| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | eml | 2025-12-08 15:06:01 | 2025-12-08 15:09:15 | 194 seconds | Show Options | Show Analysis Log | 9.2 |
vnc_port=5900
2025-12-06 18:31:41,707 [root] INFO: Date set to: 20251208T07:06:01, timeout set to: 180
2025-12-06 18:31:41,707 [root] DEBUG: Starting analyzer from: C:\tmpw7hn3wdo
2025-12-06 18:31:41,707 [root] DEBUG: Storing results at: C:\UMqzgRcss
2025-12-06 18:31:41,707 [root] DEBUG: Pipe server name: \\.\PIPE\pdpVBYn
2025-12-06 18:31:41,707 [root] DEBUG: Python path: C:\Python38
2025-12-06 18:31:41,707 [root] INFO: analysis running as a normal user
2025-12-06 18:31:41,707 [root] INFO: analysis package specified: "eml"
2025-12-06 18:31:41,707 [root] DEBUG: importing analysis package module: "modules.packages.eml"...
2025-12-06 18:31:41,707 [root] DEBUG: imported analysis package "eml"
2025-12-06 18:31:41,707 [root] DEBUG: initializing analysis package "eml"...
2025-12-06 18:31:41,707 [lib.common.common] INFO: wrapping
2025-12-06 18:31:41,707 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-06 18:31:41,707 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\49768fe73895b939.unknown
2025-12-06 18:31:41,722 [root] INFO: Analyzer: Package modules.packages.eml does not specify a DLL option
2025-12-06 18:31:41,722 [root] INFO: Analyzer: Package modules.packages.eml does not specify a DLL_64 option
2025-12-06 18:31:41,722 [root] INFO: Analyzer: Package modules.packages.eml does not specify a loader option
2025-12-06 18:31:41,722 [root] INFO: Analyzer: Package modules.packages.eml does not specify a loader_64 option
2025-12-06 18:31:41,738 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-12-06 18:31:41,738 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain"
2025-12-06 18:31:41,738 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-12-06 18:31:41,738 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script"
2025-12-06 18:31:41,738 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks"
2025-12-06 18:31:41,754 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx"
2025-12-06 18:31:41,754 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-12-06 18:31:41,754 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script"
2025-12-06 18:31:41,754 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-12-06 18:31:41,769 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2025-12-06 18:31:41,769 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2025-12-06 18:31:41,785 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-12-06 18:31:41,785 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon"
2025-12-06 18:31:41,785 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-12-06 18:31:41,785 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage"
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Browser"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Browser' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-12-06 18:31:41,785 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Curtain"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Curtain' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Curtain does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"...
2025-12-06 18:31:41,785 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Disguise' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-12-06 18:31:41,785 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.disguise: [WinError 5] Access is denied
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data
2025-12-06 18:31:41,785 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"...
2025-12-06 18:31:41,785 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe
2025-12-06 18:31:41,785 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Evtx"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Evtx' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Evtx does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"...
2025-12-06 18:31:41,785 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
2025-12-06 18:31:41,785 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Human"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Human' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Human does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-12-06 18:31:41,785 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Pre_script"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Pre_script' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Pre_script does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"...
2025-12-06 18:31:41,785 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script
2025-12-06 18:31:41,785 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-12-06 18:31:41,785 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-12-06 18:31:41,785 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-12-06 18:31:41,785 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-12-06 18:31:41,801 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-12-06 18:31:41,801 [root] DEBUG: Initialized auxiliary module "Sysmon"
2025-12-06 18:31:41,801 [root] DEBUG: attempting to configure 'Sysmon' from data
2025-12-06 18:31:41,801 [root] DEBUG: module Sysmon does not support data configuration, ignoring
2025-12-06 18:31:41,801 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"...
2025-12-06 18:31:41,879 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
2025-12-06 18:31:41,910 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe
2025-12-06 18:31:41,926 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques.
2025-12-06 18:31:41,926 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-12-06 18:31:41,926 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-12-06 18:31:41,926 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-12-06 18:31:41,926 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-12-06 18:31:41,926 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 668
2025-12-06 18:31:41,926 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,926 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,926 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,926 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,926 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,926 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,926 [lib.api.process] DEBUG: Failed getting exit code for <Process 668 ???>
2025-12-06 18:31:41,926 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,926 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,926 [lib.api.process] WARNING: failed to open process 668
2025-12-06 18:31:41,926 [lib.api.process] DEBUG: Failed getting image name for pid 668
2025-12-06 18:31:41,926 [lib.api.process] WARNING: the <Process 668 ???> is not alive, injection aborted
2025-12-06 18:31:41,926 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2025-12-06 18:31:41,926 [root] DEBUG: Initialized auxiliary module "Usage"
2025-12-06 18:31:41,926 [root] DEBUG: attempting to configure 'Usage' from data
2025-12-06 18:31:41,926 [root] DEBUG: module Usage does not support data configuration, ignoring
2025-12-06 18:31:41,926 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"...
2025-12-06 18:31:41,926 [root] DEBUG: Started auxiliary module modules.auxiliary.usage
2025-12-06 18:31:41,926 [root] DEBUG: Initialized auxiliary module "During_script"
2025-12-06 18:31:41,926 [root] DEBUG: attempting to configure 'During_script' from data
2025-12-06 18:31:41,926 [root] DEBUG: module During_script does not support data configuration, ignoring
2025-12-06 18:31:41,926 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"...
2025-12-06 18:31:41,926 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script
2025-12-06 18:31:41,926 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
2025-12-06 18:31:41,973 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe
2025-12-06 18:31:41,973 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
2025-12-06 18:31:42,019 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
2025-12-06 18:31:42,051 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe
2025-12-06 18:31:42,066 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2025-12-06 18:31:42,097 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
2025-12-06 18:31:42,113 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe
2025-12-06 18:31:42,128 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
2025-12-06 18:31:42,160 [root] INFO: Restarting WMI Service
2025-12-06 18:31:42,175 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
2025-12-06 18:31:42,207 [root] DEBUG: package modules.packages.eml does not support configure, ignoring
2025-12-06 18:31:42,207 [root] WARNING: configuration error for package modules.packages.eml: error importing data.packages.eml: No module named 'data.packages'
2025-12-06 18:31:42,207 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
2025-12-06 18:31:42,207 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-06 18:31:42,238 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
2025-12-06 18:31:42,238 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
2025-12-06 18:31:42,285 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
2025-12-06 18:31:42,285 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2025-12-06 18:31:42,316 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
2025-12-06 18:31:42,332 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2025-12-06 18:31:42,347 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
2025-12-06 18:31:42,379 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable
2025-12-06 18:31:42,394 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" with arguments "/eml "C:\Users\user\AppData\Local\Temp\49768fe73895b939.unknown"" with pid 2160
2025-12-06 18:31:42,394 [lib.api.process] INFO: Monitor config for <Process 2160 OUTLOOK.EXE>: C:\tmpw7hn3wdo\dll\2160.ini
2025-12-06 18:31:42,394 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpw7hn3wdo\dll\bzpqGRz.dll, loader C:\tmpw7hn3wdo\bin\NfRTtMG.exe
2025-12-06 18:31:42,394 [root] DEBUG: Loader: Injecting process 2160 (thread 2268) with C:\tmpw7hn3wdo\dll\bzpqGRz.dll.
2025-12-06 18:31:42,394 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-06 18:31:42,394 [root] DEBUG: Successfully injected DLL C:\tmpw7hn3wdo\dll\bzpqGRz.dll.
2025-12-06 18:31:42,410 [lib.api.process] INFO: Injected into 32-bit <Process 2160 OUTLOOK.EXE>
2025-12-06 18:31:42,410 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable
2025-12-06 18:31:42,441 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
2025-12-06 18:31:42,473 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable
2025-12-06 18:31:42,488 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
2025-12-06 18:31:42,520 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
2025-12-06 18:31:42,551 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
2025-12-06 18:31:42,582 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable
2025-12-06 18:31:42,613 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
2025-12-06 18:31:42,629 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
2025-12-06 18:31:42,660 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
2025-12-06 18:31:42,691 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
2025-12-06 18:31:42,723 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
2025-12-06 18:31:42,738 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
2025-12-06 18:31:42,770 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
2025-12-06 18:31:42,800 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
2025-12-06 18:31:42,832 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
2025-12-06 18:31:42,863 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
2025-12-06 18:31:42,894 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
2025-12-06 18:31:42,910 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
2025-12-06 18:31:42,941 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
2025-12-06 18:31:42,972 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
2025-12-06 18:31:43,004 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
2025-12-06 18:31:43,035 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
2025-12-06 18:31:43,050 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
2025-12-06 18:31:43,082 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
2025-12-06 18:31:43,113 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
2025-12-06 18:31:43,144 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
2025-12-06 18:31:43,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable
2025-12-06 18:31:43,191 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
2025-12-06 18:31:43,222 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
2025-12-06 18:31:43,254 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
2025-12-06 18:31:43,285 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
2025-12-06 18:31:43,301 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
2025-12-06 18:31:43,332 [modules.auxiliary.evtx] DEBUG: Wiping Application
2025-12-06 18:31:43,363 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents
2025-12-06 18:31:43,394 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer
2025-12-06 18:31:43,410 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service
2025-12-06 18:31:43,441 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts
2025-12-06 18:31:43,473 [modules.auxiliary.evtx] DEBUG: Wiping Security
2025-12-06 18:31:43,504 [modules.auxiliary.evtx] DEBUG: Wiping Setup
2025-12-06 18:31:43,519 [modules.auxiliary.evtx] DEBUG: Wiping System
2025-12-06 18:31:43,551 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell
2025-12-06 18:31:43,582 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational
2025-12-06 18:31:44,426 [lib.api.process] INFO: Successfully resumed <Process 2160 OUTLOOK.EXE>
2025-12-06 18:31:44,457 [root] DEBUG: 2160: Python path set to 'C:\Python38'.
2025-12-06 18:31:44,457 [root] INFO: Disabling sleep skipping.
2025-12-06 18:31:44,457 [root] DEBUG: 2160: Dropped file limit defaulting to 100.
2025-12-06 18:31:44,504 [root] DEBUG: 2160: Microsoft Office settings enabled.
2025-12-06 18:31:44,504 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied.
2025-12-06 18:31:44,504 [root] DEBUG: 2160: Monitor initialised: 32-bit capemon loaded in process 2160 at 0x73450000, thread 2268, image base 0x800000, stack from 0x2cf5000-0x2d00000
2025-12-06 18:31:44,504 [root] DEBUG: 2160: Commandline: "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\49768fe73895b939.unknown"
2025-12-06 18:31:44,519 [root] DEBUG: 2160: hook_api: Warning - CoCreateInstance export address 0x76C0569D differs from GetProcAddress -> 0x756395D0 (combase.dll::0xd95d0)
2025-12-06 18:31:44,519 [root] DEBUG: 2160: hook_api: Warning - CoCreateInstanceEx export address 0x76C056DC differs from GetProcAddress -> 0x7561C540 (combase.dll::0xbc540)
2025-12-06 18:31:44,519 [root] DEBUG: 2160: hook_api: Warning - CoGetClassObject export address 0x76C05C6C differs from GetProcAddress -> 0x756051A0 (combase.dll::0xa51a0)
2025-12-06 18:31:44,519 [root] DEBUG: 2160: hook_api: Warning - CreateRemoteThreadEx export address 0x7598866C differs from GetProcAddress -> 0x75BD7630 (KERNELBASE.dll::0x137630)
2025-12-06 18:31:44,519 [root] DEBUG: 2160: hook_api: Warning - CLSIDFromProgID export address 0x76C04ED6 differs from GetProcAddress -> 0x755D16A0 (combase.dll::0x716a0)
2025-12-06 18:31:44,519 [root] DEBUG: 2160: hook_api: Warning - CLSIDFromProgIDEx export address 0x76C04F13 differs from GetProcAddress -> 0x755D0500 (combase.dll::0x70500)
2025-12-06 18:31:44,519 [root] DEBUG: 2160: Hooked 434 out of 434 functions
2025-12-06 18:31:44,519 [root] DEBUG: 2160: Syscall hook installed, syscall logging level 1
2025-12-06 18:31:44,519 [root] DEBUG: 2160: WoW64fix: Windows version 10.0 not supported.
2025-12-06 18:31:44,519 [root] INFO: Loaded monitor into process with pid 2160
2025-12-06 18:31:44,848 [root] DEBUG: 2160: DLL loaded at 0x769F0000: C:\Windows\System32\oleaut32 (0x96000 bytes).
2025-12-06 18:31:44,863 [root] DEBUG: 2160: DLL loaded at 0x72A10000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\Comctl32 (0x210000 bytes).
2025-12-06 18:31:44,863 [root] DEBUG: 2160: DLL loaded at 0x74CF0000: C:\Windows\SYSTEM32\version (0x8000 bytes).
2025-12-06 18:31:44,895 [root] DEBUG: 2160: DLL loaded at 0x73810000: C:\Windows\SYSTEM32\CRYPTUI (0x3f000 bytes).
2025-12-06 18:31:44,895 [root] DEBUG: 2160: DLL loaded at 0x74E90000: C:\Windows\SYSTEM32\IPHLPAPI (0x33000 bytes).
2025-12-06 18:31:44,895 [root] DEBUG: 2160: DLL loaded at 0x72380000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso20win32client (0x68a000 bytes).
2025-12-06 18:31:44,910 [root] DEBUG: 2160: DLL loaded at 0x74B00000: C:\Windows\system32\uxtheme (0x74000 bytes).
2025-12-06 18:31:44,910 [root] DEBUG: 2160: DLL loaded at 0x74ED0000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2025-12-06 18:31:44,910 [root] DEBUG: 2160: DLL loaded at 0x74CF0000: C:\Windows\SYSTEM32\version (0x8000 bytes).
2025-12-06 18:31:44,972 [root] DEBUG: 2160: DLL loaded at 0x737C0000: C:\Windows\SYSTEM32\wevtapi (0x49000 bytes).
2025-12-06 18:31:44,972 [root] DEBUG: 2160: DLL loaded at 0x718A0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso30win32client (0xadc000 bytes).
2025-12-06 18:31:45,019 [root] DEBUG: 2160: DLL loaded at 0x70B80000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso40uiwin32client (0xd1e000 bytes).
2025-12-06 18:31:45,019 [root] DEBUG: 2160: DLL loaded at 0x73370000: C:\Windows\SYSTEM32\wintypes (0xdb000 bytes).
2025-12-06 18:31:45,035 [root] DEBUG: 2160: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:31:45,035 [root] DEBUG: 2160: DLL loaded at 0x74CE0000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2025-12-06 18:31:45,035 [root] DEBUG: 2160: DLL loaded at 0x76640000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2025-12-06 18:31:45,050 [root] DEBUG: 2160: DLL loaded at 0x708E0000: C:\Windows\SYSTEM32\msi (0x298000 bytes).
2025-12-06 18:31:45,050 [root] DEBUG: 2160: DLL loaded at 0x73D00000: C:\Windows\SYSTEM32\srpapi (0x25000 bytes).
2025-12-06 18:31:45,066 [root] DEBUG: 2160: DLL loaded at 0x079D0000: C:\Windows\System32\SFC (0x3000 bytes).
2025-12-06 18:31:45,066 [root] DEBUG: 2160: DLL loaded at 0x74330000: C:\Windows\SYSTEM32\sfc_os (0x10000 bytes).
2025-12-06 18:31:45,097 [root] DEBUG: 2160: DLL loaded at 0x74320000: C:\Windows\SYSTEM32\WTSAPI32 (0xf000 bytes).
2025-12-06 18:31:45,097 [root] DEBUG: 2160: DLL loaded at 0x703B0000: C:\Program Files (x86)\Microsoft Office\root\Office16\OLMAPI32 (0x7c1000 bytes).
2025-12-06 18:31:45,113 [root] DEBUG: 2160: DLL loaded at 0x702C0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso50win32client (0xef000 bytes).
2025-12-06 18:31:45,191 [root] DEBUG: 2160: DLL loaded at 0x73D20000: C:\Windows\SYSTEM32\HTTPAPI (0xb000 bytes).
2025-12-06 18:31:45,207 [root] DEBUG: 2160: DLL loaded at 0x6EDE0000: C:\Windows\SYSTEM32\PROPSYS (0xc2000 bytes).
2025-12-06 18:31:45,207 [root] DEBUG: 2160: DLL loaded at 0x07E20000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso98win32client (0x1407000 bytes).
2025-12-06 18:31:45,316 [root] DEBUG: 2160: DLL loaded at 0x6D110000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso (0x1cc1000 bytes).
2025-12-06 18:31:45,332 [root] DEBUG: 2160: DLL loaded at 0x76C40000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2025-12-06 18:31:45,347 [root] DEBUG: 2160: DLL loaded at 0x6CE70000: C:\Windows\SYSTEM32\msi (0x298000 bytes).
2025-12-06 18:31:45,347 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\{C0284404-4C96-4C20-9901-21DB24609CF1} - OProcSessId.dat
2025-12-06 18:31:45,379 [root] DEBUG: 2160: DLL loaded at 0x6C950000: C:\Windows\SYSTEM32\d2d1 (0x515000 bytes).
2025-12-06 18:31:45,379 [root] DEBUG: 2160: DLL loaded at 0x73770000: C:\Windows\SYSTEM32\WINSTA (0x4e000 bytes).
2025-12-06 18:31:45,394 [root] DEBUG: 2160: DLL loaded at 0x6C880000: C:\Windows\SYSTEM32\dxgi (0xc2000 bytes).
2025-12-06 18:31:45,394 [root] DEBUG: 2160: DLL loaded at 0x73D10000: C:\Windows\SYSTEM32\resourcepolicyclient (0xf000 bytes).
2025-12-06 18:31:45,441 [root] DEBUG: 2160: DLL loaded at 0x101C0000: C:\Program Files (x86)\Microsoft Office\root\Office16\1033\OUTLLIBR (0x18f000 bytes).
2025-12-06 18:31:45,472 [root] DEBUG: 2160: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:31:45,472 [root] DEBUG: 2160: DLL loaded at 0x10350000: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLLIBR.COMMON (0x96e000 bytes).
2025-12-06 18:31:45,488 [root] DEBUG: 2160: DLL loaded at 0x73D10000: C:\Windows\SYSTEM32\Secur32 (0xa000 bytes).
2025-12-06 18:31:45,504 [root] DEBUG: 2160: DLL loaded at 0x76940000: C:\Windows\System32\shcore (0x87000 bytes).
2025-12-06 18:31:45,504 [root] DEBUG: 2160: DLL loaded at 0x6C780000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0xf9000 bytes).
2025-12-06 18:31:45,519 [root] DEBUG: 2160: DLL loaded at 0x6C570000: C:\Windows\SYSTEM32\DWrite (0x20c000 bytes).
2025-12-06 18:31:45,519 [root] DEBUG: 2160: DLL loaded at 0x73730000: C:\Windows\System32\netprofm (0x32000 bytes).
2025-12-06 18:31:45,519 [root] DEBUG: 2160: DLL loaded at 0x732A0000: C:\Windows\SYSTEM32\mscoree (0x52000 bytes).
2025-12-06 18:31:45,535 [root] DEBUG: 2160: DLL loaded at 0x6C4E0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x88000 bytes).
2025-12-06 18:31:45,535 [root] DEBUG: 2160: DLL loaded at 0x73D00000: C:\Windows\System32\npmproxy (0xa000 bytes).
2025-12-06 18:31:45,535 [root] DEBUG: 2160: DLL loaded at 0x744A0000: C:\Windows\SYSTEM32\Wldp (0x25000 bytes).
2025-12-06 18:31:45,535 [root] DEBUG: 2160: DLL loaded at 0x744D0000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes).
2025-12-06 18:31:45,550 [root] DEBUG: 2160: DLL loaded at 0x6C300000: C:\Windows\SYSTEM32\d3d11 (0x1e0000 bytes).
2025-12-06 18:31:45,550 [root] DEBUG: 2160: DLL loaded at 0x73CD0000: C:\Windows\SYSTEM32\profapi (0x18000 bytes).
2025-12-06 18:31:45,566 [root] DEBUG: 2160: DLL loaded at 0x6C230000: C:\Program Files (x86)\Microsoft Office\root\Office16\MsoAria (0xcd000 bytes).
2025-12-06 18:31:45,582 [lib.api.process] WARNING: failed to open process 792
2025-12-06 18:31:45,582 [lib.api.process] WARNING: failed to open process 792
2025-12-06 18:31:45,582 [lib.api.process] WARNING: failed to open process 792
2025-12-06 18:31:45,582 [lib.api.process] DEBUG: Failed getting image name for pid 792
2025-12-06 18:31:45,582 [lib.api.process] WARNING: failed to open process 792
2025-12-06 18:31:45,582 [lib.api.process] DEBUG: Failed getting image name for pid 792
2025-12-06 18:31:45,582 [lib.api.process] DEBUG: Failed getting exit code for <Process 792 ???>
2025-12-06 18:31:45,582 [lib.api.process] WARNING: failed to open process 792
2025-12-06 18:31:45,582 [lib.api.process] DEBUG: Failed getting image name for pid 792
2025-12-06 18:31:45,582 [lib.api.process] WARNING: failed to open process 792
2025-12-06 18:31:45,582 [lib.api.process] DEBUG: Failed getting image name for pid 792
2025-12-06 18:31:45,582 [lib.api.process] WARNING: the <Process 792 ???> is not alive, injection aborted
2025-12-06 18:31:45,597 [root] DEBUG: 2160: DLL loaded at 0x6BC60000: C:\Windows\SYSTEM32\d3d10warp (0x5c2000 bytes).
2025-12-06 18:31:45,597 [root] DEBUG: 2160: DLL loaded at 0x75D10000: C:\Windows\System32\Normaliz (0x7000 bytes).
2025-12-06 18:31:45,597 [root] DEBUG: 2160: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:31:45,597 [root] DEBUG: 2160: DLL loaded at 0x73350000: C:\Windows\SYSTEM32\sppcs (0x1c000 bytes).
2025-12-06 18:31:45,613 [root] DEBUG: 2160: DLL loaded at 0x73CC0000: C:\Windows\SYSTEM32\sppc (0x9000 bytes).
2025-12-06 18:31:45,613 [root] DEBUG: 2160: DLL loaded at 0x73C80000: C:\Windows\SYSTEM32\slc (0x1f000 bytes).
2025-12-06 18:31:45,613 [root] DEBUG: 2160: DLL loaded at 0x75420000: C:\Windows\System32\cfgmgr32 (0x3b000 bytes).
2025-12-06 18:31:45,613 [root] DEBUG: 2160: DLL loaded at 0x73270000: C:\Windows\SYSTEM32\dxcore (0x2c000 bytes).
2025-12-06 18:31:45,629 [root] DEBUG: 2160: DLL loaded at 0x6BB90000: C:\Windows\SYSTEM32\WINHTTP (0xca000 bytes).
2025-12-06 18:31:45,629 [root] DEBUG: 2160: DLL loaded at 0x6BAF0000: C:\Windows\SYSTEM32\CoreMessaging (0x9b000 bytes).
2025-12-06 18:31:45,629 [root] DEBUG: 2160: DLL loaded at 0x73C80000: C:\Windows\system32\OnDemandConnRouteHelper (0x12000 bytes).
2025-12-06 18:31:45,644 [root] DEBUG: 2160: DLL loaded at 0x6B980000: C:\Windows\System32\dcomp (0x164000 bytes).
2025-12-06 18:31:45,644 [root] DEBUG: 2160: DLL loaded at 0x74D60000: C:\Windows\system32\mswsock (0x52000 bytes).
2025-12-06 18:31:45,644 [root] DEBUG: 2160: DLL loaded at 0x76910000: C:\Windows\System32\NSI (0x7000 bytes).
2025-12-06 18:31:45,644 [root] DEBUG: 2160: DLL loaded at 0x73CC0000: C:\Windows\SYSTEM32\WINNSI (0x8000 bytes).
2025-12-06 18:31:45,691 [root] DEBUG: 2160: DLL loaded at 0x6B4B0000: C:\Windows\SYSTEM32\twinapi.appcore (0x194000 bytes).
2025-12-06 18:31:45,691 [root] DEBUG: 2160: DLL loaded at 0x6B800000: C:\Windows\System32\WindowManagementAPI (0x73000 bytes).
2025-12-06 18:31:45,691 [root] DEBUG: 2160: DLL loaded at 0x73340000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2025-12-06 18:31:45,691 [root] DEBUG: 2160: DLL loaded at 0x6B230000: C:\Windows\System32\CoreUIComponents (0x27e000 bytes).
2025-12-06 18:31:45,707 [root] DEBUG: 2160: DLL loaded at 0x6B740000: C:\Windows\System32\TextInputFramework (0xb9000 bytes).
2025-12-06 18:31:45,707 [root] DEBUG: 2160: DLL loaded at 0x6B650000: C:\Windows\System32\InputHost (0xed000 bytes).
2025-12-06 18:31:45,707 [root] DEBUG: 2160: DLL loaded at 0x6B880000: C:\Windows\System32\Windows.UI (0xf3000 bytes).
2025-12-06 18:31:45,707 [root] DEBUG: 2160: DLL loaded at 0x74E70000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x14000 bytes).
2025-12-06 18:31:45,722 [root] DEBUG: 2160: DLL loaded at 0x6B140000: C:\Windows\System32\Windows.UI.Immersive (0xec000 bytes).
2025-12-06 18:31:45,722 [root] DEBUG: 2160: DLL loaded at 0x74E50000: C:\Windows\SYSTEM32\dhcpcsvc (0x16000 bytes).
2025-12-06 18:31:45,738 [root] DEBUG: 2160: DLL loaded at 0x6AD60000: C:\Windows\SYSTEM32\iertutil (0x22d000 bytes).
2025-12-06 18:31:45,754 [root] DEBUG: 2160: DLL loaded at 0x73C80000: C:\Windows\SYSTEM32\srvcli (0x1d000 bytes).
2025-12-06 18:31:45,754 [root] DEBUG: 2160: DLL loaded at 0x73720000: C:\Windows\SYSTEM32\netutils (0xb000 bytes).
2025-12-06 18:31:45,754 [root] DEBUG: 2160: DLL loaded at 0x6AF90000: C:\Windows\SYSTEM32\urlmon (0x1a8000 bytes).
2025-12-06 18:31:45,754 [root] DEBUG: 2160: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-06 18:31:45,754 [root] DEBUG: 2160: DLL loaded at 0x6AD40000: C:\Windows\SYSTEM32\sppcs (0x1c000 bytes).
2025-12-06 18:31:45,754 [root] DEBUG: 2160: api-rate-cap: RtlSetCurrentTransaction hook disabled due to rate
2025-12-06 18:31:45,754 [root] DEBUG: 2160: DLL loaded at 0x73260000: C:\Windows\SYSTEM32\sppc (0x9000 bytes).
2025-12-06 18:31:45,754 [root] DEBUG: 2160: api-rate-cap: NtQueryKey hook disabled due to rate
2025-12-06 18:31:45,769 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Content\Anonymous\Insights.json to files\fafb3b8db54b6d2b64c782ccc5550c1df58ef9bf02d87cf9047275d32079bed4; Size is 390; Max size: 100000000
2025-12-06 18:31:45,785 [root] DEBUG: 2160: DLL loaded at 0x6A8E0000: C:\Windows\SYSTEM32\WININET (0x455000 bytes).
2025-12-06 18:31:45,800 [root] DEBUG: 2160: DLL loaded at 0x6A650000: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\RICHED20 (0x283000 bytes).
2025-12-06 18:31:45,800 [root] DEBUG: 2160: DLL loaded at 0x6A630000: C:\Windows\SYSTEM32\ondemandconnroutehelper (0x12000 bytes).
2025-12-06 18:31:45,816 [root] DEBUG: 2160: DLL loaded at 0x158C0000: C:\Program Files (x86)\Microsoft Office\root\Office16\1033\mapir (0x2b7000 bytes).
2025-12-06 18:31:45,816 [root] DEBUG: 2160: DLL loaded at 0x6A5B0000: C:\Windows\SYSTEM32\webio (0x73000 bytes).
2025-12-06 18:31:45,816 [root] DEBUG: 2160: DLL loaded at 0x6A580000: C:\Windows\SYSTEM32\srpapi (0x25000 bytes).
2025-12-06 18:31:45,832 [root] DEBUG: 2160: DLL loaded at 0x74DC0000: C:\Windows\SYSTEM32\DNSAPI (0x90000 bytes).
2025-12-06 18:31:45,832 [root] DEBUG: 2160: DLL loaded at 0x6A570000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2025-12-06 18:31:45,847 [root] DEBUG: 2160: DLL loaded at 0x6A480000: C:\Windows\SYSTEM32\webservices (0xef000 bytes).
2025-12-06 18:31:45,863 [root] DEBUG: 2160: DLL loaded at 0x6A440000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2025-12-06 18:31:45,863 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
2025-12-06 18:31:45,879 [root] DEBUG: 2160: DLL loaded at 0x6A400000: C:\Windows\System32\vaultcli (0x37000 bytes).
2025-12-06 18:31:45,894 [root] DEBUG: 2160: DLL loaded at 0x6A3D0000: C:\Windows\System32\aadWamExtension (0x23000 bytes).
2025-12-06 18:31:46,066 [root] DEBUG: 2160: api-rate-cap: NtReadVirtualMemory hook disabled due to rate
2025-12-06 18:31:46,066 [root] DEBUG: 2160: DLL loaded at 0x74D40000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2025-12-06 18:31:46,082 [root] DEBUG: 2160: DLL loaded at 0x74D10000: C:\Windows\system32\rsaenh (0x2f000 bytes).
2025-12-06 18:31:46,160 [root] DEBUG: 2160: DLL loaded at 0x6A330000: C:\Windows\System32\Windows.Web (0x92000 bytes).
2025-12-06 18:31:46,269 [root] DEBUG: 2160: DLL loaded at 0x6A320000: C:\Windows\SYSTEM32\DPAPI (0x8000 bytes).
2025-12-06 18:31:46,269 [root] DEBUG: 2160: DLL loaded at 0x6A2B0000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x61000 bytes).
2025-12-06 18:31:46,285 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres
2025-12-06 18:31:46,301 [root] DEBUG: 2160: api-rate-cap: NtEnumerateValueKey hook disabled due to rate
2025-12-06 18:31:46,301 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres'
2025-12-06 18:31:46,301 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres'
2025-12-06 18:31:46,316 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres'
2025-12-06 18:31:46,316 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres'
2025-12-06 18:31:46,332 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres'
2025-12-06 18:31:46,332 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres'
2025-12-06 18:31:46,332 [root] DEBUG: 2160: hook_api: NetUserGetInfo export address 0x6A29E1DE obtained via GetFunctionAddress
2025-12-06 18:31:46,332 [root] DEBUG: 2160: hook_api: NetGetJoinInformation export address 0x6A29D233 obtained via GetFunctionAddress
2025-12-06 18:31:46,332 [root] DEBUG: 2160: hook_api: NetUserGetLocalGroups export address 0x6A29E20A obtained via GetFunctionAddress
2025-12-06 18:31:46,332 [root] DEBUG: 2160: hook_api: DsEnumerateDomainTrustsW export address 0x6A29BC9F obtained via GetFunctionAddress
2025-12-06 18:31:46,332 [root] DEBUG: 2160: DLL loaded at 0x6A290000: C:\Windows\SYSTEM32\netapi32 (0x14000 bytes).
2025-12-06 18:31:46,348 [root] DEBUG: 2160: DLL loaded at 0x6A110000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2025-12-06 18:31:46,348 [root] DEBUG: 2160: DLL loaded at 0x6A180000: C:\Windows\SYSTEM32\DSREG (0x110000 bytes).
2025-12-06 18:31:47,473 [root] DEBUG: 2160: api-rate-cap: NtQueryPerformanceCounter hook disabled due to rate
2025-12-06 18:31:47,473 [root] DEBUG: 2160: DLL loaded at 0x6A1E0000: C:\Windows\System32\Windows.Networking.Connectivity (0x8f000 bytes).
2025-12-06 18:31:47,488 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal
2025-12-06 18:31:47,488 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal to files\45651c82a27c1d70b392e3be3318c2a11cc8ee4a6e5752da04e714466f7b19ac; Size is 512; Max size: 100000000
2025-12-06 18:31:47,504 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal
2025-12-06 18:31:47,504 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal to files\1847a5de7be8cf7da649e88b05192ea2d1d4b5def601852d77d83fa7b5dac2c3; Size is 4616; Max size: 100000000
2025-12-06 18:31:47,519 [root] DEBUG: 2160: DLL loaded at 0x6A110000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xc1000 bytes).
2025-12-06 18:31:47,535 [root] DEBUG: 2160: DLL loaded at 0x69D50000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes).
2025-12-06 18:31:47,598 [lib.api.process] WARNING: failed to open process 2664
2025-12-06 18:31:47,598 [lib.api.process] WARNING: failed to open process 2664
2025-12-06 18:31:47,598 [lib.api.process] WARNING: failed to open process 2664
2025-12-06 18:31:47,598 [lib.api.process] DEBUG: Failed getting image name for pid 2664
2025-12-06 18:31:47,598 [lib.api.process] WARNING: failed to open process 2664
2025-12-06 18:31:47,598 [lib.api.process] DEBUG: Failed getting image name for pid 2664
2025-12-06 18:31:47,598 [lib.api.process] DEBUG: Failed getting exit code for <Process 2664 ???>
2025-12-06 18:31:47,598 [lib.api.process] WARNING: failed to open process 2664
2025-12-06 18:31:47,598 [lib.api.process] DEBUG: Failed getting image name for pid 2664
2025-12-06 18:31:47,598 [lib.api.process] WARNING: failed to open process 2664
2025-12-06 18:31:47,598 [lib.api.process] DEBUG: Failed getting image name for pid 2664
2025-12-06 18:31:47,598 [lib.api.process] WARNING: the <Process 2664 ???> is not alive, injection aborted
2025-12-06 18:31:48,238 [root] DEBUG: 2160: api-cap: NtQueryInformationFile hook disabled due to count: 5000
2025-12-06 18:31:48,332 [root] DEBUG: 2160: api-cap: NtSetInformationFile hook disabled due to count: 5000
2025-12-06 18:31:48,550 [root] DEBUG: 2160: api-cap: NtAllocateVirtualMemory hook disabled due to count: 5000
2025-12-06 18:31:48,613 [root] DEBUG: 2160: api-cap: NtClose hook disabled due to count: 5000
2025-12-06 18:31:48,660 [root] DEBUG: 2160: api-cap: NtReadFile hook disabled due to count: 5000
2025-12-06 18:31:48,941 [root] DEBUG: 2160: DLL loaded at 0x667B0000: C:\Program Files (x86)\Microsoft Office\root\Office16\oart (0xc68000 bytes).
2025-12-06 18:31:48,941 [root] DEBUG: 2160: DLL loaded at 0x67420000: C:\Program Files (x86)\Microsoft Office\root\Office16\wwlib (0x2930000 bytes).
2025-12-06 18:31:48,957 [root] DEBUG: 2160: DLL loaded at 0x66780000: C:\Program Files (x86)\Microsoft Office\root\Office16\contab32 (0x2a000 bytes).
2025-12-06 18:31:48,972 [root] DEBUG: 2160: DLL loaded at 0x66780000: C:\Program Files (x86)\Microsoft Office\root\Office16\contab32 (0x2a000 bytes).
2025-12-06 18:31:49,003 [root] DEBUG: 2160: DLL loaded at 0x666E0000: C:\Windows\SYSTEM32\TextShaping (0x94000 bytes).
2025-12-06 18:31:49,019 [root] DEBUG: 2160: DLL loaded at 0x666B0000: C:\Windows\SYSTEM32\dwmapi (0x26000 bytes).
2025-12-06 18:31:49,082 [root] DEBUG: 2160: hook_api: Warning - ScriptIsComplex export address 0x66691714 differs from GetProcAddress -> 0x765F0FB0 (gdi32full.dll::0xa0fb0)
2025-12-06 18:31:49,082 [root] DEBUG: 2160: DLL loaded at 0x66690000: C:\Windows\SYSTEM32\usp10 (0x17000 bytes).
2025-12-06 18:31:49,097 [root] DEBUG: 2160: DLL loaded at 0x664F0000: C:\Windows\System32\Bcp47Langs (0x48000 bytes).
2025-12-06 18:31:49,113 [root] DEBUG: 2160: DLL loaded at 0x664C0000: C:\Windows\System32\bcp47mrm (0x22000 bytes).
2025-12-06 18:31:49,113 [root] DEBUG: 2160: DLL loaded at 0x66540000: C:\Windows\System32\Windows.Globalization (0x145000 bytes).
2025-12-06 18:31:49,113 [root] DEBUG: 2160: DLL loaded at 0x664A0000: C:\Windows\SYSTEM32\globinputhost (0x1c000 bytes).
2025-12-06 18:31:49,175 [root] DEBUG: 2160: DLL loaded at 0x66460000: C:\Windows\system32\dataexchange (0x31000 bytes).
2025-12-06 18:31:49,613 [root] DEBUG: 2160: DLL loaded at 0x663E0000: C:\Windows\SYSTEM32\wbemcomn (0x70000 bytes).
2025-12-06 18:31:49,613 [root] DEBUG: 2160: DLL loaded at 0x66450000: C:\Windows\system32\wbem\wbemprox (0xd000 bytes).
2025-12-06 18:31:49,628 [root] DEBUG: 2160: DLL loaded at 0x663D0000: C:\Windows\system32\wbem\wbemsvc (0x10000 bytes).
2025-12-06 18:31:49,644 [root] DEBUG: 2160: DLL loaded at 0x66300000: C:\Windows\system32\wbem\fastprox (0xc9000 bytes).
2025-12-06 18:31:49,644 [root] DEBUG: 2160: DLL loaded at 0x662E0000: C:\Windows\SYSTEM32\amsi (0x18000 bytes).
2025-12-06 18:31:49,660 [root] DEBUG: 2160: DLL loaded at 0x662A0000: C:\Program Files (x86)\Windows Defender\MpOav (0x38000 bytes).
2025-12-06 18:31:50,097 [modules.auxiliary.human] INFO: Found button "next >", clicking it
2025-12-06 18:31:50,504 [root] DEBUG: 2160: DLL loaded at 0x66250000: C:\Windows\system32\POWRPROF (0x44000 bytes).
2025-12-06 18:31:50,504 [root] DEBUG: 2160: DLL loaded at 0x66240000: C:\Windows\system32\UMPDC (0xd000 bytes).
2025-12-06 18:31:52,207 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:31:54,316 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:01,363 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:03,472 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:05,504 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:07,535 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:09,644 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:11,675 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:18,707 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:25,738 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:27,848 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:34,941 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:41,988 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:44,019 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:46,129 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:48,160 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:50,269 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:52,379 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:32:59,410 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:01,441 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:03,551 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:10,582 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:17,613 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:19,722 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:21,832 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:28,925 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:31,035 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:38,066 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:45,097 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:47,207 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:54,300 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:56,410 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:33:58,519 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:00,629 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:02,738 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:04,847 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:06,957 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:09,066 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:16,097 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:23,191 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:30,238 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:32,347 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:34,457 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:36,488 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:38,598 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:40,629 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:42,660 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:44,769 [modules.auxiliary.human] INFO: Found button "yes", clicking it
2025-12-06 18:34:45,207 [root] INFO: Analysis timeout hit, terminating analysis
2025-12-06 18:34:45,207 [lib.api.process] INFO: Terminate event set for <Process 2160 OUTLOOK.EXE>
2025-12-06 18:34:45,207 [root] DEBUG: 2160: Terminate Event: Attempting to dump process 2160
2025-12-06 18:34:45,222 [root] DEBUG: 2160: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-06 18:34:45,222 [root] DEBUG: 2160: Terminate Event: Current region empty
2025-12-06 18:34:45,238 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm
2025-12-06 18:34:45,238 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal
2025-12-06 18:34:45,238 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db
2025-12-06 18:34:45,238 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1765080704639042700_C0284404-4C96-4C20-9901-21DB24609CF1.log
2025-12-06 18:34:45,238 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1765080704637629400_C0284404-4C96-4C20-9901-21DB24609CF1.log
2025-12-06 18:34:45,238 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16924_20150-20251206T2011440910-2160.etl
2025-12-06 18:34:45,238 [lib.api.process] INFO: Termination confirmed for <Process 2160 OUTLOOK.EXE>
2025-12-06 18:34:45,238 [root] DEBUG: 2160: Terminate Event: CAPE shutdown complete for process 2160
2025-12-06 18:34:45,238 [root] INFO: Terminate event set for process 2160
2025-12-06 18:34:45,238 [root] INFO: Created shutdown mutex
2025-12-06 18:34:46,253 [root] INFO: Shutting down package
2025-12-06 18:34:46,253 [root] INFO: Stopping auxiliary modules
2025-12-06 18:34:46,253 [root] INFO: Stopping auxiliary module: Browser
2025-12-06 18:34:46,253 [root] INFO: Stopping auxiliary module: Curtain
2025-12-06 18:34:46,253 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [Errno 13] Permission denied: 'C:\\curtain.log'
2025-12-06 18:34:46,253 [modules.auxiliary.curtain] ERROR: Curtain log file not found!
2025-12-06 18:34:46,253 [root] INFO: Stopping auxiliary module: End_noisy_tasks
2025-12-06 18:34:46,253 [root] INFO: Stopping auxiliary module: Evtx
2025-12-06 18:34:46,253 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump
2025-12-06 18:34:46,253 [root] WARNING: Cannot terminate auxiliary module Evtx: [Errno 13] Permission denied: 'C:/windows/Sysnative/winevt/Logs\\Application.evtx'
2025-12-06 18:34:46,253 [root] INFO: Stopping auxiliary module: Human
2025-12-06 18:34:46,800 [root] INFO: Stopping auxiliary module: Pre_script
2025-12-06 18:34:46,800 [root] INFO: Stopping auxiliary module: Screenshots
2025-12-06 18:34:48,457 [root] INFO: Stopping auxiliary module: Usage
2025-12-06 18:34:49,347 [root] INFO: Stopping auxiliary module: During_script
2025-12-06 18:34:49,347 [root] INFO: Finishing auxiliary modules
2025-12-06 18:34:49,347 [root] INFO: Shutting down pipe server and dumping dropped files
2025-12-06 18:34:49,347 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT to files\3453ffe7fa0cbc5801931fd608c5f4e68ef026a8ac311e4f7e1fd70d2c39b308; Size is 245980; Max size: 100000000
2025-12-06 18:34:49,363 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres to files\706b1e045154934788d19e671c94fa971f98bef9e089cc90fbbd266ad96b165a; Size is 2684; Max size: 100000000
2025-12-06 18:34:49,363 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm to files\aa2b80e25f86de5cab4e6eb8b0f966cb2dc435e6b318ddf8a37c5fd82fb28569; Size is 32768; Max size: 100000000
2025-12-06 18:34:49,378 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal to files\94f3b19e7dde83183042afe2a240a4a8b7690c4db0e89be07bc77f143d27b3d1; Size is 45352; Max size: 100000000
2025-12-06 18:34:49,378 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db to files\c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6; Size is 4096; Max size: 100000000
2025-12-06 18:34:49,425 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1765080704639042700_C0284404-4C96-4C20-9901-21DB24609CF1.log to files\cd52d81e25f372e6fa4db2c0dfceb59862c1969cab17096da352b34950c973cc; Size is 20971520; Max size: 100000000
2025-12-06 18:34:49,535 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1765080704637629400_C0284404-4C96-4C20-9901-21DB24609CF1.log to files\0073f75858a9d68c311971fb69df47a16d7649c6a9f8b4bbe58b902f2ed6c36a; Size is 20971520; Max size: 100000000
2025-12-06 18:34:49,613 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16924_20150-20251206T2011440910-2160.etl to files\66767b7a9e70b87de0449ef125edbd92f709e013136e321035845fb5e94aae66; Size is 40960; Max size: 100000000
2025-12-06 18:34:49,629 [root] WARNING: Folder at path "C:\UMqzgRcss\debugger" does not exist, skipping
2025-12-06 18:34:49,629 [root] WARNING: Folder at path "C:\UMqzgRcss\tlsdump" does not exist, skipping
2025-12-06 18:34:49,629 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win10-64bit-tiny-3 | win10-64bit-tiny-3 | KVM | 2025-12-08 15:06:01 | 2025-12-08 15:09:15 |
| File Name |
49768fe73895b939.unknown
|
|---|---|
| File Type | SMTP mail, ASCII text |
| File Size | 20646 bytes |
| MD5 | fbe3cb4dfce740c3728c459b853e4249 |
| SHA1 | 400dbbcdc16baadb2509263a434c0294e91b1d1b |
| SHA256 | 49768fe73895b9394d5c16130de7f3d390faaaa7d78fc4323fad3ab3f0761508 [VT] [MWDB] [Bazaar] |
| SHA3-384 | b49ff34023f33667d31356ac5de14c10e285c25b9f7baf2dd990f5cbfe8ee9e79f2542ac955e5bf069772d5959fa565f |
| CRC32 | 984EE1F9 |
| TLSH | T13F92DF925C130EDD3BB35B973ED2E432D5B0C7C9A81B12BA5FAC2181188FFE075684A4 |
| Ssdeep | 384:vOFMo9f0nDsXD42crq1Hy1Sb2AAfNYx/F45IO5GWYekd3+iql3/8fyVcF:251HaI2AA1YxcIOlsN+iqlP8Z |
| File BinGraph Vba2Graph Text |
Return-Path: <> Delivered-To: banned-quarantine X-Envelope-From: <mobileapp@firstbank.ro> X-Envelope-To: <cteodorovici@electroputere.ro>, <ndunga@electroputere.ro>, <psabaila@electroputere.ro> X-Envelope-To-Blocked: <cteodorovici@electroputere.ro>, <ndunga@electroputere.ro>, <psabaila@electroputere.ro> X-Quarantine-ID: <zIox0GRx84Nt> X-Amavis-Alert: BANNED, message contains .exe,.exe-ms,Payment Advice swift mesaji.exe X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tag=x tag2=x kill=x tests=[] autolearn=unavailable Received: from unknown by localhost (amavisd-new, unix socket) id zIox0GRx84Nt; Wed, 23 Feb 2022 00:50:16 +0200 (EET) Received: from mail.needion.com (unknown [213.128.71.137]) by spin.electroputere.ro (amavisd-milter) with ESMTPS id 21MMo6hg000429; Tue, 22 Feb 2022 05:01:28 +0200 (envelope-from <mobileapp@firstbank.ro>) Received: from localhost (localhost [127.0.0.1]) by mail.needion.com (Postfix) with ESMTP id EB3524A7E69; Wed, 23 Feb 2022 01:13:25 +0300 (+03) Received: from mail.needion.com ([127.0.0.1]) by localhost (mail.needion.com [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id Qn9no5wseyi6; Wed, 23 Feb 2022 01:13:25 +0300 (+03) Received: from localhost (localhost [127.0.0.1]) by mail.needion.com (Postfix) with ESMTP id 8CCAB4A7E79; Wed, 23 Feb 2022 01:13:25 +0300 (+03) X-Virus-Scanned: amavisd-new at needion.com Received: from mail.needion.com ([127.0.0.1]) by localhost (mail.needion.com [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id ZbKz9EzOw07f; Wed, 23 Feb 2022 01:13:25 +0300 (+03) Received: from zico.vvgcbdsales.example.com (unknown [87.249.139.161]) by mail.needion.com (Postfix) with ESMTPSA id A81AE4A7E69; Wed, 23 Feb 2022 01:13:23 +0300 (+03) Content-Type: multipart/mixed; boundary="===============1055680849==" MIME-Version: 1.0 Subject: Confirmare OP ALL NUTS. To: "mobileapp.firstbank" <mobileapp@firstbank.ro> From: mobileapp.firstbank<mobileapp@firstbank.ro> Date: Tue, 22 Feb 2022 14:45:51 -0800 Reply-To: asafbulutgunes@gmail.com Message-Id: <20220222221323.A81AE4A7E69@mail.needion.com> You will not see this in a MIME-aware mail reader. --===============1055680849== Content-Type: multipart/alternative; boundary="===============0533200053==" MIME-Version: 1.0 --===============0533200053== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Description: Mail message body Drag=103 client, Acesta este un mail automat generat de sistemul Internet/Mobile Banking Fi= rst Bank trimis de clientul: ALL NUTS SRL Mesaj: = Toate cele bune, First Bank --===============0533200053== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Description: Mail message body <HTML><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset= =3Dutf-8"/></head><BODY><P>Drag=C4=83 client,</P> <P>Acesta este un mail automat generat de sistemul Internet/Mobile Banking = First Bank trimis de clientul: ALL NUTS SRL</P> <P>Mesaj:</P> <P><BR>Toate cele bune,</P> <P>First Bank</P></BODY></HTML> --===============0533200053==-- --===============1055680849== Content-Type: application/octet-stream MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="Payment Advice swift mesaji.uue" UmFyIRoHAQATrjD8CwEFBwAGAQH14oAAP/XZZj0CAwuj4gAEgOgBIIleVsyAAwAfUGF5bWVudCBB ZHZpY2Ugc3dpZnQgbWVzYWppLmV4ZQoDAnRt5W7PJ9gBzbkfMUB2VEQiRlcASIerLNKOoQRFRQR0 igiaVRUBQQVMRUUB2YtgWoKBYmx1CiIqKgg6DQ6BcBFcf4AKiooo4uK4rjtxxzHR7mn1xfVxXFSq i6qznJqrsuwsfc97Hfe/Y+9jsdiO//oK0TM8nmiZ5PJ5PKko/F5mfJmfJmfJmfnz555MzU3RVGiC IAsiCD8Bw2PmikZRRS6PJhhpSlIcYAo33Eoc2Rp41kK4Ng6dvpUT8HSBhoeNaouMTZaMSRLVCJIq KTRzVBpWqMj4pqhw/XvEQDVEpoVK32OxsVxUiT++Gj8iAysLMb2cVDfiKXEVhROBwzGuRNx3nQ1a lRusAh5riB7URdN1ToT6iB2wEsnsx/6rd1HCi6QRvEKR2hsatUr0JpYjmIEG0Ff6PAmjCo3YRl4Q 3dvjkslHESjKgEOq5XRWyjfGRsZCFKTYROY85Z1cLoT2AAGliE0IgdCHo8UjKv0vRSjnTOhuMIfW y8Uy3Aa/CyoKikRov8FzN2/pcMjgFcWpCsYymwRYXw6rptXzW5szE2ml2a1xsFPLEVdjS2OAAoI7 hqIeNloJRleFeuY9Co0LHTFcowREWmtJKAPOwGxnNtpTWondstY9bncEBXdMA2WwZTY0KSWAyEv6 AKtlDuvD5IgOVWYc9IUPVs4zLZbRCRl3EbbLcnZWVM0j2jiUTEvpmolI+moeAmZZV+06ggsXJmbF 4UbbRNbyBxkNbCJOgOAkxuhGokZAEHVrNU1wJ0uJrG3JO1YdoXV5MKIxMXVu9YUX0RoA4ym1Wnto 2XQhtlRbiWjYRLq/YW0pgOAIATerPXxQFNl1ITN2INswU8evsE/YimFM2jLsbMyLrbjrAxrs+yAf hjAsbjVkXwnGBtvTGvsYA2RhYwDV3IZhmNWxvJTAHrA3WcJ4LDxC1o3E5ZGJtu1WWnGhVh1ONTDu XMAdRkrtWWAZFCNDYWAk9LAPYX22NirL7lzU+BRD0uFXw1XjZngtbLrKWFs25rKjG8S96ooRcPT4 mvA9I1wTgPEoQGgHrEA9sN2QVpYTVfPExYHT1XwV9KEkXZVTsBtRm8APriebbFxtjGvWxyGRHCZA rhGbAwV4D5noK7RHUcISDo3uDe5uDm43xOAbiDn3Cde4Z6rIUa60QmUuEBHRkPFZaNUT8hLeFGv7 hBQBT9Yz2MXDBwT69muRGW9o071EJoNBfwJ3UWMtG0RWAhbe9E5iwITycjyePxEshStNsyCKVNtr ymjXFPdQX1GdgDdUK5h14OtjRmzjol5espVEK3gr4or8unEquGyFNvrT06fup2RP+SK8DWSZ1wZ8 y3rmVRmjGv9I5wqI2fwjTpF9ROeUomGXThiKl0XiOdiJWcfOiIYqZdih641duY0t6RS6M4+w2mAI GZ6S6zr5pvClETLoVwcaMo2fBeIKv9jyYtpUEocUdZQ1OPKvGzfHlq8L9XLSiNDjkCNnFEu1cxh5 3vWUekH1xKHi9949VAxImNdKVWfj7+WYrmo8SvvNZJuC+bhGbY9e5a8bGEjF//g5jxobECtr7UbM AvFeQq1j1vxVuRP4t3xWqK9CNrRABHnydGz+4TKnEobZwrBI7mNH6zszi6bH+3m1hwyO7GtObgrS Lt4Nco1rAsQ51lTcxxtCrpV1zNaY7PSKdTX7Tc9wp3NfAbdawty/gUS4V6lcaOPibdUzliZD1Vui OwAv4OARwQK2oerEVdU4J+cTrfE7ynfU+JT45OkNbQB2z/PMqLJp9KeL2+NbWVxVF5ai/gatRWgO vpK2CO7AZVEeiItoFv6rEa+TrIFOAGCJ1X72nRM69gCrei1C7gytmVClQRzIL+SA2Im1GEnVFc0r MDM65di1AivCKWq24ItOB1UW/RzagEe52re+vbIQQIeowOqiwpRK4MR84evAXuiVPFdde6o0txXu 0GAgSfABsRZdf8QzOSX/OV0BOfqK/M872qRXEpdRAfM2VrVxvBjmRRB1ZCkprbCtEnuBWoTtptcy uCa34rjJ8CV0U4FfaOYA+fyB1hCmURMD/PChjSsOuPpVAU6o4c2ypQflAuHEwJIcThr9BuQk/cuX MMuxnit2V5iveGFEYXiXSZ8hXuYlHhAXc0y7hjn9isUPVwX8YiJSgDUFgHucMQMbAtSqgDzsQza6 Dv0ZiYCr+jPZe31fPZFVXFjRMpO1bm+kjU+RMJvPrx1dsMmhY+ISvAJSTjY5LEt77iComNhE0ZEQ 8GVAw0YlSQo0MVCB4poqHzSUJGDSx2GD9hkyghUuVSBXcc+xQVaQAolAy8VIJswHbFR8VHQ8SlgZ OLS4QJ+FAfCVsSTggFaJUzMaaZPGQ4eSaRgI6TGW/hRAKkbGrE1lhC2HSRKATBQ4TJ8iASwkfGQ4 BQa0jgrZNEEG1QxRcCJtQCqFcKvMP2NTKACUVS0Dx6SACKeYuLBLUIkA+gI+AfI6OHI9nz+MSweK CuIsJ2NPH+s88CFjSODs+QoGJNGPQGXkY1JBgbwD6knICBeT7OjyAtAcoOPGawIJ1ixP5GAK0UHQ QSvRYOPh1iSqCgVrCpVaeewMzH5YEcxmHAvYIC+jFtSEKK03WzdLJm8XDxsOo8XmNAaiQmZOBCqW 88BtAJ+JSRmYVqKBCSFtfBBoXCWRTLFAqqhutYsDtATQH0WlIBiisrD5aPjCW31pTAgRsIE1F1qk PtKn1rikod5I/xjVpXoKNIWPhI5bFvFyYTWWhlvRAOJIqTVqBBb4fPh4QYFYK21e6Udi0kRH1ZIH 9X/LRMlExMi3pZIh2CI7IsUf4rLKcJw9Q9Dq0wpGN6FlU+hjoxXChC7CfSgGAxNwS8RcvW1+qusf GvTiJHB+HT2lIrql7+GBGFPSYK1Sj3gRLmAFLpQTgE+K/h7AmyeJ+DtGRglspmawzatdRVOYMHSg JyHzSjxAzuVAloQ+ZPwun0K7TFIYaH+YT0TBgnU6oY7QYOkZHKpiLCjBH58iAAWksWQ3yDEiFdAh cDcgH5MCMFj58gnYh+sUrJaSBgrgwexkhDhKf0wBaOrJtUh8K3FKjepxNCm8D6pidT+ykLvcOFbR SYPIBKNKFldC34CN4WNrGfaNrd5o4CSKFFJdV2mVE9XadSfoJh7SZeMkm9CwvDnCtRN8Yq8UMdoF LIqODzPoLlYdaiqpaHg8Bs6PUmBCNJZoa/wUQCIJiQZzU3EIrYeYzLR4H0A/AScRB5cLzyo7eHCj KPSvFD4Dbp7Pb9yiXlT2lnMx4CxHKcB9AwKARGJJM+tFOG6UB1Mm+AHAU/x0mQ5Kb/Q5QmCEKiQz 5lXC8Bm2GoqLByQFng+IUqQqGCux/BzcTCGCrZgSo8qMUKUQQFy9nzqQ+tSrA/VacCLcpvoYaSOE XARrfSgHkg9QohZvHqAcjTxdjB80ghWLrB9AMJD64SDLhk6BLRoz98ByPuZV5KdSnQpyHzvQ+LkM twHqoAkuJqQMBS3lRl1NQrW9j1cquuhqSuADD+KPAHJIeQ/JESzLiZUJkqy4oSEgPMYJah1KtIS4 g830SM6B6SHMmRHl5ex88uIYkhrH8e6ZQkriOOUqcJ3FVdTEstQh/mVvmTruLznsI+fR5NxUfnKW fkFLrUiRMKMNabXh8GNjJKshOi4EtcDxsh87Eo2AAS8Uoc6v1clJZhCRZ5TSh+6BfKGVqLGPYndf YFyzvtnwwOVmz4mrNYIdALT1kDsuNDRbWgHjAnbG1LzRZAotgE/sxmhAtq8H4vkF6jEkAKSm3P67 ohGPYS/CmYWEBUs8FZLaFfMzBYQ64ZhD9HzUGJTwSeCXFwHN+BcjVjRn9cSnghRwA0UFMCGGBgRg KqUPwhlsMvkR0HZdBFWeHJ0ZT0O9Af1h4mayOLtTp4tKjXwCDzDp2UHS6wnKISXAzg+B5PJSdIcb GwiQ+TKusI0o9BoTmHNgDaJCE9rcOi1ArjNjIxJFhnlnyShEpMt/Aww51REINgJo7dzNLfjgdHaW SapGHjoZqkEwMLzUkjY2HF1eRzU8g5SBRqvHh2ymjFjnnDvb5jWp+fsCEuwp19CvQ83dO6qsvo1N kJdWpycHFyu4dHJyalaqbxHSIasUQFGh2Sg4upBLChAbd1CvriAcSuDrC3twu+VCqDo6OTnB3dJe sq63e8h4BOOYUkJCOcKgYgHZvcW9zb3V0dTjBp7W34d8gVTg7bkMus7jrtBYKyMtZRPYI3i4hJJi 7n7MSqaqyhanQNG5Dh5Do51tpab4EMs0HUMvoA1loiTFnUhVVI9R8PEBkNmFxvTe4E/AhzAFXC4a HhACAFMrHN4OewY+QryPhQNo3nulQRbQaGAce8PlgdeVkxAD0iEouY0HZQB6wCPbipHwLtKog+4J r1Oj+/JIffVDzEV0/CrxPyuNzUpfXagU2I6IHoJhDM6O4FUeCVwO+Ew/x4N6kJhUoJdDMNgGoO93 tJeYS83pxvjm6BdWvlwWhOn5PhVMCjRXiY395eyfvBKrXFmrcveuhu3RUxeijppnRR4ZPAgjl8kk pHF6ekkqVvhYiIPozLkAlgCv/LOF0kDfArflLJVwIFUG6YYTUoznOUHvWgF8mnaxZyN/bSVajPjP +UHUFaVQjp7vVOV9P+RVcqIjrNIq4Y0JihR15P72wJ6e8J+q8p/FhTenP <truncated>
| Credential Access | Discovery | Defense Evasion | Privilege Escalation | Execution |
|
|
|
|
|---|
No hosts contacted.
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP