Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 20, 2023, 5:28 p.m.	June 20, 2023, 5:43 p.m.

Size	307.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`70a81d8a8e39dc10c9245907afbd5960`
SHA256	`a656e12c7d6227c6da8236a727fb596d4799e0bd36ddb7f215493bd5bb1d94ca`
CRC32	`B730D374`
ssdeep	`6144:MNDlOw0MTS2L/2fxOlHoXu6NSVqryYJB3gOG0AkapIoZf/g:M50QL/aMHMuFQykB3gOYkaOoZXg`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library NSIS_Installer - Null Soft Installer PE_Header_Zero - PE File Signature IsPE32 - (no description)

HSBC%20Payment%20Advice.exe "C:\Users\test22\AppData\Local\Temp\HSBC%20Payment%20Advice.exe"
1984

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 20, 2023, 5:28 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 20, 2023, 5:28 p.m.	process_identifier: 1984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x741e5000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 20, 2023, 5:28 p.m.	process_identifier: 1984 region_size: 24018944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsrDB0A.tmp\System.dll

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\nsrDB0A.tmp\System.dll

Queries for potentially installed applications (4 events)

Time & API	Arguments	Return
RegOpenKeyExW June 20, 2023, 5:28 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers	2
RegOpenKeyExW June 20, 2023, 5:28 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers	2
RegOpenKeyExW June 20, 2023, 5:28 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers	2
RegOpenKeyExW June 20, 2023, 5:28 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00020019 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Klovnenummers	2

Performs 207 file moves indicative of a ransomware file encryption process (50 out of 207 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0

Appends a new file extension or content to 207 files indicative of a ransomware file encryption process (50 out of 207 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0
MoveFileWithProgressW June 20, 2023, 5:28 p.m.	newfilepath_r: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib flags: 2 oldfilepath_r: C:\Program Files (x86)\Nanogrammes.Cat newfilepath: C:\Users\test22\Oligoprothetic\Gynaecian\Naughtier\Magnetisr.Jib oldfilepath: C:\Program Files (x86)\Nanogrammes.Cat		0	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Guloader.4!c
MicroWorld-eScan	Trojan.GenericKD.67386363
FireEye	Trojan.GenericKD.67386363
CAT-QuickHeal	Trojan.Guloader
McAfee	Artemis!70A81D8A8E39
Malwarebytes	Trojan.GuLoader.NSIS
VIPRE	Trojan.GenericKD.67386363
Sangfor	Trojan.NSIS.Guloader.V110
K7AntiVirus	Trojan ( 005903451 )
Alibaba	TrojanDropper:Win32/Guloader.60e17e38
K7GW	Trojan ( 005903451 )
Arcabit	Trojan.Generic.D4043BFB
VirIT	Trojan.Win32.GenusT.DMHH
Cyren	W32/ABRisk.DNCA-7899
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	NSIS/Injector.ASH
Kaspersky	HEUR:Trojan.NSIS.Makoob.gen
BitDefender	Trojan.GenericKD.67386363
NANO-Antivirus	Trojan.Win32.Makoob.jwrkeb
Avast	NSIS:MalwareX-gen [Trj]
Tencent	Win32.Trojan.FalseSign.Iflw
Emsisoft	Trojan.GenericKD.67386363 (B)
F-Secure	Trojan.TR/Redcap.loeum
Zillya	Trojan.Makoob.Win32.487
TrendMicro	TROJ_GEN.R053C0DF723
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Google	Detected
Avira	TR/Redcap.loeum
MAX	malware (ai score=81)
Gridinsoft	Trojan.Win32.GuLoader.bot
Xcitium	Malware@#3756mw6mfglng
Microsoft	Trojan:Win32/Guloader.RKA!MTB
ZoneAlarm	HEUR:Trojan.NSIS.Makoob.gen
GData	Trojan.GenericKD.67386363
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Leonem.C5381469
ALYac	Trojan.GenericKD.67386363
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R053C0DF723
Fortinet	W32/ASH!tr
AVG	NSIS:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

HSBC%20Payment%20Advice.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All