13.4
0-day
该样本未表现出任何异常！
重新分析
更多

7949bf3e09366bdb23ca7472cb6c4d9183ad5b081ac5a568d556aec8beae0785

636a3d5759907f7a3261beac3f75ca6a.exe

分析耗时

135s

最近分析

文件大小

57.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (7 个事件)
Time & API Arguments Status Return Repeated
1619610670.328625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619610679.703625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649081.128501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649096.425501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649097.269501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649099.566501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649099.566501
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1619610673.359625
IsDebuggerPresent
failed 0 0
1619649096.222501
IsDebuggerPresent
failed 0 0
Tries to locate where the browsers are installed (1 个事件)
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\libGLESv2.dll
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619610665.109625
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .cdata
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619610673.562625
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x026c0000
success 0 0
A process attempted to delay the analysis task. (1 个事件)
description 636a3d5759907f7a3261beac3f75ca6a.exe tried to sleep 322 seconds, actually delayed analysis time by 322 seconds
Steals private information from local Internet browsers (50 out of 137 个事件)
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Favicons
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6072F20C-274.pma
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000001
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001.id[38C63B41-2275].[helprecover@foxmail.com].help
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\index.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\LOG
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1.id[38C63B41-2275].[helprecover@foxmail.com].help
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOCK
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000002.id[38C63B41-2275].[helprecover@foxmail.com].help
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOCK
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Favicons.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000004
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6072F217-D54.pma.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma.id[38C63B41-2275].[helprecover@foxmail.com].help
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db-journal
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Media History
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\16d48f1e7b824888_0.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000001.id[38C63B41-2275].[helprecover@foxmail.com].help
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db-journal
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0.id[38C63B41-2275].[helprecover@foxmail.com].help
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
Creates executable files on the filesystem (29 个事件)
file C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe
file C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\mojo_core.dll
file C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe
file C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\libEGL.dll
file C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\libEGL.dll
file C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
file C:\Program Files\Microsoft Games\Hearts\Hearts.exe
file C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll
file C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe
file C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
file C:\Program Files\Microsoft Games\More Games\MoreGames.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_elf.dll
file C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk
file C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\eventlog_provider.dll
file C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk
file C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
file C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe
file C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk
file C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
file C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk
file C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk
file C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe
Creates a shortcut to an executable file (6 个事件)
file C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk
file C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk
file C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk
file C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk
file C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk
file C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk
Creates a suspicious process (2 个事件)
cmdline C:\Windows\System32\cmd.exe
cmdline wmic shadowcopy delete
Executes one or more WMI queries (1 个事件)
wmi SELECT * FROM Win32_ShadowCopy
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.846017680855577 section {'size_of_data': '0x00003e00', 'virtual_address': '0x0000f000', 'entropy': 7.846017680855577, 'name': '.cdata', 'virtual_size': '0x00003cc8'} description A section with a high entropy has been found
entropy 0.2767857142857143 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619610670.328625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619649019.347499
LookupPrivilegeValueW
system_name:
privilege_name: SeBackupPrivilege
success 1 0
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 210 个事件)
Time & API Arguments Status Return Repeated
1619610670.828625
Process32NextW
process_name: 636a3d5759907f7a3261beac3f75ca6a.exe
snapshot_handle: 0x0000018c
process_identifier: 2852
failed 0 0
1619610671.328625
Process32NextW
process_name: 636a3d5759907f7a3261beac3f75ca6a.exe
snapshot_handle: 0x00000190
process_identifier: 2852
failed 0 0
1619610671.828625
Process32NextW
process_name: 636a3d5759907f7a3261beac3f75ca6a.exe
snapshot_handle: 0x0000018c
process_identifier: 2852
failed 0 0
1619610672.328625
Process32NextW
process_name: cmd.exe
snapshot_handle: 0x000001b4
process_identifier: 2996
failed 0 0
1619610672.828625
Process32NextW
process_name: cmd.exe
snapshot_handle: 0x000001b8
process_identifier: 2996
failed 0 0
1619610673.328625
Process32NextW
process_name: cmd.exe
snapshot_handle: 0x000001d0
process_identifier: 2996
failed 0 0
1619610673.828625
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x00000198
process_identifier: 1752
failed 0 0
1619610674.359625
Process32NextW
process_name: cmd.exe
snapshot_handle: 0x000001c8
process_identifier: 2996
failed 0 0
1619610674.859625
Process32NextW
process_name: conhost.exe
snapshot_handle: 0x00000224
process_identifier: 1760
failed 0 0
1619610675.390625
Process32NextW
process_name: conhost.exe
snapshot_handle: 0x00000230
process_identifier: 1760
failed 0 0
1619610675.890625
Process32NextW
process_name: conhost.exe
snapshot_handle: 0x00000230
process_identifier: 1760
failed 0 0
1619610676.390625
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x0000022c
process_identifier: 2196
failed 0 0
1619610676.890625
Process32NextW
process_name: vssadmin.exe
snapshot_handle: 0x00000194
process_identifier: 420
failed 0 0
1619610677.406625
Process32NextW
process_name: vssadmin.exe
snapshot_handle: 0x0000026c
process_identifier: 420
failed 0 0
1619610677.906625
Process32NextW
process_name: vssadmin.exe
snapshot_handle: 0x00000274
process_identifier: 420
failed 0 0
1619610678.406625
Process32NextW
process_name: vssadmin.exe
snapshot_handle: 0x000001c8
process_identifier: 420
failed 0 0
1619610678.937625
Process32NextW
process_name: VSSVC.exe
snapshot_handle: 0x00000270
process_identifier: 2604
failed 0 0
1619610679.437625
Process32NextW
process_name: VSSVC.exe
snapshot_handle: 0x000001fc
process_identifier: 2604
failed 0 0
1619610679.953625
Process32NextW
process_name: VSSVC.exe
snapshot_handle: 0x00000290
process_identifier: 2604
failed 0 0
1619610680.484625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000028c
process_identifier: 2548
failed 0 0
1619610681.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000268
process_identifier: 2548
failed 0 0
1619610681.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000280
process_identifier: 2548
failed 0 0
1619610682.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000270
process_identifier: 2548
failed 0 0
1619610682.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000280
process_identifier: 2548
failed 0 0
1619610683.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000298
process_identifier: 2548
failed 0 0
1619610683.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000280
process_identifier: 2548
failed 0 0
1619610684.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000214
process_identifier: 2548
failed 0 0
1619610684.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000214
process_identifier: 2548
failed 0 0
1619610685.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000214
process_identifier: 2548
failed 0 0
1619610685.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000027c
process_identifier: 2548
failed 0 0
1619610686.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000027c
process_identifier: 2548
failed 0 0
1619610686.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000027c
process_identifier: 2548
failed 0 0
1619610687.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000022c
process_identifier: 2548
failed 0 0
1619610687.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000028c
process_identifier: 2548
failed 0 0
1619610688.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000280
process_identifier: 2548
failed 0 0
1619610688.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000268
process_identifier: 2548
failed 0 0
1619610689.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x0000027c
process_identifier: 2548
failed 0 0
1619610689.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000268
process_identifier: 2548
failed 0 0
1619610690.000625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x000001c8
process_identifier: 2548
failed 0 0
1619610690.500625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x000001c8
process_identifier: 2548
failed 0 0
1619610691.062625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x000002b8
process_identifier: 2548
failed 0 0
1619610691.640625
Process32NextW
process_name: svchost.exe
snapshot_handle: 0x00000288
process_identifier: 2548
failed 0 0
1619610692.172625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000002c8
process_identifier: 3264
failed 0 0
1619610692.734625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000002cc
process_identifier: 3264
failed 0 0
1619610693.281625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x00000288
process_identifier: 3264
failed 0 0
1619610693.812625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000002d0
process_identifier: 3264
failed 0 0
1619610694.328625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000002d4
process_identifier: 3264
failed 0 0
1619610694.859625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000002e0
process_identifier: 3264
failed 0 0
1619610695.359625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x00000118
process_identifier: 3264
failed 0 0
1619610695.890625
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000002e0
process_identifier: 3264
failed 0 0
Uses Windows utilities for basic Windows functionality (1 个事件)
cmdline wmic shadowcopy delete
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Installs itself for autorun at Windows startup (2 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\636a3d5759907f7a3261beac3f75ca6a reg_value C:\Users\Administrator.Oskar-PC\AppData\Local\636a3d5759907f7a3261beac3f75ca6a.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\636a3d5759907f7a3261beac3f75ca6a reg_value C:\Users\Administrator.Oskar-PC\AppData\Local\636a3d5759907f7a3261beac3f75ca6a.exe
Performs 79 file moves indicative of a ransomware file encryption process (50 out of 79 个事件)
Time & API Arguments Status Return Repeated
1619610674.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
failed 0 0
1619610674.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
failed 0 0
1619610674.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.937625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
failed 0 0
1619610674.937625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
failed 0 0
1619610675.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.703625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\DVDMaker.exe
newfilepath: C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe
failed 0 0
1619610677.703625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\DVDMaker.exe
newfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdBase.dll
newfilepath: C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\OmdBase.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdProject.dll
newfilepath: C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\OmdProject.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Pipeline.dll
newfilepath: C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Pipeline.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\PipeTran.dll
newfilepath: C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\PipeTran.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.781625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
failed 0 0
1619610678.781625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
Appends a new file extension or content to 79 files indicative of a ransomware file encryption process (50 out of 79 个事件)
Time & API Arguments Status Return Repeated
1619610674.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
failed 0 0
1619610674.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\chslm.wdic2.bin.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
failed 0 0
1619610674.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
failed 0 0
1619610674.922625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610674.937625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
failed 0 0
1619610674.937625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
failed 0 0
1619610675.015625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
failed 0 0
1619610675.203625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\mshwchsr.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610675.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
failed 0 0
1619610675.218625
MoveFileWithProgressW
oldfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
newfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.703625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\DVDMaker.exe
newfilepath: C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe
failed 0 0
1619610677.703625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\DVDMaker.exe
newfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\DVDMaker.exe.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdBase.dll
newfilepath: C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\OmdBase.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdBase.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdProject.dll
newfilepath: C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\OmdProject.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\OmdProject.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Pipeline.dll
newfilepath: C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Pipeline.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Pipeline.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\PipeTran.dll
newfilepath: C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll
failed 0 0
1619610677.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\PipeTran.dll
newfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\PipeTran.dll.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
failed 0 0
1619610678.297625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.781625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
failed 0 0
1619610678.781625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
failed 0 0
1619610678.797625
MoveFileWithProgressW
oldfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
newfilepath: C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
newfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv
flags: 2
oldfilepath_r: \\?\C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.id[38C63B41-2275].[helprecover@foxmail.com].help
failed 0 0
Drops 135 unknown file mime types indicative of ransomware writing encrypted files back to disk (50 out of 135 个事件)
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-US.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\external_extensions.json
file C:\Program Files\Microsoft Games\Hearts\desktop.ini
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\it.pak
file C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-PT.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\am.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx
file C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\drive.crx
file C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db
file C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\zh-CN.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoDev.png
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ta.pak
file C:\Program Files\Microsoft Games\More Games\MoreGames.dll
file C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\gmail.crx
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\mojo_core.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ja.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\eventlog_provider.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\v8_context_snapshot.bin
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\tr.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hr.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\preloaded_data.pb
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ru.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoBeta.png
file C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll
file C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak
file C:\Program Files\Microsoft Games\Hearts\Hearts.exe
file C:\Program Files\Microsoft Games\Purble Place\zh-CN\PurblePlace.exe.mui
file C:\Program Files\Microsoft Games\Mahjong\desktop.ini
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\libEGL.dll
file C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\vi.pak
file C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\el.pak
file C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll
file C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe
file C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml
file C:\Program Files\Microsoft Games\Multiplayer\Spades\zh-CN\ShvlRes.dll.mui
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\zh-TW.pak
file C:\Program Files\Google\Chrome\Application\SetupMetrics\20210411204935.pma
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\Logo.png
file C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-GB.pak
Deletes a large number of files from the system indicative of ransomware, wiper malware or system destruction (50 out of 196 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db
file C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pl.pak
file C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe
file C:\Program Files\Microsoft Games\Chess\desktop.ini
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Favicons
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
file C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-9-0.bdic
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\external_extensions.json
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ru.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\libEGL.dll
file C:\$Recycle.Bin\S-1-5-21-3154413779-3303930873-3537499701-1001\desktop.ini
file C:\Python27\Lib\test\185test.db
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\libEGL.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\zh-TW.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\uk.pak
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\GDIPFONTCACHEV1.DAT
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak
file C:\Program Files\Microsoft Games\Mahjong\desktop.ini
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000004
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000003
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000002
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000001
file C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sk.pak
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-BR.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ro.pak
file C:\Program Files\Microsoft Games\Chess\zh-CN\Chess.exe.mui
file UNC\OSKAR-PC\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file UNC\OSKAR-PC\Users\Oskar\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
file C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fr.pak
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\eventlog_provider.dll
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hi.pak
file C:\Program Files\Microsoft Games\Purble Place\zh-CN\PurblePlace.exe.mui
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\el.pak
file C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\preloaded_data.pb
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sl.pak
file C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx
file C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fi.pak
file C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk
file C:\Program Files\Microsoft Games\FreeCell\desktop.ini
file C:\Program Files\Microsoft Games\Purble Place\desktop.ini
file C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.exe.sig
Removes the Shadow Copy to avoid recovery of the system (2 个事件)
cmdline vssadmin delete shadows /all /quiet
cmdline wmic shadowcopy delete
Uses suspicious command line tools or Windows utilities (1 个事件)
cmdline vssadmin delete shadows /all /quiet
Detects VirtualBox through the presence of a device (2 个事件)
file \??\VBoxGuest
file \??\VBoxMiniRdrDN
Detects VirtualBox through the presence of a file (1 个事件)
dll C:\Windows\system32\VBoxMRXNP.dll
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-01-25 22:37:23

Imports

Library MPR.dll:
• 0x40a154 WNetEnumResourceW
• 0x40a158 WNetUseConnectionW
• 0x40a15c WNetOpenEnumW
• 0x40a160 WNetCloseEnum
Library WS2_32.dll:
• 0x40a198 ioctlsocket
• 0x40a19c getpeername
• 0x40a1a0 ntohl
• 0x40a1a4 select
• 0x40a1a8 WSAGetLastError
• 0x40a1ac htons
• 0x40a1b0 recv
• 0x40a1b4 socket
• 0x40a1b8 closesocket
• 0x40a1bc getsockopt
• 0x40a1c0 WSAAddressToStringW
• 0x40a1c4 htonl
• 0x40a1c8 connect
Library IPHLPAPI.DLL:
• 0x40a038 GetIpAddrTable
Library WINHTTP.dll:
• 0x40a180 WinHttpOpenRequest
• 0x40a184 WinHttpConnect
• 0x40a188 WinHttpCloseHandle
• 0x40a18c WinHttpOpen
• 0x40a190 WinHttpSendRequest
Library KERNEL32.dll:
• 0x40a048 GetLocalTime
• 0x40a04c ReadProcessMemory
• 0x40a050 FindNextFileW
• 0x40a054 SetFileAttributesW
• 0x40a058 MoveFileW
• 0x40a05c GetFileSizeEx
• 0x40a060 GetFileAttributesW
• 0x40a064 SetFilePointerEx
• 0x40a068 SetEndOfFile
• 0x40a06c ExitProcess
• 0x40a070 SetFilePointer
• 0x40a074 WaitForSingleObject
• 0x40a078 GetComputerNameW
• 0x40a07c SetEvent
• 0x40a080 GetLogicalDrives
• 0x40a084 GetTickCount
• 0x40a088 Sleep
• 0x40a08c CopyFileW
• 0x40a090 ReadFile
• 0x40a094 CreateFileW
• 0x40a098 MultiByteToWideChar
• 0x40a09c CreateEventW
• 0x40a0a4 CloseHandle
• 0x40a0a8 CreateThread
• 0x40a0b8 ResetEvent
• 0x40a0c0 AllocConsole
• 0x40a0c4 WriteFile
• 0x40a0c8 WideCharToMultiByte
• 0x40a0cc WriteConsoleW
• 0x40a0d0 GetStdHandle
• 0x40a0d4 CreateMutexW
• 0x40a0d8 CreateProcessW
• 0x40a0dc GetCurrentProcess
• 0x40a0e4 OpenProcess
• 0x40a0e8 GetLocaleInfoW
• 0x40a0ec FindClose
• 0x40a0f0 TerminateProcess
• 0x40a0f4 GetModuleFileNameW
• 0x40a0f8 FlushFileBuffers
• 0x40a0fc OpenMutexW
• 0x40a100 GetLastError
• 0x40a104 GetProcAddress
• 0x40a108 Process32FirstW
• 0x40a10c GetExitCodeThread
• 0x40a110 CreatePipe
• 0x40a114 Process32NextW
• 0x40a118 GetModuleHandleA
• 0x40a120 ReleaseMutex
• 0x40a124 GetVersion
• 0x40a128 DeleteFileW
• 0x40a12c GetCurrentProcessId
• 0x40a138 HeapAlloc
• 0x40a13c GetProcessHeap
• 0x40a140 HeapReAlloc
• 0x40a144 HeapFree
• 0x40a148 FindFirstFileW
• 0x40a14c GetCurrentThreadId
Library USER32.dll:
• 0x40a174 GetShellWindow
Library ADVAPI32.dll:
• 0x40a000 FreeSid
• 0x40a008 OpenProcessToken
• 0x40a00c GetTokenInformation
• 0x40a010 EqualSid
• 0x40a014 RegSetValueExW
• 0x40a018 RegCloseKey
• 0x40a020 RegOpenKeyExW
• 0x40a024 LookupAccountSidW
• 0x40a02c DuplicateTokenEx
• 0x40a030 RegQueryValueExW
Library SHELL32.dll:
• 0x40a168 ShellExecuteExW
Library ole32.dll:
• 0x40a1d0 CoGetObject
• 0x40a1d4 CoInitializeEx
• 0x40a1d8 CoUninitialize

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49184 192.168.56.1 139
192.168.56.101 49185 192.168.56.1 139
192.168.56.101 49198 192.168.56.1 139

UDP

Source Source Port Destination Destination Port
192.168.56.1 137 192.168.56.101 137
192.168.56.1 138 192.168.56.101 138
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63921 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50849 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 53661 224.0.0.252 5355
192.168.56.101 54178 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 55331 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.