| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-08 13:51:40 | 2025-12-08 13:54:55 | 195 seconds | Show Options | Show Analysis Log | 1.5 |
vnc_port=5902
2025-12-06 18:31:41,911 [root] INFO: Date set to: 20251208T05:51:39, timeout set to: 180 2025-12-06 18:31:41,911 [root] DEBUG: Starting analyzer from: C:\tmpf1jb72zr 2025-12-06 18:31:41,911 [root] DEBUG: Storing results at: C:\ifoGryYeiD 2025-12-06 18:31:41,911 [root] DEBUG: Pipe server name: \\.\PIPE\UkWqzo 2025-12-06 18:31:41,911 [root] DEBUG: Python path: C:\Python38 2025-12-06 18:31:41,911 [root] INFO: analysis running as a normal user 2025-12-06 18:31:41,911 [root] DEBUG: no analysis package configured, picking one for you 2025-12-06 18:31:41,911 [root] INFO: analysis package selected: "generic" 2025-12-06 18:31:41,911 [root] DEBUG: importing analysis package module: "modules.packages.generic"... 2025-12-06 18:31:41,926 [root] DEBUG: imported analysis package "generic" 2025-12-06 18:31:41,926 [root] DEBUG: initializing analysis package "generic"... 2025-12-06 18:31:41,926 [lib.common.common] INFO: wrapping 2025-12-06 18:31:41,926 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-06 18:31:41,926 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\snac.log 2025-12-06 18:31:41,926 [root] INFO: Analyzer: Package modules.packages.generic does not specify a DLL option 2025-12-06 18:31:41,926 [root] INFO: Analyzer: Package modules.packages.generic does not specify a DLL_64 option 2025-12-06 18:31:41,926 [root] INFO: Analyzer: Package modules.packages.generic does not specify a loader option 2025-12-06 18:31:41,926 [root] INFO: Analyzer: Package modules.packages.generic does not specify a loader_64 option 2025-12-06 18:31:41,957 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-12-06 18:31:41,957 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain" 2025-12-06 18:31:41,957 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-12-06 18:31:41,957 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script" 2025-12-06 18:31:41,957 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks" 2025-12-06 18:31:41,957 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx" 2025-12-06 18:31:41,973 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-12-06 18:31:41,973 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script" 2025-12-06 18:31:41,973 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-12-06 18:31:41,989 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2025-12-06 18:31:41,989 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2025-12-06 18:31:42,004 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-12-06 18:31:42,004 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon" 2025-12-06 18:31:42,004 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-12-06 18:31:42,004 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage" 2025-12-06 18:31:42,004 [root] DEBUG: Initialized auxiliary module "Browser" 2025-12-06 18:31:42,004 [root] DEBUG: attempting to configure 'Browser' from data 2025-12-06 18:31:42,004 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-12-06 18:31:42,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-12-06 18:31:42,004 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-12-06 18:31:42,004 [root] DEBUG: Initialized auxiliary module "Curtain" 2025-12-06 18:31:42,004 [root] DEBUG: attempting to configure 'Curtain' from data 2025-12-06 18:31:42,004 [root] DEBUG: module Curtain does not support data configuration, ignoring 2025-12-06 18:31:42,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"... 2025-12-06 18:31:42,004 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain 2025-12-06 18:31:42,004 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-12-06 18:31:42,004 [root] DEBUG: attempting to configure 'Disguise' from data 2025-12-06 18:31:42,004 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-12-06 18:31:42,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-12-06 18:31:42,004 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.disguise: [WinError 5] Access is denied 2025-12-06 18:31:42,004 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks" 2025-12-06 18:31:42,004 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data 2025-12-06 18:31:42,004 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring 2025-12-06 18:31:42,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"... 2025-12-06 18:31:42,004 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe 2025-12-06 18:31:42,004 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks 2025-12-06 18:31:42,004 [root] DEBUG: Initialized auxiliary module "Evtx" 2025-12-06 18:31:42,004 [root] DEBUG: attempting to configure 'Evtx' from data 2025-12-06 18:31:42,004 [root] DEBUG: module Evtx does not support data configuration, ignoring 2025-12-06 18:31:42,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"... 2025-12-06 18:31:42,004 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable 2025-12-06 18:31:42,004 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx 2025-12-06 18:31:42,004 [root] DEBUG: Initialized auxiliary module "Human" 2025-12-06 18:31:42,004 [root] DEBUG: attempting to configure 'Human' from data 2025-12-06 18:31:42,004 [root] DEBUG: module Human does not support data configuration, ignoring 2025-12-06 18:31:42,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-12-06 18:31:42,020 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-12-06 18:31:42,020 [root] DEBUG: Initialized auxiliary module "Pre_script" 2025-12-06 18:31:42,020 [root] DEBUG: attempting to configure 'Pre_script' from data 2025-12-06 18:31:42,020 [root] DEBUG: module Pre_script does not support data configuration, ignoring 2025-12-06 18:31:42,020 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"... 2025-12-06 18:31:42,020 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script 2025-12-06 18:31:42,020 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-12-06 18:31:42,020 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-12-06 18:31:42,020 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-12-06 18:31:42,020 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-12-06 18:31:42,020 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-12-06 18:31:42,020 [root] DEBUG: Initialized auxiliary module "Sysmon" 2025-12-06 18:31:42,020 [root] DEBUG: attempting to configure 'Sysmon' from data 2025-12-06 18:31:42,020 [root] DEBUG: module Sysmon does not support data configuration, ignoring 2025-12-06 18:31:42,020 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"... 2025-12-06 18:31:42,114 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable 2025-12-06 18:31:42,160 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe 2025-12-06 18:31:42,176 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques. 2025-12-06 18:31:42,176 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-12-06 18:31:42,176 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-12-06 18:31:42,176 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-12-06 18:31:42,176 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-12-06 18:31:42,176 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 668 2025-12-06 18:31:42,176 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:42,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable 2025-12-06 18:31:42,176 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:42,176 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:42,176 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:42,176 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:42,176 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:42,176 [lib.api.process] DEBUG: Failed getting exit code for <Process 668 ???> 2025-12-06 18:31:42,176 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:42,176 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:42,176 [lib.api.process] WARNING: failed to open process 668 2025-12-06 18:31:42,176 [lib.api.process] DEBUG: Failed getting image name for pid 668 2025-12-06 18:31:42,176 [lib.api.process] WARNING: the <Process 668 ???> is not alive, injection aborted 2025-12-06 18:31:42,176 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2025-12-06 18:31:42,176 [root] DEBUG: Initialized auxiliary module "Usage" 2025-12-06 18:31:42,176 [root] DEBUG: attempting to configure 'Usage' from data 2025-12-06 18:31:42,176 [root] DEBUG: module Usage does not support data configuration, ignoring 2025-12-06 18:31:42,176 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"... 2025-12-06 18:31:42,176 [root] DEBUG: Started auxiliary module modules.auxiliary.usage 2025-12-06 18:31:42,176 [root] DEBUG: Initialized auxiliary module "During_script" 2025-12-06 18:31:42,176 [root] DEBUG: attempting to configure 'During_script' from data 2025-12-06 18:31:42,176 [root] DEBUG: module During_script does not support data configuration, ignoring 2025-12-06 18:31:42,176 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"... 2025-12-06 18:31:42,176 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script 2025-12-06 18:31:42,223 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable 2025-12-06 18:31:42,239 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe 2025-12-06 18:31:42,286 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable 2025-12-06 18:31:42,348 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe 2025-12-06 18:31:42,348 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable 2025-12-06 18:31:42,442 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable 2025-12-06 18:31:42,457 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe 2025-12-06 18:31:42,504 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable 2025-12-06 18:31:42,536 [root] INFO: Restarting WMI Service 2025-12-06 18:31:42,551 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable 2025-12-06 18:31:42,598 [root] DEBUG: package modules.packages.generic does not support configure, ignoring 2025-12-06 18:31:42,598 [root] WARNING: configuration error for package modules.packages.generic: error importing data.packages.generic: No module named 'data.packages' 2025-12-06 18:31:42,598 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-06 18:31:42,598 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c start /wait "" "C:\Users\user\AppData\Local\Temp\snac.log"" with pid 792 2025-12-06 18:31:42,598 [lib.api.process] INFO: Monitor config for <Process 792 cmd.exe>: C:\tmpf1jb72zr\dll\792.ini 2025-12-06 18:31:42,598 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable 2025-12-06 18:31:42,598 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpf1jb72zr\dll\TcgDtPh.dll, loader C:\tmpf1jb72zr\bin\vIRoSCH.exe 2025-12-06 18:31:42,614 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2025-12-06 18:31:42,629 [root] DEBUG: Loader: Injecting process 792 (thread 5064) with C:\tmpf1jb72zr\dll\TcgDtPh.dll. 2025-12-06 18:31:42,629 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-06 18:31:42,629 [root] DEBUG: Successfully injected DLL C:\tmpf1jb72zr\dll\TcgDtPh.dll. 2025-12-06 18:31:42,629 [lib.api.process] INFO: Injected into 32-bit <Process 792 cmd.exe> 2025-12-06 18:31:42,696 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable 2025-12-06 18:31:42,707 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f 2025-12-06 18:31:42,739 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable 2025-12-06 18:31:42,754 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 1: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f 2025-12-06 18:31:42,770 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable 2025-12-06 18:31:42,817 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable 2025-12-06 18:31:42,848 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable 2025-12-06 18:31:42,879 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable 2025-12-06 18:31:42,942 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable 2025-12-06 18:31:42,973 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable 2025-12-06 18:31:43,004 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable 2025-12-06 18:31:43,051 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable 2025-12-06 18:31:43,082 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable 2025-12-06 18:31:43,145 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable 2025-12-06 18:31:43,176 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable 2025-12-06 18:31:43,223 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable 2025-12-06 18:31:43,254 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable 2025-12-06 18:31:43,301 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable 2025-12-06 18:31:43,332 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable 2025-12-06 18:31:43,379 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable 2025-12-06 18:31:43,411 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable 2025-12-06 18:31:43,457 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable 2025-12-06 18:31:43,488 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable 2025-12-06 18:31:43,520 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable 2025-12-06 18:31:43,551 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable 2025-12-06 18:31:43,598 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable 2025-12-06 18:31:43,629 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable 2025-12-06 18:31:43,661 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable 2025-12-06 18:31:43,708 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable 2025-12-06 18:31:43,739 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable 2025-12-06 18:31:43,770 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable 2025-12-06 18:31:43,817 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable 2025-12-06 18:31:43,848 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable 2025-12-06 18:31:43,926 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable 2025-12-06 18:31:43,957 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable 2025-12-06 18:31:43,989 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable 2025-12-06 18:31:44,036 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable 2025-12-06 18:31:44,067 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable 2025-12-06 18:31:44,149 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable 2025-12-06 18:31:44,192 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable 2025-12-06 18:31:44,223 [modules.auxiliary.evtx] DEBUG: Wiping Application 2025-12-06 18:31:44,254 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents 2025-12-06 18:31:44,301 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer 2025-12-06 18:31:44,332 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service 2025-12-06 18:31:44,364 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts 2025-12-06 18:31:44,411 [modules.auxiliary.evtx] DEBUG: Wiping Security 2025-12-06 18:31:44,458 [modules.auxiliary.evtx] DEBUG: Wiping Setup 2025-12-06 18:31:44,489 [modules.auxiliary.evtx] DEBUG: Wiping System 2025-12-06 18:31:44,520 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell 2025-12-06 18:31:44,551 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational 2025-12-06 18:31:44,645 [lib.api.process] INFO: Successfully resumed <Process 792 cmd.exe> 2025-12-06 18:31:44,756 [root] DEBUG: 792: Python path set to 'C:\Python38'. 2025-12-06 18:31:44,756 [root] INFO: Disabling sleep skipping. 2025-12-06 18:31:44,756 [root] DEBUG: 792: Dropped file limit defaulting to 100. 2025-12-06 18:31:44,756 [root] DEBUG: 792: YaraInit: Compiled 41 rule files 2025-12-06 18:31:44,756 [root] DEBUG: 792: YaraInit: Compiled rules saved to file C:\tmpf1jb72zr\data\yara\capemon.yac 2025-12-06 18:31:44,770 [root] DEBUG: 792: YaraScan: Scanning 0x00B00000, size 0x595ee 2025-12-06 18:31:44,770 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied. 2025-12-06 18:31:44,770 [root] DEBUG: 792: Monitor initialised: 32-bit capemon loaded in process 792 at 0x73630000, thread 5064, image base 0xb00000, stack from 0x3043000-0x3140000 2025-12-06 18:31:44,770 [root] DEBUG: 792: Commandline: "C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\user\AppData\Local\Temp\snac.log" 2025-12-06 18:31:44,770 [root] DEBUG: 792: GetAddressByYara: ModuleBase 0x77210000 FunctionName LdrpCallInitRoutine 2025-12-06 18:31:44,785 [root] DEBUG: 792: hook_api: LdrpCallInitRoutine export address 0x77282A30 obtained via GetFunctionAddress 2025-12-06 18:31:44,785 [root] DEBUG: 792: hook_api: Warning - CreateRemoteThreadEx export address 0x76BD866C differs from GetProcAddress -> 0x770F7630 (KERNELBASE.dll::0x137630) 2025-12-06 18:31:44,785 [root] DEBUG: 792: hook_api: Warning - CoCreateInstance export address 0x762B569D differs from GetProcAddress -> 0x769995D0 (combase.dll::0xd95d0) 2025-12-06 18:31:44,785 [root] DEBUG: 792: hook_api: Warning - CoCreateInstanceEx export address 0x762B56DC differs from GetProcAddress -> 0x7697C540 (combase.dll::0xbc540) 2025-12-06 18:31:44,785 [root] DEBUG: 792: hook_api: Warning - CoGetClassObject export address 0x762B5C6C differs from GetProcAddress -> 0x769651A0 (combase.dll::0xa51a0) 2025-12-06 18:31:44,785 [root] DEBUG: 792: hook_api: Warning - UpdateProcThreadAttribute export address 0x76BDFFD2 differs from GetProcAddress -> 0x770C47B0 (KERNELBASE.dll::0x1047b0) 2025-12-06 18:31:44,801 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-06 18:31:44,801 [root] DEBUG: 792: set_hooks: Unable to hook GetCommandLineA 2025-12-06 18:31:44,801 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-06 18:31:44,801 [root] DEBUG: 792: set_hooks: Unable to hook GetCommandLineW 2025-12-06 18:31:44,801 [root] DEBUG: 792: hook_api: Warning - CLSIDFromProgID export address 0x762B4ED6 differs from GetProcAddress -> 0x769316A0 (combase.dll::0x716a0) 2025-12-06 18:31:44,801 [root] DEBUG: 792: hook_api: Warning - CLSIDFromProgIDEx export address 0x762B4F13 differs from GetProcAddress -> 0x76930500 (combase.dll::0x70500) 2025-12-06 18:31:44,801 [root] DEBUG: 792: Hooked 611 out of 613 functions 2025-12-06 18:31:44,801 [root] DEBUG: 792: Syscall hook installed, syscall logging level 1 2025-12-06 18:31:44,801 [root] DEBUG: 792: WoW64fix: Windows version 10.0 not supported. 2025-12-06 18:31:44,801 [root] INFO: Loaded monitor into process with pid 792 2025-12-06 18:31:44,801 [root] DEBUG: 792: caller_dispatch: Added region at 0x00B00000 to tracked regions list (ntdll::memcpy returns to 0x00B168FA, thread 5064). 2025-12-06 18:31:44,801 [root] DEBUG: 792: YaraScan: Scanning 0x00B00000, size 0x595ee 2025-12-06 18:31:44,801 [root] DEBUG: 792: ProcessImageBase: Main module image at 0x00B00000 unmodified (entropy change 0.000000e+00) 2025-12-06 18:31:44,817 [root] DEBUG: 792: InstrumentationCallback: Added region at 0x76FC0000 to tracked regions list (thread 5064). 2025-12-06 18:31:44,817 [root] DEBUG: 792: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-06 18:31:44,817 [root] DEBUG: 792: DLL loaded at 0x74EC0000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes). 2025-12-06 18:31:44,817 [root] DEBUG: 792: DLL loaded at 0x75CF0000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes). 2025-12-06 18:31:44,832 [root] DEBUG: 792: DLL loaded at 0x74CE0000: C:\Windows\system32\uxtheme (0x74000 bytes). 2025-12-06 18:31:44,832 [root] DEBUG: 792: DLL loaded at 0x75410000: C:\Windows\System32\shell32 (0x5b6000 bytes). 2025-12-06 18:31:44,832 [root] DEBUG: 792: InstrumentationCallback: Added region at 0x76B40000 to tracked regions list (thread 5064). 2025-12-06 18:31:44,848 [root] DEBUG: 792: DLL loaded at 0x73980000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\comctl32 (0x210000 bytes). 2025-12-06 18:31:44,848 [root] DEBUG: 792: DLL loaded at 0x75F50000: C:\Windows\System32\SHCORE (0x87000 bytes). 2025-12-06 18:31:44,864 [root] DEBUG: 792: DLL loaded at 0x74680000: C:\Windows\System32\Wldp (0x25000 bytes). 2025-12-06 18:31:44,864 [root] DEBUG: 792: DLL loaded at 0x746B0000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes). 2025-12-06 18:31:44,864 [root] DEBUG: 792: DLL loaded at 0x73EE0000: C:\Windows\System32\PROPSYS (0xc2000 bytes). 2025-12-06 18:31:44,864 [root] DEBUG: 792: DLL loaded at 0x762F0000: C:\Windows\System32\OLEAUT32 (0x96000 bytes). 2025-12-06 18:31:44,879 [root] DEBUG: 792: DLL loaded at 0x75C70000: C:\Windows\System32\clbcatq (0x7e000 bytes). 2025-12-06 18:31:44,879 [root] DEBUG: 792: DLL loaded at 0x74CC0000: C:\Windows\System32\profapi (0x18000 bytes). 2025-12-06 18:31:44,910 [root] DEBUG: 792: DLL loaded at 0x75EB0000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes). 2025-12-06 18:31:44,910 [root] DEBUG: 792: DLL loaded at 0x74520000: C:\Windows\System32\edputil (0x1b000 bytes). 2025-12-06 18:31:44,910 [root] DEBUG: 792: api-rate-cap: memcpy hook disabled due to rate 2025-12-06 18:31:44,926 [root] DEBUG: 792: DLL loaded at 0x73590000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes). 2025-12-06 18:31:44,957 [root] DEBUG: 792: DLL loaded at 0x72D70000: C:\Windows\System32\iertutil (0x22d000 bytes). 2025-12-06 18:31:44,957 [root] DEBUG: 792: DLL loaded at 0x74500000: C:\Windows\System32\srvcli (0x1d000 bytes). 2025-12-06 18:31:44,957 [root] DEBUG: 792: DLL loaded at 0x73EC0000: C:\Windows\System32\netutils (0xb000 bytes). 2025-12-06 18:31:44,957 [root] DEBUG: 792: DLL loaded at 0x72FA0000: C:\Windows\System32\urlmon (0x1a8000 bytes). 2025-12-06 18:31:44,973 [root] DEBUG: 792: DLL loaded at 0x73910000: C:\Windows\System32\msvcp110_win (0x65000 bytes). 2025-12-06 18:31:44,973 [root] DEBUG: 792: DLL loaded at 0x73450000: C:\Windows\SYSTEM32\policymanager (0x85000 bytes). 2025-12-06 18:31:44,989 [root] DEBUG: 792: DLL loaded at 0x73EA0000: C:\Windows\SYSTEM32\FLTLIB (0x8000 bytes). 2025-12-06 18:31:44,989 [root] DEBUG: 792: DLL loaded at 0x73EB0000: C:\Windows\SYSTEM32\virtdisk (0xf000 bytes). 2025-12-06 18:31:44,989 [root] DEBUG: 792: DLL loaded at 0x72C90000: C:\Windows\System32\wintypes (0xdb000 bytes). 2025-12-06 18:31:45,004 [root] DEBUG: 792: DLL loaded at 0x73540000: C:\Windows\System32\Bcp47Langs (0x48000 bytes). 2025-12-06 18:31:45,004 [root] DEBUG: 792: DLL loaded at 0x73520000: C:\Windows\System32\sppc (0x1c000 bytes). 2025-12-06 18:31:45,004 [root] DEBUG: 792: DLL loaded at 0x73E60000: C:\Windows\System32\SLC (0x1f000 bytes). 2025-12-06 18:31:45,020 [root] DEBUG: 792: DLL loaded at 0x72BE0000: C:\Windows\System32\USERENV (0x25000 bytes). 2025-12-06 18:31:45,020 [root] DEBUG: 792: DLL loaded at 0x72C10000: C:\Windows\System32\appresolver (0x71000 bytes). 2025-12-06 18:31:45,020 [root] DEBUG: 792: DLL loaded at 0x72BA0000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes). 2025-12-06 18:31:45,051 [root] DEBUG: 792: DLL loaded at 0x727E0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes). 2025-12-06 18:31:45,051 [lib.api.process] WARNING: failed to open process 796 2025-12-06 18:31:45,051 [lib.api.process] WARNING: failed to open process 796 2025-12-06 18:31:45,051 [lib.api.process] WARNING: failed to open process 796 2025-12-06 18:31:45,051 [lib.api.process] DEBUG: Failed getting image name for pid 796 2025-12-06 18:31:45,051 [lib.api.process] WARNING: failed to open process 796 2025-12-06 18:31:45,051 [lib.api.process] DEBUG: Failed getting image name for pid 796 2025-12-06 18:31:45,051 [lib.api.process] DEBUG: Failed getting exit code for <Process 796 ???> 2025-12-06 18:31:45,051 [lib.api.process] WARNING: failed to open process 796 2025-12-06 18:31:45,051 [lib.api.process] DEBUG: Failed getting image name for pid 796 2025-12-06 18:31:45,051 [lib.api.process] WARNING: failed to open process 796 2025-12-06 18:31:45,051 [lib.api.process] DEBUG: Failed getting image name for pid 796 2025-12-06 18:31:45,051 [lib.api.process] WARNING: the <Process 796 ???> is not alive, injection aborted 2025-12-06 18:31:47,091 [root] DEBUG: 792: CreateProcessHandler: Injection info set for new process 364: C:\Windows\system32\NOTEPAD.EXE, ImageBase: 0x00D20000 2025-12-06 18:31:47,091 [root] INFO: Announced 32-bit process name: notepad.exe pid: 364 2025-12-06 18:31:47,091 [lib.api.process] INFO: Monitor config for <Process 364 notepad.exe>: C:\tmpf1jb72zr\dll\364.ini 2025-12-06 18:31:47,098 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpf1jb72zr\dll\TcgDtPh.dll, loader C:\tmpf1jb72zr\bin\vIRoSCH.exe 2025-12-06 18:31:47,098 [root] DEBUG: Loader: Injecting process 364 (thread 4348) with C:\tmpf1jb72zr\dll\TcgDtPh.dll. 2025-12-06 18:31:47,098 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-06 18:31:47,098 [root] DEBUG: Successfully injected DLL C:\tmpf1jb72zr\dll\TcgDtPh.dll. 2025-12-06 18:31:47,114 [lib.api.process] INFO: Injected into 32-bit <Process 364 notepad.exe> 2025-12-06 18:31:47,114 [root] DEBUG: 792: DLL loaded at 0x72760000: C:\Windows\System32\MPR (0x19000 bytes). 2025-12-06 18:31:47,131 [root] DEBUG: 792: DLL loaded at 0x72780000: C:\Windows\SYSTEM32\pcacli (0x11000 bytes). 2025-12-06 18:31:47,131 [root] DEBUG: 792: DLL loaded at 0x73900000: C:\Windows\System32\sfc_os (0x10000 bytes). 2025-12-06 18:31:47,145 [root] DEBUG: 364: Python path set to 'C:\Python38'. 2025-12-06 18:31:47,145 [root] INFO: Disabling sleep skipping. 2025-12-06 18:31:47,145 [root] DEBUG: 364: Dropped file limit defaulting to 100. 2025-12-06 18:31:47,145 [root] DEBUG: 364: YaraInit: Compiled rules loaded from existing file C:\tmpf1jb72zr\data\yara\capemon.yac 2025-12-06 18:31:47,145 [root] DEBUG: 364: YaraScan: Scanning 0x00D20000, size 0x2d426 2025-12-06 18:31:47,145 [root] DEBUG: Error 5 (0x5) - AmsiDumper: Is CAPE agent running elevated? Initialisation failed: Access is denied. 2025-12-06 18:31:47,145 [root] DEBUG: 364: Monitor initialised: 32-bit capemon loaded in process 364 at 0x73630000, thread 4348, image base 0xd20000, stack from 0x32f000-0x340000 2025-12-06 18:31:47,145 [root] DEBUG: 364: Commandline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Local\Temp\snac.log 2025-12-06 18:31:47,160 [root] DEBUG: 364: GetAddressByYara: ModuleBase 0x77210000 FunctionName LdrpCallInitRoutine 2025-12-06 18:31:47,160 [root] DEBUG: 364: hook_api: LdrpCallInitRoutine export address 0x77282A30 obtained via GetFunctionAddress 2025-12-06 18:31:47,160 [root] DEBUG: 364: hook_api: Warning - CreateRemoteThreadEx export address 0x76BD866C differs from GetProcAddress -> 0x770F7630 (KERNELBASE.dll::0x137630) 2025-12-06 18:31:47,160 [root] DEBUG: 364: hook_api: Warning - CoCreateInstance export address 0x762B569D differs from GetProcAddress -> 0x769995D0 (combase.dll::0xd95d0) 2025-12-06 18:31:47,160 [root] DEBUG: 364: hook_api: Warning - CoCreateInstanceEx export address 0x762B56DC differs from GetProcAddress -> 0x7697C540 (combase.dll::0xbc540) 2025-12-06 18:31:47,160 [root] DEBUG: 364: hook_api: Warning - CoGetClassObject export address 0x762B5C6C differs from GetProcAddress -> 0x769651A0 (combase.dll::0xa51a0) 2025-12-06 18:31:47,160 [root] DEBUG: 364: hook_api: Warning - UpdateProcThreadAttribute export address 0x76BDFFD2 differs from GetProcAddress -> 0x770C47B0 (KERNELBASE.dll::0x1047b0) 2025-12-06 18:31:47,160 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-06 18:31:47,160 [root] DEBUG: 364: set_hooks: Unable to hook GetCommandLineA 2025-12-06 18:31:47,160 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-06 18:31:47,176 [root] DEBUG: 364: set_hooks: Unable to hook GetCommandLineW 2025-12-06 18:31:47,176 [root] DEBUG: 364: hook_api: Warning - CLSIDFromProgID export address 0x762B4ED6 differs from GetProcAddress -> 0x769316A0 (combase.dll::0x716a0) 2025-12-06 18:31:47,176 [root] DEBUG: 364: hook_api: Warning - CLSIDFromProgIDEx export address 0x762B4F13 differs from GetProcAddress -> 0x76930500 (combase.dll::0x70500) 2025-12-06 18:31:47,176 [root] DEBUG: 364: Hooked 611 out of 613 functions 2025-12-06 18:31:47,176 [root] DEBUG: 364: Syscall hook installed, syscall logging level 1 2025-12-06 18:31:47,176 [root] DEBUG: 364: WoW64fix: Windows version 10.0 not supported. 2025-12-06 18:31:47,176 [root] INFO: Loaded monitor into process with pid 364 2025-12-06 18:31:47,176 [root] DEBUG: 364: InstrumentationCallback: Added region at 0x76B40000 to tracked regions list (thread 4348). 2025-12-06 18:31:47,176 [root] DEBUG: 364: caller_dispatch: Added region at 0x00D20000 to tracked regions list (ntdll::memcpy returns to 0x00D4166E, thread 4348). 2025-12-06 18:31:47,176 [root] DEBUG: 364: YaraScan: Scanning 0x00D20000, size 0x2d426 2025-12-06 18:31:47,176 [root] DEBUG: 364: ProcessImageBase: Main module image at 0x00D20000 unmodified (entropy change 0.000000e+00) 2025-12-06 18:31:47,176 [root] DEBUG: 364: DLL loaded at 0x75CF0000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes). 2025-12-06 18:31:47,192 [root] DEBUG: 364: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-06 18:31:47,192 [root] DEBUG: 364: DLL loaded at 0x74EC0000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes). 2025-12-06 18:31:47,192 [root] DEBUG: 364: DLL loaded at 0x74CE0000: C:\Windows\system32\uxtheme (0x74000 bytes). 2025-12-06 18:31:47,192 [root] DEBUG: 364: DLL loaded at 0x75C70000: C:\Windows\System32\clbcatq (0x7e000 bytes). 2025-12-06 18:31:47,207 [root] DEBUG: 364: DLL loaded at 0x726A0000: C:\Windows\System32\MrmCoreR (0xbe000 bytes). 2025-12-06 18:31:47,207 [root] DEBUG: 364: InstrumentationCallback: Added region at 0x76FC0000 to tracked regions list (thread 4348). 2025-12-06 18:31:47,207 [root] DEBUG: 364: api-rate-cap: memcpy hook disabled due to rate 2025-12-06 18:31:47,207 [root] DEBUG: 364: DLL loaded at 0x75410000: C:\Windows\System32\SHELL32 (0x5b6000 bytes). 2025-12-06 18:31:47,223 [root] DEBUG: 364: DLL loaded at 0x74680000: C:\Windows\System32\Wldp (0x25000 bytes). 2025-12-06 18:31:47,223 [root] DEBUG: 364: DLL loaded at 0x746B0000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes). 2025-12-06 18:31:47,223 [root] DEBUG: 364: DLL loaded at 0x762F0000: C:\Windows\System32\OLEAUT32 (0x96000 bytes). 2025-12-06 18:31:47,223 [root] DEBUG: 364: DLL loaded at 0x76060000: C:\Windows\System32\MSCTF (0xd4000 bytes). 2025-12-06 18:31:47,239 [root] DEBUG: 364: DLL loaded at 0x72600000: C:\Windows\System32\TextShaping (0x94000 bytes). 2025-12-06 18:31:47,254 [root] DEBUG: 364: DLL loaded at 0x72760000: C:\Windows\System32\MPR (0x19000 bytes). 2025-12-06 18:31:47,254 [root] DEBUG: 364: DLL loaded at 0x72C90000: C:\Windows\SYSTEM32\wintypes (0xdb000 bytes). 2025-12-06 18:31:47,254 [root] DEBUG: 364: DLL loaded at 0x72560000: C:\Windows\System32\efswrt (0x9b000 bytes). 2025-12-06 18:31:47,270 [root] DEBUG: 364: DLL loaded at 0x723C0000: C:\Windows\System32\twinapi.appcore (0x194000 bytes). 2025-12-06 18:31:47,285 [root] DEBUG: 364: DLL loaded at 0x72360000: C:\Windows\System32\oleacc (0x53000 bytes). 2025-12-06 18:31:47,348 [root] DEBUG: 364: DLL loaded at 0x71F50000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes). 2025-12-06 18:31:47,348 [root] DEBUG: 364: DLL loaded at 0x71F80000: C:\Windows\System32\CoreMessaging (0x9b000 bytes). 2025-12-06 18:31:47,348 [root] DEBUG: 364: DLL loaded at 0x72020000: C:\Windows\System32\CoreUIComponents (0x27e000 bytes). 2025-12-06 18:31:47,348 [root] DEBUG: 364: DLL loaded at 0x722A0000: C:\Windows\SYSTEM32\textinputframework (0xb9000 bytes). 2025-12-06 18:31:47,379 [root] DEBUG: 364: DLL loaded at 0x75BC0000: C:\Windows\System32\COMDLG32 (0xaf000 bytes). 2025-12-06 18:31:47,395 [root] DEBUG: 364: DLL loaded at 0x73EE0000: C:\Windows\System32\PROPSYS (0xc2000 bytes). 2025-12-06 18:31:47,676 [root] DEBUG: 364: DLL loaded at 0x73910000: C:\Windows\System32\msvcp110_win (0x65000 bytes). 2025-12-06 18:31:47,676 [root] DEBUG: 364: DLL loaded at 0x73450000: C:\Windows\SYSTEM32\policymanager (0x85000 bytes). 2025-12-06 18:31:47,676 [root] DEBUG: 364: DLL loaded at 0x75EB0000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes). 2025-12-06 18:31:47,723 [root] DEBUG: 364: DLL loaded at 0x74CC0000: C:\Windows\System32\profapi (0x18000 bytes). 2025-12-06 18:31:47,754 [root] DEBUG: 364: api-rate-cap: NtQueryValueKey hook disabled due to rate 2025-12-06 18:31:47,770 [root] DEBUG: 364: api-rate-cap: NtOpenKeyEx hook disabled due to rate 2025-12-06 18:31:47,770 [root] DEBUG: 364: api-rate-cap: RtlSetCurrentTransaction hook disabled due to rate 2025-12-06 18:31:47,785 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied. 2025-12-06 18:31:47,785 [root] DEBUG: 364: OpenProcessHandler: Injection info created for process 4460, handle 0x520: Error obtaining target process name 2025-12-06 18:34:45,411 [root] INFO: Analysis timeout hit, terminating analysis 2025-12-06 18:34:45,411 [lib.api.process] INFO: Terminate event set for <Process 792 cmd.exe> 2025-12-06 18:34:45,411 [root] DEBUG: 792: Terminate Event: Attempting to dump process 792 2025-12-06 18:34:45,411 [root] DEBUG: 792: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-06 18:34:45,411 [root] DEBUG: 792: Terminate Event: Current region empty 2025-12-06 18:34:45,411 [lib.api.process] INFO: Termination confirmed for <Process 792 cmd.exe> 2025-12-06 18:34:45,411 [root] DEBUG: 792: Terminate Event: CAPE shutdown complete for process 792 2025-12-06 18:34:45,411 [root] INFO: Terminate event set for process 792 2025-12-06 18:34:45,411 [lib.api.process] INFO: Terminate event set for <Process 364 notepad.exe> 2025-12-06 18:34:45,411 [root] DEBUG: 364: Terminate Event: Attempting to dump process 364 2025-12-06 18:34:45,411 [root] DEBUG: 364: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-06 18:34:45,411 [root] DEBUG: 364: Terminate Event: Current region empty 2025-12-06 18:34:45,411 [lib.api.process] INFO: Termination confirmed for <Process 364 notepad.exe> 2025-12-06 18:34:45,411 [root] INFO: Terminate event set for process 364 2025-12-06 18:34:45,411 [root] DEBUG: 364: Terminate Event: CAPE shutdown complete for process 364 2025-12-06 18:34:45,411 [root] INFO: Created shutdown mutex 2025-12-06 18:34:46,426 [root] INFO: Shutting down package 2025-12-06 18:34:46,426 [root] INFO: Stopping auxiliary modules 2025-12-06 18:34:46,426 [root] INFO: Stopping auxiliary module: Browser 2025-12-06 18:34:46,426 [root] INFO: Stopping auxiliary module: Curtain 2025-12-06 18:34:46,426 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [Errno 13] Permission denied: 'C:\\curtain.log' 2025-12-06 18:34:46,426 [modules.auxiliary.curtain] ERROR: Curtain log file not found! 2025-12-06 18:34:46,426 [root] INFO: Stopping auxiliary module: End_noisy_tasks 2025-12-06 18:34:46,426 [root] INFO: Stopping auxiliary module: Evtx 2025-12-06 18:34:46,426 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump 2025-12-06 18:34:46,426 [root] WARNING: Cannot terminate auxiliary module Evtx: [Errno 13] Permission denied: 'C:/windows/Sysnative/winevt/Logs\\Application.evtx' 2025-12-06 18:34:46,426 [root] INFO: Stopping auxiliary module: Human 2025-12-06 18:34:46,645 [root] INFO: Stopping auxiliary module: Pre_script 2025-12-06 18:34:46,645 [root] INFO: Stopping auxiliary module: Screenshots 2025-12-06 18:34:48,723 [root] INFO: Stopping auxiliary module: Usage 2025-12-06 18:34:49,520 [root] INFO: Stopping auxiliary module: During_script 2025-12-06 18:34:49,520 [root] INFO: Finishing auxiliary modules 2025-12-06 18:34:49,520 [root] INFO: Shutting down pipe server and dumping dropped files 2025-12-06 18:34:49,520 [root] WARNING: Folder at path "C:\ifoGryYeiD\debugger" does not exist, skipping 2025-12-06 18:34:49,520 [root] WARNING: Folder at path "C:\ifoGryYeiD\tlsdump" does not exist, skipping 2025-12-06 18:34:49,520 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win10-64bit-tiny-2 | win10-64bit-tiny-2 | KVM | 2025-12-08 13:51:40 | 2025-12-08 13:54:55 |
| File Name |
snac.log
|
|---|---|
| File Type | data |
| File Size | 159981 bytes |
| MD5 | 60cb70545fbe3c96a0f82eeb54940553 |
| SHA1 | 2294ecbbb065c517bd0e01f3f01aabd0a0402f5a |
| SHA256 | 6dc98a3c771f9f20d099e2d64995564dd083be9ac6ed9586a6e57c20ebd4176c [VT] [MWDB] [Bazaar] |
| SHA3-384 | 084cc411d9156c7cee96ec4acf3e5b7fefa3dabb421cb0756d3c04f6f8e1f891856c2db74dc062cadba7cd6073aac0b0 |
| CRC32 | 4798495F |
| TLSH | T13AF323BD0D2FB14B039E2BFE115B8E565828ED8231D5DC0E9D822A584DF0C66A1D4DFA |
| Ssdeep | 3072:zZTf+zaNLrnwZAT3SlnasBNWLh6mUi7LlLxzFHORkcluS4IPowfCCRY:zZTmzaVngkSlgh6LULxxzF2uNIBKCRY |
| File Strings BinGraph Vba2Graph |
No hosts contacted.
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP