword ptr es:[edi], dword ptr [esi]
exception.module: msvcrt.dll
exception.exception_code: 0xc0000005
exception.offset: 40332
exception.address: 0x75289d8c
registers.esp: 58783036
registers.edi: 49613024
registers.eax: 104
registers.ebp: 58783044
registers.edx: 2
registers.ebx: 259
registers.esi: 5169150
registers.ecx: 479
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1540
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1540
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1540
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1540
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 11622141952
free_bytes_available: 0
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x00010000', u'entropy': 7.591491569515972, u'name': u'.data', u'virtual_size': u'0x000015ec'} entropy 7.59149156952 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000e00', u'virtual_address': u'0x00012000', u'entropy': 7.907336173322609, u'name': u'.rsrc', u'virtual_size': u'0x00000da7'} entropy 7.90733617332 description A section with a high entropy has been found
Time & API Arguments Status Return Repeated

ControlService

 service_handle: 0x0047f6c0
service_name: vss
control_code: 1
1 1 0
file C:\Python27\agent.pyw
file C:\tmpmgprgt\analyzer.py
file C:\Users\test22\Documents\Outlook 파일\Outlook.pst
file C:\Python27\tcl\tcl8.5\encoding\euc-cn.enc
file C:\Python27\tcl\tcl8.5\encoding\dingbats.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-3.enc
file C:\Python27\tcl\tcl8.5\encoding\iso2022-kr.enc
file C:\Python27\tcl\tcl8.5\encoding\cp857.enc
file C:\Python27\tcl\tcl8.5\encoding\macIceland.enc
file C:\Python27\tcl\tcl8.5\encoding\macCyrillic.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-8.enc
file C:\Python27\tcl\tcl8.5\encoding\cp860.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-10.enc
file C:\Python27\tcl\tcl8.5\encoding\ksc5601.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-14.enc
file C:\Python27\tcl\tcl8.5\encoding\jis0212.enc
file C:\Python27\tcl\tcl8.5\encoding\cp1255.enc
file C:\Python27\tcl\tcl8.5\encoding\cp1254.enc
file C:\Python27\tcl\tcl8.5\encoding\macGreek.enc
file C:\Python27\tcl\tcl8.5\encoding\cp437.enc
file C:\Python27\tcl\tcl8.5\encoding\cp775.enc
file C:\Python27\tcl\tcl8.5\encoding\big5.enc
file C:\Python27\tcl\tcl8.5\encoding\cp936.enc
file C:\Python27\tcl\tcl8.5\encoding\cp869.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-5.enc
file C:\Python27\tcl\tcl8.5\encoding\cp949.enc
file C:\Python27\tcl\tcl8.5\encoding\ascii.enc
file C:\Python27\tcl\tcl8.5\encoding\macRoman.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-15.enc
file C:\Python27\tcl\tcl8.5\encoding\macDingbats.enc
file C:\Python27\tcl\tcl8.5\encoding\macThai.enc
file C:\Python27\tcl\tcl8.5\encoding\cp865.enc
file C:\Python27\tcl\tcl8.5\encoding\jis0201.enc
file C:\Python27\tcl\tcl8.5\encoding\macCentEuro.enc
file C:\Python27\tcl\tcl8.5\encoding\cp850.enc
file C:\Python27\tcl\tcl8.5\encoding\shiftjis.enc
file C:\Python27\tcl\tcl8.5\encoding\cp1251.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-9.enc
file C:\Python27\tcl\tcl8.5\encoding\euc-jp.enc
file C:\Python27\tcl\tcl8.5\encoding\euc-kr.enc
file C:\Python27\tcl\tcl8.5\encoding\iso2022-jp.enc
file C:\Python27\tcl\tcl8.5\encoding\macTurkish.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-1.enc
file C:\Python27\tcl\tcl8.5\encoding\cp866.enc
file C:\Python27\tcl\tcl8.5\encoding\macRomania.enc
file C:\Python27\tcl\tcl8.5\encoding\ebcdic.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-4.enc
file C:\Python27\tcl\tcl8.5\encoding\cp1250.enc
file C:\Python27\tcl\tcl8.5\encoding\cp862.enc
file C:\Python27\tcl\tcl8.5\encoding\cp864.enc
file C:\Python27\tcl\tcl8.5\encoding\koi8-r.enc
file C:\Python27\tcl\tcl8.5\encoding\koi8-u.enc
file C:\Python27\tcl\tcl8.5\encoding\iso8859-2.enc
dead_host 206.188.197.206:443
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
McAfee RDN/Ransom
Malwarebytes MachineLearning/Anomalous.96%
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Heur.Mint.Zard.25
K7GW Riskware ( 0040eff71 )
Cybereason malicious.fef81e
Arcabit Trojan.Mint.Zard.25
Cyren W32/Trojan.QSPK-5949
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.HLXFKFN
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Trojan-Ransom.Win32.Encoder.njw
NANO-Antivirus Virus.Win32.Gen.ccmw
MicroWorld-eScan Gen:Heur.Mint.Zard.25
Avast Win32:Malware-gen
Rising Trojan.Generic@ML.98 (RDML:JZFVDQXqy3+v9yTioog97Q)
Ad-Aware Gen:Heur.Mint.Zard.25
Emsisoft Gen:Heur.Mint.Zard.25 (B)
F-Secure Trojan.TR/Crypt.EPACK.Gen2
DrWeb Trojan.Encoder.34207
TrendMicro Ransom_Encoder.R002C0WH121
McAfee-GW-Edition BehavesLike.Win32.Dropper.kh
FireEye Generic.mg.598c53bfef81e489
Sophos Mal/Generic-S
Ikarus Trojan.Crypt
Avira TR/Crypt.EPACK.Gen2
eGambit Unsafe.AI_Score_93%
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Ransom.Win32.Ransom.sa
Microsoft Ransom:Win32/Genasom
ZoneAlarm Trojan-Ransom.Win32.Encoder.njw
GData Gen:Heur.Mint.Zard.25
ALYac Gen:Heur.Mint.Zard.25
MAX malware (ai score=89)
Cylance Unsafe
TrendMicro-HouseCall Ransom_Encoder.R002C0WH121
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/PossibleThreat
BitDefenderTheta AI:Packer.531073961E
AVG Win32:Malware-gen
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Trojan.Generic.HxQB9jsA
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: \\?\C:\readme.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\readme.txt
newfilepath: C:\readme.txt.twSpMDCpB
oldfilepath: C:\readme.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\pafish.log.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\pafish.log
newfilepath: C:\util\pafish.log.twSpMDCpB
oldfilepath: C:\util\pafish.log
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\vm_setting.reg.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\vm_setting.reg
newfilepath: C:\util\vm_setting.reg.twSpMDCpB
oldfilepath: C:\util\vm_setting.reg
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\ZeroCERT.bmp.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\ZeroCERT.bmp
newfilepath: C:\util\ZeroCERT.bmp.twSpMDCpB
oldfilepath: C:\util\ZeroCERT.bmp
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\TCPView\Eula.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\TCPView\Eula.txt
newfilepath: C:\util\TCPView\Eula.txt.twSpMDCpB
oldfilepath: C:\util\TCPView\Eula.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\TCPView\tcpview.chm.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\TCPView\tcpview.chm
newfilepath: C:\util\TCPView\tcpview.chm.twSpMDCpB
oldfilepath: C:\util\TCPView\tcpview.chm
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\ProcessMonitor\Eula.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\ProcessMonitor\Eula.txt
newfilepath: C:\util\ProcessMonitor\Eula.txt.twSpMDCpB
oldfilepath: C:\util\ProcessMonitor\Eula.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\ProcessMonitor\procmon.chm.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\ProcessMonitor\procmon.chm
newfilepath: C:\util\ProcessMonitor\procmon.chm.twSpMDCpB
oldfilepath: C:\util\ProcessMonitor\procmon.chm
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Searches\Everywhere.search-ms.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Searches\Everywhere.search-ms
newfilepath: C:\Users\test22\Searches\Everywhere.search-ms.twSpMDCpB
oldfilepath: C:\Users\test22\Searches\Everywhere.search-ms
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Searches\Indexed Locations.search-ms.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Searches\Indexed Locations.search-ms
newfilepath: C:\Users\test22\Searches\Indexed Locations.search-ms.twSpMDCpB
oldfilepath: C:\Users\test22\Searches\Indexed Locations.search-ms
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Pictures\readme.bmp.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Pictures\readme.bmp
newfilepath: C:\Users\test22\Pictures\readme.bmp.twSpMDCpB
oldfilepath: C:\Users\test22\Pictures\readme.bmp
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url
newfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url
newfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url
newfilepath: C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\예술로.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\예술로.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\예술로.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\예술로.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links\웹 조각 갤러리.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links\웹 조각 갤러리.url
newfilepath: C:\Users\test22\Favorites\Links\웹 조각 갤러리.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links\웹 조각 갤러리.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links\추천 사이트.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links\추천 사이트.url
newfilepath: C:\Users\test22\Favorites\Links\추천 사이트.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links\추천 사이트.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\AowJxUuCVl.doc.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\AowJxUuCVl.doc
newfilepath: C:\Users\test22\Documents\AowJxUuCVl.doc.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\AowJxUuCVl.doc
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt
newfilepath: C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx
newfilepath: C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\Database1.accdb.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\Database1.accdb
newfilepath: C:\Users\test22\Documents\Database1.accdb.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\Database1.accdb
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\DDWNNBsuYMH.rtf.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\DDWNNBsuYMH.rtf
newfilepath: C:\Users\test22\Documents\DDWNNBsuYMH.rtf.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\DDWNNBsuYMH.rtf
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\GlMXTMlwfhN.docx.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\GlMXTMlwfhN.docx
newfilepath: C:\Users\test22\Documents\GlMXTMlwfhN.docx.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\GlMXTMlwfhN.docx
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt
newfilepath: C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\OJbdrBdPxL.doc.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\OJbdrBdPxL.doc
newfilepath: C:\Users\test22\Documents\OJbdrBdPxL.doc.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\OJbdrBdPxL.doc
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\phishing_file.pdf.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\phishing_file.pdf
newfilepath: C:\Users\test22\Documents\phishing_file.pdf.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\phishing_file.pdf
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\rDjnRjTsrKQ.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\rDjnRjTsrKQ.txt
newfilepath: C:\Users\test22\Documents\rDjnRjTsrKQ.txt.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\rDjnRjTsrKQ.txt
1 1 0
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: \\?\C:\readme.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\readme.txt
newfilepath: C:\readme.txt.twSpMDCpB
oldfilepath: C:\readme.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\pafish.log.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\pafish.log
newfilepath: C:\util\pafish.log.twSpMDCpB
oldfilepath: C:\util\pafish.log
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\vm_setting.reg.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\vm_setting.reg
newfilepath: C:\util\vm_setting.reg.twSpMDCpB
oldfilepath: C:\util\vm_setting.reg
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\ZeroCERT.bmp.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\ZeroCERT.bmp
newfilepath: C:\util\ZeroCERT.bmp.twSpMDCpB
oldfilepath: C:\util\ZeroCERT.bmp
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\TCPView\Eula.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\TCPView\Eula.txt
newfilepath: C:\util\TCPView\Eula.txt.twSpMDCpB
oldfilepath: C:\util\TCPView\Eula.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\TCPView\tcpview.chm.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\TCPView\tcpview.chm
newfilepath: C:\util\TCPView\tcpview.chm.twSpMDCpB
oldfilepath: C:\util\TCPView\tcpview.chm
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\ProcessMonitor\Eula.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\ProcessMonitor\Eula.txt
newfilepath: C:\util\ProcessMonitor\Eula.txt.twSpMDCpB
oldfilepath: C:\util\ProcessMonitor\Eula.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\ProcessMonitor\procmon.chm.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\ProcessMonitor\procmon.chm
newfilepath: C:\util\ProcessMonitor\procmon.chm.twSpMDCpB
oldfilepath: C:\util\ProcessMonitor\procmon.chm
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_bg.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_cn.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_en.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_es.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_fr.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_kms.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ru.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_ua.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt
newfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt.twSpMDCpB
oldfilepath: C:\util\KMSAuto_Net_2015_v1.4.2\readme\readme_vi.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Searches\Everywhere.search-ms.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Searches\Everywhere.search-ms
newfilepath: C:\Users\test22\Searches\Everywhere.search-ms.twSpMDCpB
oldfilepath: C:\Users\test22\Searches\Everywhere.search-ms
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Searches\Indexed Locations.search-ms.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Searches\Indexed Locations.search-ms
newfilepath: C:\Users\test22\Searches\Indexed Locations.search-ms.twSpMDCpB
oldfilepath: C:\Users\test22\Searches\Indexed Locations.search-ms
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Pictures\readme.bmp.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Pictures\readme.bmp
