vnc_port=5902

2025-12-06 18:31:41,645 [root] INFO: Date set to: 20251208T05:51:54, timeout set to: 180
2025-12-06 18:31:41,645 [root] DEBUG: Starting analyzer from: C:\tmpet5am7x7
2025-12-06 18:31:41,645 [root] DEBUG: Storing results at: C:\UxUSjBSea
2025-12-06 18:31:41,645 [root] DEBUG: Pipe server name: \\.\PIPE\jPUzOZ
2025-12-06 18:31:41,645 [root] DEBUG: Python path: C:\Python38
2025-12-06 18:31:41,645 [root] INFO: analysis running as a normal user
2025-12-06 18:31:41,645 [root] INFO: analysis package specified: "mht"
2025-12-06 18:31:41,645 [root] DEBUG: importing analysis package module: "modules.packages.mht"...
2025-12-06 18:31:41,645 [root] DEBUG: imported analysis package "mht"
2025-12-06 18:31:41,645 [root] DEBUG: initializing analysis package "mht"...
2025-12-06 18:31:41,645 [lib.common.common] INFO: wrapping
2025-12-06 18:31:41,645 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-06 18:31:41,645 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\test.eml
2025-12-06 18:31:41,645 [root] INFO: Analyzer: Package modules.packages.mht does not specify a DLL option
2025-12-06 18:31:41,645 [root] INFO: Analyzer: Package modules.packages.mht does not specify a DLL_64 option
2025-12-06 18:31:41,645 [root] INFO: Analyzer: Package modules.packages.mht does not specify a loader option
2025-12-06 18:31:41,645 [root] INFO: Analyzer: Package modules.packages.mht does not specify a loader_64 option
2025-12-06 18:31:41,676 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-12-06 18:31:41,676 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain"
2025-12-06 18:31:41,676 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-12-06 18:31:41,676 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script"
2025-12-06 18:31:41,676 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks"
2025-12-06 18:31:41,676 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx"
2025-12-06 18:31:41,692 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-12-06 18:31:41,692 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script"
2025-12-06 18:31:41,692 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-12-06 18:31:41,707 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2025-12-06 18:31:41,707 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2025-12-06 18:31:41,723 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-12-06 18:31:41,723 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon"
2025-12-06 18:31:41,723 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-12-06 18:31:41,723 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage"
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Browser"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Browser' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Curtain"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Curtain' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Curtain does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"...
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Disguise' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-12-06 18:31:41,723 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.disguise: [WinError 5] Access is denied
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data
2025-12-06 18:31:41,723 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"...
2025-12-06 18:31:41,723 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Evtx"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Evtx' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Evtx does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"...
2025-12-06 18:31:41,723 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Human"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Human' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Human does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Pre_script"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Pre_script' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Pre_script does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"...
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-12-06 18:31:41,723 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-12-06 18:31:41,723 [root] DEBUG: Initialized auxiliary module "Sysmon"
2025-12-06 18:31:41,723 [root] DEBUG: attempting to configure 'Sysmon' from data
2025-12-06 18:31:41,723 [root] DEBUG: module Sysmon does not support data configuration, ignoring
2025-12-06 18:31:41,723 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"...
2025-12-06 18:31:41,817 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
2025-12-06 18:31:41,864 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe
2025-12-06 18:31:41,864 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
2025-12-06 18:31:41,864 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques.
2025-12-06 18:31:41,864 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-12-06 18:31:41,864 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-12-06 18:31:41,864 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-12-06 18:31:41,864 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-12-06 18:31:41,864 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 668
2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting exit code for <Process 668 ???>
2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,864 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,864 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,864 [lib.api.process] WARNING: the <Process 668 ???> is not alive, injection aborted
2025-12-06 18:31:41,864 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2025-12-06 18:31:41,864 [root] DEBUG: Initialized auxiliary module "Usage"
2025-12-06 18:31:41,864 [root] DEBUG: attempting to configure 'Usage' from data
2025-12-06 18:31:41,864 [root] DEBUG: module Usage does not support data configuration, ignoring
2025-12-06 18:31:41,864 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"...
2025-12-06 18:31:41,864 [root] DEBUG: Started auxiliary module modules.auxiliary.usage
2025-12-06 18:31:41,864 [root] DEBUG: Initialized auxiliary module "During_script"
2025-12-06 18:31:41,864 [root] DEBUG: attempting to configure 'During_script' from data
2025-12-06 18:31:41,879 [root] DEBUG: module During_script does not support data configuration, ignoring
2025-12-06 18:31:41,879 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"...
2025-12-06 18:31:41,879 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script
2025-12-06 18:31:41,911 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
2025-12-06 18:31:41,942 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe
2025-12-06 18:31:41,958 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
2025-12-06 18:31:42,004 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2025-12-06 18:31:42,020 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe
2025-12-06 18:31:42,051 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
2025-12-06 18:31:42,098 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe
2025-12-06 18:31:42,098 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
2025-12-06 18:31:42,114 [root] INFO: Restarting WMI Service
2025-12-06 18:31:42,129 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
2025-12-06 18:31:42,160 [root] DEBUG: package modules.packages.mht does not support configure, ignoring
2025-12-06 18:31:42,160 [root] WARNING: configuration error for package modules.packages.mht: error importing data.packages.mht: No module named 'data.packages'
2025-12-06 18:31:42,160 [lib.common.common] INFO: Submitted file is missing extension, adding .mht
2025-12-06 18:31:42,160 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-06 18:31:42,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
2025-12-06 18:31:42,176 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Internet Explorer\iexplore.exe" with arguments ""C:\Users\user\AppData\Local\Temp\test.eml.mht"" with pid 3336
2025-12-06 18:31:42,176 [lib.api.process] INFO: Monitor config for <Process 3336 iexplore.exe>: C:\tmpet5am7x7\dll\3336.ini
2025-12-06 18:31:42,176 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpet5am7x7\dll\hzgltx.dll, loader C:\tmpet5am7x7\bin\sRcluWB.exe
2025-12-06 18:31:42,192 [root] DEBUG: Loader: Injecting process 3336 (thread 4076) with C:\tmpet5am7x7\dll\hzgltx.dll.
2025-12-06 18:31:42,192 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-06 18:31:42,192 [root] DEBUG: Successfully injected DLL C:\tmpet5am7x7\dll\hzgltx.dll.
2025-12-06 18:31:42,192 [lib.api.process] INFO: Injected into 32-bit <Process 3336 iexplore.exe>
2025-12-06 18:31:42,207 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
2025-12-06 18:31:42,207 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
2025-12-06 18:31:42,239 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2025-12-06 18:31:42,239 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
2025-12-06 18:31:42,286 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
2025-12-06 18:31:42,286 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2025-12-06 18:31:42,317 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
2025-12-06 18:31:42,348 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable
2025-12-06 18:31:42,379 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable
2025-12-06 18:31:42,395 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
2025-12-06 18:31:42,426 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable
2025-12-06 18:31:42,457 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
2025-12-06 18:31:42,488 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
2025-12-06 18:31:42,535 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
2025-12-06 18:31:42,551 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable
2025-12-06 18:31:42,582 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
2025-12-06 18:31:42,613 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
2025-12-06 18:31:42,645 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
2025-12-06 18:31:42,676 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
2025-12-06 18:31:42,707 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
2025-12-06 18:31:42,739 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
2025-12-06 18:31:42,770 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
2025-12-06 18:31:42,801 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
2025-12-06 18:31:42,832 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
2025-12-06 18:31:42,864 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
2025-12-06 18:31:42,895 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
2025-12-06 18:31:42,926 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
2025-12-06 18:31:42,958 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
2025-12-06 18:31:42,989 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
2025-12-06 18:31:43,020 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
2025-12-06 18:31:43,051 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
2025-12-06 18:31:43,083 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
2025-12-06 18:31:43,113 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
2025-12-06 18:31:43,145 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
2025-12-06 18:31:43,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
2025-12-06 18:31:43,207 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable
2025-12-06 18:31:43,238 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
2025-12-06 18:31:43,270 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
2025-12-06 18:31:43,285 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
2025-12-06 18:31:43,317 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
2025-12-06 18:31:43,348 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
2025-12-06 18:31:43,379 [modules.auxiliary.evtx] DEBUG: Wiping Application
2025-12-06 18:31:43,410 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents
2025-12-06 18:31:43,442 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer
2025-12-06 18:31:43,473 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service
2025-12-06 18:31:43,504 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts
2025-12-06 18:31:43,535 [modules.auxiliary.evtx] DEBUG: Wiping Security
2025-12-06 18:31:43,567 [modules.auxiliary.evtx] DEBUG: Wiping Setup
2025-12-06 18:31:43,598 [modules.auxiliary.evtx] DEBUG: Wiping System
2025-12-06 18:31:43,629 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell
2025-12-06 18:31:43,660 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational
2025-12-06 18:31:44,207 [lib.api.process] INFO: Successfully resumed <Process 3336 iexplore.exe>
2025-12-06 18:31:44,223 [root] DEBUG: 3336: Python path set to 'C:\Python38'.
2025-12-06 18:31:44,223 [root] INFO: Disabling sleep skipping.
2025-12-06 18:31:44,223 [root] DEBUG: 3336: Dropped file limit defaulting to 100.
2025-12-06 18:31:44,223 [root] DEBUG: 3336: Internet Explorer-specific hook-set enabled.
2025-12-06 18:31:44,239 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied.
2025-12-06 18:31:44,239 [root] DEBUG: 3336: Monitor initialised: 32-bit capemon loaded in process 3336 at 0x73630000, thread 4076, image base 0x160000, stack from 0x30f2000-0x3100000
2025-12-06 18:31:44,239 [root] DEBUG: 3336: Commandline: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" "C:\Users\user\AppData\Local\Temp\test.eml.mht"
2025-12-06 18:31:44,239 [root] DEBUG: 3336: hook_api: Warning - CoCreateInstance export address 0x762B569D differs from GetProcAddress -> 0x769995D0 (combase.dll::0xd95d0)
2025-12-06 18:31:44,239 [root] DEBUG: 3336: hook_api: Warning - CoCreateInstanceEx export address 0x762B56DC differs from GetProcAddress -> 0x7697C540 (combase.dll::0xbc540)
2025-12-06 18:31:44,239 [root] DEBUG: 3336: hook_api: Warning - CoGetClassObject export address 0x762B5C6C differs from GetProcAddress -> 0x769651A0 (combase.dll::0xa51a0)
2025-12-06 18:31:44,239 [root] DEBUG: 3336: hook_api: Warning - CLSIDFromProgID export address 0x762B4ED6 differs from GetProcAddress -> 0x769316A0 (combase.dll::0x716a0)
2025-12-06 18:31:44,239 [root] DEBUG: 3336: Hooked 64 out of 64 functions
2025-12-06 18:31:44,239 [root] DEBUG: 3336: Syscall hook installed, syscall logging level 1
2025-12-06 18:31:44,239 [root] DEBUG: 3336: WoW64fix: Windows version 10.0 not supported.
2025-12-06 18:31:44,239 [root] INFO: Loaded monitor into process with pid 3336
2025-12-06 18:31:44,254 [root] DEBUG: 3336: caller_dispatch: Added region at 0x00160000 to tracked regions list (ntdll::NtClose returns to 0x00162A68, thread 4076).
2025-12-06 18:31:44,254 [root] DEBUG: 3336: ProcessImageBase: Main module image at 0x00160000 unmodified (entropy change 0.000000e+00)
2025-12-06 18:31:44,254 [root] DEBUG: 3336: DLL loaded at 0x75CF0000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2025-12-06 18:31:44,254 [root] DEBUG: 3336: DLL loaded at 0x73F60000: C:\Windows\SYSTEM32\msIso (0x46000 bytes).
2025-12-06 18:31:44,254 [root] DEBUG: 3336: InstrumentationCallback: Added region at 0x76FC0000 to tracked regions list (thread 4076).
2025-12-06 18:31:44,254 [root] DEBUG: 3336: set_hooks_by_export_directory: Hooked 0 out of 64 functions
2025-12-06 18:31:44,254 [root] DEBUG: 3336: DLL loaded at 0x74EC0000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2025-12-06 18:31:44,270 [root] DEBUG: 3336: NtTerminateProcess hook: Attempting to dump process 3336
2025-12-06 18:31:44,270 [root] DEBUG: 3336: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-06 18:31:44,270 [root] INFO: Process with pid 3336 has terminated
2025-12-06 18:31:50,286 [root] INFO: Process list is empty, terminating analysis
2025-12-06 18:31:51,301 [root] INFO: Created shutdown mutex
2025-12-06 18:31:52,316 [root] INFO: Shutting down package
2025-12-06 18:31:52,316 [root] INFO: Stopping auxiliary modules
2025-12-06 18:31:52,316 [root] INFO: Stopping auxiliary module: Browser
2025-12-06 18:31:52,316 [root] INFO: Stopping auxiliary module: Curtain
2025-12-06 18:31:52,316 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [Errno 13] Permission denied: 'C:\\curtain.log'
2025-12-06 18:31:52,316 [modules.auxiliary.curtain] ERROR: Curtain log file not found!
2025-12-06 18:31:52,316 [root] INFO: Stopping auxiliary module: End_noisy_tasks
2025-12-06 18:31:52,316 [root] INFO: Stopping auxiliary module: Evtx
2025-12-06 18:31:52,316 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump
2025-12-06 18:31:52,316 [root] WARNING: Cannot terminate auxiliary module Evtx: [Errno 13] Permission denied: 'C:/windows/Sysnative/winevt/Logs\\Application.evtx'
2025-12-06 18:31:52,316 [root] INFO: Stopping auxiliary module: Human
2025-12-06 18:31:52,426 [root] INFO: Stopping auxiliary module: Pre_script
2025-12-06 18:31:52,426 [root] INFO: Stopping auxiliary module: Screenshots
2025-12-06 18:31:56,863 [root] INFO: Stopping auxiliary module: Usage
2025-12-06 18:31:57,988 [root] INFO: Stopping auxiliary module: During_script
2025-12-06 18:31:57,988 [root] INFO: Finishing auxiliary modules
2025-12-06 18:31:57,988 [root] INFO: Shutting down pipe server and dumping dropped files
2025-12-06 18:31:57,988 [root] WARNING: Folder at path "C:\UxUSjBSea\debugger" does not exist, skipping
2025-12-06 18:31:57,988 [root] WARNING: Folder at path "C:\UxUSjBSea\tlsdump" does not exist, skipping
2025-12-06 18:31:57,988 [root] INFO: Analysis completed