Analysis

Category Package Started Completed Duration Options Log
FILE bat 2025-07-09 20:04:44 2025-07-09 20:07:50 186 seconds Show Options Show Log 
procdump=1
amsidump=1
2024-04-29 04:31:22,859 [root] INFO: Date set to: 20250709T13:04:43, timeout set to: 150
2025-07-09 13:04:43,015 [root] DEBUG: Starting analyzer from: C:\tmp9sa_k9cw
2025-07-09 13:04:43,015 [root] DEBUG: Storing results at: C:\MXVIiysWpa
2025-07-09 13:04:43,015 [root] DEBUG: Pipe server name: \\.\PIPE\OdXcGbTMJP
2025-07-09 13:04:43,015 [root] DEBUG: Python path: C:\olddocs
2025-07-09 13:04:43,031 [root] DEBUG: No analysis package specified, trying to detect it automagically
2025-07-09 13:04:43,031 [root] INFO: Automatically selected analysis package "bat"
2025-07-09 13:04:43,031 [root] DEBUG: Importing analysis package "bat"...
2025-07-09 13:04:43,031 [root] DEBUG: Initializing analysis package "bat"...
2025-07-09 13:04:43,031 [root] INFO: Analyzer: Package modules.packages.bat does not specify a DLL option
2025-07-09 13:04:43,031 [root] INFO: Analyzer: Package modules.packages.bat does not specify a DLL_64 option
2025-07-09 13:04:43,031 [root] INFO: Analyzer: Package modules.packages.bat does not specify a loader option
2025-07-09 13:04:43,031 [root] INFO: Analyzer: Package modules.packages.bat does not specify a loader_64 option
2025-07-09 13:04:43,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.browser"...
2025-07-09 13:04:43,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.curtain"...
2025-07-09 13:04:43,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.default_apps"...
2025-07-09 13:04:43,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.digisig"...
2025-07-09 13:04:43,093 [root] DEBUG: Importing auxiliary module "modules.auxiliary.disguise"...
2025-07-09 13:04:43,109 [root] DEBUG: Importing auxiliary module "modules.auxiliary.evtx"...
2025-07-09 13:04:43,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.fiddler"...
2025-07-09 13:04:43,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.human"...
2025-07-09 13:04:43,140 [root] DEBUG: Importing auxiliary module "modules.auxiliary.screenshots"...
2025-07-09 13:04:43,140 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-07-09 13:04:43,203 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2025-07-09 13:04:43,203 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2025-07-09 13:04:43,218 [root] DEBUG: Importing auxiliary module "modules.auxiliary.sysmon"...
2025-07-09 13:04:43,218 [root] DEBUG: Importing auxiliary module "modules.auxiliary.tlsdump"...
2025-07-09 13:04:43,218 [root] DEBUG: Importing auxiliary module "modules.auxiliary.usage"...
2025-07-09 13:04:43,234 [root] DEBUG: Initializing auxiliary module "Browser"...
2025-07-09 13:04:43,234 [root] DEBUG: Started auxiliary module Browser
2025-07-09 13:04:43,234 [root] DEBUG: Initializing auxiliary module "Curtain"...
2025-07-09 13:04:43,234 [root] DEBUG: Started auxiliary module Curtain
2025-07-09 13:04:43,234 [root] DEBUG: Initializing auxiliary module "DefaultApps"...
2025-07-09 13:04:43,265 [modules.auxiliary.default_apps] DEBUG: Getting current user SID using WinAPI
2025-07-09 13:04:43,265 [root] DEBUG: Started auxiliary module DefaultApps
2025-07-09 13:04:43,265 [root] DEBUG: Initializing auxiliary module "DigiSig"...
2025-07-09 13:04:43,265 [modules.auxiliary.digisig] INFO: signtool.exe was not found in bin/
2025-07-09 13:04:43,265 [modules.auxiliary.digisig] INFO: dummy
2025-07-09 13:04:43,265 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, unsupported analyzer package
2025-07-09 13:04:43,265 [root] DEBUG: Started auxiliary module DigiSig
2025-07-09 13:04:43,265 [root] DEBUG: Initializing auxiliary module "Disguise"...
2025-07-09 13:04:43,484 [modules.auxiliary.disguise] INFO: Setting NoRecentDocsHistory
2025-07-09 13:04:43,484 [root] WARNING: Cannot execute auxiliary module Disguise: [WinError 2] The system cannot find the file specified
2025-07-09 13:04:43,484 [root] DEBUG: Initializing auxiliary module "Evtx"...
2025-07-09 13:04:43,484 [modules.auxiliary.evtx] INFO: Loading audit policy C:\tmp9sa_k9cw\bin\auditpol.csv
2025-07-09 13:04:43,937 [modules.auxiliary.evtx] INFO: Wiping logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:04:44,625 [root] DEBUG: Started auxiliary module Evtx
2025-07-09 13:04:44,625 [root] DEBUG: Initializing auxiliary module "Fiddler"...
2025-07-09 13:04:44,625 [modules.auxiliary.fiddler] INFO: fiddler package: dummy
2025-07-09 13:04:44,625 [root] DEBUG: Started auxiliary module Fiddler
2025-07-09 13:04:44,625 [root] DEBUG: Initializing auxiliary module "Human"...
2025-07-09 13:04:44,640 [root] DEBUG: Started auxiliary module Human
2025-07-09 13:04:44,640 [root] DEBUG: Initializing auxiliary module "Screenshots"...
2025-07-09 13:04:44,640 [root] DEBUG: Started auxiliary module Screenshots
2025-07-09 13:04:44,640 [root] DEBUG: Initializing auxiliary module "Sysmon"...
2025-07-09 13:04:44,640 [modules.auxiliary.sysmon] INFO: Seeing if we need to update sysmon config
2025-07-09 13:04:44,640 [modules.auxiliary.sysmon] INFO: Found Sysmon Executable
2025-07-09 13:04:44,640 [modules.auxiliary.sysmon] INFO: Found Sysmon config
2025-07-09 13:04:44,640 [root] DEBUG: Started auxiliary module Sysmon
2025-07-09 13:04:44,640 [root] DEBUG: Initializing auxiliary module "TLSDumpMasterSecrets"...
2025-07-09 13:04:44,640 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 556
2025-07-09 13:04:44,640 [lib.api.process] INFO: Monitor config for process 556: C:\tmp9sa_k9cw\dll\556.ini
2025-07-09 13:04:46,750 [modules.auxiliary.sysmon] INFO: Clearing existing sysmon logs
2025-07-09 13:04:47,640 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2025-07-09 13:04:47,640 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor
2025-07-09 13:04:47,640 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor
2025-07-09 13:04:47,640 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2025-07-09 13:04:47,640 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp9sa_k9cw\dll\YCTGbx.dll, loader C:\tmp9sa_k9cw\bin\cXOZyfUS.exe
2025-07-09 13:04:47,656 [root] DEBUG: Loader: Injecting process 556 with C:\tmp9sa_k9cw\dll\YCTGbx.dll.
2025-07-09 13:04:47,703 [root] DEBUG: 556: Python path set to 'C:\olddocs'.
2025-07-09 13:04:47,734 [root] DEBUG: 556: Disabling sleep skipping.
2025-07-09 13:04:47,734 [root] DEBUG: 556: Process dumps enabled.
2025-07-09 13:04:47,734 [root] DEBUG: 556: AMSI dumping enabled.
2025-07-09 13:04:47,750 [root] DEBUG: 556: TLS secret dump mode enabled.
2025-07-09 13:04:47,750 [root] DEBUG: 556: Monitor initialised: 64-bit capemon loaded in process 556 at 0x000007FEECC50000, thread 2988, image base 0x00000000FF8A0000, stack from 0x0000000001EF3000-0x0000000001F00000
2025-07-09 13:04:47,750 [root] DEBUG: 556: Commandline: C:\Windows\system32\lsass.exe
2025-07-09 13:04:47,765 [root] DEBUG: 556: Hooked 5 out of 5 functions
2025-07-09 13:04:47,765 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-07-09 13:04:47,765 [root] DEBUG: Successfully injected DLL C:\tmp9sa_k9cw\dll\YCTGbx.dll.
2025-07-09 13:04:47,765 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 556
2025-07-09 13:04:47,765 [root] DEBUG: Started auxiliary module TLSDumpMasterSecrets
2025-07-09 13:04:47,765 [root] DEBUG: Initializing auxiliary module "Usage"...
2025-07-09 13:04:47,765 [root] DEBUG: Started auxiliary module Usage
2025-07-09 13:04:50,406 [root] INFO: Restarting WMI Service
2025-07-09 13:04:54,484 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c start /wait "" "C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat"" with pid 1348
2025-07-09 13:04:54,484 [lib.api.process] INFO: Monitor config for process 1348: C:\tmp9sa_k9cw\dll\1348.ini
2025-07-09 13:04:54,500 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2025-07-09 13:04:54,500 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor
2025-07-09 13:04:54,500 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor
2025-07-09 13:04:54,500 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp9sa_k9cw\dll\tBXGAq.dll, loader C:\tmp9sa_k9cw\bin\RIQWrzN.exe
2025-07-09 13:04:54,531 [root] DEBUG: Loader: Injecting process 1348 (thread 2844) with C:\tmp9sa_k9cw\dll\tBXGAq.dll.
2025-07-09 13:04:54,531 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-07-09 13:04:54,531 [root] DEBUG: Successfully injected DLL C:\tmp9sa_k9cw\dll\tBXGAq.dll.
2025-07-09 13:04:54,546 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1348
2025-07-09 13:04:56,546 [lib.api.process] INFO: Successfully resumed process with pid 1348
2025-07-09 13:04:56,593 [root] DEBUG: 1348: Python path set to 'C:\olddocs'.
2025-07-09 13:04:56,593 [root] DEBUG: 1348: Disabling sleep skipping.
2025-07-09 13:04:56,593 [root] DEBUG: 1348: Process dumps enabled.
2025-07-09 13:04:56,609 [root] DEBUG: 1348: AMSI dumping enabled.
2025-07-09 13:04:56,609 [root] DEBUG: 1348: Dropped file limit defaulting to 100.
2025-07-09 13:04:56,625 [root] DEBUG: 1348: YaraInit: Compiled 43 rule files
2025-07-09 13:04:56,625 [root] DEBUG: 1348: YaraInit: Compiled rules saved to file C:\tmp9sa_k9cw\data\yara\capemon.yac
2025-07-09 13:04:56,625 [root] DEBUG: 1348: YaraScan: Scanning 0x4AC30000, size 0x4bb2e
2025-07-09 13:04:56,640 [root] DEBUG: 1348: Monitor initialised: 32-bit capemon loaded in process 1348 at 0x73a80000, thread 2844, image base 0x4ac30000, stack from 0x233000-0x330000
2025-07-09 13:04:56,640 [root] DEBUG: 1348: Commandline: "C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat"
2025-07-09 13:04:56,656 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-07-09 13:04:56,656 [root] DEBUG: 1348: set_hooks: Unable to hook GetCommandLineA
2025-07-09 13:04:56,656 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-07-09 13:04:56,656 [root] DEBUG: 1348: set_hooks: Unable to hook GetCommandLineW
2025-07-09 13:04:56,671 [root] DEBUG: 1348: Hooked 615 out of 617 functions
2025-07-09 13:04:56,671 [root] DEBUG: 1348: WoW64 detected: 64-bit ntdll base: 0x76e60000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x76ecb5f0, Wow64PrepareForException: 0x0
2025-07-09 13:04:56,671 [root] DEBUG: 1348: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x150000
2025-07-09 13:04:56,687 [root] INFO: Loaded monitor into process with pid 1348
2025-07-09 13:04:56,687 [root] DEBUG: 1348: caller_dispatch: Added region at 0x4AC30000 to tracked regions list (ntdll::NtOpenThread returns to 0x4AC3732B, thread 2844).
2025-07-09 13:04:56,687 [root] DEBUG: 1348: YaraScan: Scanning 0x4AC30000, size 0x4bb2e
2025-07-09 13:04:56,703 [root] DEBUG: 1348: ProcessImageBase: Main module image at 0x4AC30000 unmodified (entropy change 0.000000e+00)
2025-07-09 13:04:56,703 [root] DEBUG: 1348: CreateProcessHandler: Injection info set for new process 396: C:\Windows\system32\cmd.exe, ImageBase: 0x4AC30000
2025-07-09 13:04:56,703 [root] INFO: Announced 32-bit process name: cmd.exe pid: 396
2025-07-09 13:04:56,703 [lib.api.process] INFO: Monitor config for process 396: C:\tmp9sa_k9cw\dll\396.ini
2025-07-09 13:04:56,703 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2025-07-09 13:04:56,703 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor
2025-07-09 13:04:56,703 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor
2025-07-09 13:04:56,703 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp9sa_k9cw\dll\tBXGAq.dll, loader C:\tmp9sa_k9cw\bin\RIQWrzN.exe
2025-07-09 13:04:56,718 [root] DEBUG: Loader: Injecting process 396 (thread 2660) with C:\tmp9sa_k9cw\dll\tBXGAq.dll.
2025-07-09 13:04:56,734 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-07-09 13:04:56,734 [root] DEBUG: Successfully injected DLL C:\tmp9sa_k9cw\dll\tBXGAq.dll.
2025-07-09 13:04:56,734 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 396
2025-07-09 13:04:56,734 [root] DEBUG: 1348: DLL loaded at 0x72280000: C:\Windows\system32\apphelp (0x4c000 bytes).
2025-07-09 13:04:56,734 [root] WARNING: Received request to inject process with pid 396, skipped alredy in inject list
2025-07-09 13:04:56,781 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:04:56,781 [root] DEBUG: 396: Python path set to 'C:\olddocs'.
2025-07-09 13:04:56,781 [root] DEBUG: 396: Disabling sleep skipping.
2025-07-09 13:04:56,781 [root] DEBUG: 396: Process dumps enabled.
2025-07-09 13:04:56,781 [root] DEBUG: 396: AMSI dumping enabled.
2025-07-09 13:04:56,781 [root] DEBUG: 396: Dropped file limit defaulting to 100.
2025-07-09 13:04:56,781 [root] DEBUG: 396: YaraInit: Compiled rules loaded from existing file C:\tmp9sa_k9cw\data\yara\capemon.yac
2025-07-09 13:04:56,796 [root] DEBUG: 396: YaraScan: Scanning 0x4AC30000, size 0x4bb2e
2025-07-09 13:04:56,796 [root] DEBUG: 396: Monitor initialised: 32-bit capemon loaded in process 396 at 0x73a80000, thread 2660, image base 0x4ac30000, stack from 0x213000-0x310000
2025-07-09 13:04:56,796 [root] DEBUG: 396: Commandline: C:\Windows\system32\cmd.exe  /K "C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat"
2025-07-09 13:04:56,812 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-07-09 13:04:56,812 [root] DEBUG: 396: set_hooks: Unable to hook GetCommandLineA
2025-07-09 13:04:56,812 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-07-09 13:04:56,812 [root] DEBUG: 396: set_hooks: Unable to hook GetCommandLineW
2025-07-09 13:04:56,828 [root] DEBUG: 396: Hooked 615 out of 617 functions
2025-07-09 13:04:56,828 [root] DEBUG: 396: WoW64 detected: 64-bit ntdll base: 0x76e60000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x76ecb5f0, Wow64PrepareForException: 0x0
2025-07-09 13:04:56,828 [root] DEBUG: 396: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x190000
2025-07-09 13:04:56,828 [root] INFO: Loaded monitor into process with pid 396
2025-07-09 13:04:56,828 [root] DEBUG: 396: caller_dispatch: Added region at 0x4AC30000 to tracked regions list (ntdll::NtOpenThread returns to 0x4AC3732B, thread 2660).
2025-07-09 13:04:56,828 [root] DEBUG: 396: YaraScan: Scanning 0x4AC30000, size 0x4bb2e
2025-07-09 13:04:56,843 [root] DEBUG: 396: ProcessImageBase: Main module image at 0x4AC30000 unmodified (entropy change 0.000000e+00)
2025-07-09 13:04:56,890 [root] DEBUG: 396: CreateProcessHandler: Injection info set for new process 1704: C:\Windows\system32\calc.exe, ImageBase: 0x00770000
2025-07-09 13:04:56,890 [root] INFO: Announced 32-bit process name: calc.exe pid: 1704
2025-07-09 13:04:56,890 [lib.api.process] INFO: Monitor config for process 1704: C:\tmp9sa_k9cw\dll\1704.ini
2025-07-09 13:04:56,890 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2025-07-09 13:04:56,890 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor
2025-07-09 13:04:56,890 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor
2025-07-09 13:04:56,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp9sa_k9cw\dll\tBXGAq.dll, loader C:\tmp9sa_k9cw\bin\RIQWrzN.exe
2025-07-09 13:04:56,906 [root] DEBUG: Loader: Injecting process 1704 (thread 2700) with C:\tmp9sa_k9cw\dll\tBXGAq.dll.
2025-07-09 13:04:56,906 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2025-07-09 13:04:56,906 [root] DEBUG: Successfully injected DLL C:\tmp9sa_k9cw\dll\tBXGAq.dll.
2025-07-09 13:04:56,906 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1704
2025-07-09 13:04:56,906 [root] DEBUG: 396: DLL loaded at 0x72280000: C:\Windows\system32\apphelp (0x4c000 bytes).
2025-07-09 13:04:56,937 [root] WARNING: Received request to inject process with pid 1704, skipped alredy in inject list
2025-07-09 13:04:56,953 [root] DEBUG: 1704: Python path set to 'C:\olddocs'.
2025-07-09 13:04:56,953 [root] DEBUG: 1704: Process dumps enabled.
2025-07-09 13:04:56,953 [root] DEBUG: 1704: AMSI dumping enabled.
2025-07-09 13:04:56,953 [root] DEBUG: 1704: Dropped file limit defaulting to 100.
2025-07-09 13:04:56,968 [root] DEBUG: 1704: Disabling sleep skipping.
2025-07-09 13:04:56,968 [root] DEBUG: 1704: YaraInit: Compiled rules loaded from existing file C:\tmp9sa_k9cw\data\yara\capemon.yac
2025-07-09 13:04:56,968 [root] DEBUG: 1704: YaraScan: Scanning 0x00770000, size 0xbfb3a
2025-07-09 13:04:56,968 [root] DEBUG: 1704: Monitor initialised: 32-bit capemon loaded in process 1704 at 0x73a80000, thread 2700, image base 0x770000, stack from 0x2c6000-0x2d0000
2025-07-09 13:04:56,984 [root] DEBUG: 1704: Commandline: calc.exe
2025-07-09 13:04:57,000 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2025-07-09 13:04:57,000 [root] DEBUG: 1704: set_hooks: Unable to hook GetCommandLineA
2025-07-09 13:04:57,000 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2025-07-09 13:04:57,000 [root] DEBUG: 1704: set_hooks: Unable to hook GetCommandLineW
2025-07-09 13:04:57,015 [root] DEBUG: 1704: Hooked 615 out of 617 functions
2025-07-09 13:04:57,015 [root] DEBUG: 1704: WoW64 detected: 64-bit ntdll base: 0x76e60000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x76ecb5f0, Wow64PrepareForException: 0x0
2025-07-09 13:04:57,015 [root] DEBUG: 1704: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x160000
2025-07-09 13:04:57,015 [root] INFO: Loaded monitor into process with pid 1704
2025-07-09 13:04:57,015 [root] DEBUG: 1704: caller_dispatch: Added region at 0x00770000 to tracked regions list (ntdll::NtOpenKey returns to 0x00783433, thread 2700).
2025-07-09 13:04:57,015 [root] DEBUG: 1704: YaraScan: Scanning 0x00770000, size 0xbfb3a
2025-07-09 13:04:57,031 [root] DEBUG: 1704: ProcessImageBase: Main module image at 0x00770000 unmodified (entropy change 0.000000e+00)
2025-07-09 13:04:57,031 [root] DEBUG: 1704: DLL loaded at 0x737C0000: C:\Windows\SysWOW64\WindowsCodecs (0x130000 bytes).
2025-07-09 13:04:57,062 [root] DEBUG: 1704: DLL loaded at 0x73E20000: C:\Windows\SysWOW64\dwmapi (0x13000 bytes).
2025-07-09 13:04:57,078 [root] DEBUG: 1704: DLL loaded at 0x74D90000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2025-07-09 13:04:57,259 [root] DEBUG: 1704: DLL loaded at 0x73DE0000: C:\Windows\SysWOW64\oleacc (0x3c000 bytes).
2025-07-09 13:04:59,634 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:04:59,947 [lib.common.results] INFO: File 1752091499884765600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:04:59,978 [lib.common.results] INFO: File 1752091499869140600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:04:59,994 [lib.common.results] INFO: File 1752091499869140600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:05:00,009 [lib.common.results] INFO: File 1752091499869140600.Application.evtx.gz size is 6837, Max size: 100000000
2025-07-09 13:05:00,025 [lib.common.results] INFO: File 1752091499947265600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:00,041 [lib.common.results] INFO: File 1752091499962890600.System.evtx.gz size is 8805, Max size: 100000000
2025-07-09 13:05:00,041 [lib.common.results] INFO: File 1752091499947265600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:00,056 [lib.common.results] INFO: File 1752091499947265600.Security.evtx.gz size is 15163, Max size: 100000000
2025-07-09 13:05:00,072 [lib.common.results] INFO: File 1752091500009765600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:05:01,869 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091501.8691404.sysmon.evtx.gz to host
2025-07-09 13:05:01,869 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 9190, Max size: 100000000
2025-07-09 13:05:07,791 [lib.common.results] INFO: File c:\olddocs\1752091502791.saz size is 4601, Max size: 100000000
2025-07-09 13:05:07,806 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:05:15,103 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:05:15,337 [lib.common.results] INFO: File 1752091515291015600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:05:15,353 [lib.common.results] INFO: File 1752091515291015600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:05:15,369 [lib.common.results] INFO: File 1752091515306640600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:05:15,384 [lib.common.results] INFO: File 1752091515291015600.Application.evtx.gz size is 6766, Max size: 100000000
2025-07-09 13:05:15,400 [lib.common.results] INFO: File 1752091515337890600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:15,400 [lib.common.results] INFO: File 1752091515337890600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:15,416 [lib.common.results] INFO: File 1752091515337890600.Security.evtx.gz size is 7879, Max size: 100000000
2025-07-09 13:05:15,416 [lib.common.results] INFO: File 1752091515337890600.System.evtx.gz size is 8609, Max size: 100000000
2025-07-09 13:05:15,431 [lib.common.results] INFO: File 1752091515400390600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:05:16,884 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:05:21,994 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091521.9941406.sysmon.evtx.gz to host
2025-07-09 13:05:21,994 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 18038, Max size: 100000000
2025-07-09 13:05:27,916 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:05:30,462 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:05:30,697 [lib.common.results] INFO: File 1752091530650390600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:05:30,712 [lib.common.results] INFO: File 1752091530650390600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:05:30,728 [lib.common.results] INFO: File 1752091530650390600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:05:30,744 [lib.common.results] INFO: File 1752091530650390600.Application.evtx.gz size is 6766, Max size: 100000000
2025-07-09 13:05:30,759 [lib.common.results] INFO: File 1752091530697265600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:30,775 [lib.common.results] INFO: File 1752091530697265600.Security.evtx.gz size is 7728, Max size: 100000000
2025-07-09 13:05:30,775 [lib.common.results] INFO: File 1752091530697265600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:30,775 [lib.common.results] INFO: File 1752091530712890600.System.evtx.gz size is 8814, Max size: 100000000
2025-07-09 13:05:30,791 [lib.common.results] INFO: File 1752091530744140600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:05:37,025 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:05:42,103 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091542.1035156.sysmon.evtx.gz to host
2025-07-09 13:05:42,103 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5658, Max size: 100000000
2025-07-09 13:05:45,822 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:05:46,056 [lib.common.results] INFO: File 1752091546009765600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:05:46,072 [lib.common.results] INFO: File 1752091546009765600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:05:46,087 [lib.common.results] INFO: File 1752091546009765600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:05:46,103 [lib.common.results] INFO: File 1752091546009765600.Application.evtx.gz size is 6766, Max size: 100000000
2025-07-09 13:05:46,119 [lib.common.results] INFO: File 1752091546072265600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:46,134 [lib.common.results] INFO: File 1752091546056640600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:05:46,150 [lib.common.results] INFO: File 1752091546056640600.Security.evtx.gz size is 7748, Max size: 100000000
2025-07-09 13:05:46,166 [lib.common.results] INFO: File 1752091546072265600.System.evtx.gz size is 8524, Max size: 100000000
2025-07-09 13:05:46,181 [lib.common.results] INFO: File 1752091546119140600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:05:48,009 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:05:57,119 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:06:01,212 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:06:01,416 [lib.common.results] INFO: File 1752091561369140600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:06:01,447 [lib.common.results] INFO: File 1752091561384765600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:06:01,462 [lib.common.results] INFO: File 1752091561384765600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:06:01,462 [lib.common.results] INFO: File 1752091561369140600.Application.evtx.gz size is 6870, Max size: 100000000
2025-07-09 13:06:01,478 [lib.common.results] INFO: File 1752091561416015600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:01,494 [lib.common.results] INFO: File 1752091561416015600.Security.evtx.gz size is 7762, Max size: 100000000
2025-07-09 13:06:01,494 [lib.common.results] INFO: File 1752091561431640600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:01,509 [lib.common.results] INFO: File 1752091561431640600.System.evtx.gz size is 8527, Max size: 100000000
2025-07-09 13:06:01,525 [lib.common.results] INFO: File 1752091561478515600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:06:02,181 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091562.1816406.sysmon.evtx.gz to host
2025-07-09 13:06:02,181 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5735, Max size: 100000000
2025-07-09 13:06:08,087 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:06:16,556 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:06:16,775 [lib.common.results] INFO: File 1752091576712890600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:06:16,791 [lib.common.results] INFO: File 1752091576712890600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:06:16,791 [lib.common.results] INFO: File 1752091576728515600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:06:16,806 [lib.common.results] INFO: File 1752091576712890600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:06:16,837 [lib.common.results] INFO: File 1752091576775390600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:16,853 [lib.common.results] INFO: File 1752091576775390600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:16,869 [lib.common.results] INFO: File 1752091576775390600.System.evtx.gz size is 8523, Max size: 100000000
2025-07-09 13:06:16,884 [lib.common.results] INFO: File 1752091576775390600.Security.evtx.gz size is 7782, Max size: 100000000
2025-07-09 13:06:16,900 [lib.common.results] INFO: File 1752091576837890600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:06:17,197 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:06:22,259 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091582.2597654.sysmon.evtx.gz to host
2025-07-09 13:06:22,259 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5630, Max size: 100000000
2025-07-09 13:06:28,166 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:06:31,931 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:06:32,150 [lib.common.results] INFO: File 1752091592103515600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:06:32,166 [lib.common.results] INFO: File 1752091592103515600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:06:32,181 [lib.common.results] INFO: File 1752091592103515600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:06:32,197 [lib.common.results] INFO: File 1752091592103515600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:06:32,197 [lib.common.results] INFO: File 1752091592150390600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:32,197 [lib.common.results] INFO: File 1752091592150390600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:32,212 [lib.common.results] INFO: File 1752091592150390600.Security.evtx.gz size is 7736, Max size: 100000000
2025-07-09 13:06:32,228 [lib.common.results] INFO: File 1752091592166015600.System.evtx.gz size is 8538, Max size: 100000000
2025-07-09 13:06:32,244 [lib.common.results] INFO: File 1752091592197265600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:06:37,275 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:06:42,337 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091602.3378906.sysmon.evtx.gz to host
2025-07-09 13:06:42,337 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5519, Max size: 100000000
2025-07-09 13:06:47,275 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:06:47,478 [lib.common.results] INFO: File 1752091607431640600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:06:47,494 [lib.common.results] INFO: File 1752091607431640600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:06:47,509 [lib.common.results] INFO: File 1752091607431640600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:06:47,525 [lib.common.results] INFO: File 1752091607431640600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:06:47,541 [lib.common.results] INFO: File 1752091607478515600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:47,556 [lib.common.results] INFO: File 1752091607478515600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:06:47,572 [lib.common.results] INFO: File 1752091607478515600.Security.evtx.gz size is 7752, Max size: 100000000
2025-07-09 13:06:47,587 [lib.common.results] INFO: File 1752091607494140600.System.evtx.gz size is 8564, Max size: 100000000
2025-07-09 13:06:47,603 [lib.common.results] INFO: File 1752091607509765600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:06:48,244 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:06:57,353 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:07:02,431 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091622.4316406.sysmon.evtx.gz to host
2025-07-09 13:07:02,431 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5788, Max size: 100000000
2025-07-09 13:07:02,634 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:07:02,837 [lib.common.results] INFO: File 1752091622791015600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:07:02,853 [lib.common.results] INFO: File 1752091622791015600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:07:02,869 [lib.common.results] INFO: File 1752091622791015600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:07:02,869 [lib.common.results] INFO: File 1752091622791015600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:07:02,884 [lib.common.results] INFO: File 1752091622822265600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:02,900 [lib.common.results] INFO: File 1752091622837890600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:02,900 [lib.common.results] INFO: File 1752091622837890600.System.evtx.gz size is 8571, Max size: 100000000
2025-07-09 13:07:02,916 [lib.common.results] INFO: File 1752091622837890600.Security.evtx.gz size is 7766, Max size: 100000000
2025-07-09 13:07:02,931 [lib.common.results] INFO: File 1752091622884765600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:07:08,322 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:07:17,447 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:07:17,962 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:07:18,166 [lib.common.results] INFO: File 1752091638119140600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:07:18,181 [lib.common.results] INFO: File 1752091638119140600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:07:18,197 [lib.common.results] INFO: File 1752091638119140600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:07:18,212 [lib.common.results] INFO: File 1752091638119140600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:07:18,228 [lib.common.results] INFO: File 1752091638166015600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:18,244 [lib.common.results] INFO: File 1752091638166015600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:18,259 [lib.common.results] INFO: File 1752091638166015600.Security.evtx.gz size is 7822, Max size: 100000000
2025-07-09 13:07:18,275 [lib.common.results] INFO: File 1752091638181640600.System.evtx.gz size is 8567, Max size: 100000000
2025-07-09 13:07:18,306 [lib.common.results] INFO: File 1752091638212890600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:07:22,509 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091642.5097656.sysmon.evtx.gz to host
2025-07-09 13:07:22,509 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5634, Max size: 100000000
2025-07-09 13:07:27,556 [root] INFO: Analysis timeout hit, terminating analysis
2025-07-09 13:07:27,556 [lib.api.process] INFO: Terminate event set for process 1348
2025-07-09 13:07:27,556 [root] DEBUG: 1348: Terminate Event: Attempting to dump process 1348
2025-07-09 13:07:27,556 [root] DEBUG: 1348: DoProcessDump: Skipping process dump as code is identical on disk.
2025-07-09 13:07:27,556 [lib.api.process] INFO: Termination confirmed for process 1348
2025-07-09 13:07:27,556 [root] INFO: Terminate event set for process 1348
2025-07-09 13:07:27,556 [root] DEBUG: 1348: Terminate Event: monitor shutdown complete for process 1348
2025-07-09 13:07:27,556 [lib.api.process] INFO: Terminate event set for process 396
2025-07-09 13:07:27,556 [root] DEBUG: 396: Terminate Event: Attempting to dump process 396
2025-07-09 13:07:27,556 [root] DEBUG: 396: DoProcessDump: Skipping process dump as code is identical on disk.
2025-07-09 13:07:27,572 [lib.api.process] INFO: Termination confirmed for process 396
2025-07-09 13:07:27,572 [root] INFO: Terminate event set for process 396
2025-07-09 13:07:27,572 [root] DEBUG: 396: Terminate Event: monitor shutdown complete for process 396
2025-07-09 13:07:27,572 [lib.api.process] INFO: Terminate event set for process 1704
2025-07-09 13:07:27,572 [root] DEBUG: 1704: Terminate Event: Attempting to dump process 1704
2025-07-09 13:07:27,572 [root] DEBUG: 1704: DoProcessDump: Skipping process dump as code is identical on disk.
2025-07-09 13:07:27,572 [lib.api.process] INFO: Termination confirmed for process 1704
2025-07-09 13:07:27,572 [root] INFO: Terminate event set for process 1704
2025-07-09 13:07:27,572 [root] DEBUG: 1704: Terminate Event: monitor shutdown complete for process 1704
2025-07-09 13:07:27,572 [root] INFO: Created shutdown mutex
2025-07-09 13:07:28,400 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:07:28,572 [root] INFO: Shutting down package
2025-07-09 13:07:28,572 [root] INFO: Stopping auxiliary modules
2025-07-09 13:07:28,572 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [WinError 6] The handle is invalid
2025-07-09 13:07:28,572 [lib.common.results] INFO: File C:\curtain.log size is 0, Max size: 100000000
2025-07-09 13:07:28,587 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:07:28,791 [lib.common.results] INFO: File 1752091648744140600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:07:28,806 [lib.common.results] INFO: File 1752091648744140600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:07:28,822 [lib.common.results] INFO: File 1752091648744140600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:07:28,822 [lib.common.results] INFO: File 1752091648744140600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:07:28,837 [lib.common.results] INFO: File 1752091648791015600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:28,853 [lib.common.results] INFO: File 1752091648791015600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:28,869 [lib.common.results] INFO: File 1752091648791015600.Security.evtx.gz size is 7757, Max size: 100000000
2025-07-09 13:07:28,884 [lib.common.results] INFO: File 1752091648806640600.System.evtx.gz size is 8536, Max size: 100000000
2025-07-09 13:07:28,900 [lib.common.results] INFO: File 1752091648837890600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:07:33,337 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2025-07-09 13:07:33,556 [lib.common.results] INFO: File 1752091653509765600.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2025-07-09 13:07:33,572 [lib.common.results] INFO: File 1752091653509765600.HardwareEvents.evtx.gz size is 214, Max size: 100000000
2025-07-09 13:07:33,587 [lib.common.results] INFO: File 1752091653509765600.KeyManagementService.evtx.gz size is 227, Max size: 100000000
2025-07-09 13:07:33,603 [lib.common.results] INFO: File 1752091653509765600.Application.evtx.gz size is 6799, Max size: 100000000
2025-07-09 13:07:33,619 [lib.common.results] INFO: File 1752091653556640600.Security.evtx.gz size is 7405, Max size: 100000000
2025-07-09 13:07:33,634 [lib.common.results] INFO: File 1752091653556640600.OAlerts.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:33,650 [lib.common.results] INFO: File 1752091653556640600.Setup.evtx.gz size is 247, Max size: 100000000
2025-07-09 13:07:33,681 [lib.common.results] INFO: File 1752091653572265600.System.evtx.gz size is 8542, Max size: 100000000
2025-07-09 13:07:33,697 [lib.common.results] INFO: File 1752091653619140600.WindowsPowerShell.evtx.gz size is 1073, Max size: 100000000
2025-07-09 13:07:34,009 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2025-07-09 13:07:34,009 [modules.auxiliary.sysmon] INFO: Doing final sysmon log dump
2025-07-09 13:07:37,525 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2025-07-09 13:07:39,087 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1752091659.0878906.sysmon.evtx.gz to host
2025-07-09 13:07:39,087 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 10690, Max size: 100000000
2025-07-09 13:07:39,103 [root] INFO: Finishing auxiliary modules
2025-07-09 13:07:39,103 [root] INFO: Shutting down pipe server and dumping dropped files
2025-07-09 13:07:39,103 [root] WARNING: Folder at path "C:\MXVIiysWpa\debugger" does not exist, skipping
2025-07-09 13:07:39,103 [root] WARNING: Folder at path "C:\MXVIiysWpa\tlsdump" does not exist, skipping
2025-07-09 13:07:39,103 [root] INFO: Analysis completed

Machine

Name Label Manager Started On Shutdown On Route
win7office2k3flash2800137TWN3H102 win7office2k3flash2800137TWN3H102 KVM 2025-07-09 20:04:44 2025-07-09 20:07:50 internet

File Details

File Name opencalc.bat
File Size 9 bytes
File Type ASCII text
MD5 c61463921d79e07e461fd0e731f72619
SHA1 4c70ac1680d2c4bdb145d5be5dad5230b20805f2
SHA256 7fdf626e0603f5bc2375a7bbc92c94a21088841c0a03cf3c5f12aa9c680ce4e6
SHA512 1a0ada808250064beaafad6095f6d12b0a26ddeb0aff616205986dc4db7c4e72686701945bfb948a141a5f6db0d0e6cec29cd2fddc59ba07a9279a93a7e3541e
SHA3-384 b61a7654e9f55c8d3f21ad0e18325fb9d987f7baece23caa7b5803b1ed18cc0603d1cc5a57f344355e3e08a0950fcd36
CRC32 8D648BCF
Ssdeep 3:FGLAdK:FbK
File 
                                    
                                
calc.exe
calc.exe

Processing ( 11.23 seconds )

  • 7.426 Suricata
  • 3.129 Zircolite
  • 0.279 BehaviorAnalysis
  • 0.128 NetworkAnalysis
  • 0.072 Deduplicate
  • 0.057 CAPE
  • 0.054 AnalysisInfo
  • 0.053 Fiddler
  • 0.022 TargetInfo
  • 0.004 Static
  • 0.003 Debug
  • 0.001 Strings

Signatures ( 0.05 seconds )

  • 0.014 antiav_detectreg
  • 0.005 infostealer_ftp
  • 0.005 territorial_disputes_sigs
  • 0.003 infostealer_im
  • 0.002 guloader_apis
  • 0.002 masslogger_artifacts
  • 0.002 antianalysis_detectreg
  • 0.002 ransomware_files
  • 0.002 sigma
  • 0.001 persistence_autorun
  • 0.001 antianalysis_detectfile
  • 0.001 antiav_detectfile
  • 0.001 antivm_vbox_keys
  • 0.001 antivm_vmware_keys
  • 0.001 geodo_banking_trojan
  • 0.001 infostealer_bitcoin
  • 0.001 infostealer_mail
  • 0.001 ransomware_extensions

Reporting ( 0.01 seconds )

  • 0.012 JsonDump

Signatures

Dynamic (imported) function loading detected
DynamicLoader: kernel32.dll/SetThreadUILanguage
DynamicLoader: kernel32.dll/CopyFileExW
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/SetConsoleInputExeNameW
DynamicLoader: ADVAPI32.dll/SaferIdentifyLevel
DynamicLoader: ADVAPI32.dll/SaferComputeTokenFromLevel
DynamicLoader: ADVAPI32.dll/SaferCloseLevel
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: LPK.dll/LpkEditControl
DynamicLoader: WindowsCodecs.dll/WICCreateImagingFactory_Proxy
DynamicLoader: UxTheme.dll/ThemeInitApiHook
DynamicLoader: USER32.dll/IsProcessDPIAware
DynamicLoader: dwmapi.dll/DwmIsCompositionEnabled
DynamicLoader: GDI32.dll/GetLayout
DynamicLoader: GDI32.dll/GdiRealizationInfo
DynamicLoader: GDI32.dll/FontIsLinked
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: GDI32.dll/GetTextFaceAliasW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: GDI32.dll/GetFontAssocStatus
DynamicLoader: ADVAPI32.dll/RegQueryValueExA
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: USER32.dll/GetWindowInfo
DynamicLoader: USER32.dll/GetAncestor
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/EnumDisplayDevicesA
DynamicLoader: GDI32.dll/ExtTextOutW
DynamicLoader: GDI32.dll/GdiIsMetaPrintDC
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: UxTheme.dll/OpenThemeData
DynamicLoader: UxTheme.dll/IsThemePartDefined
DynamicLoader: UxTheme.dll/GetThemeFont
DynamicLoader: UxTheme.dll/GetThemeColor
DynamicLoader: UxTheme.dll/GetThemeBool
DynamicLoader: IMM32.DLL/ImmIsIME
DynamicLoader: UxTheme.dll/EnableThemeDialogTexture
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: WINMM.dll/timeGetTime
DynamicLoader: WINMM.dll/timeSetEvent
DynamicLoader: WINMM.dll/timeKillEvent
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: OLEAUT32.dll/#2
DynamicLoader: OLEAUT32.dll/#10
DynamicLoader: OLEAUT32.dll/#6
DynamicLoader: UxTheme.dll/BufferedPaintInit
DynamicLoader: UxTheme.dll/BufferedPaintRenderAnimation
DynamicLoader: UxTheme.dll/BeginBufferedAnimation
DynamicLoader: UxTheme.dll/IsThemeBackgroundPartiallyTransparent
DynamicLoader: UxTheme.dll/DrawThemeParentBackground
DynamicLoader: UxTheme.dll/DrawThemeBackground
DynamicLoader: UxTheme.dll/GetThemeBackgroundContentRect
DynamicLoader: UxTheme.dll/EndBufferedAnimation
DynamicLoader: GDI32.dll/GetTextExtentExPointWPri
DynamicLoader: UxTheme.dll/DrawThemeText
DynamicLoader: UxTheme.dll/BufferedPaintStopAllAnimations
DynamicLoader: OLEAUT32.dll/#9
Sigma Alerts
title: Uncommon Process Access Rights For Target Image
id: a24e5861-c6ca-4fde-a93c-ba9256feddf0
description: Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
sigmafile:
sigma: ["SELECT * FROM logs WHERE Channel='Microsoft-Windows-Sysmon/Operational' AND (EventID=10 AND ((TargetImage LIKE '%\\\\calc.exe' ESCAPE '\\' OR TargetImage LIKE '%\\\\calculator.exe' ESCAPE '\\' OR TargetImage LIKE '%\\\\mspaint.exe' ESCAPE '\\' OR TargetImage LIKE '%\\\\notepad.exe' ESCAPE '\\' OR TargetImage LIKE '%\\\\ping.exe' ESCAPE '\\' OR TargetImage LIKE '%\\\\wordpad.exe' ESCAPE '\\' OR TargetImage LIKE '%\\\\write.exe' ESCAPE '\\') AND GrantedAccess='0x1FFFFF'))"]
rule_level: low
tags: ['attack.defense-evasion', 'attack.privilege-escalation', 'attack.t1055.011']
count: 2
matches: [{'row_id': 956, 'Provider_Name': 'Microsoft-Windows-Sysmon', 'Guid': '5770385F-C22A-43E0-BF4C-06F5698FFBD9', 'EventID': 10, 'Version': 3, 'Level': 4, 'Task': 10, 'Opcode': 0, 'Keywords': '0x8000000000000000', 'SystemTime': '2025-07-09T20:04:56.890625Z', 'EventRecordID': 1922767, 'ProcessID': 1328, 'ThreadID': 1728, 'Channel': 'Microsoft-Windows-Sysmon/Operational', 'Computer': 'WS-977744', 'UserID': 'S-1-5-18', 'OriginalLogfile': '1752091521.9941406.sysmon.evtx-UZ8FG2SL.json', 'RuleName': '-', 'UtcTime': '2025-07-09 20:04:56.875', 'SourceProcessGUID': '34022EC5-CB68-686E-1D03-000000007500', 'SourceProcessId': 396, 'SourceThreadId': 2660, 'SourceImage': 'C:\\Windows\\SysWOW64\\cmd.exe', 'TargetProcessGUID': '34022EC5-CB5C-686E-0003-000000007500', 'TargetProcessId': 1704, 'TargetImage': 'C:\\Windows\\SysWOW64\\calc.exe', 'GrantedAccess': '0x1fffff', 'CallTrace': 'C:\\Windows\\SYSTEM32\\ntdll.dll+6a35a|C:\\Windows\\SYSTEM32\\wow64.dll+ba4f|C:\\Windows\\SYSTEM32\\wow64.dll+2161f|C:\\Windows\\SYSTEM32\\wow64.dll+d18f|C:\\Windows\\SYSTEM32\\wow64cpu.dll+2776|C:\\Windows\\SYSTEM32\\wow64.dll+d286|C:\\Windows\\SYSTEM32\\wow64.dll+c69e|C:\\Windows\\SYSTEM32\\ntdll.dll+343c3|C:\\Windows\\SYSTEM32\\ntdll.dll+99780|C:\\Windows\\SYSTEM32\\ntdll.dll+4371e|C:\\Windows\\SysWOW64\\ntdll.dll+2095e(wow64)|UNKNOWN(0000000073ABDAF2)|C:\\Windows\\syswow64\\kernel32.dll+2439c(wow64)|UNKNOWN(0000000073AC85E9)|C:\\Windows\\syswow64\\kernel32.dll+11069(wow64)|C:\\Windows\\SysWOW64\\cmd.exe+3f94|C:\\Windows\\SysWOW64\\cmd.exe+3cb5|C:\\Windows\\SysWOW64\\cmd.exe+3d48|C:\\Windows\\SysWOW64\\cmd.exe+15c5|C:\\Windows\\SysWOW64\\cmd.exe+22c0|C:\\Windows\\SysWOW64\\cmd.exe+4d0e|C:\\Windows\\SysWOW64\\cmd.exe+5718|C:\\Windows\\SysWOW64\\cmd.exe+6b85|C:\\Windows\\SysWOW64\\cmd.exe+3d48', 'SourceUser': 'WS-977744\\ZCTYEb', 'TargetUser': 'WS-977744\\ZCTYEb'}, {'row_id': 962, 'Provider_Name': 'Microsoft-Windows-Sysmon', 'Guid': '5770385F-C22A-43E0-BF4C-06F5698FFBD9', 'EventID': 10, 'Version': 3, 'Level': 4, 'Task': 10, 'Opcode': 0, 'Keywords': '0x8000000000000000', 'SystemTime': '2025-07-09T20:04:56.906250Z', 'EventRecordID': 1922773, 'ProcessID': 1328, 'ThreadID': 1728, 'Channel': 'Microsoft-Windows-Sysmon/Operational', 'Computer': 'WS-977744', 'UserID': 'S-1-5-18', 'OriginalLogfile': '1752091521.9941406.sysmon.evtx-UZ8FG2SL.json', 'RuleName': '-', 'UtcTime': '2025-07-09 20:04:56.906', 'SourceProcessGUID': '34022EC5-CB68-686E-2403-000000007500', 'SourceProcessId': 2280, 'SourceThreadId': 2904, 'SourceImage': 'C:\\tmp9sa_k9cw\\bin\\RIQWrzN.exe', 'TargetProcessGUID': '34022EC5-CB68-686E-2303-000000007500', 'TargetProcessId': 1704, 'TargetImage': 'C:\\Windows\\SysWOW64\\calc.exe', 'GrantedAccess': '0x1fffff', 'CallTrace': 'C:\\Windows\\SYSTEM32\\ntdll.dll+69aea|C:\\Windows\\SYSTEM32\\wow64.dll+14ec8|C:\\Windows\\SYSTEM32\\wow64.dll+d18f|C:\\Windows\\SYSTEM32\\wow64cpu.dll+2776|C:\\Windows\\SYSTEM32\\wow64.dll+d286|C:\\Windows\\SYSTEM32\\wow64.dll+c69e|C:\\Windows\\SYSTEM32\\ntdll.dll+343c3|C:\\Windows\\SYSTEM32\\ntdll.dll+99780|C:\\Windows\\SYSTEM32\\ntdll.dll+4371e|C:\\Windows\\SysWOW64\\ntdll.dll+1fc62(wow64)|C:\\Windows\\syswow64\\KERNELBASE.dll+f369(wow64)|C:\\tmp9sa_k9cw\\bin\\RIQWrzN.exe+2d8e|C:\\tmp9sa_k9cw\\bin\\RIQWrzN.exe+3831|C:\\tmp9sa_k9cw\\bin\\RIQWrzN.exe+44d5|C:\\Windows\\syswow64\\kernel32.dll+1344d(wow64)|C:\\Windows\\SysWOW64\\ntdll.dll+39802(wow64)|C:\\Windows\\SysWOW64\\ntdll.dll+397d5(wow64)', 'SourceUser': 'WS-977744\\ZCTYEb', 'TargetUser': 'WS-977744\\ZCTYEb'}]
Network activity detected but not expressed in API logs

Screenshots

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States

DNS

No domains contacted.

Summary

C:\Users\pgabriel\AppData\Local\Temp
C:\Users
C:\Users\pgabriel
C:\Users\pgabriel\AppData
C:\Users\pgabriel\AppData\Local
C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat
C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat\
C:\Users\pgabriel\AppData\Local\Temp\
C:\Users\pgabriel\AppData\Local\
C:\Users\pgabriel\AppData\
C:\Users\pgabriel\
C:\Users\
\??\MountPointManager
C:\Users\pgabriel\AppData\Local\Temp\calc.exe
C:\Users\pgabriel\AppData\Local\Temp\calc.exe.*
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\calc.exe
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\calc.exe.*
C:\Windows\System32\calc.exe
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Fonts\staticcache.dat
C:\Windows\System32\rpcss.dll
C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Fonts\staticcache.dat
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\LevelObjects
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Srp\\GP\
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_CLASSES_ROOT\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance
HKEY_CLASSES_ROOT\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
HKEY_CURRENT_USER\Software\Microsoft\Calc
HKEY_CURRENT_USER\Software\Microsoft\Calc\layout
HKEY_CURRENT_USER\Software\Microsoft\Calc\UseSep
HKEY_CURRENT_USER\Software\Microsoft\Calc\ShowHistory
HKEY_CURRENT_USER\Software\Microsoft\Calc\UnitConv
HKEY_CURRENT_USER\Software\Microsoft\Calc\Templates
HKEY_CURRENT_USER\Software\Microsoft\Calc\DateTime
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Placement
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sDecimal
HKEY_CURRENT_USER\Control Panel\International\sThousand
HKEY_CURRENT_USER\Control Panel\International\sGrouping
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Min_Width
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Min_Height
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\calc.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Consolas
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI Symbol
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DisableUNCCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\EnableExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DelayedExpansion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\DefaultColor
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\CompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\PathCompletionChar
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor\AutoRun
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\Levels
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\DefaultLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\SaferFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Srp\GP\RuleCount
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\PolicyScope
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\LogFileName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
HKEY_CURRENT_USER\Software\Microsoft\Calc\layout
HKEY_CURRENT_USER\Software\Microsoft\Calc\UseSep
HKEY_CURRENT_USER\Software\Microsoft\Calc\ShowHistory
HKEY_CURRENT_USER\Software\Microsoft\Calc\UnitConv
HKEY_CURRENT_USER\Software\Microsoft\Calc\Templates
HKEY_CURRENT_USER\Software\Microsoft\Calc\DateTime
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Placement
HKEY_CURRENT_USER\Control Panel\International\sDecimal
HKEY_CURRENT_USER\Control Panel\International\sThousand
HKEY_CURRENT_USER\Control Panel\International\sGrouping
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Min_Width
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Min_Height
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
HKEY_CURRENT_USER\Software\Microsoft\Calc
HKEY_CURRENT_USER\Software\Microsoft\Calc\Window_Placement
kernel32.dll.SetThreadUILanguage
kernel32.dll.CopyFileExW
kernel32.dll.IsDebuggerPresent
kernel32.dll.SetConsoleInputExeNameW
advapi32.dll.SaferIdentifyLevel
advapi32.dll.SaferComputeTokenFromLevel
advapi32.dll.SaferCloseLevel
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
lpk.dll.LpkEditControl
windowscodecs.dll.WICCreateImagingFactory_Proxy
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
dwmapi.dll.DwmIsCompositionEnabled
gdi32.dll.GetLayout
gdi32.dll.GdiRealizationInfo
gdi32.dll.FontIsLinked
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryInfoKeyW
gdi32.dll.GetTextFaceAliasW
advapi32.dll.RegEnumValueW
advapi32.dll.RegCloseKey
advapi32.dll.RegQueryValueExW
gdi32.dll.GetFontAssocStatus
advapi32.dll.RegQueryValueExA
advapi32.dll.RegEnumKeyExW
kernel32.dll.IsProcessorFeaturePresent
user32.dll.GetWindowInfo
user32.dll.GetAncestor
user32.dll.GetMonitorInfoA
user32.dll.EnumDisplayMonitors
user32.dll.EnumDisplayDevicesA
gdi32.dll.ExtTextOutW
gdi32.dll.GdiIsMetaPrintDC
comctl32.dll.RegisterClassNameW
uxtheme.dll.OpenThemeData
uxtheme.dll.IsThemePartDefined
uxtheme.dll.GetThemeFont
uxtheme.dll.GetThemeColor
uxtheme.dll.GetThemeBool
imm32.dll.ImmIsIME
uxtheme.dll.EnableThemeDialogTexture
cryptbase.dll.SystemFunction036
winmm.dll.timeGetTime
winmm.dll.timeSetEvent
winmm.dll.timeKillEvent
ole32.dll.CoInitializeEx
ole32.dll.CoUninitialize
ole32.dll.CoRegisterInitializeSpy
ole32.dll.CoRevokeInitializeSpy
oleaut32.dll.#2
oleaut32.dll.#10
oleaut32.dll.#6
uxtheme.dll.BufferedPaintInit
uxtheme.dll.BufferedPaintRenderAnimation
uxtheme.dll.BeginBufferedAnimation
uxtheme.dll.IsThemeBackgroundPartiallyTransparent
uxtheme.dll.DrawThemeParentBackground
uxtheme.dll.DrawThemeBackground
uxtheme.dll.GetThemeBackgroundContentRect
uxtheme.dll.EndBufferedAnimation
gdi32.dll.GetTextExtentExPointWPri
uxtheme.dll.DrawThemeText
uxtheme.dll.BufferedPaintStopAllAnimations
oleaut32.dll.#9
C:\Windows\system32\cmd.exe /K "C:\Users\pgabriel\AppData\Local\Temp\opencalc.bat"
calc.exe
No static analysis available.
Sorry! No behavior.

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

DNS

No domains contacted.

HTTP Requests

No HTTP(s) requests performed.

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No Suricata Extracted files.
Sorry! No dropped files.
Sorry! No process dumps.