newfilepath: C:\Users\test22\Pictures\readme.bmp.twSpMDCpB
oldfilepath: C:\Users\test22\Pictures\readme.bmp
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 갤러리.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 메일.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 스페이스.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url
newfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Windows Live\Windows Live 패키지 다운로드.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 금융.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 뉴스.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 스포츠.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN 연예.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url
newfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\MSN 웹 사이트\MSN.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url
newfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\IE 홈.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url
newfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Microsoft 웹 사이트\Microsoft Store.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url
newfilepath: C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Microsoft Websites\IE 추가 기능 갤러리.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\e뮤지엄.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 구석구석.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\대한민국 전자정부.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\에듀넷.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\예술로.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\예술로.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\예술로.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\예술로.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url
newfilepath: C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links for 대한민국\전자민원G4C.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links\웹 조각 갤러리.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links\웹 조각 갤러리.url
newfilepath: C:\Users\test22\Favorites\Links\웹 조각 갤러리.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links\웹 조각 갤러리.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Favorites\Links\추천 사이트.url.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Favorites\Links\추천 사이트.url
newfilepath: C:\Users\test22\Favorites\Links\추천 사이트.url.twSpMDCpB
oldfilepath: C:\Users\test22\Favorites\Links\추천 사이트.url
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\AowJxUuCVl.doc.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\AowJxUuCVl.doc
newfilepath: C:\Users\test22\Documents\AowJxUuCVl.doc.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\AowJxUuCVl.doc
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt
newfilepath: C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\BVTfHicIyFGFaICP.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx
newfilepath: C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\cJALUlugfsUYawfSH.pptx
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\Database1.accdb.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\Database1.accdb
newfilepath: C:\Users\test22\Documents\Database1.accdb.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\Database1.accdb
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\DDWNNBsuYMH.rtf.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\DDWNNBsuYMH.rtf
newfilepath: C:\Users\test22\Documents\DDWNNBsuYMH.rtf.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\DDWNNBsuYMH.rtf
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\GlMXTMlwfhN.docx.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\GlMXTMlwfhN.docx
newfilepath: C:\Users\test22\Documents\GlMXTMlwfhN.docx.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\GlMXTMlwfhN.docx
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt
newfilepath: C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\NCIfLLWjsmeroWboX.txt
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\OJbdrBdPxL.doc.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\OJbdrBdPxL.doc
newfilepath: C:\Users\test22\Documents\OJbdrBdPxL.doc.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\OJbdrBdPxL.doc
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\phishing_file.pdf.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\phishing_file.pdf
newfilepath: C:\Users\test22\Documents\phishing_file.pdf.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\phishing_file.pdf
1 1 0

MoveFileWithProgressW

 newfilepath_r: \\?\C:\Users\test22\Documents\rDjnRjTsrKQ.txt.twSpMDCpB
flags: 8
oldfilepath_r: \\?\C:\Users\test22\Documents\rDjnRjTsrKQ.txt
newfilepath: C:\Users\test22\Documents\rDjnRjTsrKQ.txt.twSpMDCpB
oldfilepath: C:\Users\test22\Documents\rDjnRjTsrKQ.txt
1 1 0