Status: Clean
Analysis
| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | exe | 2025-12-08 13:45:25 | 2025-12-08 13:45:48 | 23 seconds | Show Options | Show Analysis Log | 1.2 |
vnc_port=5900
2025-12-06 18:31:41,676 [root] INFO: Date set to: 20251208T05:45:24, timeout set to: 180 2025-12-06 18:31:41,676 [root] DEBUG: Starting analyzer from: C:\tmpet5am7x7 2025-12-06 18:31:41,676 [root] DEBUG: Storing results at: C:\jcVWCJPBR 2025-12-06 18:31:41,676 [root] DEBUG: Pipe server name: \\.\PIPE\rZGssUMRJ 2025-12-06 18:31:41,676 [root] DEBUG: Python path: C:\Python38 2025-12-06 18:31:41,676 [root] INFO: analysis running as a normal user 2025-12-06 18:31:41,676 [root] INFO: analysis package specified: "exe" 2025-12-06 18:31:41,676 [root] DEBUG: importing analysis package module: "modules.packages.exe"... 2025-12-06 18:31:41,676 [root] DEBUG: imported analysis package "exe" 2025-12-06 18:31:41,676 [root] DEBUG: initializing analysis package "exe"... 2025-12-06 18:31:41,676 [lib.common.common] INFO: wrapping 2025-12-06 18:31:41,676 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-06 18:31:41,676 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\notepad.exe 2025-12-06 18:31:41,676 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option 2025-12-06 18:31:41,676 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option 2025-12-06 18:31:41,676 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option 2025-12-06 18:31:41,676 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option 2025-12-06 18:31:41,692 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-12-06 18:31:41,707 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script" 2025-12-06 18:31:41,707 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-12-06 18:31:41,723 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2025-12-06 18:31:41,723 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2025-12-06 18:31:41,739 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-12-06 18:31:41,739 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon" 2025-12-06 18:31:41,739 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-12-06 18:31:41,739 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage" 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Browser" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Browser' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-12-06 18:31:41,739 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Curtain" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Curtain' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Curtain does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"... 2025-12-06 18:31:41,739 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Disguise' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-12-06 18:31:41,739 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.disguise: [WinError 5] Access is denied 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data 2025-12-06 18:31:41,739 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"... 2025-12-06 18:31:41,739 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe 2025-12-06 18:31:41,739 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Evtx" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Evtx' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Evtx does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"... 2025-12-06 18:31:41,739 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable 2025-12-06 18:31:41,739 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Human" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Human' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Human does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-12-06 18:31:41,739 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Pre_script" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Pre_script' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Pre_script does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"... 2025-12-06 18:31:41,739 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script 2025-12-06 18:31:41,739 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-12-06 18:31:41,739 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-12-06 18:31:41,739 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-12-06 18:31:41,739 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-12-06 18:31:41,754 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-12-06 18:31:41,754 [root] DEBUG: Initialized auxiliary module "Sysmon" 2025-12-06 18:31:41,754 [root] DEBUG: attempting to configure 'Sysmon' from data 2025-12-06 18:31:41,754 [root] DEBUG: module Sysmon does not support data configuration, ignoring 2025-12-06 18:31:41,754 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"... 2025-12-06 18:31:41,817 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable 2025-12-06 18:31:41,848 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe 2025-12-06 18:31:41,864 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques. 2025-12-06 18:31:41,864 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-12-06 18:31:41,864 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-12-06 18:31:41,864 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-12-06 18:31:41,864 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-12-06 18:31:41,864 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 668 2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting exit code for <Process 668 ???> 2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:41,864 [lib.api.process] WARNING: the <Process 668 ???> is not alive, injection aborted 2025-12-06 18:31:41,864 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2025-12-06 18:31:41,864 [root] DEBUG: Initialized auxiliary module "Usage" 2025-12-06 18:31:41,864 [root] DEBUG: attempting to configure 'Usage' from data 2025-12-06 18:31:41,864 [root] DEBUG: module Usage does not support data configuration, ignoring 2025-12-06 18:31:41,864 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"... 2025-12-06 18:31:41,864 [root] DEBUG: Started auxiliary module modules.auxiliary.usage 2025-12-06 18:31:41,864 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable 2025-12-06 18:31:41,864 [root] DEBUG: Initialized auxiliary module "During_script" 2025-12-06 18:31:41,864 [root] DEBUG: attempting to configure 'During_script' from data 2025-12-06 18:31:41,864 [root] DEBUG: module During_script does not support data configuration, ignoring 2025-12-06 18:31:41,864 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"... 2025-12-06 18:31:41,864 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script 2025-12-06 18:31:41,911 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable 2025-12-06 18:31:41,911 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe 2025-12-06 18:31:41,958 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable 2025-12-06 18:31:41,973 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe 2025-12-06 18:31:42,004 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable 2025-12-06 18:31:42,035 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable 2025-12-06 18:31:42,035 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe 2025-12-06 18:31:42,067 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable 2025-12-06 18:31:42,082 [root] INFO: Restarting WMI Service 2025-12-06 18:31:42,113 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable 2025-12-06 18:31:42,113 [root] DEBUG: package modules.packages.exe does not support configure, ignoring 2025-12-06 18:31:42,129 [root] WARNING: configuration error for package modules.packages.exe: error importing data.packages.exe: No module named 'data.packages' 2025-12-06 18:31:42,129 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-06 18:31:42,129 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\notepad.exe" with arguments "" with pid 5680 2025-12-06 18:31:42,129 [lib.api.process] INFO: Monitor config for <Process 5680 notepad.exe>: C:\tmpet5am7x7\dll\5680.ini 2025-12-06 18:31:42,129 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpet5am7x7\dll\IklxUPDo.dll, loader C:\tmpet5am7x7\bin\GFMSQHhy.exe 2025-12-06 18:31:42,145 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2025-12-06 18:31:42,145 [root] DEBUG: Loader: Injecting process 5680 (thread 3564) with C:\tmpet5am7x7\dll\IklxUPDo.dll. 2025-12-06 18:31:42,145 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-06 18:31:42,145 [root] DEBUG: Successfully injected DLL C:\tmpet5am7x7\dll\IklxUPDo.dll. 2025-12-06 18:31:42,145 [lib.api.process] INFO: Injected into 64-bit <Process 5680 notepad.exe> 2025-12-06 18:31:42,145 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable 2025-12-06 18:31:42,176 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f 2025-12-06 18:31:42,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable 2025-12-06 18:31:42,207 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable 2025-12-06 18:31:42,223 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f 2025-12-06 18:31:42,238 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable 2025-12-06 18:31:42,270 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable 2025-12-06 18:31:42,301 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable 2025-12-06 18:31:42,317 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable 2025-12-06 18:31:42,348 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable 2025-12-06 18:31:42,379 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable 2025-12-06 18:31:42,410 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable 2025-12-06 18:31:42,442 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable 2025-12-06 18:31:42,457 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable 2025-12-06 18:31:42,489 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable 2025-12-06 18:31:42,520 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable 2025-12-06 18:31:42,551 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable 2025-12-06 18:31:42,567 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable 2025-12-06 18:31:42,598 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable 2025-12-06 18:31:42,629 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable 2025-12-06 18:31:42,645 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable 2025-12-06 18:31:42,676 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable 2025-12-06 18:31:42,707 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable 2025-12-06 18:31:42,739 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable 2025-12-06 18:31:42,770 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable 2025-12-06 18:31:42,785 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable 2025-12-06 18:31:42,817 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable 2025-12-06 18:31:42,848 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable 2025-12-06 18:31:42,879 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable 2025-12-06 18:31:42,895 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable 2025-12-06 18:31:42,926 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable 2025-12-06 18:31:42,957 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable 2025-12-06 18:31:42,989 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable 2025-12-06 18:31:43,004 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable 2025-12-06 18:31:43,036 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable 2025-12-06 18:31:43,067 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable 2025-12-06 18:31:43,098 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable 2025-12-06 18:31:43,114 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable 2025-12-06 18:31:43,145 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable 2025-12-06 18:31:43,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable 2025-12-06 18:31:43,192 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable 2025-12-06 18:31:43,223 [modules.auxiliary.evtx] DEBUG: Wiping Application 2025-12-06 18:31:43,254 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents 2025-12-06 18:31:43,270 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer 2025-12-06 18:31:43,301 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service 2025-12-06 18:31:43,332 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts 2025-12-06 18:31:43,348 [modules.auxiliary.evtx] DEBUG: Wiping Security 2025-12-06 18:31:43,379 [modules.auxiliary.evtx] DEBUG: Wiping Setup 2025-12-06 18:31:43,410 [modules.auxiliary.evtx] DEBUG: Wiping System 2025-12-06 18:31:43,426 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell 2025-12-06 18:31:43,457 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational 2025-12-06 18:31:44,160 [lib.api.process] INFO: Successfully resumed <Process 5680 notepad.exe> 2025-12-06 18:31:44,176 [root] DEBUG: 5680: Python path set to 'C:\Python38'. 2025-12-06 18:31:44,176 [root] INFO: Disabling sleep skipping. 2025-12-06 18:31:44,176 [root] DEBUG: 5680: Dropped file limit defaulting to 100. 2025-12-06 18:31:44,176 [root] DEBUG: 5680: YaraInit: Compiled 41 rule files 2025-12-06 18:31:44,176 [root] DEBUG: 5680: YaraInit: Compiled rules saved to file C:\tmpet5am7x7\data\yara\capemon.yac 2025-12-06 18:31:44,176 [root] DEBUG: 5680: GetAddressByYara: ModuleBase 0x00007FF978DB0000 FunctionName RtlInsertInvertedFunctionTable 2025-12-06 18:31:44,192 [root] DEBUG: 5680: RtlInsertInvertedFunctionTable 0x00007FF978DC090E, LdrpInvertedFunctionTableSRWLock 0x00007FF978F1D510 2025-12-06 18:31:44,192 [root] DEBUG: 5680: YaraScan: Scanning 0x00007FF792220000, size 0x372d6 2025-12-06 18:31:44,192 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied. 2025-12-06 18:31:44,192 [root] DEBUG: 5680: Monitor initialised: 64-bit capemon loaded in process 5680 at 0x00007FF9550C0000, thread 3564, image base 0x00007FF792220000, stack from 0x0000009C5586F000-0x0000009C55880000 2025-12-06 18:31:44,192 [root] DEBUG: 5680: Commandline: "C:\Users\user\AppData\Local\Temp\notepad.exe" 2025-12-06 18:31:44,207 [root] DEBUG: 5680: hook_api: LdrpCallInitRoutine export address 0x00007FF978DC99BC obtained via GetFunctionAddress 2025-12-06 18:31:44,207 [root] DEBUG: 5680: hook_api: Warning - CoCreateInstance export address 0x00007FF9775F42CB differs from GetProcAddress -> 0x00007FF97782A420 (combase.dll::0x2a420) 2025-12-06 18:31:44,207 [root] DEBUG: 5680: hook_api: Warning - CoCreateInstanceEx export address 0x00007FF9775F430A differs from GetProcAddress -> 0x00007FF9778A4180 (combase.dll::0xa4180) 2025-12-06 18:31:44,207 [root] DEBUG: 5680: hook_api: Warning - CoGetClassObject export address 0x00007FF9775F489A differs from GetProcAddress -> 0x00007FF97782EB00 (combase.dll::0x2eb00) 2025-12-06 18:31:44,207 [root] DEBUG: 5680: hook_api: Warning - CLSIDFromProgID export address 0x00007FF9775F3B16 differs from GetProcAddress -> 0x00007FF9778A8570 (combase.dll::0xa8570) 2025-12-06 18:31:44,207 [root] DEBUG: 5680: hook_api: Warning - CLSIDFromProgIDEx export address 0x00007FF9775F3B53 differs from GetProcAddress -> 0x00007FF9778A8A40 (combase.dll::0xa8a40) 2025-12-06 18:31:44,207 [root] WARNING: b'Unable to place hook on LockResource' 2025-12-06 18:31:44,207 [root] DEBUG: 5680: set_hooks: Unable to hook LockResource 2025-12-06 18:31:44,223 [root] DEBUG: 5680: Hooked 605 out of 606 functions 2025-12-06 18:31:44,223 [root] DEBUG: 5680: Syscall hook installed, syscall logging level 1 2025-12-06 18:31:44,223 [root] INFO: Loaded monitor into process with pid 5680 2025-12-06 18:31:44,223 [root] DEBUG: 5680: caller_dispatch: Added region at 0x00007FF792220000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF7922439C9, thread 3564). 2025-12-06 18:31:44,223 [root] DEBUG: 5680: YaraScan: Scanning 0x00007FF792220000, size 0x372d6 2025-12-06 18:31:44,223 [root] DEBUG: 5680: ProcessImageBase: Main module image at 0x00007FF792220000 unmodified (entropy change 0.000000e+00) 2025-12-06 18:31:44,223 [root] DEBUG: 5680: DLL loaded at 0x00007FF976A00000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes). 2025-12-06 18:31:44,223 [root] DEBUG: 5680: set_hooks_by_export_directory: Hooked 0 out of 606 functions 2025-12-06 18:31:44,223 [root] DEBUG: 5680: DLL loaded at 0x00007FF974360000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes). 2025-12-06 18:31:44,223 [root] DEBUG: 5680: DLL loaded at 0x00007FF973E70000: C:\Windows\system32\uxtheme (0x9e000 bytes). 2025-12-06 18:31:44,223 [root] DEBUG: 5680: DLL loaded at 0x00007FF977E40000: C:\Windows\System32\clbcatq (0xa9000 bytes). 2025-12-06 18:31:44,238 [root] DEBUG: 5680: DLL loaded at 0x00007FF96A6C0000: C:\Windows\System32\MrmCoreR (0xf4000 bytes). 2025-12-06 18:31:44,254 [root] DEBUG: 5680: NtTerminateProcess hook: Attempting to dump process 5680 2025-12-06 18:31:44,254 [root] DEBUG: 5680: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-06 18:31:44,254 [root] INFO: Process with pid 5680 has terminated 2025-12-06 18:31:50,254 [root] INFO: Process list is empty, terminating analysis 2025-12-06 18:31:51,270 [root] INFO: Created shutdown mutex 2025-12-06 18:31:52,285 [root] INFO: Shutting down package 2025-12-06 18:31:52,285 [root] INFO: Stopping auxiliary modules 2025-12-06 18:31:52,285 [root] INFO: Stopping auxiliary module: Browser 2025-12-06 18:31:52,285 [root] INFO: Stopping auxiliary module: Curtain 2025-12-06 18:31:52,285 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [Errno 13] Permission denied: 'C:\\curtain.log' 2025-12-06 18:31:52,285 [modules.auxiliary.curtain] ERROR: Curtain log file not found! 2025-12-06 18:31:52,285 [root] INFO: Stopping auxiliary module: End_noisy_tasks 2025-12-06 18:31:52,285 [root] INFO: Stopping auxiliary module: Evtx 2025-12-06 18:31:52,285 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump 2025-12-06 18:31:52,285 [root] WARNING: Cannot terminate auxiliary module Evtx: [Errno 13] Permission denied: 'C:/windows/Sysnative/winevt/Logs\\Application.evtx' 2025-12-06 18:31:52,285 [root] INFO: Stopping auxiliary module: Human 2025-12-06 18:31:54,160 [root] INFO: Stopping auxiliary module: Pre_script 2025-12-06 18:31:54,160 [root] INFO: Stopping auxiliary module: Screenshots 2025-12-06 18:31:56,879 [root] INFO: Stopping auxiliary module: Usage 2025-12-06 18:31:57,989 [root] INFO: Stopping auxiliary module: During_script 2025-12-06 18:31:57,989 [root] INFO: Finishing auxiliary modules 2025-12-06 18:31:57,989 [root] INFO: Shutting down pipe server and dumping dropped files 2025-12-06 18:31:57,989 [root] WARNING: Folder at path "C:\jcVWCJPBR\debugger" does not exist, skipping 2025-12-06 18:31:57,989 [root] WARNING: Folder at path "C:\jcVWCJPBR\tlsdump" does not exist, skipping 2025-12-06 18:31:57,989 [root] INFO: Analysis completed
Machine
| Name | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win10-64bit-tiny-2 | win10-64bit-tiny-2 | KVM | 2025-12-08 13:45:25 | 2025-12-08 13:45:47 |
File Details
| File Name |
notepad.exe
|
|---|---|
| File Type | PE32+ executable (GUI) x86-64, for MS Windows |
| File Size | 200704 bytes |
| MD5 | bd4718db42d3ac15939d51d8f7fd0330 |
| SHA1 | 31315201b97b1eb85bb602dcb586c3a1a7b5dbf7 |
| SHA256 | cb448ea83bcf46a21aa9a9b258f39c85df962b18ae3682f2aaac9d79e2c04ebd [VT] [MWDB] [Bazaar] |
| SHA3-384 | 2a896d565d4204d07b2d15d427981c1518766bb8c759f35104bb2676ce5ce9daba791c3b1a3546d16cc0d6ca1aadfbed |
| CRC32 | 5731AD47 |
| TLSH | T16714382D22EE10E5E47B917CDD524256E6B27431132262EF16E0C57C8F23AEDBA78F41 |
| Ssdeep | 3072:JfDg8iAAFxfJZwjPCSm3tK69oUnTYS/7zk+XDBG8BNJtALCgEvkwi6/LPlcF/NL:JriAAFr7vz9oUn8AoSDBrSLCXfFz2F |
| PE | File Strings BinGraph Vba2Graph |
FailFast
NtQuerySystemInformation
EndDialog
GetModuleFileNameA
EncodingSelection
VWATAUAWH
SetThreadpoolTimer
RegDeleteKeyExW
version="5.1.0.0"
S~=5p
api-ms-win-crt-string-l1-1-0.dll
fE9,Pu
GlobalCollection
ShellExecuteW
D$PH;
\$ UVWAVAWH
Segoe UI
\Notepad
\$ UH
GetACP
sQPI[5T
LocalUnlock
SetAbortProc
CloseClipboard
OriginalFilename
GetCurrentThreadId
.gehcont
ntelA
RegSetValueExW
Ly^X`
RaiseFailFastException
.CRT$XIZ
CoWaitForMultipleHandles
ADVAPI32.dll
EndDoc
tCfA;@
Microsoft JhengHei UI
pA_A^A]A\_^]
SHELL32.dll
GlobalAcc
@USVWATAUAVAWH
Leelawadee UI Semilight
fSaveWindowPositions
FindFirstFileW
WAVAWH
_register_thread_local_exe_atexit_callback
fD9$Xu
xv#?H
GetMessageW
MICROSOFTEDPENLIGHTENEDAPPINFO
USVWATAUAVAWH
f9,zu
HeapFree
DebugBreak
L$8E3
FoldStringW
api-ms-win-core-synch-l1-2-0.dll
<assemblyIdentity
f95:>
VWAVH
D!t$$H
o\$PH
_o__cexit
Leelawadee UI Bold
ReadFile
|$(A_
EnableMenuItem
HL$xH
WINSPOOL.DRV
},YOP
IsTextUnicode
SHCreateItemFromParsingName
DispatchMessageW
fD9%d
SaveComplete
.rdata$zETW2
CloseThreadpoolTimer
RtlSubscribeWnfStateChangeNotification
.CRT$XCA
api-ms-win-core-winrt-string-l1-1-0.dll
ReleaseSemaphore
Unknown
T$PL;
GetWindowTextW
RtlCaptureContext
<$.u#fA
h UAVAWH
RtlRegisterFeatureConfigurationChangeNotification
api-ms-win-core-sysinfo-l1-1-0.dll
</trustInfo>
lfStrikeOut
l$(E3
\$(E3
%hs(%u)\%hs!%p:
Assert
NPCTXT
memset
CreateFontIndirectW
t;E8(t6H
imageName
GetTickCount
@SUVWATAVAWH
k UAVAWH
A_A^A\_^[]
StringFileInfo
PropVariantToStringVectorAlloc
d$PE3
ReplaceTextW
PA_A^A\_^][
A_A^A\
9L$Tu
timestamp
imageSize
.CRT$XCU
wcsnlen
__C_specific_handler
RegisterWindowMessageW
api-ms-win-core-errorhandling-l1-1-0.dll
GetCurrentProcessId
GetForegroundWindow
0Hc|$`3
.?AVexception@std@@
Software\Microsoft\Notepad\DefaultFonts
processorArchitecture="*"
UnhandledExceptionFilter
L$0E3
USVWAVH
F0D8#ubD8c
RtlDllShutdownInProgress
.?AVbad_array_new_length@std@@
FreeLibrary
0A_A^_
T$XE3
T$0E3
https://go.microsoft.com/fwlink/?LinkId=834783
LoadCursorW
bad allocation
UWAVH
gxI3!'
A_A^A\_^
DefWindowProcW
lfFaceName
AbortDoc
lfWeight
COMCTL32.dll
HeapAlloc
Microsoft Corporation. All rights reserved.
@A_A^A]A\_^]
_o_free
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
RtlQueryFeatureConfiguration
ew0hp
@SVWH
version="6.0.0.0"
l$0E3
RoGetActivationFactory
commdlg_FindReplace
LoadIconW
fD95dJ
|$pD3
f4Og|
%hs!%p:
M H1E
D$0E3
FAIL/Error
EDPPERMISSIVEAPPINFOID
iWindowPosY
api-ms-win-core-processthreads-l1-1-1.dll
w9X!P/
_o_terminate
GetProcessMitigationPolicy
memmove
DuplicateEncryptionInfoFile
RoGetMatchingRestrictedErrorInfo
.text$mn
%08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X
_CxxThrowException
DragAcceptFiles
VG2/iI
}<HcD$ L
|$01u"
(_^][
RestartByRestartManager:
/.SETUP
FileSaveAsCount
T$@H!t$@H
__CxxFrameHandler3
$>b~t
VarFileInfo
pA_A^A\_^[]
Security-SPP-GenuineLocalStatus
LegalCopyright
t"fA;@
FileOpenComplete
_c_exit
<ws2:dpiAwareness>PerMonitorV2</ws2:dpiAwareness>
D+D$xH
api-ms-win-core-string-l1-1-0.dll
D$ L;
T$(A+
_o__exit
SelectObject
A_A^A]_]
t$ WH
L$ H;
uq@85
MapViewOfFile
SetWindowPos
GetKeyboardLayout
D$hI;
api-ms-win-core-libraryloader-l1-2-0.dll
<application xmlns="urn:schemas-microsoft-com:asm.v3">
Msg:[%ws]
MessageBoxW
`A_A^A]A\_^]
<unknown>
.rsrc
RoInitialize
SetThreadDpiAwarenessContext
SetEndOfFile
ModuleCollection
_o__set_new_mode
Malgun Gothic Semilight
L$ SUVWH
probe.autosave
UVWAVAWH
L$ SVWH
l6s+o
PeekMessageW
\$ WH
.rdata$zETW1
type="win32"
DD$h3
GetLocalTime
D$`D#
iWindowPosDX
TimeDateInvoked
Yu Gothic UI Semibold
uzH9A
RegCreateKeyW
byjA`
GetSubMenu
ntdll.dll
urlmon.dll
StartDocW
lfCharSet
T$8H!\$8
PropVariantClear
T$@E3
\$(uMH
api-ms-win-core-processthreads-l1-1-0.dll
UVWATAUAVAWH
COMDLG32.dll
USVWATAVAWH
CallContext:[%hs]
Lc\$xE
CoCreateGuid
3D$8%x
shell\osshell\accesory\notepad\filesystemhelpers.h
fD9%%
Files/Resources/notepad.exe.mui
SendDlgItemMessageW
CoInitializeEx
.didat$6
fMLE_is_broken
GenuD
Microsoft JhengHei UI Light
RegisterApplicationRestart
.idata$5
.CRT$XIAA
LoadImageW
<dependentAssembly>
RtlUnregisterFeatureConfigurationChangeNotification
_o_iswdigit
RaiseException
t*JcT
l$xE3
hasQueryText
.CRT$XIC
D$ E3
SHAddToRecentDocs
lfUnderline
lfClipPrecision
fMatchCase
fD9$Hu
JHcH<
D$PL;
assertVersion
fReverse
d$@E3
EventUnregister
LHcH<
d$XE3
SetRestrictedErrorInfo
t!fD9't
DeleteFileW
f9tC0u
SetLastError
OpenClipboard
z?801i:It6
DragQueryFileW
FileVersion
D$hE3
%i,%s
l$ VWATAVAWH
InitializeSListHead
D$x9t$8
LeaveCriticalSection
VWATAVAWH
MultiByteToWideChar
MessageBeep
_o__get_wide_winmain_command_line
L$@E3
.rtc$TZZ
.data$r$brc
H_^[]
Microsoft
L$ UVWATAUAVAWH
A_A^A]A\_^]
WindowsCreateStringReference
Windows.Storage.StorageFile
L$XE3
t"D8=
.CRT$XTA
NtUpdateWnfStateData
CreateMutexExW
A8_8t
L$`H3
.rtc$IAA
UATAUAVAWH
EventWriteTransfer
bad array new length
D$ fD
</requestedPrivileges>
WaitForSingleObjectEx
10.0.19041.3996
EditFindCount
_o___std_exception_copy
DecryptFileW
EnableWindow
Encoding
prop:System.Security.EncryptionOwners
t$XfD9n
GetProcAddress
DeleteObject
MoveWindow
api-ms-win-core-rtlsupport-l1-1-0.dll
\$pA3
totalHits
SetScrollPos
StatusBar
feedback-hub://?tabid=2&contextid=1010
shell\osshell\accesory\notepad\nprestart.cpp
H!\$0H!\$8D
IsWordWrap
api-ms-win-crt-private-l1-1-0.dll
szHeader
A^_^[]
IsClipboardFormatAvailable
Microsoft YaHei UI Light
CoTaskMemFree
EditPasteCount
.didat$3
GetUserDefaultUILanguage
KERNEL32.dll
.rsrc$01
t$ UWAUAVAWH
SessionId
GetModuleHandleW
WaitForSingleObject
_o__purecall
api-ms-win-core-profile-l1-1-0.dll
ew|>&=4_
Windows.Security.EnterpriseData.ProtectionPolicyManager
RtlNtStatusToDosErrorNoTeb
7T})gW
GetWindowTextLengthW
GetLastError
.?AVbad_alloc@std@@
+\$`H
.CRT$XPZ
TranslateAcceleratorW
_o_exit
count
HasHeaderOrFooter
api-ms-win-shcore-obsolete-l1-1-0.dll
CreateWindowExW
language="*"
.CRT$XIA
MH+UD+M@
RtlDisownModuleHeapAllocation
EndPage
api-ms-win-core-synch-l1-1-0.dll
Windows.ApplicationModel.DataTransfer.Clipboard
EditUndoCount
u(D9M
CommDlgExtendedError
HA_A^A]A\_^[]
FindMimeFromData
IsLogEntry
GetTokenInformation
api-ms-win-core-winrt-error-l1-1-1.dll
GetTimeFormatW
D9-0,
WAxK0i
1o?-XfF
ProductVersion
D$4E3
D$p9D$t
u$D9M
EventSetInformation
GetClientRect
.rdata$brc
t$ WAVAWH
FindNLSString
CompareStringOrdinal
_initterm
.didat$4
0A_A^_^]
A_A^A\_^
SequenceNumber
EditCutCount
td@8=
GetTextMetricsW
L9o@t
shell\osshell\accesory\common\edpapphelper\edpapphelper.cpp
notepad.pdb
RegOpenKeyExW
api-ms-win-crt-runtime-l1-1-0.dll
</dependency>
AcquireSRWLockShared
_o__wcsicmp
A_A^A]A\_
D$PE3
https://go.microsoft.com/fwlink/p/?linkid=838060
#D$@H
L$0H3
L$`H;
Microsoft.Notepad
OpenPrinterW
LoadLibraryExW
l$(E#
CoUninitialize
VS_VERSION_INFO
|$(E#
test/log
FileNewCount
.idata$3
?L!|$ L
FileSize
InitializeCriticalSectionEx
GetTextExtentPoint32W
InvalidateRect
SetWindowTextW
oLW\f
l$ E3
d|BNeU
T$0H!t$0H
Local\SM0:%d:%d:%hs
</application>
OpenProcessToken
d$XD9d$Hu
T$$D!t$ H
$(SQO
PrintDlgExW
Sleep
<description>Windows Shell</description>
D$T9p
FormatMessageW
t#E9V0t
iWindowPosDY
.gfids
LocalReAlloc
\$XE3
UAVAWH
A_A^A]A\_
PathFindExtensionW
</windowsSettings>
GB18030
SetWindowExtEx
QueryPerformanceCounter
B8<)u
!\$`3
ViewHelp
.CRT$XCAA
EnumFontsW
MonitorFromWindow
iMarginBottom
WinSta0
tYD9%
VY$[X
x ATAVAWH
UWAUAVAWH
api-ms-win-core-interlocked-l1-1-0.dll
replaceString
HeapSetInformation
A_A^A]A\_^[]
D9%,E
@USWH
.rdata$zETW9
RtlVirtualUnwind
t@fE9(t:H
LaunchNotepadStart
PROPSYS.dll
_o___p__commode
wcscmp
_o__set_fmode
GetWindowLongW
szTrailer
CharUpperW
ReleaseDC
A_A^_^]
api-ms-win-core-com-l1-1-0.dll
A_A^]
<WD9%
`A_A^A\_^[]
bgOne
.?AVtype_info@@
EnterCriticalSection
GetTextFaceW
,B>DY
.didat$5
api-ms-win-eventing-provider-l1-1-0.dll
\$ UVWH
OpenSemaphoreW
PathIsFileSpecW
T$HE3
publicKeyToken="6595b64144ccf1df"
Microsoft Corporation
.rdata
.rdata$zzzdbg
<dependency>
!L$8H
SetDlgItemTextW
T$hE3
PostQuitMessage
ContextMenu
GlobalAlloc
UnmapViewOfFile
[%hs]
L$pH3
X\?E/5
EditDeleteCount
type="win32"/>
.CRT$XTZ
UnhookWinEvent
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
Microsoft YaHei UI
SaveStart
AcquireSRWLockExclusive
ED$`H
FileOpenStart
GetCurrentProcess
CheckMenuItem
%UM;%
f94Gu
_o__initialize_wide_environment
WATAUAVAWH
SetWindowLongW
%s%c*.txt%c%s%c*.*%c
onecore\internal\sdk\inc\wil\opensource/wil/filesystem.h
_o_toupper
LocalLock
ResolveDelayLoadedAPI
RegQueryValueExW
PageSetupUpdated
Software\Microsoft\Notepad
0A^_^][
H;L$hv
Segoe Pseudo
Yu Gothic UI
Microsoft JhengHei UI Bold
SHGetKnownFolderPath
PathFileExistsW
@W=7A=
</security>
iWindowPosX
SendMessageW
0A_A^A\_^
MainAcc
040904B0
.idata$6
.rdata$zETW0
|$T!L$0
RtlUnsubscribeWnfNotificationWaitForCompletion
CharNextW
Windows.ApplicationModel.Resources.Core.ResourceManager
_o___stdio_common_vswprintf
ShellAboutW
</assembly>
797t3A
</dependentAssembly>
$Rich
GetModuleFileNameW
|$4fA9
Segoe UI Light
L$ E3
fD9&u#L
GetCommandLineW
fD9$Au
CreateDialogParamW
.rtc$TAA
u0HcH<H
MICROSOFTEDPPERMISSIVEAPPINFO
CloseHandle
FormatFontCount
}0H+}(H
IsAdminMode
GetMenu
D$HD+D$xH
EditReplaceCount
StartPage
L$pE3
.text$yd
tBE8(t=H
LoadStringW
api-ms-win-shcore-scaling-l1-1-1.dll
fWindowsOnlyEOL
GlobalFree
AppExit
A_A^A\_]
.CRT$XPA
0A^_^
D$@E3
D$@fD
A_A^A]A\]
SetWindowPlacement
Lucida Console
d$pD9e
A_A]A\_^
fD9,Cu
.rsrc$02
GetModuleHandleExW
WriteFile
GlobalUnlock
EventRegister
GetFileTitleW
u$9T$ht
USER32.dll
rY&'K
ul%G1
tJfA;@
StatusBarVisibility
L$(H;
RegQueryInfoKeyW
E\$HH
LaunchNotepadComplete
_o__register_onexit_function
D$(E3
C D8U@u
FindTextW
EditGotoCount
fE9,hu
Notepad
RtlLookupFunctionEntry
api-ms-win-core-winrt-error-l1-1-0.dll
_o___std_exception_destroy
TextOutW
[%hs(%hs)]
searchString
ShowWindow
TerminateProcess
[ UVWAVAWH
f94Yu
(caller: %p)
memcmp
D8%\\
T$`E3
WindowsCreateString
.idata$2
LoadAcceleratorsW
@.didat
_o__errno
\$(D#
DelayLoadFailureHook
Microsoft YaHei UI Bold
D9l$0u
LocalFree
USVWH
GetDC
onecore\internal\sdk\inc\wil\opensource\wil\resource.h
GetOpenFileNameW
LocalSize
name="Microsoft.Windows.Common-Controls"
onecore\internal\sdk\inc\wil\opensource/wil/win32_helpers.h
memcpy
TelemetryAssertDiagTrack
IsDebuggerPresent
fD9#t
SearchBingInvoked
t$0E3
FreshWindow
%s\%s
+T$HH
D$p+D$h9D$xuoL
\$ L;
WilError_03
@.data
onecore\internal\sdk\inc\wil/Staging.h
L$PD9
.text$mn$00
GetDiskFreeSpaceExW
_o__initialize_onexit_table
_o__callnewh
|$(D#
Segoe UI SemiBold
GetLocaleInfoW
D$DL;
.00cfg
<requestedPrivileges>
Software\Microsoft\Notepad\Autosave
Default
*.txt
D9d$h
_o__configure_wide_argv
hwp1p0
bWti^
.xdata
GetPrinterDriverW
CreateDirectoryW
Unknown exception
Malgun Gothic
'R{=f
GetSaveFileNameW
NHcH<
SetViewportExtEx
.rdata$r
p WAVAWH
SlipUpAcc
m]#0D
DialogBoxParamW
EditCopyCount
UWATAVAWH
L$PH3
ReleaseSRWLockExclusive
A_A^_
api-ms-win-core-winrt-l1-1-0.dll
EventProviderEnabled
GetDlgCtrlID
HcD$`A
DeleteCriticalSection
<!-- Copyright (c) Microsoft Corporation -->
FilePrintCount
.data$brc
L$HH3
RegisterClassExW
t)fA;@
RegCreateKeyExW
ClosePrinter
MulDiv
L$ USVWATAUAVAWH
.data
_o_malloc
_o__crt_atexit
Exception
RoUninitialize
LogHr
lfOrientation
HcD$ H
PSGetPropertyDescriptionListFromString
u@;}8
+dBVY
SetCursor
CompanyName
fD90t,
f9<Au
GetProcessHeap
_initterm_e
L$@H3
@A^_^
NOTEPAD.EXE
CreateFileW
TranslateMessage
zudL9
PageSetupDlgW
FileSaveCount
EDPENLIGHTENEDAPPINFOID
/>
IsDialogMessageW
GetFileAttributesW
GetDlgItemTextW
.pdata
name="Microsoft.Windows.Shell.notepad"
@.reloc
oL$0f
LocalAlloc
GetFileAttributesExW
SetUnhandledExceptionFilter
0A^_^[]
oT$@f
f9,^u
L$XL+
.didat$2
CreateThreadpoolTimer
t$hD#
SetFocus
H!_(H!_0H!_8H!_@3
x AVH
{ ATAVAWH
iPointSize
tOfD9
SetActiveWindow
UpdateWindow
Leelawadee UI
FWph?r
lfQuality
fWrap
ReturnHr
GetFileInformationByHandle
CoCreateInstance
10.0.19041.3996 (WinBuild.160101.0800)
D;l$xr
_o__wtol
.text
CreateSemaphoreExW
WindowsDeleteString
oD$ f
Lct$$H
GDI32.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
RedrawWindow
DrawTextExW
WilStaging_02
CreateEventExW
GetStartupInfoW
.CRT$XCZ
MH+UD+M@D
L$H9L$@v\H
Da6N^
SHStrDupW
iMarginLeft
<security>
.xdata$x
FileExtension
WideCharToMultiByte
PostMessageW
.text$di
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
iMarginRight
E8,8u
GetSystemMenu
ReleaseMutex
@USVWATAVAWH
H)t$xH
EdpPasteToNoContextCount
RegCloseKey
Operating System
_o__configthreadlocale
GetDeviceCaps
_o__seh_filter_exe
NtQueryWnfStateData
CoTaskMemAlloc
lfPitchAndFamily
GetSystemTimeAsFileTime
kernelbase.dll
PA_A^A\_^[]
GetFocus
Vving1
.idata$4
zufL9
GetWindowPlacement
.CRT$XIAC
Translation
rMfD9?w
` UAVAWH
.giats
SetEvent
.text$x
t$4E3
hgtlCm
FindClose
CreateFileMappingW
WindowsGetStringRawBuffer
x UAVAWH
.didat$7
D9t$8
IsProcessorFeaturePresent
<windowsSettings xmlns:ws2="http://schemas.microsoft.com/SMI/2016/WindowsSettings">
D$0H;
pA_A^_^]
lfItalic
api-ms-win-core-shlwapi-legacy-l1-1-0.dll
x UATAUAVAWH
E9V0u
fD9$Ou
lfEscapement
ProductName
GetFullPathNameW
A_A^_
ContentType
D$HD#
CoCreateFreeThreadedMarshaler
SetWinEventHook
fE9,Fu
L$@I+
WaitForThreadpoolTimerCallbacks
305.1i
DestroyWindow
DragFinish
InternalName
.rtc$IZZ
DeleteDC
Windows.Security.EnterpriseData.FileProtectionManager
SetMapMode
RtlNotifyFeatureUsage
en-US
EditMenu
_o__invalid_parameter_noinfo
fD9$su
D$HE3
GetDateFormatW
C9fD9?u-
lfOutPrecision
iDefaultEncoding
@SUVWAVH
EdpFileOpenCount
Windows
T$ f9
\$8L;
LPtoDP
%hs(%d) tid(%x) %08X %ws
|$ UATAUAVAWH
D$0H9D$(utH
entrypoint
CreateStatusWindowW
EdpFileOpenAttemptFailCount
D9%Iw
|$0E3
processorArchitecture="amd64"
EdpFileSaveCount
shell\osshell\accesory\notepad\notepad.cpp
CreateDCW
lstrcmpiW
!This program cannot be run in DOS mode.
IsIconic
fWrapAround
ReleaseSRWLockShared
iMarginTop
^BNQ,^
TelemetryAssert
ChooseFontW
<assemblyIdentity
fPasteOriginalEOL
RegEnumValueW
IsNetworkPath
GlobalLock
SetBkMode
|$ UH
x AW3
f9|$@u
commdlg_help
_o__set_app_type
GetDpiForMonitor
L$`E3
`.rdata
FileDescription
H3E H3E
Yu Gothic UI Light
Malgun Gothic Bold
GetDpiForWindow
fD91u
T$p+T$hL
%s\%s.autosave
OutputDebugStringW
api-ms-win-shcore-path-l1-1-0.dll
PE Information
| Image Base | Entry Point | Reported Checksum | Actual Checksum | Minimum OS Version | PDB Path | Compile Time | Import Hash |
|---|---|---|---|---|---|---|---|
| 0x140000000 | 0x00023b60 | 0x0003f436 | 0x0003f436 | 10.0 | notepad.pdb | 2000-11-09 23:45:06 | 09ed737a03db7295bf734a9953f6eb5e |
Version Infos
| CompanyName | Microsoft Corporation |
|---|---|
| FileDescription | Notepad |
| FileVersion | 10.0.19041.3996 (WinBuild.160101.0800) |
| InternalName | Notepad |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | NOTEPAD.EXE |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 10.0.19041.3996 |
| Translation | 0x0409 0x04b0 |
Sections
| Name | RAW Address | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
|---|---|---|---|---|---|---|
| .text | 0x00000400 | 0x00001000 | 0x0002441f | 0x00024600 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.27 |
| .rdata | 0x00024a00 | 0x00026000 | 0x000092a8 | 0x00009400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.94 |
| .data | 0x0002de00 | 0x00030000 | 0x00002718 | 0x00000e00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 1.80 |
| .pdata | 0x0002ec00 | 0x00033000 | 0x000010e0 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.94 |
| .didat | 0x0002fe00 | 0x00035000 | 0x00000178 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 2.52 |
| .rsrc | 0x00030000 | 0x00036000 | 0x00000bd8 | 0x00000c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.61 |
| .reloc | 0x00030c00 | 0x00037000 | 0x000002d8 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 4.13 |
| Name | Offset | Size | Language | Sub-language | Entropy | File type |
|---|---|---|---|---|---|---|
| EDPENLIGHTENEDAPPINFOID | 0x00036710 | 0x00000002 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 1.00 | None |
| EDPPERMISSIVEAPPINFOID | 0x00036718 | 0x00000002 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 1.00 | None |
| MUI | 0x00036a98 | 0x00000140 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.07 | None |
| RT_VERSION | 0x00036720 | 0x00000374 | LANG_ENGLISH | SUBLANG_ENGLISH_US | 3.52 | None |
| RT_MANIFEST | 0x00036260 | 0x000004af | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.99 | None |
Imports
| Name | Address |
|---|---|
| CreateDCW | 0x140026800 |
| StartPage | 0x140026808 |
| StartDocW | 0x140026810 |
| SetAbortProc | 0x140026818 |
| DeleteDC | 0x140026820 |
| EndDoc | 0x140026828 |
| AbortDoc | 0x140026830 |
| EndPage | 0x140026838 |
| GetTextMetricsW | 0x140026840 |
| SetBkMode | 0x140026848 |
| LPtoDP | 0x140026850 |
| SetWindowExtEx | 0x140026858 |
| SetViewportExtEx | 0x140026860 |
| SetMapMode | 0x140026868 |
| GetTextExtentPoint32W | 0x140026870 |
| TextOutW | 0x140026878 |
| EnumFontsW | 0x140026880 |
| GetTextFaceW | 0x140026888 |
| SelectObject | 0x140026890 |
| DeleteObject | 0x140026898 |
| CreateFontIndirectW | 0x1400268a0 |
| GetDeviceCaps | 0x1400268a8 |
| Name | Address |
|---|---|
| _c_exit | 0x140027060 |
| _register_thread_local_exe_atexit_callback | 0x140027068 |
| _initterm_e | 0x140027070 |
| _initterm | 0x140027078 |
| Name | Address |
|---|---|
| CoWaitForMultipleHandles | 0x140026d80 |
| CoUninitialize | 0x140026d88 |
| PropVariantClear | 0x140026d90 |
| CoTaskMemFree | 0x140026d98 |
| CoTaskMemAlloc | 0x140026da0 |
| CoCreateFreeThreadedMarshaler | 0x140026da8 |
| CoCreateInstance | 0x140026db0 |
| CoInitializeEx | 0x140026db8 |
| CoCreateGuid | 0x140026dc0 |
| Name | Address |
|---|---|
| PathIsFileSpecW | 0x140026e68 |
| PathFindExtensionW | 0x140026e70 |
| PathFileExistsW | 0x140026e78 |
| Name | Address |
|---|---|
| SHStrDupW | 0x1400270b8 |
| Name | Address |
|---|---|
| GetDpiForMonitor | 0x1400270d8 |
| Name | Address |
|---|---|
| RtlLookupFunctionEntry | 0x140026e48 |
| RtlCaptureContext | 0x140026e50 |
| RtlVirtualUnwind | 0x140026e58 |
| Name | Address |
|---|---|
| SetUnhandledExceptionFilter | 0x140026dd0 |
| UnhandledExceptionFilter | 0x140026dd8 |
| RaiseException | 0x140026de0 |
| Name | Address |
|---|---|
| TerminateProcess | 0x140026e10 |
| Name | Address |
|---|---|
| GetProcessMitigationPolicy | 0x140026e20 |
| IsProcessorFeaturePresent | 0x140026e28 |
| Name | Address |
|---|---|
| QueryPerformanceCounter | 0x140026e38 |
| Name | Address |
|---|---|
| GetTickCount | 0x140026ec0 |
| GetSystemTimeAsFileTime | 0x140026ec8 |
| Name | Address |
|---|---|
| InitializeSListHead | 0x140026df0 |
| Name | Address |
|---|---|
| LoadLibraryExW | 0x140026e00 |
| Name | Address |
|---|---|
| WindowsCreateString | 0x140026f18 |
| WindowsDeleteString | 0x140026f20 |
| WindowsGetStringRawBuffer | 0x140026f28 |
| WindowsCreateStringReference | 0x140026f30 |
| Name | Address |
|---|---|
| SetEvent | 0x140026e98 |
| CreateEventExW | 0x140026ea0 |
| Name | Address |
|---|---|
| SetRestrictedErrorInfo | 0x140026ed8 |
| Name | Address |
|---|---|
| CompareStringOrdinal | 0x140026e88 |
| Name | Address |
|---|---|
| RoInitialize | 0x140026ef8 |
| RoUninitialize | 0x140026f00 |
| RoGetActivationFactory | 0x140026f08 |
| Name | Address |
|---|---|
| RoGetMatchingRestrictedErrorInfo | 0x140026ee8 |
| Name | Address |
|---|---|
| EventProviderEnabled | 0x1400270a8 |
| Name | Address |
|---|---|
| Sleep | 0x140026eb0 |
| Name | Address |
|---|---|
| CreateStatusWindowW | 0x1400267e8 |
| Command and Control | Defense Evasion |
|
|---|
Usage
Processing ( 0.43 seconds )
- 0.422 CAPE
- 0.007 Heatmap
- 0.004 BehaviorAnalysis
- 0.002 AnalysisInfo
Signatures ( 0.02 seconds )
- 0.003 ransomware_files
- 0.002 antianalysis_detectfile
- 0.002 antiav_detectreg
- 0.002 ransomware_extensions
- 0.001 antiav_detectfile
- 0.001 antivm_vbox_files
- 0.001 infostealer_bitcoin
- 0.001 infostealer_ftp
- 0.001 infostealer_im
- 0.001 poullight_files
- 0.001 territorial_disputes_sigs
- 0.001 ursnif_behavior
Reporting ( 0.04 seconds )
- 0.041 ReportHTML
- 0.001 MITRE_TTPS
Signatures
The PE file contains a PDB path
pdbpath: notepad.pdb
SetUnhandledExceptionFilter detected (possible anti-debug)
The binary contains an unknown PE section name indicative of packing
unknown section: {'name': '.didat', 'raw_address': '0x0002fe00', 'virtual_address': '0x00035000', 'virtual_size': '0x00000178', 'size_of_data': '0x00000200', 'characteristics': 'IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE', 'characteristics_raw': '0xc0000040', 'entropy': '2.52'}
Checks for presence of debugger via IsDebuggerPresent
Anomalous binary characteristics
anomaly: Entrypoint of binary is located outside of any mapped sections
Screenshots
Session Playback
No playback available.
Hosts
No hosts contacted.
DNS
No domains contacted.
Summary
C:\Windows\System32\kernel.appcore.dll
C:\Users\user\AppData\Local\Temp\resources.pri
C:\Users\user\AppData\Local\Temp\notepad.exe
C:\Users\user\AppData\Local\Temp\resources.pri
C:\Users\user\AppData\Local\Temp\notepad.exe
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Scaling
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Mrt\_Merged
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_CURRENT_USER\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Scaling
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Mrt\_Merged
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Resources.Core.ResourceManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
Local\SM0:5680:304:WilStaging_02
Local\SM0:5680:120:WilError_03
Local\SM0:5680:120:WilError_03
Sorry! No behavior.
Sorry! No tracee.
Sorry! No strace.
Sorry! No tracee.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP traffic
No SMTP traffic performed.
IRC traffic
No IRC requests performed.
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.