| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-10 09:36:26 | 2025-12-10 09:39:49 | 203 seconds | Show Options | Show Analysis Log | 8.2 |
vnc_port=5900
2025-12-06 09:51:39,227 [root] INFO: Date set to: 20251210T01:36:26, timeout set to: 180 2025-12-10 01:36:26,000 [root] DEBUG: Starting analyzer from: C:\tmpp30yut2a 2025-12-10 01:36:26,000 [root] DEBUG: Storing results at: C:\NkIdepa 2025-12-10 01:36:26,000 [root] DEBUG: Pipe server name: \\.\PIPE\FbtpLSFPuQ 2025-12-10 01:36:26,000 [root] DEBUG: Python path: C:\Python38 2025-12-10 01:36:26,000 [root] INFO: analysis running as an admin 2025-12-10 01:36:26,000 [root] DEBUG: no analysis package configured, picking one for you 2025-12-10 01:36:26,000 [root] INFO: analysis package selected: "generic" 2025-12-10 01:36:26,000 [root] DEBUG: importing analysis package module: "modules.packages.generic"... 2025-12-10 01:36:26,000 [root] DEBUG: imported analysis package "generic" 2025-12-10 01:36:26,000 [root] DEBUG: initializing analysis package "generic"... 2025-12-10 01:36:26,000 [lib.common.common] INFO: wrapping 2025-12-10 01:36:26,000 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-10 01:36:26,000 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\0a76c55fa88d4c134012a.xz 2025-12-10 01:36:26,000 [root] INFO: Analyzer: Package modules.packages.generic does not specify a DLL option 2025-12-10 01:36:26,000 [root] INFO: Analyzer: Package modules.packages.generic does not specify a DLL_64 option 2025-12-10 01:36:26,000 [root] INFO: Analyzer: Package modules.packages.generic does not specify a loader option 2025-12-10 01:36:26,000 [root] INFO: Analyzer: Package modules.packages.generic does not specify a loader_64 option 2025-12-10 01:36:26,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-12-10 01:36:26,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain" 2025-12-10 01:36:26,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-12-10 01:36:26,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script" 2025-12-10 01:36:26,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks" 2025-12-10 01:36:26,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx" 2025-12-10 01:36:26,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-12-10 01:36:26,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script" 2025-12-10 01:36:26,062 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-12-10 01:36:26,093 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2025-12-10 01:36:26,093 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2025-12-10 01:36:26,093 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-12-10 01:36:26,093 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon" 2025-12-10 01:36:26,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-12-10 01:36:26,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage" 2025-12-10 01:36:26,109 [root] DEBUG: Initialized auxiliary module "Browser" 2025-12-10 01:36:26,109 [root] DEBUG: attempting to configure 'Browser' from data 2025-12-10 01:36:26,109 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-12-10 01:36:26,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-12-10 01:36:26,109 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-12-10 01:36:26,109 [root] DEBUG: Initialized auxiliary module "Curtain" 2025-12-10 01:36:26,109 [root] DEBUG: attempting to configure 'Curtain' from data 2025-12-10 01:36:26,109 [root] DEBUG: module Curtain does not support data configuration, ignoring 2025-12-10 01:36:26,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"... 2025-12-10 01:36:26,109 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain 2025-12-10 01:36:26,109 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-12-10 01:36:26,109 [root] DEBUG: attempting to configure 'Disguise' from data 2025-12-10 01:36:26,109 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-12-10 01:36:26,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-12-10 01:36:26,109 [modules.auxiliary.disguise] INFO: Disguising GUID to 46270c88-27c2-4d36-a3a0-a4f3e8b88c88 2025-12-10 01:36:26,109 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-12-10 01:36:26,109 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks" 2025-12-10 01:36:26,109 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data 2025-12-10 01:36:26,109 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring 2025-12-10 01:36:26,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"... 2025-12-10 01:36:26,109 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe 2025-12-10 01:36:26,109 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks 2025-12-10 01:36:26,109 [root] DEBUG: Initialized auxiliary module "Evtx" 2025-12-10 01:36:26,109 [root] DEBUG: attempting to configure 'Evtx' from data 2025-12-10 01:36:26,109 [root] DEBUG: module Evtx does not support data configuration, ignoring 2025-12-10 01:36:26,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"... 2025-12-10 01:36:26,109 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable 2025-12-10 01:36:26,109 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx 2025-12-10 01:36:26,109 [root] DEBUG: Initialized auxiliary module "Human" 2025-12-10 01:36:26,109 [root] DEBUG: attempting to configure 'Human' from data 2025-12-10 01:36:26,109 [root] DEBUG: module Human does not support data configuration, ignoring 2025-12-10 01:36:26,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-12-10 01:36:26,109 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-12-10 01:36:26,125 [root] DEBUG: Initialized auxiliary module "Pre_script" 2025-12-10 01:36:26,125 [root] DEBUG: attempting to configure 'Pre_script' from data 2025-12-10 01:36:26,125 [root] DEBUG: module Pre_script does not support data configuration, ignoring 2025-12-10 01:36:26,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"... 2025-12-10 01:36:26,125 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script 2025-12-10 01:36:26,125 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-12-10 01:36:26,125 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-12-10 01:36:26,125 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-12-10 01:36:26,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-12-10 01:36:26,125 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-12-10 01:36:26,125 [root] DEBUG: Initialized auxiliary module "Sysmon" 2025-12-10 01:36:26,125 [root] DEBUG: attempting to configure 'Sysmon' from data 2025-12-10 01:36:26,125 [root] DEBUG: module Sysmon does not support data configuration, ignoring 2025-12-10 01:36:26,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"... 2025-12-10 01:36:26,171 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable 2025-12-10 01:36:26,218 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques. 2025-12-10 01:36:26,218 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-12-10 01:36:26,218 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-12-10 01:36:26,218 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-12-10 01:36:26,218 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-12-10 01:36:26,218 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 392 2025-12-10 01:36:26,218 [lib.api.process] INFO: Monitor config for <Process 392 lsass.exe>: C:\tmpp30yut2a\dll\392.ini 2025-12-10 01:36:26,218 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-12-10 01:36:26,218 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:26,218 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable 2025-12-10 01:36:26,234 [root] DEBUG: Loader: Injecting process 392 with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:26,249 [root] DEBUG: 392: Python path set to 'C:\Python38'. 2025-12-10 01:36:26,249 [root] INFO: Disabling sleep skipping. 2025-12-10 01:36:26,249 [root] DEBUG: 392: TLS secret dump mode enabled. 2025-12-10 01:36:26,249 [root] DEBUG: 392: Monitor initialised: 32-bit capemon loaded in process 392 at 0x6c090000, thread 3148, image base 0xba0000, stack from 0xd36000-0xd40000 2025-12-10 01:36:26,249 [root] DEBUG: 392: Commandline: C:\Windows\system32\lsass.exe 2025-12-10 01:36:26,249 [root] DEBUG: 392: Hooked 5 out of 5 functions 2025-12-10 01:36:26,265 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable 2025-12-10 01:36:26,265 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-10 01:36:26,265 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:26,265 [lib.api.process] INFO: Injected into 32-bit <Process 392 lsass.exe> 2025-12-10 01:36:26,265 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2025-12-10 01:36:26,265 [root] DEBUG: Initialized auxiliary module "Usage" 2025-12-10 01:36:26,265 [root] DEBUG: attempting to configure 'Usage' from data 2025-12-10 01:36:26,265 [root] DEBUG: module Usage does not support data configuration, ignoring 2025-12-10 01:36:26,265 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"... 2025-12-10 01:36:26,265 [root] DEBUG: Started auxiliary module modules.auxiliary.usage 2025-12-10 01:36:26,265 [root] DEBUG: Initialized auxiliary module "During_script" 2025-12-10 01:36:26,265 [root] DEBUG: attempting to configure 'During_script' from data 2025-12-10 01:36:26,265 [root] DEBUG: module During_script does not support data configuration, ignoring 2025-12-10 01:36:26,265 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"... 2025-12-10 01:36:26,265 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script 2025-12-10 01:36:26,281 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe 2025-12-10 01:36:26,281 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable 2025-12-10 01:36:26,328 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable 2025-12-10 01:36:26,343 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe 2025-12-10 01:36:26,343 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable 2025-12-10 01:36:26,359 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable 2025-12-10 01:36:26,375 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe 2025-12-10 01:36:26,390 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable 2025-12-10 01:36:26,406 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable 2025-12-10 01:36:26,421 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe 2025-12-10 01:36:26,421 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable 2025-12-10 01:36:26,437 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable 2025-12-10 01:36:26,453 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable 2025-12-10 01:36:26,468 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2025-12-10 01:36:26,484 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable 2025-12-10 01:36:26,500 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f 2025-12-10 01:36:26,500 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable 2025-12-10 01:36:26,515 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f 2025-12-10 01:36:26,515 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable 2025-12-10 01:36:26,531 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable 2025-12-10 01:36:26,546 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable 2025-12-10 01:36:26,562 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable 2025-12-10 01:36:26,578 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable 2025-12-10 01:36:26,593 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable 2025-12-10 01:36:26,609 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable 2025-12-10 01:36:26,625 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable 2025-12-10 01:36:26,640 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable 2025-12-10 01:36:26,640 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable 2025-12-10 01:36:26,656 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable 2025-12-10 01:36:26,671 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable 2025-12-10 01:36:26,687 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable 2025-12-10 01:36:26,703 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable 2025-12-10 01:36:26,718 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable 2025-12-10 01:36:26,734 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable 2025-12-10 01:36:26,750 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable 2025-12-10 01:36:26,765 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable 2025-12-10 01:36:26,781 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable 2025-12-10 01:36:26,796 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable 2025-12-10 01:36:26,812 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable 2025-12-10 01:36:26,828 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable 2025-12-10 01:36:26,843 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable 2025-12-10 01:36:26,843 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable 2025-12-10 01:36:26,859 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable 2025-12-10 01:36:26,875 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable 2025-12-10 01:36:26,890 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable 2025-12-10 01:36:26,906 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable 2025-12-10 01:36:26,921 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable 2025-12-10 01:36:26,937 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable 2025-12-10 01:36:26,953 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable 2025-12-10 01:36:26,968 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable 2025-12-10 01:36:26,984 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable 2025-12-10 01:36:27,000 [modules.auxiliary.evtx] DEBUG: Wiping Application 2025-12-10 01:36:27,000 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents 2025-12-10 01:36:27,015 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer 2025-12-10 01:36:27,031 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service 2025-12-10 01:36:27,046 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts 2025-12-10 01:36:27,062 [modules.auxiliary.evtx] DEBUG: Wiping Security 2025-12-10 01:36:27,062 [modules.auxiliary.evtx] DEBUG: Wiping Setup 2025-12-10 01:36:27,078 [modules.auxiliary.evtx] DEBUG: Wiping System 2025-12-10 01:36:27,093 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell 2025-12-10 01:36:27,109 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational 2025-12-10 01:36:31,453 [root] INFO: Restarting WMI Service 2025-12-10 01:36:33,484 [root] DEBUG: package modules.packages.generic does not support configure, ignoring 2025-12-10 01:36:33,484 [root] WARNING: configuration error for package modules.packages.generic: error importing data.packages.generic: No module named 'data.packages' 2025-12-10 01:36:33,484 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-10 01:36:33,484 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c start /wait "" "C:\Users\user\AppData\Local\Temp\0a76c55fa88d4c134012a.xz"" with pid 3076 2025-12-10 01:36:33,484 [lib.api.process] INFO: Monitor config for <Process 3076 cmd.exe>: C:\tmpp30yut2a\dll\3076.ini 2025-12-10 01:36:33,484 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:33,484 [root] DEBUG: Loader: Injecting process 3076 (thread 3092) with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:33,484 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-10 01:36:33,484 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:33,484 [lib.api.process] INFO: Injected into 32-bit <Process 3076 cmd.exe> 2025-12-10 01:36:35,484 [lib.api.process] INFO: Successfully resumed <Process 3076 cmd.exe> 2025-12-10 01:36:35,500 [root] DEBUG: 3076: Python path set to 'C:\Python38'. 2025-12-10 01:36:35,500 [root] INFO: Disabling sleep skipping. 2025-12-10 01:36:35,500 [root] DEBUG: 3076: Dropped file limit defaulting to 100. 2025-12-10 01:36:35,500 [root] DEBUG: 3076: YaraInit: Compiled 41 rule files 2025-12-10 01:36:35,500 [root] DEBUG: 3076: YaraInit: Compiled rules saved to file C:\tmpp30yut2a\data\yara\capemon.yac 2025-12-10 01:36:35,500 [root] DEBUG: 3076: YaraScan: Scanning 0x49D60000, size 0x4bb2e 2025-12-10 01:36:35,500 [root] DEBUG: 3076: Monitor initialised: 32-bit capemon loaded in process 3076 at 0x6c090000, thread 3092, image base 0x49d60000, stack from 0x193000-0x290000 2025-12-10 01:36:35,500 [root] DEBUG: 3076: Commandline: "C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\user\AppData\Local\Temp\0a76c55fa88d4c134012a.xz" 2025-12-10 01:36:35,500 [root] DEBUG: 3076: GetAddressByYara: ModuleBase 0x77BD0000 FunctionName LdrpCallInitRoutine 2025-12-10 01:36:35,515 [root] DEBUG: 3076: hook_api: LdrpCallInitRoutine export address 0x77C28810 obtained via GetFunctionAddress 2025-12-10 01:36:35,515 [root] DEBUG: 3076: hook_api: Warning - CreateRemoteThreadEx export address 0x77A3F98F differs from GetProcAddress -> 0x75E3BB18 (KERNELBASE.dll::0xbb18) 2025-12-10 01:36:35,515 [root] DEBUG: 3076: hook_api: Warning - UpdateProcThreadAttribute export address 0x77A4020F differs from GetProcAddress -> 0x75E443FB (KERNELBASE.dll::0x143fb) 2025-12-10 01:36:35,515 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-10 01:36:35,515 [root] DEBUG: 3076: set_hooks: Unable to hook GetCommandLineA 2025-12-10 01:36:35,515 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-10 01:36:35,515 [root] DEBUG: 3076: set_hooks: Unable to hook GetCommandLineW 2025-12-10 01:36:35,515 [root] DEBUG: 3076: Hooked 611 out of 613 functions 2025-12-10 01:36:35,515 [root] DEBUG: 3076: WoW64 not detected. 2025-12-10 01:36:35,515 [root] INFO: Loaded monitor into process with pid 3076 2025-12-10 01:36:35,515 [root] DEBUG: 3076: caller_dispatch: Added region at 0x49D60000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x49D67CBD, thread 3092). 2025-12-10 01:36:35,515 [root] DEBUG: 3076: YaraScan: Scanning 0x49D60000, size 0x4bb2e 2025-12-10 01:36:35,515 [root] DEBUG: 3076: ProcessImageBase: Main module image at 0x49D60000 unmodified (entropy change 0.000000e+00) 2025-12-10 01:36:35,578 [root] DEBUG: 3076: DLL loaded at 0x76930000: C:\Windows\system32\SHELL32 (0xc4c000 bytes). 2025-12-10 01:36:35,578 [root] DEBUG: 3076: DLL loaded at 0x74AE0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes). 2025-12-10 01:36:35,578 [root] DEBUG: 3076: DLL loaded at 0x75AD0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes). 2025-12-10 01:36:35,578 [root] DEBUG: 3076: DLL loaded at 0x74930000: C:\Windows\system32\uxtheme (0x40000 bytes). 2025-12-10 01:36:35,578 [root] DEBUG: 3076: DLL loaded at 0x74970000: C:\Windows\system32\PROPSYS (0xf5000 bytes). 2025-12-10 01:36:35,578 [root] DEBUG: 3076: DLL loaded at 0x76820000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes). 2025-12-10 01:36:35,593 [root] DEBUG: 3076: DLL loaded at 0x75EE0000: C:\Windows\system32\CLBCatQ (0x83000 bytes). 2025-12-10 01:36:35,593 [root] DEBUG: 3076: DLL loaded at 0x74050000: C:\Windows\system32\ntmarta (0x21000 bytes). 2025-12-10 01:36:35,593 [root] DEBUG: 3076: DLL loaded at 0x77D70000: C:\Windows\system32\WLDAP32 (0x45000 bytes). 2025-12-10 01:36:35,593 [root] DEBUG: 3076: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:35,593 [root] DEBUG: 3076: DLL loaded at 0x75BC0000: C:\Windows\system32\profapi (0xb000 bytes). 2025-12-10 01:36:35,609 [root] DEBUG: 3076: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-10 01:36:35,609 [root] DEBUG: 3076: api-rate-cap: NtQueryValueKey hook disabled due to rate 2025-12-10 01:36:35,609 [root] DEBUG: 3076: api-rate-cap: RegOpenKeyExW hook disabled due to rate 2025-12-10 01:36:35,625 [root] DEBUG: 3076: DLL loaded at 0x75A80000: C:\Windows\system32\apphelp (0x4c000 bytes). 2025-12-10 01:36:35,625 [root] DEBUG: 3076: DLL loaded at 0x6F2D0000: C:\Windows\System32\shdocvw (0x2e000 bytes). 2025-12-10 01:36:35,625 [root] DEBUG: 3076: DLL loaded at 0x75F80000: C:\Windows\system32\SETUPAPI (0x19d000 bytes). 2025-12-10 01:36:35,625 [root] DEBUG: 3076: DLL loaded at 0x75E00000: C:\Windows\system32\CFGMGR32 (0x27000 bytes). 2025-12-10 01:36:35,625 [root] DEBUG: 3076: DLL loaded at 0x75EC0000: C:\Windows\system32\DEVOBJ (0x12000 bytes). 2025-12-10 01:36:35,625 [root] DEBUG: 3076: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:35,625 [root] DEBUG: 3076: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:35,656 [root] DEBUG: 3076: CreateProcessHandler: Injection info set for new process 3308: C:\Program Files\WinRAR\WinRAR.exe, ImageBase: 0x01390000 2025-12-10 01:36:35,656 [root] INFO: Announced 32-bit process name: WinRAR.exe pid: 3308 2025-12-10 01:36:35,656 [lib.api.process] INFO: Monitor config for <Process 3308 WinRAR.exe>: C:\tmpp30yut2a\dll\3308.ini 2025-12-10 01:36:35,656 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:35,656 [root] DEBUG: Loader: Injecting process 3308 (thread 3360) with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:35,656 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-10 01:36:35,656 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:35,656 [lib.api.process] INFO: Injected into 32-bit <Process 3308 WinRAR.exe> 2025-12-10 01:36:35,671 [root] INFO: Announced 32-bit process name: WinRAR.exe pid: 3308 2025-12-10 01:36:35,671 [lib.api.process] INFO: Monitor config for <Process 3308 WinRAR.exe>: C:\tmpp30yut2a\dll\3308.ini 2025-12-10 01:36:35,671 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:35,671 [root] DEBUG: Loader: Injecting process 3308 (thread 3360) with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:35,671 [root] DEBUG: InjectDllViaIAT: This image has already been patched. 2025-12-10 01:36:35,671 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:35,671 [lib.api.process] INFO: Injected into 32-bit <Process 3308 WinRAR.exe> 2025-12-10 01:36:35,671 [root] DEBUG: 3076: DLL loaded at 0x74080000: C:\Windows\system32\sfc (0x3000 bytes). 2025-12-10 01:36:35,687 [root] DEBUG: 3076: DLL loaded at 0x72C80000: C:\Windows\system32\sfc_os (0xd000 bytes). 2025-12-10 01:36:35,687 [root] DEBUG: 3076: DLL loaded at 0x75330000: C:\Windows\system32\DEVRTL (0xe000 bytes). 2025-12-10 01:36:35,687 [root] DEBUG: 3076: DLL loaded at 0x727C0000: C:\Windows\system32\MPR (0x12000 bytes). 2025-12-10 01:36:35,703 [root] INFO: Announced starting service "b'PcaSvc'" 2025-12-10 01:36:35,703 [lib.api.process] INFO: Monitor config for <Process 376 services.exe>: C:\tmpp30yut2a\dll\376.ini 2025-12-10 01:36:35,703 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:35,703 [root] DEBUG: Loader: Injecting process 376 with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:35,703 [root] DEBUG: 376: Python path set to 'C:\Python38'. 2025-12-10 01:36:35,703 [root] INFO: Disabling sleep skipping. 2025-12-10 01:36:35,703 [root] DEBUG: 376: Dropped file limit defaulting to 100. 2025-12-10 01:36:35,703 [root] DEBUG: 376: parent_has_path: unable to get path for parent process 328 2025-12-10 01:36:35,718 [root] DEBUG: 376: YaraInit: Compiled rules loaded from existing file C:\tmpp30yut2a\data\yara\capemon.yac 2025-12-10 01:36:35,718 [root] DEBUG: 376: YaraScan: Scanning 0x00820000, size 0x40944 2025-12-10 01:36:35,718 [root] DEBUG: 376: Monitor initialised: 32-bit capemon loaded in process 376 at 0x6c090000, thread 3588, image base 0x820000, stack from 0x666000-0x670000 2025-12-10 01:36:35,718 [root] DEBUG: 376: Commandline: C:\Windows\system32\services.exe 2025-12-10 01:36:35,718 [root] DEBUG: 376: GetAddressByYara: ModuleBase 0x77BD0000 FunctionName LdrpCallInitRoutine 2025-12-10 01:36:35,718 [root] DEBUG: 376: hook_api: LdrpCallInitRoutine export address 0x77C28810 obtained via GetFunctionAddress 2025-12-10 01:36:35,718 [root] DEBUG: 376: hook_api: Warning - CreateRemoteThreadEx export address 0x77A3F98F differs from GetProcAddress -> 0x75E3BB18 (KERNELBASE.dll::0xbb18) 2025-12-10 01:36:35,718 [root] DEBUG: 376: hook_api: Warning - UpdateProcThreadAttribute export address 0x77A4020F differs from GetProcAddress -> 0x75E443FB (KERNELBASE.dll::0x143fb) 2025-12-10 01:36:35,718 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-10 01:36:35,718 [root] DEBUG: 376: set_hooks: Unable to hook GetCommandLineA 2025-12-10 01:36:35,718 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-10 01:36:35,718 [root] DEBUG: 376: set_hooks: Unable to hook GetCommandLineW 2025-12-10 01:36:35,734 [root] DEBUG: 376: Hooked 611 out of 613 functions 2025-12-10 01:36:35,734 [root] DEBUG: 376: WoW64 not detected. 2025-12-10 01:36:35,734 [root] INFO: Loaded monitor into process with pid 376 2025-12-10 01:36:35,734 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-10 01:36:35,734 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:35,734 [lib.api.process] INFO: Injected into 32-bit <Process 376 services.exe> 2025-12-10 01:36:37,734 [root] DEBUG: 376: caller_dispatch: Added region at 0x00820000 to tracked regions list (ntdll::memcpy returns to 0x00822979, thread 2556). 2025-12-10 01:36:37,734 [root] DEBUG: 376: YaraScan: Scanning 0x00820000, size 0x40944 2025-12-10 01:36:37,734 [root] DEBUG: 376: ProcessImageBase: Main module image at 0x00820000 unmodified (entropy change 0.000000e+00) 2025-12-10 01:36:37,734 [root] DEBUG: 376: CreateProcessHandler: Injection info set for new process 3732: C:\Windows\system32\svchost.exe, ImageBase: 0x00690000 2025-12-10 01:36:37,734 [root] INFO: Announced 32-bit process name: svchost.exe pid: 3732 2025-12-10 01:36:37,734 [lib.api.process] INFO: Monitor config for <Process 3732 svchost.exe>: C:\tmpp30yut2a\dll\3732.ini 2025-12-10 01:36:37,734 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:37,734 [root] DEBUG: Loader: Injecting process 3732 (thread 3704) with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:37,734 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-10 01:36:37,734 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:37,734 [lib.api.process] INFO: Injected into 32-bit <Process 3732 svchost.exe> 2025-12-10 01:36:37,750 [root] INFO: Announced 32-bit process name: svchost.exe pid: 3732 2025-12-10 01:36:37,750 [lib.api.process] INFO: Monitor config for <Process 3732 svchost.exe>: C:\tmpp30yut2a\dll\3732.ini 2025-12-10 01:36:37,750 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:36:37,750 [root] DEBUG: Loader: Injecting process 3732 (thread 3704) with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:37,750 [root] DEBUG: InjectDllViaIAT: This image has already been patched. 2025-12-10 01:36:37,750 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:36:37,750 [lib.api.process] INFO: Injected into 32-bit <Process 3732 svchost.exe> 2025-12-10 01:36:37,750 [root] DEBUG: 3732: Python path set to 'C:\Python38'. 2025-12-10 01:36:37,750 [root] DEBUG: 3732: Dropped file limit defaulting to 100. 2025-12-10 01:36:37,750 [root] DEBUG: 3732: parent_has_path: unable to get path for parent process 376 2025-12-10 01:36:37,750 [root] INFO: Disabling sleep skipping. 2025-12-10 01:36:37,750 [root] DEBUG: 3732: YaraInit: Compiled rules loaded from existing file C:\tmpp30yut2a\data\yara\capemon.yac 2025-12-10 01:36:37,765 [root] DEBUG: 3732: YaraScan: Scanning 0x00690000, size 0x73ca 2025-12-10 01:36:37,765 [root] DEBUG: 3732: Monitor initialised: 32-bit capemon loaded in process 3732 at 0x6c090000, thread 3704, image base 0x690000, stack from 0x1c6000-0x1d0000 2025-12-10 01:36:37,765 [root] DEBUG: 3732: Commandline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted 2025-12-10 01:36:37,765 [root] DEBUG: 3732: GetAddressByYara: ModuleBase 0x77BD0000 FunctionName LdrpCallInitRoutine 2025-12-10 01:36:37,765 [root] DEBUG: 3732: hook_api: LdrpCallInitRoutine export address 0x77C28810 obtained via GetFunctionAddress 2025-12-10 01:36:37,765 [root] DEBUG: 3732: hook_api: Warning - CreateRemoteThreadEx export address 0x77A3F98F differs from GetProcAddress -> 0x75E3BB18 (KERNELBASE.dll::0xbb18) 2025-12-10 01:36:37,765 [root] DEBUG: 3732: hook_api: Warning - UpdateProcThreadAttribute export address 0x77A4020F differs from GetProcAddress -> 0x75E443FB (KERNELBASE.dll::0x143fb) 2025-12-10 01:36:37,765 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-10 01:36:37,765 [root] DEBUG: 3732: set_hooks: Unable to hook GetCommandLineA 2025-12-10 01:36:37,765 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-10 01:36:37,765 [root] DEBUG: 3732: set_hooks: Unable to hook GetCommandLineW 2025-12-10 01:36:37,765 [root] DEBUG: 3732: Hooked 611 out of 613 functions 2025-12-10 01:36:37,765 [root] DEBUG: 3732: WoW64 not detected. 2025-12-10 01:36:37,781 [root] INFO: Loaded monitor into process with pid 3732 2025-12-10 01:36:37,781 [root] DEBUG: 3732: caller_dispatch: Added region at 0x00690000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00691E10, thread 3704). 2025-12-10 01:36:37,781 [root] DEBUG: 3732: YaraScan: Scanning 0x00690000, size 0x73ca 2025-12-10 01:36:37,781 [root] DEBUG: 3732: ProcessImageBase: Main module image at 0x00690000 unmodified (entropy change 0.000000e+00) 2025-12-10 01:36:37,781 [root] DEBUG: 3732: DLL loaded at 0x75AD0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes). 2025-12-10 01:36:37,781 [root] DEBUG: 3732: DLL loaded at 0x75EE0000: C:\Windows\system32\CLBCatQ (0x83000 bytes). 2025-12-10 01:36:37,781 [root] DEBUG: 3732: DLL loaded at 0x76820000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes). 2025-12-10 01:36:37,781 [root] DEBUG: 3732: DLL loaded at 0x722E0000: c:\windows\system32\pcasvc (0x28000 bytes). 2025-12-10 01:36:37,781 [root] DEBUG: 3732: DLL loaded at 0x75A80000: c:\windows\system32\apphelp (0x4c000 bytes). 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x71FD0000: c:\windows\system32\AEPIC (0x35000 bytes). 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x76930000: C:\Windows\system32\SHELL32 (0xc4c000 bytes). 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x72C80000: c:\windows\system32\sfc (0x3000 bytes). 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x74080000: c:\windows\system32\sfc_os (0xd000 bytes). 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x75050000: c:\windows\system32\VERSION (0x9000 bytes). 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x75790000: c:\windows\system32\wevtapi (0x42000 bytes). 2025-12-10 01:36:37,796 [root] INFO: Announced starting service "b'PcaSvc'" 2025-12-10 01:36:37,796 [root] DEBUG: 3732: DLL loaded at 0x75B40000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2025-12-10 01:36:37,812 [root] DEBUG: 3732: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:37,812 [root] DEBUG: 3732: api-rate-cap: RegEnumKeyExW hook disabled due to rate 2025-12-10 01:36:38,796 [root] DEBUG: 3732: OpenProcessHandler: Injection info created for process 3076, handle 0x1a8: C:\Windows\System32\cmd.exe 2025-12-10 01:36:38,796 [root] DEBUG: 3732: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:38,812 [root] DEBUG: 3732: OpenProcessHandler: Image base for process 3308 (handle 0x1b0): 0x01390000. 2025-12-10 01:36:38,812 [root] DEBUG: 3732: OpenProcessHandler: Injection info created for process 3308, handle 0x1b0: C:\Program Files\WinRAR\WinRAR.exe 2025-12-10 01:36:38,828 [root] DEBUG: 3308: Python path set to 'C:\Python38'. 2025-12-10 01:36:38,828 [root] DEBUG: 3308: Dropped file limit defaulting to 100. 2025-12-10 01:36:38,828 [root] INFO: Disabling sleep skipping. 2025-12-10 01:36:38,828 [root] DEBUG: 3308: YaraInit: Compiled rules loaded from existing file C:\tmpp30yut2a\data\yara\capemon.yac 2025-12-10 01:36:38,828 [root] DEBUG: 3308: YaraScan: Scanning 0x01390000, size 0x30b36e 2025-12-10 01:36:38,843 [root] DEBUG: 3308: Monitor initialised: 32-bit capemon loaded in process 3308 at 0x6c090000, thread 3360, image base 0x1390000, stack from 0x146000-0x150000 2025-12-10 01:36:38,843 [root] DEBUG: 3308: Commandline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\user\AppData\Local\Temp\0a76c55fa88d4c134012a.xz" 2025-12-10 01:36:38,843 [root] DEBUG: 3308: GetAddressByYara: ModuleBase 0x77BD0000 FunctionName LdrpCallInitRoutine 2025-12-10 01:36:38,859 [root] DEBUG: 3308: hook_api: LdrpCallInitRoutine export address 0x77C28810 obtained via GetFunctionAddress 2025-12-10 01:36:38,859 [root] DEBUG: 3308: hook_api: Warning - CreateRemoteThreadEx export address 0x77A3F98F differs from GetProcAddress -> 0x75E3BB18 (KERNELBASE.dll::0xbb18) 2025-12-10 01:36:38,859 [root] DEBUG: 3308: hook_api: Warning - UpdateProcThreadAttribute export address 0x77A4020F differs from GetProcAddress -> 0x75E443FB (KERNELBASE.dll::0x143fb) 2025-12-10 01:36:38,859 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-10 01:36:38,859 [root] DEBUG: 3308: set_hooks: Unable to hook GetCommandLineA 2025-12-10 01:36:38,859 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-10 01:36:38,859 [root] DEBUG: 3308: set_hooks: Unable to hook GetCommandLineW 2025-12-10 01:36:38,859 [root] DEBUG: 3308: Hooked 611 out of 613 functions 2025-12-10 01:36:38,859 [root] DEBUG: 3308: WoW64 not detected. 2025-12-10 01:36:38,859 [root] INFO: Loaded monitor into process with pid 3308 2025-12-10 01:36:38,859 [root] DEBUG: 3308: caller_dispatch: Added region at 0x01390000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x014AEDD6, thread 3360). 2025-12-10 01:36:38,859 [root] DEBUG: 3308: YaraScan: Scanning 0x01390000, size 0x30b36e 2025-12-10 01:36:38,875 [root] DEBUG: 3308: ProcessImageBase: Main module image at 0x01390000 unmodified (entropy change 0.000000e+00) 2025-12-10 01:36:38,890 [root] DEBUG: 3308: DLL loaded at 0x75AD0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes). 2025-12-10 01:36:38,890 [root] DEBUG: 3308: DLL loaded at 0x75EE0000: C:\Windows\system32\CLBCatQ (0x83000 bytes). 2025-12-10 01:36:38,890 [root] DEBUG: 3308: DLL loaded at 0x74970000: C:\Windows\system32\propsys (0xf5000 bytes). 2025-12-10 01:36:38,890 [root] DEBUG: 3308: DLL loaded at 0x74050000: C:\Windows\system32\ntmarta (0x21000 bytes). 2025-12-10 01:36:38,890 [root] DEBUG: 3308: DLL loaded at 0x77D70000: C:\Windows\system32\WLDAP32 (0x45000 bytes). 2025-12-10 01:36:38,906 [root] DEBUG: 3308: DLL loaded at 0x715E0000: C:\Windows\system32\riched20 (0x76000 bytes). 2025-12-10 01:36:38,968 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Roaming\WinRAR\version.dat 2025-12-10 01:36:38,968 [root] DEBUG: 3308: DLL loaded at 0x74600000: C:\Windows\system32\dwmapi (0x13000 bytes). 2025-12-10 01:36:39,000 [root] DEBUG: 3308: DLL loaded at 0x6F060000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0x58000 bytes). 2025-12-10 01:36:39,000 [root] DEBUG: 3308: DLL loaded at 0x743E0000: C:\Windows\system32\WindowsCodecs (0x130000 bytes). 2025-12-10 01:36:39,000 [root] DEBUG: 3308: DLL loaded at 0x75A80000: C:\Windows\system32\apphelp (0x4c000 bytes). 2025-12-10 01:36:39,000 [root] DEBUG: 3308: DLL loaded at 0x6F5E0000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\FileSyncShell (0x1ff000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x77580000: C:\Windows\system32\WININET (0x1e4000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x75DA0000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x75E90000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x75E80000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x75050000: C:\Windows\system32\version (0x9000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x75EA0000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes). 2025-12-10 01:36:39,015 [root] DEBUG: 3308: DLL loaded at 0x77E10000: C:\Windows\system32\normaliz (0x3000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x76120000: C:\Windows\system32\iertutil (0x232000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x75EB0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x75DB0000: C:\Windows\system32\USERENV (0x17000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x75BC0000: C:\Windows\system32\profapi (0xb000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x6F560000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\MSVCP120 (0x71000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x6F470000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\MSVCR120 (0xee000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x6F440000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\LoggingPlatform (0x18000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x6F3D0000: C:\Windows\system32\WSOCK32 (0x7000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x6F380000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\Telemetry (0x4f000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x75F70000: C:\Windows\system32\PSAPI (0x5000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x73910000: C:\Windows\system32\Cabinet (0x15000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x73300000: C:\Windows\system32\WINHTTP (0x58000 bytes). 2025-12-10 01:36:39,031 [root] DEBUG: 3308: DLL loaded at 0x73370000: C:\Windows\system32\webio (0x50000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x6F1F0000: C:\Windows\system32\EhStorShell (0x31000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x6F180000: C:\Windows\System32\cscui (0x6a000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x6F170000: C:\Windows\System32\CSCDLL (0x9000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x6FA10000: C:\Windows\system32\CSCAPI (0xb000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x6F100000: C:\Windows\system32\ntshrui (0x70000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x759A0000: C:\Windows\system32\srvcli (0x19000 bytes). 2025-12-10 01:36:39,046 [root] DEBUG: 3308: DLL loaded at 0x73C20000: C:\Windows\system32\slc (0xa000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x727C0000: C:\Windows\system32\MPR (0x12000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x72030000: C:\Windows\System32\drprov (0x8000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x755C0000: C:\Windows\System32\WINSTA (0x29000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x71860000: C:\Windows\System32\ntlanman (0x14000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x71840000: C:\Windows\System32\davclnt (0x17000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x71830000: C:\Windows\System32\DAVHLPR (0x8000 bytes). 2025-12-10 01:36:39,140 [root] DEBUG: 3308: DLL loaded at 0x742D0000: C:\Windows\system32\wkscli (0xf000 bytes). 2025-12-10 01:36:39,156 [root] DEBUG: 3308: DLL loaded at 0x742E0000: C:\Windows\system32\netutils (0x9000 bytes). 2025-12-10 01:36:39,171 [root] DEBUG: 3308: DLL loaded at 0x6DC30000: C:\Windows\system32\wpdshext (0x238000 bytes). 2025-12-10 01:36:39,171 [root] DEBUG: 3308: DLL loaded at 0x6F7E0000: C:\Windows\system32\WINMM (0x32000 bytes). 2025-12-10 01:36:39,171 [root] DEBUG: 3308: DLL loaded at 0x72970000: C:\Windows\system32\PortableDeviceApi (0x89000 bytes). 2025-12-10 01:36:39,171 [root] DEBUG: 3308: DLL loaded at 0x75DD0000: C:\Windows\system32\WINTRUST (0x2f000 bytes). 2025-12-10 01:36:39,171 [root] DEBUG: 3308: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-10 01:36:39,187 [root] DEBUG: 3308: DLL loaded at 0x70390000: C:\Windows\system32\audiodev (0x3f000 bytes). 2025-12-10 01:36:39,203 [root] DEBUG: 3308: DLL loaded at 0x6BE20000: C:\Windows\system32\WMVCore (0x267000 bytes). 2025-12-10 01:36:39,203 [root] DEBUG: 3308: DLL loaded at 0x6E370000: C:\Windows\system32\WMASF (0x3d000 bytes). 2025-12-10 01:36:39,203 [root] DEBUG: 3308: DLL loaded at 0x6E340000: C:\Windows\system32\EhStorAPI (0x22000 bytes). 2025-12-10 01:36:39,203 [root] DEBUG: 3308: DLL loaded at 0x6F2D0000: C:\Windows\System32\shdocvw (0x2e000 bytes). 2025-12-10 01:36:39,218 [root] DEBUG: 3308: DLL loaded at 0x75A40000: C:\Windows\system32\Secur32 (0x8000 bytes). 2025-12-10 01:36:39,218 [root] DEBUG: 392: DLL loaded at 0x77D70000: C:\Windows\system32\WLDAP32 (0x45000 bytes). 2025-12-10 01:36:39,218 [root] DEBUG: 3308: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-10 01:36:39,234 [root] DEBUG: 3308: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:39,249 [root] DEBUG: 3308: api-rate-cap: memcpy hook disabled due to rate 2025-12-10 01:36:39,265 [root] DEBUG: 3308: caller_dispatch: Added region at 0x002F0000 to tracked regions list (user32::GetSystemMetrics returns to 0x00360037, thread 3360). 2025-12-10 01:36:39,265 [root] DEBUG: 3308: DumpPEsInRange: Scanning range 0x002F0000 - 0x002F1FF7. 2025-12-10 01:36:39,281 [root] DEBUG: 3308: ScanForDisguisedPE: No PE image located in range 0x002F0000-0x002F1FF7. 2025-12-10 01:36:39,281 [lib.common.results] INFO: Uploading file C:\NkIdepa\CAPE\3308_54851229112192122025 to CAPE\d00adba9589e7ece48a2b0b3b5aadd614ae280c3585c018b5ce278046d47bd43; Size is 8183; Max size: 100000000 2025-12-10 01:36:39,296 [root] DEBUG: 3308: DumpMemory: Payload successfully created: C:\NkIdepa\CAPE\3308_54851229112192122025 (size 8183 bytes) 2025-12-10 01:36:39,296 [root] DEBUG: 3308: DumpRegion: Dumped entire allocation from 0x002F0000, size 8192 bytes. 2025-12-10 01:36:39,296 [root] DEBUG: 3308: ProcessTrackedRegion: Dumped region at 0x002F0000. 2025-12-10 01:36:39,296 [root] DEBUG: 3308: YaraScan: Scanning 0x002F0000, size 0x1ff7 2025-12-10 01:36:39,296 [root] DEBUG: 3308: GetEntropy: Error - Supplied address inaccessible: 0x00050000 2025-12-10 01:36:39,296 [root] DEBUG: 3308: AddTrackedRegion: GetEntropy failed. 2025-12-10 01:36:39,296 [root] DEBUG: 3308: caller_dispatch: Added region at 0x00050000 to tracked regions list (user32::GetSystemMetrics returns to 0x00140BF8, thread 3360). 2025-12-10 01:36:39,296 [root] DEBUG: 3308: ReverseScanForNonZero: Error - Supplied size zero. 2025-12-10 01:36:39,296 [lib.common.results] INFO: Uploading file C:\NkIdepa\CAPE\3308_348806429112192122025 to CAPE\efe562aba4fc5ffb751f18889df28d02fc57d879162ed3f5192d716f38272b1e; Size is 64300; Max size: 100000000 2025-12-10 01:36:39,312 [root] DEBUG: 3308: DumpMemory: Payload successfully created: C:\NkIdepa\CAPE\3308_348806429112192122025 (size 64300 bytes) 2025-12-10 01:36:39,312 [root] DEBUG: 3308: DumpRegion: Dumped region at 0x00140000, size 65536 bytes. 2025-12-10 01:36:39,312 [root] DEBUG: 3308: ProcessTrackedRegion: Dumped region at 0x00140000. 2025-12-10 01:36:39,312 [root] DEBUG: 3308: ReverseScanForNonZero: Error - Supplied address inaccessible: 0x0005FFFF 2025-12-10 01:36:39,312 [root] DEBUG: 3308: YaraScan: Nothing to scan at 0x00140000! 2025-12-10 01:36:39,312 [root] DEBUG: 3308: DLL loaded at 0x6F840000: C:\Windows\system32\explorerframe (0x170000 bytes). 2025-12-10 01:36:39,312 [root] DEBUG: 3308: DLL loaded at 0x74A70000: C:\Windows\system32\DUser (0x2f000 bytes). 2025-12-10 01:36:39,328 [root] DEBUG: 3308: DLL loaded at 0x746E0000: C:\Windows\system32\DUI70 (0xb2000 bytes). 2025-12-10 01:36:39,328 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied. 2025-12-10 01:36:39,328 [root] DEBUG: 3308: OpenProcessHandler: Injection info created for process 1552, handle 0x3b0: Error obtaining target process name 2025-12-10 01:36:39,343 [root] DEBUG: 3308: DLL loaded at 0x6C340000: C:\Windows\System32\ieframe (0xc42000 bytes). 2025-12-10 01:36:39,343 [root] DEBUG: 3308: DLL loaded at 0x702C0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes). 2025-12-10 01:36:39,343 [root] DEBUG: 3308: DLL loaded at 0x70240000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes). 2025-12-10 01:36:39,343 [root] DEBUG: 3308: DLL loaded at 0x733C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes). 2025-12-10 01:36:39,359 [root] DEBUG: 3308: DLL loaded at 0x765D0000: C:\Windows\system32\urlmon (0x14a000 bytes). 2025-12-10 01:36:39,359 [root] DEBUG: 3308: DLL loaded at 0x75BD0000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes). 2025-12-10 01:36:39,359 [root] DEBUG: 3308: DLL loaded at 0x75580000: C:\Windows\system32\mswsock (0x3c000 bytes). 2025-12-10 01:36:39,359 [root] DEBUG: 3308: DLL loaded at 0x73CB0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes). 2025-12-10 01:36:39,375 [root] DEBUG: 3308: DLL loaded at 0x73DB0000: C:\Windows\system32\WINNSI (0x7000 bytes). 2025-12-10 01:36:39,375 [root] DEBUG: 3308: DLL loaded at 0x75570000: C:\Windows\System32\wship6 (0x6000 bytes). 2025-12-10 01:36:39,375 [root] DEBUG: 3308: DLL loaded at 0x75440000: C:\Windows\system32\DNSAPI (0x44000 bytes). 2025-12-10 01:36:39,375 [root] DEBUG: 3308: DLL loaded at 0x732A0000: C:\Windows\System32\netprofm (0x5a000 bytes). 2025-12-10 01:36:39,375 [root] DEBUG: 3308: DLL loaded at 0x73360000: C:\Windows\System32\nlaapi (0x10000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x73CE0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x750E0000: C:\Windows\System32\wshtcpip (0x5000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x73C90000: C:\Windows\system32\dhcpcsvc (0x12000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x73290000: C:\Windows\system32\rasadhlp (0x6000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x755F0000: C:\Windows\system32\CRYPTSP (0x16000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x75350000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2025-12-10 01:36:39,390 [root] DEBUG: 3308: DLL loaded at 0x75B40000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2025-12-10 01:36:39,406 [root] DEBUG: 3308: DLL loaded at 0x72D80000: C:\Windows\System32\npmproxy (0x8000 bytes). 2025-12-10 01:36:39,578 [root] DEBUG: 3308: DLL loaded at 0x6AB60000: C:\Windows\system32\MSHTML (0x12bc000 bytes). 2025-12-10 01:36:39,609 [root] DEBUG: 3308: DLL loaded at 0x73D40000: C:\Windows\System32\fwpuclnt (0x38000 bytes). 2025-12-10 01:36:44,375 [modules.auxiliary.human] INFO: Found button "ok", clicking it 2025-12-10 01:37:07,875 [root] DEBUG: 376: OpenProcessHandler: Injection info created for process 2008, handle 0x374: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2025-12-10 01:37:07,875 [root] INFO: Announced 32-bit process name: OfficeC2RClient.exe pid: 2008 2025-12-10 01:37:07,875 [lib.api.process] INFO: Monitor config for <Process 2008 OfficeC2RClient.exe>: C:\tmpp30yut2a\dll\2008.ini 2025-12-10 01:37:07,875 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:37:07,875 [root] DEBUG: Loader: Injecting process 2008 with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:37:07,890 [root] DEBUG: 2008: Python path set to 'C:\Python38'. 2025-12-10 01:37:07,890 [root] DEBUG: 2008: Dropped file limit defaulting to 100. 2025-12-10 01:37:07,906 [root] INFO: Disabling sleep skipping. 2025-12-10 01:37:07,906 [root] DEBUG: 2008: YaraInit: Compiled rules loaded from existing file C:\tmpp30yut2a\data\yara\capemon.yac 2025-12-10 01:37:07,906 [root] DEBUG: 2008: YaraScan: Scanning 0x000F0000, size 0xf7067c 2025-12-10 01:37:07,984 [root] DEBUG: 2008: Monitor initialised: 32-bit capemon loaded in process 2008 at 0x6c090000, thread 2240, image base 0xf0000, stack from 0x3647000-0x3650000 2025-12-10 01:37:07,984 [root] DEBUG: 2008: Commandline: "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update SCHEDULEDTASK displaylevel=False 2025-12-10 01:37:07,984 [root] DEBUG: 2008: GetAddressByYara: ModuleBase 0x77BD0000 FunctionName LdrpCallInitRoutine 2025-12-10 01:37:07,984 [root] DEBUG: 2008: hook_api: LdrpCallInitRoutine export address 0x77C28810 obtained via GetFunctionAddress 2025-12-10 01:37:07,984 [root] DEBUG: 2008: hook_api: Warning - CreateRemoteThreadEx export address 0x77A3F98F differs from GetProcAddress -> 0x75E3BB18 (KERNELBASE.dll::0xbb18) 2025-12-10 01:37:07,984 [root] DEBUG: 2008: hook_api: Warning - UpdateProcThreadAttribute export address 0x77A4020F differs from GetProcAddress -> 0x75E443FB (KERNELBASE.dll::0x143fb) 2025-12-10 01:37:08,000 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-10 01:37:08,000 [root] DEBUG: 2008: set_hooks: Unable to hook GetCommandLineA 2025-12-10 01:37:08,000 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-10 01:37:08,000 [root] DEBUG: 2008: set_hooks: Unable to hook GetCommandLineW 2025-12-10 01:37:08,000 [root] DEBUG: 2008: Hooked 611 out of 613 functions 2025-12-10 01:37:08,000 [root] DEBUG: 2008: WoW64 not detected. 2025-12-10 01:37:08,000 [root] INFO: Loaded monitor into process with pid 2008 2025-12-10 01:37:08,000 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-10 01:37:08,000 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:37:08,000 [lib.api.process] INFO: Injected into 32-bit <Process 2008 OfficeC2RClient.exe> 2025-12-10 01:37:08,015 [root] DEBUG: 2008: caller_dispatch: Added region at 0x000F0000 to tracked regions list (ntdll::memcpy returns to 0x002EAD04, thread 1992). 2025-12-10 01:37:08,015 [root] DEBUG: 2008: YaraScan: Scanning 0x000F0000, size 0xf7067c 2025-12-10 01:37:08,062 [root] DEBUG: 2008: ProcessImageBase: Main module image at 0x000F0000 unmodified (entropy change 0.000000e+00) 2025-12-10 01:37:08,078 [root] DEBUG: 2008: caller_dispatch: Added region at 0x738F0000 to tracked regions list (ntdll::memcpy returns to 0x738F46F5, thread 1992). 2025-12-10 01:37:08,078 [root] DEBUG: 2008: ProcessTrackedRegion: Region at 0x738F0000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, skipping 2025-12-10 01:37:08,078 [root] DEBUG: 2008: caller_dispatch: Added region at 0x736F0000 to tracked regions list (ntdll::NtWaitForSingleObject returns to 0x73701047, thread 1992). 2025-12-10 01:37:08,078 [root] DEBUG: 2008: ProcessTrackedRegion: Region at 0x736F0000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll, skipping 2025-12-10 01:37:08,875 [root] DEBUG: 2008: caller_dispatch: Added region at 0x73800000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x7382F7CB, thread 1992). 2025-12-10 01:37:08,875 [root] DEBUG: 2008: ProcessTrackedRegion: Region at 0x73800000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll, skipping 2025-12-10 01:37:08,875 [root] DEBUG: 2008: DLL loaded at 0x74520000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2025-12-10 01:37:08,875 [root] DEBUG: 2008: NtTerminateProcess hook: Attempting to dump process 2008 2025-12-10 01:37:08,890 [root] DEBUG: 2008: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-10 01:37:08,890 [root] DEBUG: 2008: caller_dispatch: Added region at 0x73620000 to tracked regions list (ntdll::LdrUnloadDll returns to 0x7362C230, thread 1992). 2025-12-10 01:37:08,890 [root] DEBUG: 2008: caller_dispatch: Scanning calling region at 0x73620000... 2025-12-10 01:37:08,890 [root] DEBUG: 2008: ProcessTrackedRegion: Region at 0x73620000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, skipping 2025-12-10 01:37:08,921 [root] INFO: Process with pid 2008 has terminated 2025-12-10 01:37:30,078 [root] DEBUG: 3732: OpenProcessHandler: Injection info created for process 1552, handle 0x1b8: C:\Windows\explorer.exe 2025-12-10 01:37:30,078 [root] DEBUG: 3732: OpenProcessHandler: Image base for process 2948 (handle 0x1b4): 0x003C0000. 2025-12-10 01:37:30,078 [root] DEBUG: 3732: OpenProcessHandler: Injection info created for process 2948, handle 0x1b4: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2025-12-10 01:38:53,140 [root] DEBUG: 3308: api-rate-cap: RegOpenKeyExW hook disabled due to rate 2025-12-10 01:38:53,140 [root] DEBUG: 3308: api-rate-cap: RegCloseKey hook disabled due to rate 2025-12-10 01:38:53,140 [root] DEBUG: 3308: api-rate-cap: NtQueryValueKey hook disabled due to rate 2025-12-10 01:38:59,500 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:01,562 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:01,562 [root] DEBUG: 376: OpenProcessHandler: Injection info created for process 260, handle 0x2fc: C:\Windows\System32\taskhost.exe 2025-12-10 01:39:01,562 [root] INFO: Announced 32-bit process name: taskhost.exe pid: 260 2025-12-10 01:39:01,562 [lib.api.process] INFO: Monitor config for <Process 260 taskhost.exe>: C:\tmpp30yut2a\dll\260.ini 2025-12-10 01:39:01,579 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpp30yut2a\dll\umWBveGE.dll, loader C:\tmpp30yut2a\bin\rfxzBvN.exe 2025-12-10 01:39:01,585 [root] DEBUG: Loader: Injecting process 260 with C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:39:01,587 [root] DEBUG: 260: Python path set to 'C:\Python38'. 2025-12-10 01:39:01,587 [root] DEBUG: 260: Dropped file limit defaulting to 100. 2025-12-10 01:39:01,588 [root] DEBUG: 260: VerifyCodeSection: Executable code does not match, 0x0 of 0xa2d4 matching 2025-12-10 01:39:01,594 [root] INFO: Disabling sleep skipping. 2025-12-10 01:39:01,594 [root] DEBUG: 260: YaraInit: Compiled rules loaded from existing file C:\tmpp30yut2a\data\yara\capemon.yac 2025-12-10 01:39:01,594 [root] DEBUG: 260: YaraScan: Scanning 0x00D60000, size 0xe99c 2025-12-10 01:39:01,594 [root] DEBUG: 260: Monitor initialised: 32-bit capemon loaded in process 260 at 0x6c090000, thread 3920, image base 0xd60000, stack from 0x36f6000-0x3700000 2025-12-10 01:39:01,594 [root] DEBUG: 260: Commandline: "taskhost.exe" 2025-12-10 01:39:01,602 [root] DEBUG: 260: GetAddressByYara: ModuleBase 0x77BD0000 FunctionName LdrpCallInitRoutine 2025-12-10 01:39:01,602 [root] DEBUG: 260: hook_api: LdrpCallInitRoutine export address 0x77C28810 obtained via GetFunctionAddress 2025-12-10 01:39:01,610 [root] DEBUG: 260: hook_api: Warning - CreateRemoteThreadEx export address 0x77A3F98F differs from GetProcAddress -> 0x75E3BB18 (KERNELBASE.dll::0xbb18) 2025-12-10 01:39:01,610 [root] DEBUG: 260: hook_api: Warning - UpdateProcThreadAttribute export address 0x77A4020F differs from GetProcAddress -> 0x75E443FB (KERNELBASE.dll::0x143fb) 2025-12-10 01:39:01,610 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-10 01:39:01,610 [root] DEBUG: 260: set_hooks: Unable to hook GetCommandLineA 2025-12-10 01:39:01,610 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-10 01:39:01,618 [root] DEBUG: 260: set_hooks: Unable to hook GetCommandLineW 2025-12-10 01:39:01,618 [root] DEBUG: 260: Hooked 611 out of 613 functions 2025-12-10 01:39:01,618 [root] DEBUG: 260: WoW64 not detected. 2025-12-10 01:39:01,618 [root] INFO: Loaded monitor into process with pid 260 2025-12-10 01:39:01,618 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-10 01:39:01,618 [root] DEBUG: Successfully injected DLL C:\tmpp30yut2a\dll\umWBveGE.dll. 2025-12-10 01:39:01,618 [lib.api.process] INFO: Injected into 32-bit <Process 260 taskhost.exe> 2025-12-10 01:39:03,571 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:10,571 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:12,633 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:14,696 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:16,758 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:23,758 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:25,821 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:32,821 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:34,883 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:35,540 [root] INFO: Analysis timeout hit, terminating analysis 2025-12-10 01:39:35,540 [lib.api.process] INFO: Terminate event set for <Process 3076 cmd.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 3076: Terminate Event: Attempting to dump process 3076 2025-12-10 01:39:35,540 [root] DEBUG: 3076: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-10 01:39:35,540 [root] DEBUG: 3076: Terminate Event: Current region empty 2025-12-10 01:39:35,540 [lib.api.process] INFO: Termination confirmed for <Process 3076 cmd.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 3076: Terminate Event: CAPE shutdown complete for process 3076 2025-12-10 01:39:35,540 [root] INFO: Terminate event set for process 3076 2025-12-10 01:39:35,540 [lib.api.process] INFO: Terminate event set for <Process 376 services.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 376: Terminate Event: Attempting to dump process 376 2025-12-10 01:39:35,540 [root] DEBUG: 376: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-10 01:39:35,540 [root] DEBUG: 376: Terminate Event: Current region empty 2025-12-10 01:39:35,540 [lib.api.process] INFO: Termination confirmed for <Process 376 services.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 376: Terminate Event: CAPE shutdown complete for process 376 2025-12-10 01:39:35,540 [root] INFO: Terminate event set for process 376 2025-12-10 01:39:35,540 [lib.api.process] INFO: Terminate event set for <Process 3732 svchost.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 3732: Terminate Event: Attempting to dump process 3732 2025-12-10 01:39:35,540 [root] DEBUG: 3732: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-10 01:39:35,540 [root] DEBUG: 3732: Terminate Event: Current region empty 2025-12-10 01:39:35,540 [lib.api.process] INFO: Termination confirmed for <Process 3732 svchost.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 3732: Terminate Event: CAPE shutdown complete for process 3732 2025-12-10 01:39:35,540 [root] INFO: Terminate event set for process 3732 2025-12-10 01:39:35,540 [lib.api.process] INFO: Terminate event set for <Process 3308 WinRAR.exe> 2025-12-10 01:39:35,540 [root] DEBUG: 3308: Terminate Event: Attempting to dump process 3308 2025-12-10 01:39:35,540 [root] DEBUG: 3308: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-10 01:39:35,571 [root] DEBUG: 3308: Terminate Event: Current region empty 2025-12-10 01:39:35,571 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2025-12-10 01:39:35,571 [root] DEBUG: 3308: Terminate Event: CAPE shutdown complete for process 3308 2025-12-10 01:39:35,571 [lib.api.process] INFO: Termination confirmed for <Process 3308 WinRAR.exe> 2025-12-10 01:39:35,571 [root] INFO: Terminate event set for process 3308 2025-12-10 01:39:35,571 [lib.api.process] INFO: Terminate event set for <Process 260 taskhost.exe> 2025-12-10 01:39:35,602 [root] DEBUG: 260: Terminate Event: Attempting to dump process 260 2025-12-10 01:39:35,618 [root] DEBUG: 260: VerifyCodeSection: Executable code does not match, 0x0 of 0xa2d4 matching 2025-12-10 01:39:35,618 [root] DEBUG: 260: DoProcessDump: Code modification detected, dumping Imagebase at 0x00D60000. 2025-12-10 01:39:35,618 [root] DEBUG: 260: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2025-12-10 01:39:35,665 [root] DEBUG: 260: DumpProcess: Instantiating PeParser with address: 0x00D60000. 2025-12-10 01:39:35,665 [root] DEBUG: 260: DumpProcess: Module entry point VA is 0x00003254. 2025-12-10 01:39:35,665 [lib.common.results] INFO: Uploading file C:\NkIdepa\CAPE\260_2726535391792122025 to procdump\d46686a421b057e91efeaf840b1a11f0c6f7821f3ee6a45524c4ce71958184ba; Size is 48640; Max size: 100000000 2025-12-10 01:39:35,665 [root] DEBUG: 260: DumpProcess: Module image dump success - dump size 0xbe00. 2025-12-10 01:39:35,665 [root] DEBUG: 260: Terminate Event: Current region empty 2025-12-10 01:39:35,665 [lib.api.process] INFO: Termination confirmed for <Process 260 taskhost.exe> 2025-12-10 01:39:35,665 [root] DEBUG: 260: Terminate Event: CAPE shutdown complete for process 260 2025-12-10 01:39:35,665 [root] INFO: Terminate event set for process 260 2025-12-10 01:39:35,665 [root] INFO: Created shutdown mutex 2025-12-10 01:39:36,665 [root] INFO: Shutting down package 2025-12-10 01:39:36,665 [root] INFO: Stopping auxiliary modules 2025-12-10 01:39:36,665 [root] INFO: Stopping auxiliary module: Browser 2025-12-10 01:39:36,665 [root] INFO: Stopping auxiliary module: Curtain 2025-12-10 01:39:36,680 [lib.common.results] INFO: Uploading file C:\curtain.log to curtain/1765301976.680664.curtain.log; Size is 36; Max size: 100000000 2025-12-10 01:39:36,680 [root] INFO: Stopping auxiliary module: End_noisy_tasks 2025-12-10 01:39:36,680 [root] INFO: Stopping auxiliary module: Evtx 2025-12-10 01:39:36,680 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Application.evtx to zip dump 2025-12-10 01:39:36,680 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\HardwareEvents.evtx to zip dump 2025-12-10 01:39:36,680 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Internet Explorer.evtx to zip dump 2025-12-10 01:39:36,680 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Key Management Service.evtx to zip dump 2025-12-10 01:39:36,680 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Microsoft-Windows-Sysmon%4Operational.evtx to zip dump 2025-12-10 01:39:36,711 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\OAlerts.evtx to zip dump 2025-12-10 01:39:36,711 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Security.evtx to zip dump 2025-12-10 01:39:36,711 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Setup.evtx to zip dump 2025-12-10 01:39:36,711 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\System.evtx to zip dump 2025-12-10 01:39:36,711 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Windows PowerShell.evtx to zip dump 2025-12-10 01:39:36,883 [modules.auxiliary.human] INFO: Found button "keep broken files", clicking it 2025-12-10 01:39:36,899 [modules.auxiliary.evtx] DEBUG: Uploading evtx.zip to host 2025-12-10 01:39:36,899 [lib.common.results] INFO: Uploading file evtx.zip to evtx/evtx.zip; Size is 341373; Max size: 100000000 2025-12-10 01:39:36,899 [root] INFO: Stopping auxiliary module: Human 2025-12-10 01:39:38,883 [root] INFO: Stopping auxiliary module: Pre_script 2025-12-10 01:39:38,883 [root] INFO: Stopping auxiliary module: Screenshots 2025-12-10 01:39:41,446 [root] INFO: Stopping auxiliary module: Usage 2025-12-10 01:39:42,274 [root] INFO: Stopping auxiliary module: During_script 2025-12-10 01:39:42,274 [root] INFO: Finishing auxiliary modules 2025-12-10 01:39:42,274 [root] INFO: Shutting down pipe server and dumping dropped files 2025-12-10 01:39:42,274 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Roaming\WinRAR\version.dat to files\6c89db51a072fcfb65c67d0d7d1e7cf9ef659537ab63d900f841d2213e7f2b3b; Size is 12; Max size: 100000000 2025-12-10 01:39:42,274 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat to files\42f9c76ccf7a86c64d1244263a0ff86751e86e025a5996c938bd49c2e24714a1; Size is 128; Max size: 100000000 2025-12-10 01:39:42,274 [root] WARNING: Folder at path "C:\NkIdepa\debugger" does not exist, skipping 2025-12-10 01:39:42,274 [root] WARNING: Folder at path "C:\NkIdepa\tlsdump" does not exist, skipping 2025-12-10 01:39:42,274 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7-32bit-3 | win7-32bit-3 | KVM | 2025-12-10 09:36:26 | 2025-12-10 09:39:49 | inetsim |
| File Name |
0a76c55fa88d4c134012a.xz
|
|---|---|
| File Type | XZ compressed data, checksum CRC64 |
| File Size | 17380 bytes |
| MD5 | 4c8dfaea2c3e8ec3d1fb2de73e398cb4 |
| SHA1 | cd11422fcececb8317ccd29e24637a0067b7e6c1 |
| SHA256 | 7cff2f40fac1d5e48e93d68be489ed467394860b31a731b5f5431821b8cea4bc [VT] [MWDB] [Bazaar] |
| SHA3-384 | 1bb27d903b0112f01506e62917eda59f7671d06d1d38fc66cd684f7267aa707fe7ad1b1c17b5c9e1323c5a44758859f2 |
| CRC32 | 334C711F |
| TLSH | T1C672C017CD4F836E2EFBE7C51344AFAE819059E0065C29D74E0D949AD3D02BDCAACD24 |
| Ssdeep | 384:zC9Q8gauiOzFal1p1eNDNeI/17M/jBI9QRJnaqbnay:zCAaoFMvSDgI/1EmQRzbnay |
| File Strings BinGraph Vba2Graph |
| Discovery | Command and Control | Execution | Defense Evasion | Privilege Escalation |
|
|
|
|---|
No hosts contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP