| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-08 16:30:48 | 2025-12-08 16:34:55 | 247 seconds | Show Options | Show Analysis Log | 5.4 |
vnc_port=5901
2025-12-06 19:18:15,676 [root] INFO: Date set to: 20251208T08:30:47, timeout set to: 180 2025-12-08 08:30:47,008 [root] DEBUG: Starting analyzer from: C:\tmphvfp1ko9 2025-12-08 08:30:47,008 [root] DEBUG: Storing results at: C:\ztotMKfuJ 2025-12-08 08:30:47,008 [root] DEBUG: Pipe server name: \\.\PIPE\mXbrpiNPNM 2025-12-08 08:30:47,008 [root] DEBUG: Python path: C:\Python38 2025-12-08 08:30:47,008 [root] INFO: analysis running as an admin 2025-12-08 08:30:47,008 [root] DEBUG: no analysis package configured, picking one for you 2025-12-08 08:30:47,008 [root] INFO: analysis package selected: "zip" 2025-12-08 08:30:47,008 [root] DEBUG: importing analysis package module: "modules.packages.zip"... 2025-12-08 08:30:47,070 [root] DEBUG: imported analysis package "zip" 2025-12-08 08:30:47,070 [root] DEBUG: initializing analysis package "zip"... 2025-12-08 08:30:47,070 [lib.common.common] INFO: wrapping 2025-12-08 08:30:47,070 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-08 08:30:47,070 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\2210d1f3b152858bd86f.zip 2025-12-08 08:30:47,070 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL option 2025-12-08 08:30:47,070 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL_64 option 2025-12-08 08:30:47,070 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader option 2025-12-08 08:30:47,070 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader_64 option 2025-12-08 08:30:47,117 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-12-08 08:30:47,117 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain" 2025-12-08 08:30:47,117 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-12-08 08:30:47,117 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script" 2025-12-08 08:30:47,133 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks" 2025-12-08 08:30:47,133 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx" 2025-12-08 08:30:47,133 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-12-08 08:30:47,133 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script" 2025-12-08 08:30:47,148 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-12-08 08:30:47,148 [lib.api.screenshot] ERROR: No module named 'PIL' 2025-12-08 08:30:47,148 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-12-08 08:30:47,164 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon" 2025-12-08 08:30:47,164 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-12-08 08:30:47,164 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage" 2025-12-08 08:30:47,164 [root] DEBUG: Initialized auxiliary module "Browser" 2025-12-08 08:30:47,164 [root] DEBUG: attempting to configure 'Browser' from data 2025-12-08 08:30:47,164 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-12-08 08:30:47,164 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-12-08 08:30:47,164 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-12-08 08:30:47,164 [root] DEBUG: Initialized auxiliary module "Curtain" 2025-12-08 08:30:47,164 [root] DEBUG: attempting to configure 'Curtain' from data 2025-12-08 08:30:47,164 [root] DEBUG: module Curtain does not support data configuration, ignoring 2025-12-08 08:30:47,164 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"... 2025-12-08 08:30:47,164 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain 2025-12-08 08:30:47,164 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-12-08 08:30:47,164 [root] DEBUG: attempting to configure 'Disguise' from data 2025-12-08 08:30:47,164 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-12-08 08:30:47,164 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-12-08 08:30:47,164 [modules.auxiliary.disguise] INFO: Disguising GUID to 27b028a3-b63a-43be-97ec-1f6fd25d143c 2025-12-08 08:30:47,164 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-12-08 08:30:47,164 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks" 2025-12-08 08:30:47,164 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data 2025-12-08 08:30:47,164 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring 2025-12-08 08:30:47,164 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"... 2025-12-08 08:30:47,179 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe 2025-12-08 08:30:47,179 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks 2025-12-08 08:30:47,179 [root] DEBUG: Initialized auxiliary module "Evtx" 2025-12-08 08:30:47,179 [root] DEBUG: attempting to configure 'Evtx' from data 2025-12-08 08:30:47,179 [root] DEBUG: module Evtx does not support data configuration, ignoring 2025-12-08 08:30:47,179 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"... 2025-12-08 08:30:47,179 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable 2025-12-08 08:30:47,179 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx 2025-12-08 08:30:47,179 [root] DEBUG: Initialized auxiliary module "Human" 2025-12-08 08:30:47,179 [root] DEBUG: attempting to configure 'Human' from data 2025-12-08 08:30:47,179 [root] DEBUG: module Human does not support data configuration, ignoring 2025-12-08 08:30:47,179 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-12-08 08:30:47,195 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-12-08 08:30:47,195 [root] DEBUG: Initialized auxiliary module "Pre_script" 2025-12-08 08:30:47,195 [root] DEBUG: attempting to configure 'Pre_script' from data 2025-12-08 08:30:47,195 [root] DEBUG: module Pre_script does not support data configuration, ignoring 2025-12-08 08:30:47,195 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"... 2025-12-08 08:30:47,195 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script 2025-12-08 08:30:47,195 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-12-08 08:30:47,195 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-12-08 08:30:47,195 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-12-08 08:30:47,195 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-12-08 08:30:47,195 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled 2025-12-08 08:30:47,195 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-12-08 08:30:47,195 [root] DEBUG: Initialized auxiliary module "Sysmon" 2025-12-08 08:30:47,195 [root] DEBUG: attempting to configure 'Sysmon' from data 2025-12-08 08:30:47,195 [root] DEBUG: module Sysmon does not support data configuration, ignoring 2025-12-08 08:30:47,195 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"... 2025-12-08 08:30:47,367 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable 2025-12-08 08:30:47,476 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable 2025-12-08 08:30:47,539 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques. 2025-12-08 08:30:47,539 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-12-08 08:30:47,539 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-12-08 08:30:47,539 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-12-08 08:30:47,539 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-12-08 08:30:47,539 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 716 2025-12-08 08:30:47,539 [lib.api.process] INFO: Monitor config for <Process 716 lsass.exe>: C:\tmphvfp1ko9\dll\716.ini 2025-12-08 08:30:47,539 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable 2025-12-08 08:30:47,539 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-12-08 08:30:47,554 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmphvfp1ko9\dll\QwzCdw.dll, loader C:\tmphvfp1ko9\bin\GyhYBQTL.exe 2025-12-08 08:30:47,679 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable 2025-12-08 08:30:47,820 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe 2025-12-08 08:30:47,851 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable 2025-12-08 08:30:47,976 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable 2025-12-08 08:30:48,023 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe 2025-12-08 08:30:48,054 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable 2025-12-08 08:30:48,086 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable 2025-12-08 08:30:48,117 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe 2025-12-08 08:30:48,133 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable 2025-12-08 08:30:48,211 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable 2025-12-08 08:30:48,242 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe 2025-12-08 08:30:48,273 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable 2025-12-08 08:30:48,336 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable 2025-12-08 08:30:48,383 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable 2025-12-08 08:30:48,429 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable 2025-12-08 08:30:48,429 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2025-12-08 08:30:48,476 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable 2025-12-08 08:30:48,476 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f 2025-12-08 08:30:48,508 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable 2025-12-08 08:30:48,523 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f 2025-12-08 08:30:48,539 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable 2025-12-08 08:30:48,586 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable 2025-12-08 08:30:48,633 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable 2025-12-08 08:30:48,695 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable 2025-12-08 08:30:48,726 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable 2025-12-08 08:30:48,773 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable 2025-12-08 08:30:48,789 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable 2025-12-08 08:30:48,820 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable 2025-12-08 08:30:48,851 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable 2025-12-08 08:30:48,883 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable 2025-12-08 08:30:48,914 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable 2025-12-08 08:30:48,945 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable 2025-12-08 08:30:48,992 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable 2025-12-08 08:30:49,008 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable 2025-12-08 08:30:49,039 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable 2025-12-08 08:30:49,070 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable 2025-12-08 08:30:49,101 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable 2025-12-08 08:30:49,148 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable 2025-12-08 08:30:49,179 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable 2025-12-08 08:30:49,211 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable 2025-12-08 08:30:49,242 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable 2025-12-08 08:30:49,273 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable 2025-12-08 08:30:49,289 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable 2025-12-08 08:30:49,320 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable 2025-12-08 08:30:49,351 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable 2025-12-08 08:30:49,383 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable 2025-12-08 08:30:49,398 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable 2025-12-08 08:30:49,429 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable 2025-12-08 08:30:49,461 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable 2025-12-08 08:30:49,476 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable 2025-12-08 08:30:49,508 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable 2025-12-08 08:30:49,539 [modules.auxiliary.evtx] DEBUG: Wiping Application 2025-12-08 08:30:49,554 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents 2025-12-08 08:30:49,586 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer 2025-12-08 08:30:49,617 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service 2025-12-08 08:30:49,633 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts 2025-12-08 08:30:49,664 [modules.auxiliary.evtx] DEBUG: Wiping Security 2025-12-08 08:30:49,695 [modules.auxiliary.evtx] DEBUG: Wiping Setup 2025-12-08 08:30:49,726 [modules.auxiliary.evtx] DEBUG: Wiping System 2025-12-08 08:30:49,773 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell 2025-12-08 08:30:49,820 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational 2025-12-08 08:31:11,563 [root] DEBUG: Loader: Injecting process 716 with C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:31:35,597 [root] DEBUG: 716: Python path set to 'C:\Python38'. 2025-12-08 08:31:35,612 [root] INFO: Disabling sleep skipping. 2025-12-08 08:31:35,612 [root] DEBUG: 716: TLS secret dump mode enabled. 2025-12-08 08:31:35,612 [root] DEBUG: 716: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable 2025-12-08 08:31:35,612 [root] DEBUG: 716: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0 2025-12-08 08:31:35,612 [root] DEBUG: 716: Monitor initialised: 64-bit capemon loaded in process 716 at 0x00007FFCAE970000, thread 3740, image base 0x00007FF6BC8A0000, stack from 0x0000001E0C174000-0x0000001E0C180000 2025-12-08 08:31:35,612 [root] DEBUG: 716: Commandline: C:\Windows\system32\lsass.exe 2025-12-08 08:31:35,612 [root] DEBUG: 716: Hooked 5 out of 5 functions 2025-12-08 08:31:35,612 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-08 08:31:35,612 [root] DEBUG: Successfully injected DLL C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:31:35,612 [lib.api.process] INFO: Injected into 64-bit <Process 716 lsass.exe> 2025-12-08 08:31:35,628 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2025-12-08 08:31:35,628 [root] DEBUG: Initialized auxiliary module "Usage" 2025-12-08 08:31:35,628 [root] DEBUG: attempting to configure 'Usage' from data 2025-12-08 08:31:35,628 [root] DEBUG: module Usage does not support data configuration, ignoring 2025-12-08 08:31:35,628 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"... 2025-12-08 08:31:35,628 [root] DEBUG: Started auxiliary module modules.auxiliary.usage 2025-12-08 08:31:35,628 [root] DEBUG: Initialized auxiliary module "During_script" 2025-12-08 08:31:35,628 [root] DEBUG: attempting to configure 'During_script' from data 2025-12-08 08:31:35,628 [root] DEBUG: module During_script does not support data configuration, ignoring 2025-12-08 08:31:35,628 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"... 2025-12-08 08:31:35,628 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script 2025-12-08 08:31:38,254 [root] INFO: Restarting WMI Service 2025-12-08 08:31:40,316 [root] DEBUG: package modules.packages.zip does not support configure, ignoring 2025-12-08 08:31:40,316 [root] WARNING: configuration error for package modules.packages.zip: error importing data.packages.zip: No module named 'data.packages' 2025-12-08 08:31:40,316 [lib.common.zip_utils] DEBUG: Archive is encrypted, using default password value: infected 2025-12-08 08:31:40,316 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'l', 'C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip'] 2025-12-08 08:32:28,927 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-p', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip'] 2025-12-08 08:32:29,256 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20\r\n\r\nScanning the drive for archives:\r\n1 file, 664861 bytes (650 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip\r\nType = zip\r\nPhysical Size = 664861\r\n\r\n\r\nSub items Errors: 1\r\n\r\nArchives with Errors: 1\r\n\r\nSub items Errors: 1\r\n' b'ERROR: Wrong password : 2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar\r\n' 2025-12-08 08:32:29,256 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-pinfected', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip'] 2025-12-08 08:32:29,537 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20\r\n\r\nScanning the drive for archives:\r\n1 file, 664861 bytes (650 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\2210d1f3b152858bd86f.zip\r\nType = zip\r\nPhysical Size = 664861\r\n\r\nEverything is Ok\r\n\r\nSize: 664539\r\nCompressed: 664861\r\n' b'' 2025-12-08 08:32:29,537 [lib.common.zip_utils] INFO: Uploading C:\Users\user\AppData\Local\Temp\2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar to host 2025-12-08 08:32:29,537 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar to files/2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf; Size is 664539; Max size: 100000000 2025-12-08 08:32:29,537 [modules.packages.zip] DEBUG: No interesting files found, auto executing the first file: 2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar 2025-12-08 08:32:29,537 [modules.packages.zip] DEBUG: Missing file option, auto executing: ['2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar'] 2025-12-08 08:32:29,537 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-08 08:32:29,552 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c "cd ^"C:\Users\user\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\user\AppData\Local\Temp\2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar^"" with pid 5144 2025-12-08 08:32:29,552 [lib.api.process] INFO: Monitor config for <Process 5144 cmd.exe>: C:\tmphvfp1ko9\dll\5144.ini 2025-12-08 08:32:29,568 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphvfp1ko9\dll\UIKVMYZ.dll, loader C:\tmphvfp1ko9\bin\iOHfGOs.exe 2025-12-08 08:32:53,644 [root] DEBUG: Loader: Injecting process 5144 (thread 3800) with C:\tmphvfp1ko9\dll\UIKVMYZ.dll. 2025-12-08 08:32:53,644 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:32:53,644 [root] DEBUG: Successfully injected DLL C:\tmphvfp1ko9\dll\UIKVMYZ.dll. 2025-12-08 08:32:53,644 [lib.api.process] INFO: Injected into 32-bit <Process 5144 cmd.exe> 2025-12-08 08:32:55,659 [lib.api.process] INFO: Successfully resumed <Process 5144 cmd.exe> 2025-12-08 08:33:19,987 [root] DEBUG: 5144: Python path set to 'C:\Python38'. 2025-12-08 08:33:19,987 [root] INFO: Disabling sleep skipping. 2025-12-08 08:33:19,987 [root] DEBUG: 5144: Dropped file limit defaulting to 100. 2025-12-08 08:33:19,987 [root] DEBUG: 5144: YaraInit: Compiled 41 rule files 2025-12-08 08:33:19,987 [root] DEBUG: 5144: YaraInit: Compiled rules saved to file C:\tmphvfp1ko9\data\yara\capemon.yac 2025-12-08 08:33:19,987 [root] DEBUG: 5144: YaraScan: Scanning 0x00270000, size 0x5a55a 2025-12-08 08:33:19,987 [root] DEBUG: 5144: AmsiDumper initialised. 2025-12-08 08:33:19,987 [root] DEBUG: 5144: Monitor initialised: 32-bit capemon loaded in process 5144 at 0x749a0000, thread 3800, image base 0x270000, stack from 0x2803000-0x2900000 2025-12-08 08:33:19,987 [root] DEBUG: 5144: Commandline: "C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\user\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\user\AppData\Local\Temp\2210d1f3b152858bd86fc559caf22d32a9d93e9447711aebb4d2a512db9bddcf.rar^" 2025-12-08 08:33:20,002 [root] DEBUG: 5144: GetAddressByYara: ModuleBase 0x77470000 FunctionName LdrpCallInitRoutine 2025-12-08 08:33:20,002 [root] DEBUG: 5144: hook_api: LdrpCallInitRoutine export address 0x774E66A0 obtained via GetFunctionAddress 2025-12-08 08:33:20,002 [root] DEBUG: 5144: hook_api: Warning - CreateRemoteThreadEx export address 0x76289A4C differs from GetProcAddress -> 0x76AEDDB0 (KERNELBASE.dll::0x11ddb0) 2025-12-08 08:33:20,002 [root] DEBUG: 5144: hook_api: Warning - CoCreateInstance export address 0x75730FEB differs from GetProcAddress -> 0x75F0FF70 (combase.dll::0xdff70) 2025-12-08 08:33:20,002 [root] DEBUG: 5144: hook_api: Warning - CoCreateInstanceEx export address 0x7573102A differs from GetProcAddress -> 0x75F5CCF0 (combase.dll::0x12ccf0) 2025-12-08 08:33:20,002 [root] DEBUG: 5144: hook_api: Warning - CoGetClassObject export address 0x757315BA differs from GetProcAddress -> 0x75ED2BD0 (combase.dll::0xa2bd0) 2025-12-08 08:33:20,002 [root] DEBUG: 5144: hook_api: Warning - UpdateProcThreadAttribute export address 0x762918BA differs from GetProcAddress -> 0x76B1BD10 (KERNELBASE.dll::0x14bd10) 2025-12-08 08:33:20,018 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:33:20,018 [root] DEBUG: 5144: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:33:20,018 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:33:20,018 [root] DEBUG: 5144: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:33:20,018 [root] DEBUG: 5144: hook_api: Warning - CLSIDFromProgID export address 0x75730824 differs from GetProcAddress -> 0x75EA54C0 (combase.dll::0x754c0) 2025-12-08 08:33:20,018 [root] DEBUG: 5144: hook_api: Warning - CLSIDFromProgIDEx export address 0x75730861 differs from GetProcAddress -> 0x75E9FF40 (combase.dll::0x6ff40) 2025-12-08 08:33:20,018 [root] DEBUG: 5144: Hooked 611 out of 613 functions 2025-12-08 08:33:20,018 [root] DEBUG: 5144: Syscall hook installed, syscall logging level 1 2025-12-08 08:33:20,018 [root] DEBUG: 5144: WoW64fix: Windows version 10.0 not supported. 2025-12-08 08:33:20,018 [root] INFO: Loaded monitor into process with pid 5144 2025-12-08 08:33:20,018 [root] DEBUG: 5144: caller_dispatch: Added region at 0x00270000 to tracked regions list (ntdll::memcpy returns to 0x0028BB7E, thread 3800). 2025-12-08 08:33:20,018 [root] DEBUG: 5144: YaraScan: Scanning 0x00270000, size 0x5a55a 2025-12-08 08:33:20,018 [root] DEBUG: 5144: ProcessImageBase: Main module image at 0x00270000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:33:20,034 [root] DEBUG: 5144: InstrumentationCallback: Added region at 0x769D0000 to tracked regions list (thread 3800). 2025-12-08 08:33:20,034 [root] DEBUG: 5144: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-08 08:33:20,034 [root] DEBUG: 5144: DLL loaded at 0x74F30000: C:\Windows\SYSTEM32\kernel.appcore (0x13000 bytes). 2025-12-08 08:33:20,034 [root] DEBUG: 5144: DLL loaded at 0x75540000: C:\Windows\System32\bcryptPrimitives (0x62000 bytes). 2025-12-08 08:33:20,034 [root] DEBUG: 5144: DLL loaded at 0x74D40000: C:\Windows\system32\uxtheme (0x7f000 bytes). 2025-12-08 08:33:20,065 [root] DEBUG: 5144: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:33:20,065 [root] DEBUG: 5144: DLL loaded at 0x74C50000: C:\Windows\SYSTEM32\wintypes (0xc7000 bytes). 2025-12-08 08:33:20,065 [root] DEBUG: 5144: DLL loaded at 0x74020000: C:\Windows\SYSTEM32\windows.storage (0x6ec000 bytes). 2025-12-08 08:33:20,065 [root] DEBUG: 5144: DLL loaded at 0x76C50000: C:\Windows\System32\shcore (0xc1000 bytes). 2025-12-08 08:33:20,081 [root] DEBUG: 5144: InstrumentationCallback: Added region at 0x761F0000 to tracked regions list (thread 3800). 2025-12-08 08:33:20,081 [root] DEBUG: 5144: DLL loaded at 0x73DF0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.2506_none_6eb991c088050a06\comctl32 (0x228000 bytes). 2025-12-08 08:33:20,096 [root] DEBUG: 5144: DLL loaded at 0x748A0000: C:\Windows\System32\PROPSYS (0xc7000 bytes). 2025-12-08 08:33:20,096 [root] DEBUG: 5144: DLL loaded at 0x758D0000: C:\Windows\System32\OLEAUT32 (0x9c000 bytes). 2025-12-08 08:33:20,112 [root] DEBUG: 5144: DLL loaded at 0x76130000: C:\Windows\System32\clbcatq (0x82000 bytes). 2025-12-08 08:33:20,128 [root] DEBUG: 5144: DLL loaded at 0x73D80000: C:\Windows\System32\msvcp110_win (0x67000 bytes). 2025-12-08 08:33:20,128 [root] DEBUG: 5144: DLL loaded at 0x747B0000: C:\Windows\System32\Windows.System.Launcher (0xe3000 bytes). 2025-12-08 08:33:20,128 [root] DEBUG: 5144: DLL loaded at 0x74D20000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x13000 bytes). 2025-12-08 08:33:20,158 [root] DEBUG: 5144: DLL loaded at 0x73D60000: C:\Windows\System32\profapi (0x1d000 bytes). 2025-12-08 08:33:20,190 [root] DEBUG: 5144: api-rate-cap: NtQueryValueKey hook disabled due to rate 2025-12-08 08:33:20,206 [root] DEBUG: 5144: api-rate-cap: NtOpenKeyEx hook disabled due to rate 2025-12-08 08:33:20,221 [root] DEBUG: 5144: DLL loaded at 0x73D20000: C:\Windows\System32\CFGMGR32 (0x3d000 bytes). 2025-12-08 08:33:20,221 [root] DEBUG: 5144: DLL loaded at 0x73D00000: C:\Windows\System32\edputil (0x1f000 bytes). 2025-12-08 08:33:20,221 [lib.api.process] INFO: Monitor config for <Process 844 svchost.exe>: C:\tmphvfp1ko9\dll\844.ini 2025-12-08 08:33:20,221 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmphvfp1ko9\dll\QwzCdw.dll, loader C:\tmphvfp1ko9\bin\GyhYBQTL.exe 2025-12-08 08:33:20,237 [root] DEBUG: Loader: Injecting process 844 with C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:20,237 [root] DEBUG: 844: Python path set to 'C:\Python38'. 2025-12-08 08:33:20,237 [root] INFO: Disabling sleep skipping. 2025-12-08 08:33:20,237 [root] DEBUG: 844: Dropped file limit defaulting to 100. 2025-12-08 08:33:20,237 [root] DEBUG: 844: Services hook set enabled 2025-12-08 08:33:20,237 [root] DEBUG: 844: YaraInit: Compiled rules loaded from existing file C:\tmphvfp1ko9\data\yara\capemon.yac 2025-12-08 08:33:20,237 [root] DEBUG: 844: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable 2025-12-08 08:33:20,253 [root] DEBUG: 844: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0 2025-12-08 08:33:20,253 [root] DEBUG: 844: AmsiDumper initialised. 2025-12-08 08:33:20,253 [root] DEBUG: 844: Monitor initialised: 64-bit capemon loaded in process 844 at 0x00007FFCAE970000, thread 6544, image base 0x00007FF6D10B0000, stack from 0x000000D631C75000-0x000000D631C80000 2025-12-08 08:33:20,253 [root] DEBUG: 844: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p 2025-12-08 08:33:20,253 [root] DEBUG: 844: hook_api: Warning - CoCreateInstance export address 0x00007FFCDBCB7EF9 differs from GetProcAddress -> 0x00007FFCDBD92050 (combase.dll::0x42050) 2025-12-08 08:33:20,253 [root] DEBUG: 844: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCDBCB7F38 differs from GetProcAddress -> 0x00007FFCDBD6CC40 (combase.dll::0x1cc40) 2025-12-08 08:33:20,253 [root] DEBUG: 844: hook_api: Warning - CoGetClassObject export address 0x00007FFCDBCB84C8 differs from GetProcAddress -> 0x00007FFCDBE19870 (combase.dll::0xc9870) 2025-12-08 08:33:20,253 [root] DEBUG: 844: Hooked 69 out of 69 functions 2025-12-08 08:33:20,253 [root] INFO: Loaded monitor into process with pid 844 2025-12-08 08:33:20,253 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-08 08:33:20,253 [root] DEBUG: Successfully injected DLL C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:20,253 [lib.api.process] INFO: Injected into 64-bit <Process 844 svchost.exe> 2025-12-08 08:33:22,268 [root] DEBUG: 5144: DLL loaded at 0x73CA0000: C:\Windows\System32\Windows.StateRepositoryPS (0x5f000 bytes). 2025-12-08 08:33:22,299 [root] DEBUG: 5144: DLL loaded at 0x73270000: C:\Windows\System32\iertutil (0x238000 bytes). 2025-12-08 08:33:22,299 [root] DEBUG: 5144: DLL loaded at 0x73AD0000: C:\Windows\System32\srvcli (0x1d000 bytes). 2025-12-08 08:33:22,299 [root] DEBUG: 5144: DLL loaded at 0x73AC0000: C:\Windows\System32\netutils (0xb000 bytes). 2025-12-08 08:33:22,299 [root] DEBUG: 5144: DLL loaded at 0x73AF0000: C:\Windows\System32\urlmon (0x1a2000 bytes). 2025-12-08 08:33:22,315 [root] DEBUG: 5144: DLL loaded at 0x73AA0000: C:\Windows\SYSTEM32\virtdisk (0x12000 bytes). 2025-12-08 08:33:22,315 [root] DEBUG: 5144: DLL loaded at 0x73A50000: C:\Windows\System32\Wldp (0x44000 bytes). 2025-12-08 08:33:22,315 [root] DEBUG: 5144: DLL loaded at 0x73A30000: C:\Windows\System32\smartscreenps (0x13000 bytes). 2025-12-08 08:33:22,346 [root] DEBUG: 5144: DLL loaded at 0x76330000: C:\Windows\System32\SHELL32 (0x697000 bytes). 2025-12-08 08:33:22,346 [root] DEBUG: 5144: DLL loaded at 0x739C0000: C:\Windows\SYSTEM32\shdocvw (0x6f000 bytes). 2025-12-08 08:33:22,346 [root] DEBUG: 5144: DLL loaded at 0x70D10000: C:\Windows\SYSTEM32\apphelp (0xa6000 bytes). 2025-12-08 08:33:22,362 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 4456: C:\Windows\system32\OpenWith.exe, ImageBase: 0x00007FF731DE0000 2025-12-08 08:33:22,362 [root] INFO: Announced 64-bit process name: OpenWith.exe pid: 4456 2025-12-08 08:33:22,362 [lib.api.process] INFO: Monitor config for <Process 4456 OpenWith.exe>: C:\tmphvfp1ko9\dll\4456.ini 2025-12-08 08:33:22,362 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmphvfp1ko9\dll\QwzCdw.dll, loader C:\tmphvfp1ko9\bin\GyhYBQTL.exe 2025-12-08 08:33:22,362 [root] DEBUG: Loader: Injecting process 4456 (thread 2240) with C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:22,362 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:33:22,362 [root] DEBUG: Successfully injected DLL C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:22,377 [lib.api.process] INFO: Injected into 64-bit <Process 4456 OpenWith.exe> 2025-12-08 08:33:22,377 [root] INFO: Announced 64-bit process name: OpenWith.exe pid: 4456 2025-12-08 08:33:22,377 [lib.api.process] INFO: Monitor config for <Process 4456 OpenWith.exe>: C:\tmphvfp1ko9\dll\4456.ini 2025-12-08 08:33:22,377 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmphvfp1ko9\dll\QwzCdw.dll, loader C:\tmphvfp1ko9\bin\GyhYBQTL.exe 2025-12-08 08:33:22,377 [root] DEBUG: Loader: Injecting process 4456 (thread 2240) with C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:22,377 [root] DEBUG: InjectDllViaIAT: This image has already been patched. 2025-12-08 08:33:22,377 [root] DEBUG: Successfully injected DLL C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:22,377 [lib.api.process] INFO: Injected into 64-bit <Process 4456 OpenWith.exe> 2025-12-08 08:33:22,409 [root] DEBUG: 4456: Python path set to 'C:\Python38'. 2025-12-08 08:33:22,409 [root] DEBUG: 4456: Dropped file limit defaulting to 100. 2025-12-08 08:33:22,409 [root] INFO: Disabling sleep skipping. 2025-12-08 08:33:22,409 [root] DEBUG: 4456: YaraInit: Compiled rules loaded from existing file C:\tmphvfp1ko9\data\yara\capemon.yac 2025-12-08 08:33:22,409 [root] DEBUG: 4456: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable 2025-12-08 08:33:22,424 [root] DEBUG: 4456: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0 2025-12-08 08:33:22,424 [root] DEBUG: 4456: YaraScan: Scanning 0x00007FF731DE0000, size 0x251e4 2025-12-08 08:33:22,424 [root] DEBUG: 4456: AmsiDumper initialised. 2025-12-08 08:33:22,424 [root] DEBUG: 4456: Monitor initialised: 64-bit capemon loaded in process 4456 at 0x00007FFCAE970000, thread 2240, image base 0x00007FF731DE0000, stack from 0x0000006EC3475000-0x0000006EC3480000 2025-12-08 08:33:22,424 [root] DEBUG: 4456: Commandline: C:\Windows\system32\OpenWith.exe -Embedding 2025-12-08 08:33:22,440 [root] DEBUG: 4456: hook_api: LdrpCallInitRoutine export address 0x00007FFCDC378634 obtained via GetFunctionAddress 2025-12-08 08:33:22,440 [root] DEBUG: 4456: hook_api: Warning - CoCreateInstance export address 0x00007FFCDBCB7EF9 differs from GetProcAddress -> 0x00007FFCDBD92050 (combase.dll::0x42050) 2025-12-08 08:33:22,440 [root] DEBUG: 4456: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCDBCB7F38 differs from GetProcAddress -> 0x00007FFCDBD6CC40 (combase.dll::0x1cc40) 2025-12-08 08:33:22,440 [root] DEBUG: 4456: hook_api: Warning - CoGetClassObject export address 0x00007FFCDBCB84C8 differs from GetProcAddress -> 0x00007FFCDBE19870 (combase.dll::0xc9870) 2025-12-08 08:33:22,440 [root] DEBUG: 4456: hook_api: Warning - CLSIDFromProgID export address 0x00007FFCDBCB7744 differs from GetProcAddress -> 0x00007FFCDBD6E410 (combase.dll::0x1e410) 2025-12-08 08:33:22,440 [root] DEBUG: 4456: hook_api: Warning - CLSIDFromProgIDEx export address 0x00007FFCDBCB7781 differs from GetProcAddress -> 0x00007FFCDBF10280 (combase.dll::0x1c0280) 2025-12-08 08:33:22,440 [root] WARNING: b'Unable to place hook on LockResource' 2025-12-08 08:33:22,440 [root] DEBUG: 4456: set_hooks: Unable to hook LockResource 2025-12-08 08:33:22,440 [root] DEBUG: 4456: Hooked 605 out of 606 functions 2025-12-08 08:33:22,440 [root] DEBUG: 4456: Syscall hook installed, syscall logging level 1 2025-12-08 08:33:22,456 [root] INFO: Loaded monitor into process with pid 4456 2025-12-08 08:33:22,456 [root] DEBUG: 4456: caller_dispatch: Added region at 0x00007FF731DE0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF731DE14F2, thread 2240). 2025-12-08 08:33:22,456 [root] DEBUG: 4456: YaraScan: Scanning 0x00007FF731DE0000, size 0x251e4 2025-12-08 08:33:22,456 [root] DEBUG: 4456: ProcessImageBase: Main module image at 0x00007FF731DE0000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:33:22,456 [root] DEBUG: 4456: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-08 08:33:22,456 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD86C0000: C:\Windows\SYSTEM32\kernel.appcore (0x18000 bytes). 2025-12-08 08:33:22,456 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD9BA0000: C:\Windows\System32\bcryptPrimitives (0x7a000 bytes). 2025-12-08 08:33:22,456 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD6BB0000: C:\Windows\system32\uxtheme (0xab000 bytes). 2025-12-08 08:33:22,456 [root] DEBUG: 4456: DLL loaded at 0x00007FFCDC0E0000: C:\Windows\System32\clbcatq (0xb0000 bytes). 2025-12-08 08:33:22,471 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD2AE0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x625000 bytes). 2025-12-08 08:33:22,471 [root] DEBUG: 5144: DLL loaded at 0x72D60000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x27d000 bytes). 2025-12-08 08:33:22,487 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD74A0000: C:\Windows\SYSTEM32\wintypes (0x13e000 bytes). 2025-12-08 08:33:22,487 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD75E0000: C:\Windows\system32\windows.storage (0x8f6000 bytes). 2025-12-08 08:33:22,502 [root] DEBUG: 5144: DLL loaded at 0x73970000: C:\Windows\System32\OneCoreCommonProxyStub (0x46000 bytes). 2025-12-08 08:33:22,518 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCB8B0000: C:\Windows\System32\OneCoreCommonProxyStub (0xab000 bytes). 2025-12-08 08:33:22,518 [root] DEBUG: 4456: DLL loaded at 0x00007FFCBF420000: C:\Windows\System32\edputil (0x28000 bytes). 2025-12-08 08:33:22,518 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD6DA0000: C:\Windows\System32\dwmapi (0x2b000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD5BC0000: C:\Windows\System32\PROPSYS (0x101000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD8E60000: C:\Windows\System32\Wldp (0x4b000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCB2E0000: C:\Windows\System32\MrmCoreR (0x118000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD6630000: C:\Windows\System32\msvcp110_win (0x93000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD66D0000: C:\Windows\SYSTEM32\policymanager (0xa5000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD7F60000: C:\Windows\System32\SLC (0x2f000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD86E0000: C:\Windows\SYSTEM32\ntmarta (0x34000 bytes). 2025-12-08 08:33:22,534 [root] DEBUG: 4456: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-08 08:33:22,534 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC9AB0000: C:\Windows\System32\Windows.Internal.OpenWithHost (0x81000 bytes). 2025-12-08 08:33:22,549 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD95F0000: C:\Windows\system32\profapi (0x26000 bytes). 2025-12-08 08:33:22,565 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD9140000: C:\Windows\system32\CFGMGR32 (0x4e000 bytes). 2025-12-08 08:33:22,581 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCC4D0000: C:\Windows\System32\Windows.StateRepositoryPS (0xeb000 bytes). 2025-12-08 08:33:22,581 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD09A0000: C:\Windows\System32\Windows.System.Launcher (0x135000 bytes). 2025-12-08 08:33:22,581 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD0980000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x1a000 bytes). 2025-12-08 08:33:22,628 [root] INFO: Announced starting service "b'AppMgmt'" 2025-12-08 08:33:22,628 [lib.api.process] INFO: Monitor config for <Process 668 services.exe>: C:\tmphvfp1ko9\dll\668.ini 2025-12-08 08:33:22,628 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmphvfp1ko9\dll\QwzCdw.dll, loader C:\tmphvfp1ko9\bin\GyhYBQTL.exe 2025-12-08 08:33:22,628 [root] DEBUG: Loader: Injecting process 668 with C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:22,628 [root] DEBUG: Loader: Copied config file C:\tmphvfp1ko9\dll\668.ini to system path C:\668.ini 2025-12-08 08:33:46,634 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 668 C:\tmphvfp1ko9\dll\QwzCdw.dll 2025-12-08 08:33:46,634 [root] DEBUG: Successfully injected DLL C:\tmphvfp1ko9\dll\QwzCdw.dll. 2025-12-08 08:33:46,634 [lib.api.process] INFO: Injected into 64-bit <Process 668 services.exe> 2025-12-08 08:33:48,765 [root] DEBUG: 5144: NtTerminateProcess hook: Attempting to dump process 5144 2025-12-08 08:33:48,765 [root] DEBUG: 5144: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:33:48,765 [root] INFO: Process with pid 5144 has terminated 2025-12-08 08:33:48,781 [root] DEBUG: 4456: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-08 08:33:48,796 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD2770000: C:\Windows\System32\ActXPrxy (0x7f000 bytes). 2025-12-08 08:33:48,812 [root] DEBUG: 4456: DLL loaded at 0x00007FFCDB910000: C:\Windows\System32\MSCTF (0x150000 bytes). 2025-12-08 08:33:48,890 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD9590000: C:\Windows\SYSTEM32\powrprof (0x4d000 bytes). 2025-12-08 08:33:48,890 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC99D0000: C:\Windows\System32\wincorlib (0x73000 bytes). 2025-12-08 08:33:48,890 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes). 2025-12-08 08:33:48,890 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC2310000: C:\Windows\System32\twinui.pcshell (0x9dc000 bytes). 2025-12-08 08:33:48,890 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD94C0000: C:\Windows\SYSTEM32\UMPDC (0x13000 bytes). 2025-12-08 08:33:48,890 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD3170000: C:\Windows\System32\twinapi.appcore (0x285000 bytes). 2025-12-08 08:33:48,906 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC8540000: C:\Windows\System32\Windows.UI.Xaml (0x1226000 bytes). 2025-12-08 08:33:48,922 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD0940000: C:\Windows\SYSTEM32\windows.staterepositoryclient (0x3d000 bytes). 2025-12-08 08:33:48,922 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC9800000: C:\Windows\System32\Windows.UI (0x174000 bytes). 2025-12-08 08:33:48,937 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC9770000: C:\Windows\System32\bcp47mrm (0x32000 bytes). 2025-12-08 08:33:48,937 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC97B0000: C:\Windows\SYSTEM32\languageoverlayutil (0x44000 bytes). 2025-12-08 08:33:48,953 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC83C0000: C:\Windows\System32\Windows.UI.Immersive (0x175000 bytes). 2025-12-08 08:33:48,968 [root] DEBUG: 4456: DLL loaded at 0x00007FFCB7C50000: C:\Windows\ShellComponents\WindowsInternal.ComposableShell.DesktopHosting (0x87000 bytes). 2025-12-08 08:33:49,000 [root] DEBUG: 4456: DLL loaded at 0x00007FFCB7940000: C:\Windows\ShellComponents\WindowsInternal.ComposableShell.Experiences.Switcher (0x30f000 bytes). 2025-12-08 08:33:49,015 [root] DEBUG: 4456: DLL loaded at 0x00007FFCB78C0000: C:\Windows\ShellExperiences\TileControl (0x7a000 bytes). 2025-12-08 08:33:49,031 [root] DEBUG: 4456: DLL loaded at 0x00007FFCB7670000: C:\Windows\ShellComponents\TaskFlowUI (0x24e000 bytes). 2025-12-08 08:33:49,031 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD55D0000: C:\Windows\SYSTEM32\d2d1 (0x5ee000 bytes). 2025-12-08 08:33:49,047 [root] DEBUG: 4456: DLL loaded at 0x00007FFCB7640000: C:\Windows\ShellComponents\WindowsInternal.ShellUI (0x2c000 bytes). 2025-12-08 08:33:49,078 [root] DEBUG: 4456: DLL loaded at 0x00007FFCBCEB0000: C:\Windows\SystemApps\Microsoft.UI.Xaml.CBS_8wekyb3d8bbwe\Microsoft.UI.Xaml (0x5d4000 bytes). 2025-12-08 08:33:49,109 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD8C30000: C:\Windows\system32\USERENV (0x2c000 bytes). 2025-12-08 08:33:49,109 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD4B10000: C:\Windows\system32\XmlLite (0x37000 bytes). 2025-12-08 08:33:49,109 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC7270000: C:\Windows\system32\windowsudk.shellcommon (0x4f2000 bytes). 2025-12-08 08:33:49,125 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD1D00000: C:\Windows\System32\AppXDeploymentClient (0x135000 bytes). 2025-12-08 08:33:49,265 [root] DEBUG: 4456: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-08 08:33:49,281 [root] DEBUG: 4456: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-08 08:33:49,281 [root] DEBUG: 4456: api-rate-cap: IsDebuggerPresent hook disabled due to rate 2025-12-08 08:33:49,281 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD64F0000: C:\Windows\System32\CoreMessaging (0x133000 bytes). 2025-12-08 08:33:49,281 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCF560000: C:\Windows\System32\InputHost (0x20a000 bytes). 2025-12-08 08:33:49,297 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC3E10000: C:\Windows\System32\UiaManager (0xf2000 bytes). 2025-12-08 08:33:49,312 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD3E50000: C:\Windows\System32\WindowManagementAPI (0x1f7000 bytes). 2025-12-08 08:33:49,328 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes). 2025-12-08 08:33:49,328 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes). 2025-12-08 08:33:49,328 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes). 2025-12-08 08:33:49,343 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD5CD0000: C:\Windows\System32\dcomp (0x252000 bytes). 2025-12-08 08:33:49,343 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC0740000: C:\Windows\system32\DataExchange (0x5e000 bytes). 2025-12-08 08:33:49,359 [root] DEBUG: 4456: DLL loaded at 0x00007FFCBEF50000: C:\Windows\SYSTEM32\WinUICohabitation (0x23000 bytes). 2025-12-08 08:33:49,391 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD6C90000: C:\Windows\SYSTEM32\dxgi (0xf8000 bytes). 2025-12-08 08:33:49,391 [root] DEBUG: 4456: api-rate-cap: NtOpenKey hook disabled due to rate 2025-12-08 08:33:49,391 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD6F00000: C:\Windows\SYSTEM32\dxcore (0x36000 bytes). 2025-12-08 08:33:49,406 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCF780000: C:\Windows\system32\Bcp47Langs (0x60000 bytes). 2025-12-08 08:33:49,406 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC7B30000: C:\Windows\system32\Windows.UI.Xaml.Controls (0x410000 bytes). 2025-12-08 08:33:49,406 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD7190000: C:\Windows\SYSTEM32\resourcepolicyclient (0x15000 bytes). 2025-12-08 08:33:49,422 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD4720000: C:\Windows\SYSTEM32\directxdatabasehelper (0x4a000 bytes). 2025-12-08 08:33:49,437 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD5370000: C:\Windows\SYSTEM32\d3d11 (0x257000 bytes). 2025-12-08 08:33:49,453 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD3730000: C:\Windows\system32\d3d10warp (0x711000 bytes). 2025-12-08 08:33:49,468 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD50F0000: C:\Windows\SYSTEM32\dwrite (0x273000 bytes). 2025-12-08 08:33:49,468 [root] DEBUG: 4456: DLL loaded at 0x00007FFCBD930000: C:\Windows\SYSTEM32\uiautomationcore (0x445000 bytes). 2025-12-08 08:33:49,468 [root] DEBUG: 4456: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:33:49,484 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC79E0000: C:\Windows\SYSTEM32\TextShaping (0xb0000 bytes). 2025-12-08 08:33:49,484 [root] DEBUG: 4456: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4B8DE1000, size: 0x1000. 2025-12-08 08:33:49,500 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD94E0000: C:\Windows\SYSTEM32\sxs (0xa3000 bytes). 2025-12-08 08:33:49,515 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCB960000: C:\Windows\System32\Windows.ApplicationModel (0xfc000 bytes). 2025-12-08 08:33:49,515 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC8200000: C:\Windows\System32\Windows.Globalization (0x1bb000 bytes). 2025-12-08 08:33:49,547 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD6A30000: C:\Windows\SYSTEM32\apphelp (0x97000 bytes). 2025-12-08 08:33:49,562 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC17C0000: C:\Windows\System32\appresolver (0x9d000 bytes). 2025-12-08 08:33:49,609 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCF430000: C:\Windows\System32\StateRepository.Core (0xb3000 bytes). 2025-12-08 08:33:49,609 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCF7E0000: C:\Windows\System32\Windows.StateRepository (0x682000 bytes). 2025-12-08 08:33:49,609 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC1990000: C:\Windows\System32\TileDataRepository (0xa6000 bytes). 2025-12-08 08:33:49,609 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD8470000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes). 2025-12-08 08:33:49,703 [root] DEBUG: 4456: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-08 08:33:49,703 [root] DEBUG: 4456: DLL loaded at 0x00007FFCB8D10000: C:\Windows\System32\Windows.Energy (0x31000 bytes). 2025-12-08 08:33:49,718 [root] DEBUG: 4456: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-08 08:33:49,718 [root] DEBUG: 4456: DLL loaded at 0x00007FFCD2580000: C:\Windows\System32\Windows.Graphics (0xa2000 bytes). 2025-12-08 08:33:49,734 [root] DEBUG: 4456: DLL loaded at 0x00007FFCCFEA0000: C:\Windows\SYSTEM32\textinputframework (0x14a000 bytes). 2025-12-08 08:33:49,750 [root] DEBUG: 4456: DLL loaded at 0x00007FFCC7A90000: C:\Windows\system32\directmanipulation (0x9d000 bytes). 2025-12-08 08:33:49,765 [root] DEBUG: 4456: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4B8DD1000, size: 0x1000. 2025-12-08 08:33:49,765 [root] DEBUG: 4456: FreeHandler: Address: 0x00007DF4B8DE0000. 2025-12-08 08:33:49,765 [root] DEBUG: 4456: ScanForNonZero: Error - Supplied size zero. 2025-12-08 08:33:49,765 [root] DEBUG: 4456: DropTrackedRegion: removed region at 0x00007DF4B8DE0000 from tracked region list. 2025-12-08 08:33:49,765 [root] DEBUG: 4456: FreeHandler: Address: 0x00007DF4B8DD0000. 2025-12-08 08:33:49,765 [root] DEBUG: 4456: ScanForNonZero: Error - Supplied size zero. 2025-12-08 08:33:49,765 [root] DEBUG: 4456: DropTrackedRegion: removed region at 0x00007DF4B8DD0000 from the end of the tracked region list. 2025-12-08 08:33:49,781 [root] DEBUG: 4456: NtTerminateProcess hook: Attempting to dump process 4456 2025-12-08 08:33:49,797 [root] DEBUG: 4456: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:33:49,797 [root] DEBUG: Error 87 (0x57) - GetAccessibleSize: unable to query memory address 0x450049100000009B: The parameter is incorrect. 2025-12-08 08:33:49,797 [root] DEBUG: 4456: ReverseScanForNonZero: Error - Supplied size zero. 2025-12-08 08:33:49,797 [root] DEBUG: Error 87 (0x57) - GetAccessibleSize: unable to query memory address 0x521200007FFCD000: The parameter is incorrect. 2025-12-08 08:33:49,812 [root] INFO: Process with pid 4456 has terminated
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win11-64bit-tiny-3 | win11-64bit-tiny-3 | KVM | 2025-12-08 16:30:48 | 2025-12-08 16:34:54 | inetsim |
| File Name |
2210d1f3b152858bd86f.zip
|
|---|---|
| File Type | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| File Size | 664861 bytes |
| MD5 | 8aa79e6e3a43e8ed3c504cf788ee2a99 |
| SHA1 | 6634698cdf32d7e213061e7c33ad8c3b03750f2b |
| SHA256 | e2ac4bef39257c08c8d0f762f254e254f699d3c9833cdfc399c192d2d312d00b [VT] [MWDB] [Bazaar] |
| SHA3-384 | f0d4330035c0642493b36b9c468c7613023baee182b289f75c0855a84583f97923f666727384bb3b882475cb6c837145 |
| CRC32 | E0DA6F90 |
| TLSH | T153E42398BDC82560EFDAED6417393ED9939A069F27C419DBC1F896CC0050DDDC3A292B |
| Ssdeep | 12288:4aDWmBG9jdyCdcuK4YgizQ75JjY9HrsxQb2HgqqeQoUp64RX+Md+FRq+VIMkKe:4aWU+EwZYgT7/jYdrs2bKqeQd53d4RqL |
| File Strings BinGraph Vba2Graph |
| Credential Access | Discovery | Defense Evasion | Privilege Escalation |
|
|
|
|
|---|
No hosts contacted.
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP