| Category | Package | Started | Completed | Duration | Options | Log(s) | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | 2025-12-08 16:29:07 | 2025-12-08 16:32:31 | 204 seconds | Show Options | Show Analysis Log | 8.2 |
vnc_port=5902
2025-12-06 09:30:10,766 [root] INFO: Date set to: 20251208T08:29:07, timeout set to: 180 2025-12-08 08:29:07,000 [root] DEBUG: Starting analyzer from: C:\tmphsls4wg6 2025-12-08 08:29:07,000 [root] DEBUG: Storing results at: C:\ufNkJOWpa 2025-12-08 08:29:07,000 [root] DEBUG: Pipe server name: \\.\PIPE\JGjpHu 2025-12-08 08:29:07,000 [root] DEBUG: Python path: C:\Python38 2025-12-08 08:29:07,000 [root] INFO: analysis running as an admin 2025-12-08 08:29:07,000 [root] DEBUG: no analysis package configured, picking one for you 2025-12-08 08:29:07,000 [root] INFO: analysis package selected: "zip" 2025-12-08 08:29:07,000 [root] DEBUG: importing analysis package module: "modules.packages.zip"... 2025-12-08 08:29:07,015 [root] DEBUG: imported analysis package "zip" 2025-12-08 08:29:07,015 [root] DEBUG: initializing analysis package "zip"... 2025-12-08 08:29:07,015 [lib.common.common] INFO: wrapping 2025-12-08 08:29:07,015 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-08 08:29:07,015 [root] DEBUG: New location of moved file: C:\Users\user\AppData\Local\Temp\5fbb6b4c69b23f4cdc69.zip 2025-12-08 08:29:07,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL option 2025-12-08 08:29:07,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a DLL_64 option 2025-12-08 08:29:07,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader option 2025-12-08 08:29:07,015 [root] INFO: Analyzer: Package modules.packages.zip does not specify a loader_64 option 2025-12-08 08:29:07,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser" 2025-12-08 08:29:07,046 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain" 2025-12-08 08:29:07,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise" 2025-12-08 08:29:07,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.during_script" 2025-12-08 08:29:07,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.end_noisy_tasks" 2025-12-08 08:29:07,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.evtx" 2025-12-08 08:29:07,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human" 2025-12-08 08:29:07,062 [root] DEBUG: Imported auxiliary module "modules.auxiliary.pre_script" 2025-12-08 08:29:07,062 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2025-12-08 08:29:07,093 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2025-12-08 08:29:07,093 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2025-12-08 08:29:07,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots" 2025-12-08 08:29:07,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon" 2025-12-08 08:29:07,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump" 2025-12-08 08:29:07,109 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage" 2025-12-08 08:29:07,109 [root] DEBUG: Initialized auxiliary module "Browser" 2025-12-08 08:29:07,109 [root] DEBUG: attempting to configure 'Browser' from data 2025-12-08 08:29:07,109 [root] DEBUG: module Browser does not support data configuration, ignoring 2025-12-08 08:29:07,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"... 2025-12-08 08:29:07,109 [root] DEBUG: Started auxiliary module modules.auxiliary.browser 2025-12-08 08:29:07,109 [root] DEBUG: Initialized auxiliary module "Curtain" 2025-12-08 08:29:07,109 [root] DEBUG: attempting to configure 'Curtain' from data 2025-12-08 08:29:07,109 [root] DEBUG: module Curtain does not support data configuration, ignoring 2025-12-08 08:29:07,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.curtain"... 2025-12-08 08:29:07,109 [root] DEBUG: Started auxiliary module modules.auxiliary.curtain 2025-12-08 08:29:07,109 [root] DEBUG: Initialized auxiliary module "Disguise" 2025-12-08 08:29:07,109 [root] DEBUG: attempting to configure 'Disguise' from data 2025-12-08 08:29:07,109 [root] DEBUG: module Disguise does not support data configuration, ignoring 2025-12-08 08:29:07,109 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"... 2025-12-08 08:29:07,125 [modules.auxiliary.disguise] INFO: Disguising GUID to 87ff9086-7beb-483f-be59-3166c30fba28 2025-12-08 08:29:07,125 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise 2025-12-08 08:29:07,125 [root] DEBUG: Initialized auxiliary module "End_noisy_tasks" 2025-12-08 08:29:07,125 [root] DEBUG: attempting to configure 'End_noisy_tasks' from data 2025-12-08 08:29:07,125 [root] DEBUG: module End_noisy_tasks does not support data configuration, ignoring 2025-12-08 08:29:07,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.end_noisy_tasks"... 2025-12-08 08:29:07,125 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wuauclt.exe 2025-12-08 08:29:07,125 [root] DEBUG: Started auxiliary module modules.auxiliary.end_noisy_tasks 2025-12-08 08:29:07,125 [root] DEBUG: Initialized auxiliary module "Evtx" 2025-12-08 08:29:07,125 [root] DEBUG: attempting to configure 'Evtx' from data 2025-12-08 08:29:07,125 [root] DEBUG: module Evtx does not support data configuration, ignoring 2025-12-08 08:29:07,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.evtx"... 2025-12-08 08:29:07,125 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable 2025-12-08 08:29:07,125 [root] DEBUG: Started auxiliary module modules.auxiliary.evtx 2025-12-08 08:29:07,125 [root] DEBUG: Initialized auxiliary module "Human" 2025-12-08 08:29:07,125 [root] DEBUG: attempting to configure 'Human' from data 2025-12-08 08:29:07,125 [root] DEBUG: module Human does not support data configuration, ignoring 2025-12-08 08:29:07,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"... 2025-12-08 08:29:07,125 [root] DEBUG: Started auxiliary module modules.auxiliary.human 2025-12-08 08:29:07,125 [root] DEBUG: Initialized auxiliary module "Pre_script" 2025-12-08 08:29:07,125 [root] DEBUG: attempting to configure 'Pre_script' from data 2025-12-08 08:29:07,125 [root] DEBUG: module Pre_script does not support data configuration, ignoring 2025-12-08 08:29:07,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.pre_script"... 2025-12-08 08:29:07,125 [root] DEBUG: Started auxiliary module modules.auxiliary.pre_script 2025-12-08 08:29:07,125 [root] DEBUG: Initialized auxiliary module "Screenshots" 2025-12-08 08:29:07,125 [root] DEBUG: attempting to configure 'Screenshots' from data 2025-12-08 08:29:07,125 [root] DEBUG: module Screenshots does not support data configuration, ignoring 2025-12-08 08:29:07,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"... 2025-12-08 08:29:07,125 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots 2025-12-08 08:29:07,125 [root] DEBUG: Initialized auxiliary module "Sysmon" 2025-12-08 08:29:07,125 [root] DEBUG: attempting to configure 'Sysmon' from data 2025-12-08 08:29:07,125 [root] DEBUG: module Sysmon does not support data configuration, ignoring 2025-12-08 08:29:07,125 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.sysmon"... 2025-12-08 08:29:07,187 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable 2025-12-08 08:29:07,234 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable 2025-12-08 08:29:07,234 [root] WARNING: Cannot execute auxiliary module modules.auxiliary.sysmon: In order to use the Sysmon functionality, it is required to have the SMaster(64|32).exe file and sysmonconfig-export.xml file in the bin path. Note that the SMaster(64|32).exe files are just the standard Sysmon binaries renamed to avoid anti-analysis detection techniques. 2025-12-08 08:29:07,234 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets" 2025-12-08 08:29:07,234 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data 2025-12-08 08:29:07,234 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring 2025-12-08 08:29:07,234 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"... 2025-12-08 08:29:07,234 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 392 2025-12-08 08:29:07,234 [lib.api.process] INFO: Monitor config for <Process 392 lsass.exe>: C:\tmphsls4wg6\dll\392.ini 2025-12-08 08:29:07,249 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2025-12-08 08:29:07,249 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:07,249 [root] DEBUG: Loader: Injecting process 392 with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:07,281 [root] DEBUG: 392: Python path set to 'C:\Python38'. 2025-12-08 08:29:07,281 [root] INFO: Disabling sleep skipping. 2025-12-08 08:29:07,281 [root] DEBUG: 392: TLS secret dump mode enabled. 2025-12-08 08:29:07,281 [root] DEBUG: 392: Monitor initialised: 32-bit capemon loaded in process 392 at 0x6c9a0000, thread 3156, image base 0x570000, stack from 0x1096000-0x10a0000 2025-12-08 08:29:07,281 [root] DEBUG: 392: Commandline: C:\Windows\system32\lsass.exe 2025-12-08 08:29:07,281 [root] DEBUG: 392: Hooked 5 out of 5 functions 2025-12-08 08:29:07,281 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable 2025-12-08 08:29:07,296 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-08 08:29:07,296 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:07,296 [lib.api.process] INFO: Injected into 32-bit <Process 392 lsass.exe> 2025-12-08 08:29:07,296 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump 2025-12-08 08:29:07,296 [root] DEBUG: Initialized auxiliary module "Usage" 2025-12-08 08:29:07,296 [root] DEBUG: attempting to configure 'Usage' from data 2025-12-08 08:29:07,296 [root] DEBUG: module Usage does not support data configuration, ignoring 2025-12-08 08:29:07,296 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.usage"... 2025-12-08 08:29:07,296 [root] DEBUG: Started auxiliary module modules.auxiliary.usage 2025-12-08 08:29:07,296 [root] DEBUG: Initialized auxiliary module "During_script" 2025-12-08 08:29:07,296 [root] DEBUG: attempting to configure 'During_script' from data 2025-12-08 08:29:07,296 [root] DEBUG: module During_script does not support data configuration, ignoring 2025-12-08 08:29:07,296 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.during_script"... 2025-12-08 08:29:07,312 [root] DEBUG: Started auxiliary module modules.auxiliary.during_script 2025-12-08 08:29:07,312 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM wusa.exe 2025-12-08 08:29:07,343 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable 2025-12-08 08:29:07,375 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM WindowsUpdate.exe 2025-12-08 08:29:07,375 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logon" /success:enable /failure:enable 2025-12-08 08:29:07,406 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Logoff" /success:enable /failure:enable 2025-12-08 08:29:07,406 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM GoogleUpdate.exe 2025-12-08 08:29:07,421 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable 2025-12-08 08:29:07,453 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable 2025-12-08 08:29:07,453 [modules.auxiliary.end_noisy_tasks] DEBUG: taskkill /f /IM MicrosoftEdgeUpdate.exe 2025-12-08 08:29:07,468 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable 2025-12-08 08:29:07,484 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable 2025-12-08 08:29:07,500 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable 2025-12-08 08:29:07,515 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f 2025-12-08 08:29:07,515 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable 2025-12-08 08:29:07,531 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f 2025-12-08 08:29:07,546 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable 2025-12-08 08:29:07,546 [modules.auxiliary.end_noisy_tasks] DEBUG: Command executed with exit code 0: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" /v EnableICMPRedirect /t REG_DWORD /d 0 /f 2025-12-08 08:29:07,562 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File System" /success:enable /failure:enable 2025-12-08 08:29:07,578 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Registry" /success:enable /failure:enable 2025-12-08 08:29:07,593 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable 2025-12-08 08:29:07,609 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"SAM" /success:disable /failure:disable 2025-12-08 08:29:07,625 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable 2025-12-08 08:29:07,625 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable 2025-12-08 08:29:07,640 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable 2025-12-08 08:29:07,656 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"File Share" /success:enable /failure:enable 2025-12-08 08:29:07,671 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable 2025-12-08 08:29:07,687 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable 2025-12-08 08:29:07,703 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable 2025-12-08 08:29:07,718 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable 2025-12-08 08:29:07,734 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable 2025-12-08 08:29:07,750 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable 2025-12-08 08:29:07,765 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable 2025-12-08 08:29:07,781 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable 2025-12-08 08:29:07,796 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable 2025-12-08 08:29:07,812 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable 2025-12-08 08:29:07,828 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable 2025-12-08 08:29:07,843 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable 2025-12-08 08:29:07,859 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable 2025-12-08 08:29:07,875 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable 2025-12-08 08:29:07,875 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable 2025-12-08 08:29:07,890 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable 2025-12-08 08:29:07,906 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable 2025-12-08 08:29:07,921 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable 2025-12-08 08:29:07,937 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable 2025-12-08 08:29:07,953 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable 2025-12-08 08:29:07,968 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:enable 2025-12-08 08:29:07,984 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable 2025-12-08 08:29:08,000 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable 2025-12-08 08:29:08,015 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable 2025-12-08 08:29:08,031 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable 2025-12-08 08:29:08,046 [modules.auxiliary.evtx] DEBUG: Enabling advanced logging -> auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable 2025-12-08 08:29:08,062 [modules.auxiliary.evtx] DEBUG: Wiping Application 2025-12-08 08:29:08,078 [modules.auxiliary.evtx] DEBUG: Wiping HardwareEvents 2025-12-08 08:29:08,078 [modules.auxiliary.evtx] DEBUG: Wiping Internet Explorer 2025-12-08 08:29:08,093 [modules.auxiliary.evtx] DEBUG: Wiping Key Management Service 2025-12-08 08:29:08,109 [modules.auxiliary.evtx] DEBUG: Wiping OAlerts 2025-12-08 08:29:08,125 [modules.auxiliary.evtx] DEBUG: Wiping Security 2025-12-08 08:29:08,140 [modules.auxiliary.evtx] DEBUG: Wiping Setup 2025-12-08 08:29:08,156 [modules.auxiliary.evtx] DEBUG: Wiping System 2025-12-08 08:29:08,171 [modules.auxiliary.evtx] DEBUG: Wiping Windows PowerShell 2025-12-08 08:29:08,171 [modules.auxiliary.evtx] DEBUG: Wiping Microsoft-Windows-Sysmon/Operational 2025-12-08 08:29:12,531 [root] INFO: Restarting WMI Service 2025-12-08 08:29:14,562 [root] DEBUG: package modules.packages.zip does not support configure, ignoring 2025-12-08 08:29:14,562 [root] WARNING: configuration error for package modules.packages.zip: error importing data.packages.zip: No module named 'data.packages' 2025-12-08 08:29:14,562 [lib.common.zip_utils] DEBUG: Archive is encrypted, using default password value: infected 2025-12-08 08:29:14,562 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'l', 'C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip'] 2025-12-08 08:29:14,593 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-p', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip'] 2025-12-08 08:29:14,609 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 22.01 (x86) : Copyright (c) 1999-2022 Igor Pavlov : 2022-07-15\r\n\r\nScanning the drive for archives:\r\n1 file, 410490 bytes (401 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip\r\nType = zip\r\nPhysical Size = 410490\r\n\r\n\r\nSub items Errors: 1\r\n\r\nArchives with Errors: 1\r\n\r\nSub items Errors: 1\r\n' b'ERROR: Wrong password : 5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar\r\n' 2025-12-08 08:29:14,625 [lib.common.zip_utils] DEBUG: ['C:\\Program Files\\7-Zip\\7z.exe', 'x', '-pinfected', '-y', '-oC:\\Users\\user\\AppData\\Local\\Temp', 'C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip'] 2025-12-08 08:29:14,640 [lib.common.zip_utils] DEBUG: b'\r\n7-Zip 22.01 (x86) : Copyright (c) 1999-2022 Igor Pavlov : 2022-07-15\r\n\r\nScanning the drive for archives:\r\n1 file, 410490 bytes (401 KiB)\r\n\r\nExtracting archive: C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip\r\n--\r\nPath = C:\\Users\\user\\AppData\\Local\\Temp\\5fbb6b4c69b23f4cdc69.zip\r\nType = zip\r\nPhysical Size = 410490\r\n\r\nEverything is Ok\r\n\r\nSize: 410169\r\nCompressed: 410490\r\n' b'' 2025-12-08 08:29:14,640 [lib.common.zip_utils] INFO: Uploading C:\Users\user\AppData\Local\Temp\5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar to host 2025-12-08 08:29:14,640 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Temp\5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar to files/5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92; Size is 410169; Max size: 100000000 2025-12-08 08:29:14,656 [modules.packages.zip] DEBUG: No interesting files found, auto executing the first file: 5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar 2025-12-08 08:29:14,656 [modules.packages.zip] DEBUG: Missing file option, auto executing: ['5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar'] 2025-12-08 08:29:14,656 [lib.core.compound] INFO: C:\Users\user\AppData\Local\Temp already exists, skipping creation 2025-12-08 08:29:14,656 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c "cd ^"C:\Users\user\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\user\AppData\Local\Temp\5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar^"" with pid 2992 2025-12-08 08:29:14,656 [lib.api.process] INFO: Monitor config for <Process 2992 cmd.exe>: C:\tmphsls4wg6\dll\2992.ini 2025-12-08 08:29:14,656 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:14,656 [root] DEBUG: Loader: Injecting process 2992 (thread 2948) with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:14,656 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:29:14,656 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:14,656 [lib.api.process] INFO: Injected into 32-bit <Process 2992 cmd.exe> 2025-12-08 08:29:16,656 [lib.api.process] INFO: Successfully resumed <Process 2992 cmd.exe> 2025-12-08 08:29:16,671 [root] DEBUG: 2992: Python path set to 'C:\Python38'. 2025-12-08 08:29:16,671 [root] INFO: Disabling sleep skipping. 2025-12-08 08:29:16,671 [root] DEBUG: 2992: Dropped file limit defaulting to 100. 2025-12-08 08:29:16,671 [root] DEBUG: 2992: YaraInit: Compiled 41 rule files 2025-12-08 08:29:16,671 [root] DEBUG: 2992: YaraInit: Compiled rules saved to file C:\tmphsls4wg6\data\yara\capemon.yac 2025-12-08 08:29:16,671 [root] DEBUG: 2992: YaraScan: Scanning 0x49E70000, size 0x4bb2e 2025-12-08 08:29:16,671 [root] DEBUG: 2992: Monitor initialised: 32-bit capemon loaded in process 2992 at 0x6c9a0000, thread 2948, image base 0x49e70000, stack from 0x1b3000-0x2b0000 2025-12-08 08:29:16,671 [root] DEBUG: 2992: Commandline: "C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\user\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\user\AppData\Local\Temp\5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar^" 2025-12-08 08:29:16,671 [root] DEBUG: 2992: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine 2025-12-08 08:29:16,687 [root] DEBUG: 2992: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress 2025-12-08 08:29:16,687 [root] DEBUG: 2992: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18) 2025-12-08 08:29:16,687 [root] DEBUG: 2992: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb) 2025-12-08 08:29:16,687 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:29:16,687 [root] DEBUG: 2992: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:29:16,687 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:29:16,687 [root] DEBUG: 2992: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:29:16,687 [root] DEBUG: 2992: Hooked 611 out of 613 functions 2025-12-08 08:29:16,687 [root] DEBUG: 2992: WoW64 not detected. 2025-12-08 08:29:16,687 [root] INFO: Loaded monitor into process with pid 2992 2025-12-08 08:29:16,687 [root] DEBUG: 2992: caller_dispatch: Added region at 0x49E70000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x49E77CBD, thread 2948). 2025-12-08 08:29:16,687 [root] DEBUG: 2992: YaraScan: Scanning 0x49E70000, size 0x4bb2e 2025-12-08 08:29:16,687 [root] DEBUG: 2992: ProcessImageBase: Main module image at 0x49E70000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:29:16,750 [root] DEBUG: 2992: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes). 2025-12-08 08:29:16,750 [root] DEBUG: 2992: DLL loaded at 0x743F0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes). 2025-12-08 08:29:16,750 [root] DEBUG: 2992: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes). 2025-12-08 08:29:16,750 [root] DEBUG: 2992: DLL loaded at 0x74170000: C:\Windows\system32\uxtheme (0x40000 bytes). 2025-12-08 08:29:16,750 [root] DEBUG: 2992: DLL loaded at 0x742B0000: C:\Windows\system32\PROPSYS (0xf5000 bytes). 2025-12-08 08:29:16,750 [root] DEBUG: 2992: DLL loaded at 0x75D80000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes). 2025-12-08 08:29:16,765 [root] DEBUG: 2992: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes). 2025-12-08 08:29:16,765 [root] DEBUG: 2992: DLL loaded at 0x73A90000: C:\Windows\system32\ntmarta (0x21000 bytes). 2025-12-08 08:29:16,765 [root] DEBUG: 2992: DLL loaded at 0x75810000: C:\Windows\system32\WLDAP32 (0x45000 bytes). 2025-12-08 08:29:16,765 [root] DEBUG: 2992: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:16,781 [root] DEBUG: 2992: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes). 2025-12-08 08:29:16,781 [root] DEBUG: 2992: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-08 08:29:16,781 [root] DEBUG: 2992: api-rate-cap: NtQueryValueKey hook disabled due to rate 2025-12-08 08:29:16,812 [root] DEBUG: 2992: DLL loaded at 0x75390000: C:\Windows\system32\apphelp (0x4c000 bytes). 2025-12-08 08:29:16,812 [root] DEBUG: 2992: DLL loaded at 0x6EC30000: C:\Windows\System32\shdocvw (0x2e000 bytes). 2025-12-08 08:29:16,812 [root] DEBUG: 2992: DLL loaded at 0x75F60000: C:\Windows\system32\SETUPAPI (0x19d000 bytes). 2025-12-08 08:29:16,812 [root] DEBUG: 2992: DLL loaded at 0x755D0000: C:\Windows\system32\CFGMGR32 (0x27000 bytes). 2025-12-08 08:29:16,812 [root] DEBUG: 2992: DLL loaded at 0x757A0000: C:\Windows\system32\DEVOBJ (0x12000 bytes). 2025-12-08 08:29:16,812 [root] DEBUG: 2992: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:16,812 [root] DEBUG: 2992: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:16,843 [root] DEBUG: 2992: CreateProcessHandler: Injection info set for new process 3576: C:\Program Files\WinRAR\WinRAR.exe, ImageBase: 0x01220000 2025-12-08 08:29:16,843 [root] INFO: Announced 32-bit process name: WinRAR.exe pid: 3576 2025-12-08 08:29:16,843 [lib.api.process] INFO: Monitor config for <Process 3576 WinRAR.exe>: C:\tmphsls4wg6\dll\3576.ini 2025-12-08 08:29:16,843 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:16,843 [root] DEBUG: Loader: Injecting process 3576 (thread 3552) with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:16,843 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:29:16,843 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:16,843 [lib.api.process] INFO: Injected into 32-bit <Process 3576 WinRAR.exe> 2025-12-08 08:29:16,859 [root] INFO: Announced 32-bit process name: WinRAR.exe pid: 3576 2025-12-08 08:29:16,859 [lib.api.process] INFO: Monitor config for <Process 3576 WinRAR.exe>: C:\tmphsls4wg6\dll\3576.ini 2025-12-08 08:29:16,859 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:16,859 [root] DEBUG: Loader: Injecting process 3576 (thread 3552) with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:16,859 [root] DEBUG: InjectDllViaIAT: This image has already been patched. 2025-12-08 08:29:16,859 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:16,859 [lib.api.process] INFO: Injected into 32-bit <Process 3576 WinRAR.exe> 2025-12-08 08:29:16,875 [root] DEBUG: 2992: DLL loaded at 0x73AC0000: C:\Windows\system32\sfc (0x3000 bytes). 2025-12-08 08:29:16,875 [root] DEBUG: 2992: DLL loaded at 0x72750000: C:\Windows\system32\sfc_os (0xd000 bytes). 2025-12-08 08:29:16,875 [root] DEBUG: 2992: DLL loaded at 0x74C40000: C:\Windows\system32\DEVRTL (0xe000 bytes). 2025-12-08 08:29:16,875 [root] DEBUG: 2992: DLL loaded at 0x72260000: C:\Windows\system32\MPR (0x12000 bytes). 2025-12-08 08:29:16,890 [root] INFO: Announced starting service "b'PcaSvc'" 2025-12-08 08:29:16,890 [lib.api.process] INFO: Monitor config for <Process 376 services.exe>: C:\tmphsls4wg6\dll\376.ini 2025-12-08 08:29:16,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:16,906 [root] DEBUG: Loader: Injecting process 376 with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:16,906 [root] DEBUG: 376: Python path set to 'C:\Python38'. 2025-12-08 08:29:16,906 [root] INFO: Disabling sleep skipping. 2025-12-08 08:29:16,906 [root] DEBUG: 376: Dropped file limit defaulting to 100. 2025-12-08 08:29:16,906 [root] DEBUG: 376: parent_has_path: unable to get path for parent process 328 2025-12-08 08:29:16,906 [root] DEBUG: 376: YaraInit: Compiled rules loaded from existing file C:\tmphsls4wg6\data\yara\capemon.yac 2025-12-08 08:29:16,906 [root] DEBUG: 376: YaraScan: Scanning 0x00A70000, size 0x40944 2025-12-08 08:29:16,906 [root] DEBUG: 376: Monitor initialised: 32-bit capemon loaded in process 376 at 0x6c9a0000, thread 3596, image base 0xa70000, stack from 0xc66000-0xc70000 2025-12-08 08:29:16,906 [root] DEBUG: 376: Commandline: C:\Windows\system32\services.exe 2025-12-08 08:29:16,906 [root] DEBUG: 376: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine 2025-12-08 08:29:16,906 [root] DEBUG: 376: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress 2025-12-08 08:29:16,906 [root] DEBUG: 376: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18) 2025-12-08 08:29:16,921 [root] DEBUG: 376: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb) 2025-12-08 08:29:16,921 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:29:16,921 [root] DEBUG: 376: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:29:16,921 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:29:16,921 [root] DEBUG: 376: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:29:16,921 [root] DEBUG: 376: Hooked 611 out of 613 functions 2025-12-08 08:29:16,921 [root] DEBUG: 376: WoW64 not detected. 2025-12-08 08:29:16,921 [root] INFO: Loaded monitor into process with pid 376 2025-12-08 08:29:16,921 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-08 08:29:16,921 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:16,921 [lib.api.process] INFO: Injected into 32-bit <Process 376 services.exe> 2025-12-08 08:29:18,921 [root] DEBUG: 376: caller_dispatch: Added region at 0x00A70000 to tracked regions list (ntdll::memcpy returns to 0x00A72979, thread 3128). 2025-12-08 08:29:18,921 [root] DEBUG: 376: YaraScan: Scanning 0x00A70000, size 0x40944 2025-12-08 08:29:18,921 [root] DEBUG: 376: ProcessImageBase: Main module image at 0x00A70000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:29:18,921 [root] DEBUG: 376: CreateProcessHandler: Injection info set for new process 3820: C:\Windows\system32\svchost.exe, ImageBase: 0x00F00000 2025-12-08 08:29:18,921 [root] INFO: Announced 32-bit process name: svchost.exe pid: 3820 2025-12-08 08:29:18,921 [lib.api.process] INFO: Monitor config for <Process 3820 svchost.exe>: C:\tmphsls4wg6\dll\3820.ini 2025-12-08 08:29:18,921 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:18,921 [root] DEBUG: Loader: Injecting process 3820 (thread 3780) with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:18,921 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT. 2025-12-08 08:29:18,937 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:18,937 [lib.api.process] INFO: Injected into 32-bit <Process 3820 svchost.exe> 2025-12-08 08:29:18,937 [root] INFO: Announced 32-bit process name: svchost.exe pid: 3820 2025-12-08 08:29:18,937 [lib.api.process] INFO: Monitor config for <Process 3820 svchost.exe>: C:\tmphsls4wg6\dll\3820.ini 2025-12-08 08:29:18,937 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:18,937 [root] DEBUG: Loader: Injecting process 3820 (thread 3780) with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:18,937 [root] DEBUG: InjectDllViaIAT: This image has already been patched. 2025-12-08 08:29:18,937 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:18,937 [lib.api.process] INFO: Injected into 32-bit <Process 3820 svchost.exe> 2025-12-08 08:29:18,937 [root] DEBUG: 3820: Python path set to 'C:\Python38'. 2025-12-08 08:29:18,937 [root] DEBUG: 3820: Dropped file limit defaulting to 100. 2025-12-08 08:29:18,937 [root] DEBUG: 3820: parent_has_path: unable to get path for parent process 376 2025-12-08 08:29:18,937 [root] INFO: Disabling sleep skipping. 2025-12-08 08:29:18,953 [root] DEBUG: 3820: YaraInit: Compiled rules loaded from existing file C:\tmphsls4wg6\data\yara\capemon.yac 2025-12-08 08:29:18,953 [root] DEBUG: 3820: YaraScan: Scanning 0x00F00000, size 0x73ca 2025-12-08 08:29:18,953 [root] DEBUG: 3820: Monitor initialised: 32-bit capemon loaded in process 3820 at 0x6c9a0000, thread 3780, image base 0xf00000, stack from 0x146000-0x150000 2025-12-08 08:29:18,953 [root] DEBUG: 3820: Commandline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted 2025-12-08 08:29:18,953 [root] DEBUG: 3820: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine 2025-12-08 08:29:18,953 [root] DEBUG: 3820: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress 2025-12-08 08:29:18,953 [root] DEBUG: 3820: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18) 2025-12-08 08:29:18,953 [root] DEBUG: 3820: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb) 2025-12-08 08:29:18,953 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:29:18,953 [root] DEBUG: 3820: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:29:18,953 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:29:18,953 [root] DEBUG: 3820: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:29:18,968 [root] DEBUG: 3820: Hooked 611 out of 613 functions 2025-12-08 08:29:18,968 [root] DEBUG: 3820: WoW64 not detected. 2025-12-08 08:29:18,968 [root] INFO: Loaded monitor into process with pid 3820 2025-12-08 08:29:18,968 [root] DEBUG: 3820: caller_dispatch: Added region at 0x00F00000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x00F01E10, thread 3780). 2025-12-08 08:29:18,968 [root] DEBUG: 3820: YaraScan: Scanning 0x00F00000, size 0x73ca 2025-12-08 08:29:18,968 [root] DEBUG: 3820: ProcessImageBase: Main module image at 0x00F00000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:29:18,968 [root] DEBUG: 3820: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes). 2025-12-08 08:29:18,968 [root] DEBUG: 3820: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes). 2025-12-08 08:29:18,968 [root] DEBUG: 3820: DLL loaded at 0x75D80000: C:\Windows\system32\OLEAUT32 (0x8f000 bytes). 2025-12-08 08:29:18,968 [root] DEBUG: 3820: DLL loaded at 0x71CF0000: c:\windows\system32\pcasvc (0x28000 bytes). 2025-12-08 08:29:18,968 [root] DEBUG: 3820: DLL loaded at 0x75390000: c:\windows\system32\apphelp (0x4c000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x719B0000: c:\windows\system32\AEPIC (0x35000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x766D0000: C:\Windows\system32\SHELL32 (0xc4c000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x72750000: c:\windows\system32\sfc (0x3000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x73AC0000: c:\windows\system32\sfc_os (0xd000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x74960000: c:\windows\system32\VERSION (0x9000 bytes). 2025-12-08 08:29:18,984 [root] INFO: Announced starting service "b'PcaSvc'" 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x750A0000: c:\windows\system32\wevtapi (0x42000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2025-12-08 08:29:18,984 [root] DEBUG: 3820: api-rate-cap: RegEnumKeyExW hook disabled due to rate 2025-12-08 08:29:18,984 [root] DEBUG: 3820: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:19,984 [root] DEBUG: 3820: OpenProcessHandler: Injection info created for process 2992, handle 0x1ac: C:\Windows\System32\cmd.exe 2025-12-08 08:29:19,984 [root] DEBUG: 3820: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:20,000 [root] DEBUG: 3820: OpenProcessHandler: Image base for process 3576 (handle 0x1b4): 0x01220000. 2025-12-08 08:29:20,000 [root] DEBUG: 3820: OpenProcessHandler: Injection info created for process 3576, handle 0x1b4: C:\Program Files\WinRAR\WinRAR.exe 2025-12-08 08:29:20,015 [root] DEBUG: 3576: Python path set to 'C:\Python38'. 2025-12-08 08:29:20,015 [root] DEBUG: 3576: Dropped file limit defaulting to 100. 2025-12-08 08:29:20,015 [root] INFO: Disabling sleep skipping. 2025-12-08 08:29:20,031 [root] DEBUG: 3576: YaraInit: Compiled rules loaded from existing file C:\tmphsls4wg6\data\yara\capemon.yac 2025-12-08 08:29:20,031 [root] DEBUG: 3576: YaraScan: Scanning 0x01220000, size 0x30b36e 2025-12-08 08:29:20,031 [root] DEBUG: 3576: Monitor initialised: 32-bit capemon loaded in process 3576 at 0x6c9a0000, thread 3552, image base 0x1220000, stack from 0x1c6000-0x1d0000 2025-12-08 08:29:20,031 [root] DEBUG: 3576: Commandline: "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\user\AppData\Local\Temp\5fbb6b4c69b23f4cdc6964e6e7c403bcf4ebfbd5e1c210999ef7632d1e5fcf92.rar" 2025-12-08 08:29:20,046 [root] DEBUG: 3576: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine 2025-12-08 08:29:20,046 [root] DEBUG: 3576: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress 2025-12-08 08:29:20,046 [root] DEBUG: 3576: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18) 2025-12-08 08:29:20,046 [root] DEBUG: 3576: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb) 2025-12-08 08:29:20,046 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:29:20,046 [root] DEBUG: 3576: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:29:20,046 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:29:20,046 [root] DEBUG: 3576: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:29:20,046 [root] DEBUG: 3576: Hooked 611 out of 613 functions 2025-12-08 08:29:20,046 [root] DEBUG: 3576: WoW64 not detected. 2025-12-08 08:29:20,046 [root] INFO: Loaded monitor into process with pid 3576 2025-12-08 08:29:20,062 [root] DEBUG: 3576: caller_dispatch: Added region at 0x01220000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x0133EDD6, thread 3552). 2025-12-08 08:29:20,062 [root] DEBUG: 3576: YaraScan: Scanning 0x01220000, size 0x30b36e 2025-12-08 08:29:20,078 [root] DEBUG: 3576: ProcessImageBase: Main module image at 0x01220000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:29:20,078 [root] DEBUG: 3576: DLL loaded at 0x753E0000: C:\Windows\system32\CRYPTBASE (0xc000 bytes). 2025-12-08 08:29:20,078 [root] DEBUG: 3576: DLL loaded at 0x76100000: C:\Windows\system32\CLBCatQ (0x83000 bytes). 2025-12-08 08:29:20,078 [root] DEBUG: 3576: DLL loaded at 0x742B0000: C:\Windows\system32\propsys (0xf5000 bytes). 2025-12-08 08:29:20,078 [root] DEBUG: 3576: DLL loaded at 0x73A90000: C:\Windows\system32\ntmarta (0x21000 bytes). 2025-12-08 08:29:20,093 [root] DEBUG: 3576: DLL loaded at 0x75810000: C:\Windows\system32\WLDAP32 (0x45000 bytes). 2025-12-08 08:29:20,093 [root] DEBUG: 3576: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:20,093 [root] DEBUG: 3576: DLL loaded at 0x70ED0000: C:\Windows\system32\riched20 (0x76000 bytes). 2025-12-08 08:29:20,125 [root] DEBUG: 3576: api-rate-cap: RegCloseKey hook disabled due to rate 2025-12-08 08:29:20,140 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Roaming\WinRAR\version.dat 2025-12-08 08:29:20,156 [root] DEBUG: 3576: DLL loaded at 0x73E80000: C:\Windows\system32\dwmapi (0x13000 bytes). 2025-12-08 08:29:20,171 [root] DEBUG: 3576: DLL loaded at 0x6E990000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0x58000 bytes). 2025-12-08 08:29:20,171 [root] DEBUG: 3576: DLL loaded at 0x73D20000: C:\Windows\system32\WindowsCodecs (0x130000 bytes). 2025-12-08 08:29:20,171 [root] DEBUG: 3576: DLL loaded at 0x75390000: C:\Windows\system32\apphelp (0x4c000 bytes). 2025-12-08 08:29:20,171 [root] DEBUG: 3576: DLL loaded at 0x6EF30000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\FileSyncShell (0x1ff000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x75920000: C:\Windows\system32\WININET (0x1e4000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x75610000: C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x757E0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x75620000: C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x74960000: C:\Windows\system32\version (0x9000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x75600000: C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes). 2025-12-08 08:29:20,187 [root] DEBUG: 3576: DLL loaded at 0x77630000: C:\Windows\system32\normaliz (0x3000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x761B0000: C:\Windows\system32\iertutil (0x232000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x755C0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x757C0000: C:\Windows\system32\USERENV (0x17000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x754D0000: C:\Windows\system32\profapi (0xb000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x6EE40000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\MSVCP120 (0x71000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x6ED50000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\MSVCR120 (0xee000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x6EBE0000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\LoggingPlatform (0x18000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x6EBD0000: C:\Windows\system32\WSOCK32 (0x7000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x6EB80000: C:\Users\user\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\Telemetry (0x4f000 bytes). 2025-12-08 08:29:20,203 [root] DEBUG: 3576: DLL loaded at 0x77640000: C:\Windows\system32\PSAPI (0x5000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x73220000: C:\Windows\system32\Cabinet (0x15000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x72BF0000: C:\Windows\system32\WINHTTP (0x58000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x72BA0000: C:\Windows\system32\webio (0x50000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x6EB40000: C:\Windows\system32\EhStorShell (0x31000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x6EAD0000: C:\Windows\System32\cscui (0x6a000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x6EF20000: C:\Windows\System32\CSCDLL (0x9000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x6F130000: C:\Windows\system32\CSCAPI (0xb000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x6ECE0000: C:\Windows\system32\ntshrui (0x70000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x752C0000: C:\Windows\system32\srvcli (0x19000 bytes). 2025-12-08 08:29:20,218 [root] DEBUG: 3576: DLL loaded at 0x73530000: C:\Windows\system32\slc (0xa000 bytes). 2025-12-08 08:29:20,312 [root] DEBUG: 3576: DLL loaded at 0x72260000: C:\Windows\system32\MPR (0x12000 bytes). 2025-12-08 08:29:20,312 [root] DEBUG: 3576: DLL loaded at 0x71AE0000: C:\Windows\System32\drprov (0x8000 bytes). 2025-12-08 08:29:20,328 [root] DEBUG: 3576: DLL loaded at 0x75070000: C:\Windows\System32\WINSTA (0x29000 bytes). 2025-12-08 08:29:20,328 [root] DEBUG: 3576: DLL loaded at 0x71170000: C:\Windows\System32\ntlanman (0x14000 bytes). 2025-12-08 08:29:20,328 [root] DEBUG: 3576: DLL loaded at 0x71150000: C:\Windows\System32\davclnt (0x17000 bytes). 2025-12-08 08:29:20,328 [root] DEBUG: 3576: DLL loaded at 0x71140000: C:\Windows\System32\DAVHLPR (0x8000 bytes). 2025-12-08 08:29:20,328 [root] DEBUG: 3576: DLL loaded at 0x73AF0000: C:\Windows\system32\wkscli (0xf000 bytes). 2025-12-08 08:29:20,328 [root] DEBUG: 3576: DLL loaded at 0x73B00000: C:\Windows\system32\netutils (0x9000 bytes). 2025-12-08 08:29:20,359 [root] DEBUG: 3576: DLL loaded at 0x6BA10000: C:\Windows\system32\wpdshext (0x238000 bytes). 2025-12-08 08:29:20,359 [root] DEBUG: 3576: DLL loaded at 0x6E660000: C:\Windows\system32\WINMM (0x32000 bytes). 2025-12-08 08:29:20,359 [root] DEBUG: 3576: DLL loaded at 0x726B0000: C:\Windows\system32\PortableDeviceApi (0x89000 bytes). 2025-12-08 08:29:20,359 [root] DEBUG: 3576: DLL loaded at 0x75630000: C:\Windows\system32\WINTRUST (0x2f000 bytes). 2025-12-08 08:29:20,359 [root] DEBUG: 3576: set_hooks_by_export_directory: Hooked 0 out of 613 functions 2025-12-08 08:29:20,359 [root] DEBUG: 3576: DLL loaded at 0x6FCA0000: C:\Windows\system32\audiodev (0x3f000 bytes). 2025-12-08 08:29:20,390 [root] DEBUG: 3576: DLL loaded at 0x6B7A0000: C:\Windows\system32\WMVCore (0x267000 bytes). 2025-12-08 08:29:20,390 [root] DEBUG: 3576: DLL loaded at 0x6DE20000: C:\Windows\system32\WMASF (0x3d000 bytes). 2025-12-08 08:29:20,390 [root] DEBUG: 3576: DLL loaded at 0x6DDF0000: C:\Windows\system32\EhStorAPI (0x22000 bytes). 2025-12-08 08:29:20,390 [root] DEBUG: 3576: DLL loaded at 0x6EC30000: C:\Windows\System32\shdocvw (0x2e000 bytes). 2025-12-08 08:29:20,406 [root] DEBUG: 3576: DLL loaded at 0x75350000: C:\Windows\system32\Secur32 (0x8000 bytes). 2025-12-08 08:29:20,406 [root] DEBUG: 392: DLL loaded at 0x75810000: C:\Windows\system32\WLDAP32 (0x45000 bytes). 2025-12-08 08:29:20,421 [root] DEBUG: 3576: api-rate-cap: RegQueryValueExW hook disabled due to rate 2025-12-08 08:29:20,453 [root] DEBUG: 3576: DLL loaded at 0x74ED0000: C:\Windows\system32\CRYPTSP (0x16000 bytes). 2025-12-08 08:29:20,453 [root] DEBUG: 3576: DLL loaded at 0x74C60000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2025-12-08 08:29:20,468 [root] DEBUG: 3576: caller_dispatch: Added region at 0x005E0000 to tracked regions list (user32::GetSystemMetrics returns to 0x0074006F, thread 3552). 2025-12-08 08:29:20,468 [root] DEBUG: 3576: DumpPEsInRange: Scanning range 0x005E0000 - 0x005F8FFF. 2025-12-08 08:29:20,468 [root] DEBUG: 3576: ScanForDisguisedPE: No PE image located in range 0x005E0000-0x005F8FFF. 2025-12-08 08:29:20,468 [lib.common.results] INFO: Uploading file C:\ufNkJOWpa\CAPE\3576_11558196104981122025 to CAPE\acd4a1af30f96dbc25de78cc5480041efb4d38064a463dc559aed34e5a282472; Size is 102399; Max size: 100000000 2025-12-08 08:29:20,468 [root] DEBUG: 3576: DumpMemory: Payload successfully created: C:\ufNkJOWpa\CAPE\3576_11558196104981122025 (size 102399 bytes) 2025-12-08 08:29:20,468 [root] DEBUG: 3576: DumpRegion: Dumped entire allocation from 0x005E0000, size 102400 bytes. 2025-12-08 08:29:20,468 [root] DEBUG: 3576: ProcessTrackedRegion: Dumped region at 0x005E0000. 2025-12-08 08:29:20,468 [root] DEBUG: 3576: YaraScan: Scanning 0x005E0000, size 0x18fff 2025-12-08 08:29:20,468 [root] DEBUG: 3576: GetEntropy: Error - Supplied address inaccessible: 0x000D0000 2025-12-08 08:29:20,484 [root] DEBUG: 3576: AddTrackedRegion: GetEntropy failed. 2025-12-08 08:29:20,484 [root] DEBUG: 3576: caller_dispatch: Added region at 0x000D0000 to tracked regions list (user32::GetSystemMetrics returns to 0x001C09F0, thread 3552). 2025-12-08 08:29:20,484 [root] DEBUG: 3576: ReverseScanForNonZero: Error - Supplied size zero. 2025-12-08 08:29:20,484 [lib.common.results] INFO: Uploading file C:\ufNkJOWpa\CAPE\3576_5259628104981122025 to CAPE\c31f5ff3ffcfcd6e8d6973f4819fe9dc58867a20314880e9d273362aeb2981d9; Size is 63780; Max size: 100000000 2025-12-08 08:29:20,500 [root] DEBUG: 3576: DumpMemory: Payload successfully created: C:\ufNkJOWpa\CAPE\3576_5259628104981122025 (size 63780 bytes) 2025-12-08 08:29:20,500 [root] DEBUG: 3576: DumpRegion: Dumped region at 0x001C0000, size 65536 bytes. 2025-12-08 08:29:20,500 [root] DEBUG: 3576: ProcessTrackedRegion: Dumped region at 0x001C0000. 2025-12-08 08:29:20,500 [root] DEBUG: 3576: ReverseScanForNonZero: Error - Supplied address inaccessible: 0x000DFFFF 2025-12-08 08:29:20,500 [root] DEBUG: 3576: YaraScan: Nothing to scan at 0x001C0000! 2025-12-08 08:29:20,500 [root] DEBUG: 3576: DLL loaded at 0x6F270000: C:\Windows\system32\explorerframe (0x170000 bytes). 2025-12-08 08:29:20,500 [root] DEBUG: 3576: DLL loaded at 0x73EE0000: C:\Windows\system32\DUser (0x2f000 bytes). 2025-12-08 08:29:20,515 [root] DEBUG: 3576: DLL loaded at 0x73F10000: C:\Windows\system32\DUI70 (0xb2000 bytes). 2025-12-08 08:29:20,515 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied. 2025-12-08 08:29:20,515 [root] DEBUG: 3576: OpenProcessHandler: Injection info created for process 1236, handle 0x3b0: Error obtaining target process name 2025-12-08 08:29:20,546 [root] DEBUG: 3576: DLL loaded at 0x6BC50000: C:\Windows\System32\ieframe (0xc42000 bytes). 2025-12-08 08:29:20,546 [root] DEBUG: 3576: DLL loaded at 0x6FBD0000: C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0 (0x4000 bytes). 2025-12-08 08:29:20,546 [root] DEBUG: 3576: DLL loaded at 0x6FB50000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes). 2025-12-08 08:29:20,546 [root] DEBUG: 3576: api-rate-cap: memcpy hook disabled due to rate 2025-12-08 08:29:20,546 [root] DEBUG: 3576: DLL loaded at 0x72CD0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes). 2025-12-08 08:29:20,546 [root] DEBUG: 3576: DLL loaded at 0x75E10000: C:\Windows\system32\urlmon (0x14a000 bytes). 2025-12-08 08:29:20,546 [root] DEBUG: 3576: DLL loaded at 0x75790000: C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes). 2025-12-08 08:29:20,562 [root] DEBUG: 3576: DLL loaded at 0x74E90000: C:\Windows\system32\mswsock (0x3c000 bytes). 2025-12-08 08:29:20,562 [root] DEBUG: 3576: DLL loaded at 0x73640000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes). 2025-12-08 08:29:20,562 [root] DEBUG: 3576: DLL loaded at 0x736D0000: C:\Windows\system32\WINNSI (0x7000 bytes). 2025-12-08 08:29:20,562 [root] DEBUG: 3576: DLL loaded at 0x74E80000: C:\Windows\System32\wship6 (0x6000 bytes). 2025-12-08 08:29:20,578 [root] DEBUG: 3576: DLL loaded at 0x74D50000: C:\Windows\system32\DNSAPI (0x44000 bytes). 2025-12-08 08:29:20,578 [root] DEBUG: 3576: DLL loaded at 0x72B10000: C:\Windows\System32\netprofm (0x5a000 bytes). 2025-12-08 08:29:20,578 [root] DEBUG: 3576: DLL loaded at 0x72C90000: C:\Windows\System32\nlaapi (0x10000 bytes). 2025-12-08 08:29:20,578 [root] DEBUG: 3576: DLL loaded at 0x735C0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes). 2025-12-08 08:29:20,578 [root] DEBUG: 3576: DLL loaded at 0x73540000: C:\Windows\system32\dhcpcsvc (0x12000 bytes). 2025-12-08 08:29:20,578 [root] DEBUG: 3576: DLL loaded at 0x749F0000: C:\Windows\System32\wshtcpip (0x5000 bytes). 2025-12-08 08:29:20,593 [root] DEBUG: 3576: DLL loaded at 0x72500000: C:\Windows\system32\rasadhlp (0x6000 bytes). 2025-12-08 08:29:20,593 [root] DEBUG: 3576: DLL loaded at 0x75450000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2025-12-08 08:29:20,593 [root] DEBUG: 3576: DLL loaded at 0x72C80000: C:\Windows\System32\npmproxy (0x8000 bytes). 2025-12-08 08:29:20,765 [root] DEBUG: 3576: DLL loaded at 0x6A4E0000: C:\Windows\system32\MSHTML (0x12bc000 bytes). 2025-12-08 08:29:20,781 [root] DEBUG: 3576: DLL loaded at 0x73600000: C:\Windows\System32\fwpuclnt (0x38000 bytes). 2025-12-08 08:29:24,375 [modules.auxiliary.human] INFO: Found button "ok", clicking it 2025-12-08 08:29:49,343 [root] DEBUG: 376: OpenProcessHandler: Injection info created for process 1840, handle 0x3c4: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2025-12-08 08:29:49,343 [root] INFO: Announced 32-bit process name: OfficeC2RClient.exe pid: 1840 2025-12-08 08:29:49,343 [lib.api.process] INFO: Monitor config for <Process 1840 OfficeC2RClient.exe>: C:\tmphsls4wg6\dll\1840.ini 2025-12-08 08:29:49,343 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmphsls4wg6\dll\noxuqMU.dll, loader C:\tmphsls4wg6\bin\rUQhfVg.exe 2025-12-08 08:29:49,343 [root] DEBUG: Loader: Injecting process 1840 with C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:49,359 [root] DEBUG: 1840: Python path set to 'C:\Python38'. 2025-12-08 08:29:49,359 [root] DEBUG: 1840: Dropped file limit defaulting to 100. 2025-12-08 08:29:49,390 [root] INFO: Disabling sleep skipping. 2025-12-08 08:29:49,390 [root] DEBUG: 1840: YaraInit: Compiled rules loaded from existing file C:\tmphsls4wg6\data\yara\capemon.yac 2025-12-08 08:29:49,390 [root] DEBUG: 1840: YaraScan: Scanning 0x00950000, size 0xf7067c 2025-12-08 08:29:49,453 [root] DEBUG: 1840: Monitor initialised: 32-bit capemon loaded in process 1840 at 0x6c9a0000, thread 904, image base 0x950000, stack from 0x3887000-0x3890000 2025-12-08 08:29:49,453 [root] DEBUG: 1840: Commandline: "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update SCHEDULEDTASK displaylevel=False 2025-12-08 08:29:49,453 [root] DEBUG: 1840: GetAddressByYara: ModuleBase 0x774E0000 FunctionName LdrpCallInitRoutine 2025-12-08 08:29:49,453 [root] DEBUG: 1840: hook_api: LdrpCallInitRoutine export address 0x77538810 obtained via GetFunctionAddress 2025-12-08 08:29:49,468 [root] DEBUG: 1840: hook_api: Warning - CreateRemoteThreadEx export address 0x764AF98F differs from GetProcAddress -> 0x754EBB18 (KERNELBASE.dll::0xbb18) 2025-12-08 08:29:49,468 [root] DEBUG: 1840: hook_api: Warning - UpdateProcThreadAttribute export address 0x764B020F differs from GetProcAddress -> 0x754F43FB (KERNELBASE.dll::0x143fb) 2025-12-08 08:29:49,468 [root] WARNING: b'Unable to place hook on GetCommandLineA' 2025-12-08 08:29:49,468 [root] DEBUG: 1840: set_hooks: Unable to hook GetCommandLineA 2025-12-08 08:29:49,468 [root] WARNING: b'Unable to place hook on GetCommandLineW' 2025-12-08 08:29:49,468 [root] DEBUG: 1840: set_hooks: Unable to hook GetCommandLineW 2025-12-08 08:29:49,468 [root] DEBUG: 1840: Hooked 611 out of 613 functions 2025-12-08 08:29:49,468 [root] DEBUG: 1840: WoW64 not detected. 2025-12-08 08:29:49,468 [root] INFO: Loaded monitor into process with pid 1840 2025-12-08 08:29:49,468 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2025-12-08 08:29:49,468 [root] DEBUG: Successfully injected DLL C:\tmphsls4wg6\dll\noxuqMU.dll. 2025-12-08 08:29:49,468 [lib.api.process] INFO: Injected into 32-bit <Process 1840 OfficeC2RClient.exe> 2025-12-08 08:29:49,484 [root] DEBUG: 1840: caller_dispatch: Added region at 0x00950000 to tracked regions list (ntdll::memcpy returns to 0x00B4AD04, thread 1856). 2025-12-08 08:29:49,484 [root] DEBUG: 1840: YaraScan: Scanning 0x00950000, size 0xf7067c 2025-12-08 08:29:49,546 [root] DEBUG: 1840: ProcessImageBase: Main module image at 0x00950000 unmodified (entropy change 0.000000e+00) 2025-12-08 08:29:49,546 [root] DEBUG: 1840: caller_dispatch: Added region at 0x73200000 to tracked regions list (ntdll::memcpy returns to 0x732046F5, thread 1856). 2025-12-08 08:29:49,546 [root] DEBUG: 1840: ProcessTrackedRegion: Region at 0x73200000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll, skipping 2025-12-08 08:29:49,546 [root] DEBUG: 1840: caller_dispatch: Added region at 0x73110000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x7313F7CB, thread 1856). 2025-12-08 08:29:49,546 [root] DEBUG: 1840: ProcessTrackedRegion: Region at 0x73110000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll, skipping 2025-12-08 08:29:49,562 [root] DEBUG: 1840: caller_dispatch: Added region at 0x73000000 to tracked regions list (ntdll::NtWaitForSingleObject returns to 0x73011047, thread 1856). 2025-12-08 08:29:49,562 [root] DEBUG: 1840: ProcessTrackedRegion: Region at 0x73000000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll, skipping 2025-12-08 08:29:50,343 [root] DEBUG: 1840: DLL loaded at 0x74200000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2025-12-08 08:29:50,343 [root] DEBUG: 1840: NtTerminateProcess hook: Attempting to dump process 1840 2025-12-08 08:29:50,359 [root] DEBUG: 1840: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:29:50,359 [root] DEBUG: 1840: caller_dispatch: Added region at 0x72F30000 to tracked regions list (ntdll::LdrUnloadDll returns to 0x72F3C230, thread 1856). 2025-12-08 08:29:50,359 [root] DEBUG: 1840: caller_dispatch: Scanning calling region at 0x72F30000... 2025-12-08 08:29:50,359 [root] DEBUG: 1840: ProcessTrackedRegion: Region at 0x72F30000 mapped as \Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll, skipping 2025-12-08 08:29:50,359 [root] INFO: Process with pid 1840 has terminated 2025-12-08 08:30:11,562 [root] DEBUG: 3820: OpenProcessHandler: Injection info created for process 1236, handle 0x1bc: C:\Windows\explorer.exe 2025-12-08 08:30:11,562 [root] DEBUG: 3820: OpenProcessHandler: Image base for process 3020 (handle 0x1b8): 0x00A00000. 2025-12-08 08:30:11,562 [root] DEBUG: 3820: OpenProcessHandler: Injection info created for process 3020, handle 0x1b8: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2025-12-08 08:32:16,750 [root] INFO: Analysis timeout hit, terminating analysis 2025-12-08 08:32:16,750 [lib.api.process] INFO: Terminate event set for <Process 2992 cmd.exe> 2025-12-08 08:32:16,750 [root] DEBUG: 2992: Terminate Event: Attempting to dump process 2992 2025-12-08 08:32:16,750 [root] DEBUG: 2992: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:32:16,750 [root] DEBUG: 2992: Terminate Event: Current region empty 2025-12-08 08:32:16,750 [root] DEBUG: 2992: Terminate Event: CAPE shutdown complete for process 2992 2025-12-08 08:32:16,750 [lib.api.process] INFO: Termination confirmed for <Process 2992 cmd.exe> 2025-12-08 08:32:16,750 [root] INFO: Terminate event set for process 2992 2025-12-08 08:32:16,750 [lib.api.process] INFO: Terminate event set for <Process 376 services.exe> 2025-12-08 08:32:16,750 [root] DEBUG: 376: Terminate Event: Attempting to dump process 376 2025-12-08 08:32:16,750 [root] DEBUG: 376: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:32:16,781 [root] DEBUG: 376: Terminate Event: Current region empty 2025-12-08 08:32:16,781 [lib.api.process] INFO: Termination confirmed for <Process 376 services.exe> 2025-12-08 08:32:16,781 [root] INFO: Terminate event set for process 376 2025-12-08 08:32:16,781 [root] DEBUG: 376: Terminate Event: CAPE shutdown complete for process 376 2025-12-08 08:32:16,781 [lib.api.process] INFO: Terminate event set for <Process 3820 svchost.exe> 2025-12-08 08:32:16,781 [root] DEBUG: 3820: Terminate Event: Attempting to dump process 3820 2025-12-08 08:32:16,796 [root] DEBUG: 3820: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:32:16,796 [root] DEBUG: 3820: Terminate Event: Current region empty 2025-12-08 08:32:16,796 [lib.api.process] INFO: Termination confirmed for <Process 3820 svchost.exe> 2025-12-08 08:32:16,796 [root] DEBUG: 3820: Terminate Event: CAPE shutdown complete for process 3820 2025-12-08 08:32:16,796 [root] INFO: Terminate event set for process 3820 2025-12-08 08:32:16,796 [lib.api.process] INFO: Terminate event set for <Process 3576 WinRAR.exe> 2025-12-08 08:32:16,796 [root] DEBUG: 3576: Terminate Event: Attempting to dump process 3576 2025-12-08 08:32:16,796 [root] DEBUG: 3576: DoProcessDump: Skipping process dump as code is identical on disk. 2025-12-08 08:32:16,796 [root] DEBUG: 3576: Terminate Event: Current region empty 2025-12-08 08:32:16,796 [root] INFO: Added new file to list with pid None and path C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 2025-12-08 08:32:16,796 [lib.api.process] INFO: Termination confirmed for <Process 3576 WinRAR.exe> 2025-12-08 08:32:16,796 [root] DEBUG: 3576: Terminate Event: CAPE shutdown complete for process 3576 2025-12-08 08:32:16,796 [root] INFO: Terminate event set for process 3576 2025-12-08 08:32:16,796 [root] INFO: Created shutdown mutex 2025-12-08 08:32:17,796 [root] INFO: Shutting down package 2025-12-08 08:32:17,796 [root] INFO: Stopping auxiliary modules 2025-12-08 08:32:17,796 [root] INFO: Stopping auxiliary module: Browser 2025-12-08 08:32:17,796 [root] INFO: Stopping auxiliary module: Curtain 2025-12-08 08:32:17,812 [lib.common.results] INFO: Uploading file C:\curtain.log to curtain/1765153937.8125.curtain.log; Size is 36; Max size: 100000000 2025-12-08 08:32:17,812 [root] INFO: Stopping auxiliary module: End_noisy_tasks 2025-12-08 08:32:17,812 [root] INFO: Stopping auxiliary module: Evtx 2025-12-08 08:32:17,859 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Application.evtx to zip dump 2025-12-08 08:32:17,859 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\HardwareEvents.evtx to zip dump 2025-12-08 08:32:17,875 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Internet Explorer.evtx to zip dump 2025-12-08 08:32:17,921 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Key Management Service.evtx to zip dump 2025-12-08 08:32:17,937 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Microsoft-Windows-Sysmon%4Operational.evtx to zip dump 2025-12-08 08:32:18,093 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\OAlerts.evtx to zip dump 2025-12-08 08:32:18,109 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Security.evtx to zip dump 2025-12-08 08:32:18,125 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Setup.evtx to zip dump 2025-12-08 08:32:18,140 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\System.evtx to zip dump 2025-12-08 08:32:18,156 [modules.auxiliary.evtx] DEBUG: Adding C:/Windows/System32/winevt/Logs\Windows PowerShell.evtx to zip dump 2025-12-08 08:32:19,359 [modules.auxiliary.evtx] DEBUG: Uploading evtx.zip to host 2025-12-08 08:32:19,359 [lib.common.results] INFO: Uploading file evtx.zip to evtx/evtx.zip; Size is 340021; Max size: 100000000 2025-12-08 08:32:19,375 [root] INFO: Stopping auxiliary module: Human 2025-12-08 08:32:19,875 [root] INFO: Stopping auxiliary module: Pre_script 2025-12-08 08:32:19,875 [root] INFO: Stopping auxiliary module: Screenshots 2025-12-08 08:32:22,375 [root] INFO: Stopping auxiliary module: Usage 2025-12-08 08:32:23,296 [root] INFO: Stopping auxiliary module: During_script 2025-12-08 08:32:23,296 [root] INFO: Finishing auxiliary modules 2025-12-08 08:32:23,296 [root] INFO: Shutting down pipe server and dumping dropped files 2025-12-08 08:32:23,296 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Roaming\WinRAR\version.dat to files\2a38cb8c907cbfe4dd956d4e020a4e9cccf6df001b657b90bf8b209ffb1f0ac3; Size is 12; Max size: 100000000 2025-12-08 08:32:23,296 [lib.common.results] INFO: Uploading file C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat to files\42f9c76ccf7a86c64d1244263a0ff86751e86e025a5996c938bd49c2e24714a1; Size is 128; Max size: 100000000 2025-12-08 08:32:23,312 [root] WARNING: Folder at path "C:\ufNkJOWpa\debugger" does not exist, skipping 2025-12-08 08:32:23,312 [root] WARNING: Folder at path "C:\ufNkJOWpa\tlsdump" does not exist, skipping 2025-12-08 08:32:23,312 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7-32bit-1 | win7-32bit-1 | KVM | 2025-12-08 16:29:07 | 2025-12-08 16:32:30 | inetsim |
| File Name |
5fbb6b4c69b23f4cdc69.zip
|
|---|---|
| File Type | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| File Size | 410490 bytes |
| MD5 | b6027f4d0e68f69418b76199f08f42d1 |
| SHA1 | 52b19df27282336f1dbc6c268a3d8557e6ea78ff |
| SHA256 | ccca4e45f765f4e3f575d85d326ad65b9a8886617617df189635095c7d6940c7 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 485053cb42ffb665fbb95d2870f840091ecdf2bc9c5e9138dcf6d246e70c4734cc68404e168da04ad94d65fba808c39e |
| CRC32 | 68567CFD |
| TLSH | T10F9423051D7FFC65BC30989F8AAC74648B025BCD28F7D7BBD1C6424DA82981E9794B82 |
| Ssdeep | 12288:L9q7xWcV34eABb5J7fXw+H/Th2xpT2eNlq:5q7xDNWnfgwcxpT9Q |
| File Strings BinGraph Vba2Graph |
| Discovery | Command and Control | Execution | Defense Evasion | Privilege Escalation |
|
|
|
|---|
No hosts contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP