| Category | Package | Started | Completed | Duration | Options | Log |
|---|---|---|---|---|---|---|
| FILE | doc | 2026-04-13 11:03:46 | 2026-04-13 11:06:56 | 190 seconds | Show Options | Show Log |
procdump=1
amsidump=1
2025-12-02 01:28:52,828 [root] INFO: Date set to: 20260413T04:03:45, timeout set to: 150
2026-04-13 05:03:45,031 [root] DEBUG: Starting analyzer from: C:\tmp5j_l8fk0
2026-04-13 05:03:45,031 [root] DEBUG: Storing results at: C:\ejbiTUmAt
2026-04-13 05:03:45,031 [root] DEBUG: Pipe server name: \\.\PIPE\jPWeDFyYmT
2026-04-13 05:03:45,031 [root] DEBUG: Python path: C:\olddocs
2026-04-13 05:03:45,031 [root] INFO: Analysis package "doc" has been specified
2026-04-13 05:03:45,031 [root] DEBUG: Importing analysis package "doc"...
2026-04-13 05:03:45,046 [root] DEBUG: Initializing analysis package "doc"...
2026-04-13 05:03:45,046 [root] INFO: Analyzer: Package modules.packages.doc does not specify a DLL option
2026-04-13 05:03:45,046 [root] INFO: Analyzer: Package modules.packages.doc does not specify a DLL_64 option
2026-04-13 05:03:45,046 [root] INFO: Analyzer: Package modules.packages.doc does not specify a loader option
2026-04-13 05:03:45,046 [root] INFO: Analyzer: Package modules.packages.doc does not specify a loader_64 option
2026-04-13 05:03:45,093 [root] DEBUG: Importing auxiliary module "modules.auxiliary.browser"...
2026-04-13 05:03:45,093 [root] DEBUG: Importing auxiliary module "modules.auxiliary.curtain"...
2026-04-13 05:03:45,093 [root] DEBUG: Importing auxiliary module "modules.auxiliary.default_apps"...
2026-04-13 05:03:45,109 [root] DEBUG: Importing auxiliary module "modules.auxiliary.digisig"...
2026-04-13 05:03:45,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.disguise"...
2026-04-13 05:03:45,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.evtx"...
2026-04-13 05:03:45,156 [root] DEBUG: Importing auxiliary module "modules.auxiliary.fiddler"...
2026-04-13 05:03:45,156 [root] DEBUG: Importing auxiliary module "modules.auxiliary.human"...
2026-04-13 05:03:45,171 [root] DEBUG: Importing auxiliary module "modules.auxiliary.screenshots"...
2026-04-13 05:03:45,171 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-04-13 05:03:45,265 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2026-04-13 05:03:45,265 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2026-04-13 05:03:45,281 [root] DEBUG: Importing auxiliary module "modules.auxiliary.sysmon"...
2026-04-13 05:03:45,281 [root] DEBUG: Importing auxiliary module "modules.auxiliary.tlsdump"...
2026-04-13 05:03:45,281 [root] DEBUG: Importing auxiliary module "modules.auxiliary.usage"...
2026-04-13 05:03:45,281 [root] DEBUG: Initializing auxiliary module "Browser"...
2026-04-13 05:03:45,281 [root] DEBUG: Started auxiliary module Browser
2026-04-13 05:03:45,281 [root] DEBUG: Initializing auxiliary module "Curtain"...
2026-04-13 05:03:45,281 [root] DEBUG: Started auxiliary module Curtain
2026-04-13 05:03:45,281 [root] DEBUG: Initializing auxiliary module "DefaultApps"...
2026-04-13 05:03:45,343 [modules.auxiliary.default_apps] DEBUG: Getting current user SID using WinAPI
2026-04-13 05:03:45,343 [root] DEBUG: Started auxiliary module DefaultApps
2026-04-13 05:03:45,343 [root] DEBUG: Initializing auxiliary module "DigiSig"...
2026-04-13 05:03:45,343 [modules.auxiliary.digisig] INFO: signtool.exe was not found in bin/
2026-04-13 05:03:45,343 [modules.auxiliary.digisig] INFO: doc
2026-04-13 05:03:45,343 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, unsupported analyzer package
2026-04-13 05:03:45,343 [root] DEBUG: Started auxiliary module DigiSig
2026-04-13 05:03:45,343 [root] DEBUG: Initializing auxiliary module "Disguise"...
2026-04-13 05:03:45,750 [modules.auxiliary.disguise] INFO: Setting NoRecentDocsHistory
2026-04-13 05:03:45,765 [root] WARNING: Cannot execute auxiliary module Disguise: [WinError 2] The system cannot find the file specified
2026-04-13 05:03:45,765 [root] DEBUG: Initializing auxiliary module "Evtx"...
2026-04-13 05:03:45,765 [modules.auxiliary.evtx] INFO: Loading audit policy C:\tmp5j_l8fk0\bin\auditpol.csv
2026-04-13 05:03:45,953 [modules.auxiliary.evtx] INFO: Wiping logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:03:46,843 [root] DEBUG: Started auxiliary module Evtx
2026-04-13 05:03:46,843 [root] DEBUG: Initializing auxiliary module "Fiddler"...
2026-04-13 05:03:46,843 [modules.auxiliary.fiddler] INFO: fiddler package: doc
2026-04-13 05:03:46,859 [root] DEBUG: Started auxiliary module Fiddler
2026-04-13 05:03:46,859 [root] DEBUG: Initializing auxiliary module "Human"...
2026-04-13 05:03:46,859 [root] DEBUG: Started auxiliary module Human
2026-04-13 05:03:46,859 [root] DEBUG: Initializing auxiliary module "Screenshots"...
2026-04-13 05:03:46,859 [root] DEBUG: Started auxiliary module Screenshots
2026-04-13 05:03:46,859 [root] DEBUG: Initializing auxiliary module "Sysmon"...
2026-04-13 05:03:46,875 [modules.auxiliary.sysmon] INFO: Seeing if we need to update sysmon config
2026-04-13 05:03:46,875 [root] DEBUG: Started auxiliary module Sysmon
2026-04-13 05:03:46,875 [root] DEBUG: Initializing auxiliary module "TLSDumpMasterSecrets"...
2026-04-13 05:03:46,875 [modules.auxiliary.sysmon] INFO: Found Sysmon Executable
2026-04-13 05:03:46,875 [modules.auxiliary.sysmon] INFO: Found Sysmon config
2026-04-13 05:03:46,875 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 560
2026-04-13 05:03:46,875 [lib.api.process] INFO: Monitor config for process 560: C:\tmp5j_l8fk0\dll\560.ini
2026-04-13 05:03:48,984 [modules.auxiliary.sysmon] INFO: Clearing existing sysmon logs
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'office' with value '1' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'yarascan' with value '0' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2026-04-13 05:03:49,890 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp5j_l8fk0\dll\bSzuIRYc.dll, loader C:\tmp5j_l8fk0\bin\HjSmXpJb.exe
2026-04-13 05:03:49,921 [root] DEBUG: Loader: IAT patching disabled.
2026-04-13 05:03:49,921 [root] DEBUG: Loader: Injecting process 560 with C:\tmp5j_l8fk0\dll\bSzuIRYc.dll.
2026-04-13 05:03:49,968 [root] DEBUG: 560: Python path set to 'C:\olddocs'.
2026-04-13 05:03:49,968 [root] DEBUG: 560: Disabling sleep skipping.
2026-04-13 05:03:49,968 [root] DEBUG: 560: Process dumps enabled.
2026-04-13 05:03:49,968 [root] DEBUG: 560: AMSI dumping enabled.
2026-04-13 05:03:49,968 [root] DEBUG: 560: Monitor config - unrecognised key office.
2026-04-13 05:03:49,968 [root] DEBUG: 560: In-monitor YARA scans disabled.
2026-04-13 05:03:49,968 [root] DEBUG: 560: TLS secret dump mode enabled.
2026-04-13 05:03:49,984 [root] DEBUG: 560: Monitor initialised: 64-bit capemon loaded in process 560 at 0x000007FEEDE50000, thread 3064, image base 0x00000000FF390000, stack from 0x0000000002003000-0x0000000002010000
2026-04-13 05:03:49,984 [root] DEBUG: 560: Commandline: C:\Windows\system32\lsass.exe
2026-04-13 05:03:49,984 [root] DEBUG: 560: Hooked 5 out of 5 functions
2026-04-13 05:03:50,000 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-04-13 05:03:50,000 [root] DEBUG: Successfully injected DLL C:\tmp5j_l8fk0\dll\bSzuIRYc.dll.
2026-04-13 05:03:50,015 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 560
2026-04-13 05:03:50,015 [root] DEBUG: Started auxiliary module TLSDumpMasterSecrets
2026-04-13 05:03:50,015 [root] DEBUG: Initializing auxiliary module "Usage"...
2026-04-13 05:03:50,015 [root] DEBUG: Started auxiliary module Usage
2026-04-13 05:03:52,750 [root] INFO: Restarting WMI Service
2026-04-13 05:03:59,000 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:04:01,843 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:04:01,859 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" with arguments ""C:\Users\pgabriel\AppData\Local\Temp\1234_as_password_ha.docx" /q" with pid 908
2026-04-13 05:04:01,859 [lib.api.process] INFO: Monitor config for process 908: C:\tmp5j_l8fk0\dll\908.ini
2026-04-13 05:04:01,890 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor
2026-04-13 05:04:01,890 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor
2026-04-13 05:04:01,890 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor
2026-04-13 05:04:01,890 [lib.api.process] INFO: Option 'office' with value '1' sent to monitor
2026-04-13 05:04:01,890 [lib.api.process] INFO: Option 'yarascan' with value '0' sent to monitor
2026-04-13 05:04:01,890 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor
2026-04-13 05:04:01,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp5j_l8fk0\dll\sPPQdjYo.dll, loader C:\tmp5j_l8fk0\bin\zyNxNcE.exe
2026-04-13 05:04:01,937 [root] DEBUG: Loader: IAT patching disabled.
2026-04-13 05:04:01,937 [root] DEBUG: Loader: Injecting process 908 (thread 2844) with C:\tmp5j_l8fk0\dll\sPPQdjYo.dll.
2026-04-13 05:04:01,953 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued.
2026-04-13 05:04:01,953 [root] DEBUG: Successfully injected DLL C:\tmp5j_l8fk0\dll\sPPQdjYo.dll.
2026-04-13 05:04:01,953 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 908
2026-04-13 05:04:02,187 [lib.common.results] INFO: File 1776081842093750000.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:04:02,203 [lib.common.results] INFO: File 1776081842093750000.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:04:02,203 [lib.common.results] INFO: File 1776081842093750000.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:04:02,203 [lib.common.results] INFO: File 1776081842093750000.Application.evtx.gz size is 6910, Max size: 100000000
2026-04-13 05:04:02,265 [lib.common.results] INFO: File 1776081842187500000.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:02,281 [lib.common.results] INFO: File 1776081842187500000.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:02,281 [lib.common.results] INFO: File 1776081842203125000.System.evtx.gz size is 8464, Max size: 100000000
2026-04-13 05:04:02,296 [lib.common.results] INFO: File 1776081842187500000.Security.evtx.gz size is 7627, Max size: 100000000
2026-04-13 05:04:02,343 [lib.common.results] INFO: File 1776081842265625000.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:04:03,953 [lib.api.process] INFO: Successfully resumed process with pid 908
2026-04-13 05:04:04,125 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081844.125.sysmon.evtx.gz to host
2026-04-13 05:04:04,125 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 9396, Max size: 100000000
2026-04-13 05:04:04,156 [root] DEBUG: 908: Python path set to 'C:\olddocs'.
2026-04-13 05:04:04,171 [root] DEBUG: 908: Disabling sleep skipping.
2026-04-13 05:04:04,171 [root] DEBUG: 908: Process dumps enabled.
2026-04-13 05:04:04,171 [root] DEBUG: 908: AMSI dumping enabled.
2026-04-13 05:04:04,171 [root] DEBUG: 908: Monitor config - unrecognised key office.
2026-04-13 05:04:04,171 [root] DEBUG: 908: In-monitor YARA scans disabled.
2026-04-13 05:04:04,171 [root] DEBUG: 908: Dropped file limit defaulting to 100.
2026-04-13 05:04:04,171 [root] DEBUG: 908: Microsoft Office settings enabled.
2026-04-13 05:04:04,171 [root] DEBUG: 908: Monitor initialised: 32-bit capemon loaded in process 908 at 0x747d0000, thread 2844, image base 0x1110000, stack from 0x1e3000-0x1f0000
2026-04-13 05:04:04,171 [root] DEBUG: 908: Commandline: "C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE" "C:\Users\pgabriel\AppData\Local\Temp\1234_as_password_ha.docx" /q
2026-04-13 05:04:04,203 [root] DEBUG: 908: Hooked 456 out of 456 functions
2026-04-13 05:04:04,218 [root] INFO: Loaded monitor into process with pid 908
2026-04-13 05:04:04,484 [root] DEBUG: 908: DLL loaded at 0x706A0000: C:\Program Files (x86)\Microsoft Office\Office15\wwlib (0x14bc000 bytes).
2026-04-13 05:04:04,515 [root] DEBUG: 908: DLL loaded at 0x74640000: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus (0x190000 bytes).
2026-04-13 05:04:04,703 [root] DEBUG: 908: DLL loaded at 0x6F8F0000: C:\Program Files (x86)\Microsoft Office\Office15\oart (0xda8000 bytes).
2026-04-13 05:04:04,718 [root] DEBUG: 908: DLL loaded at 0x74C10000: C:\Windows\system32\MSVCP100 (0x69000 bytes).
2026-04-13 05:04:04,765 [root] DEBUG: 908: DLL loaded at 0x72CD0000: C:\Windows\system32\d2d1 (0x347000 bytes).
2026-04-13 05:04:05,125 [root] DEBUG: 908: DLL loaded at 0x6E000000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso (0x18e4000 bytes).
2026-04-13 05:04:05,125 [root] DEBUG: 908: DLL loaded at 0x73A60000: C:\Windows\system32\MSIMG32 (0x5000 bytes).
2026-04-13 05:04:05,140 [root] DEBUG: 908: DLL loaded at 0x73C50000: C:\Windows\system32\uxtheme (0x80000 bytes).
2026-04-13 05:04:05,156 [root] DEBUG: 908: DLL loaded at 0x73B70000: C:\Windows\system32\WTSAPI32 (0xd000 bytes).
2026-04-13 05:04:05,156 [root] DEBUG: 908: DLL loaded at 0x74BE0000: C:\Windows\system32\WINSTA (0x29000 bytes).
2026-04-13 05:04:05,171 [root] DEBUG: 908: DLL loaded at 0x745F0000: C:\Windows\system32\dxgi (0x4c000 bytes).
2026-04-13 05:04:05,171 [root] DEBUG: 908: DLL loaded at 0x73B90000: C:\Windows\system32\VERSION (0x9000 bytes).
2026-04-13 05:04:05,187 [root] DEBUG: 908: DLL loaded at 0x745D0000: C:\Windows\system32\dwmapi (0x13000 bytes).
2026-04-13 05:04:05,187 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:05,187 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:05,187 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:05,203 [root] DEBUG: 908: DLL loaded at 0x75810000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2026-04-13 05:04:05,218 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:05,218 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:05,218 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:05,234 [root] DEBUG: 908: DLL loaded at 0x72A90000: C:\Windows\system32\msi (0x240000 bytes).
2026-04-13 05:04:05,609 [root] DEBUG: 908: DLL loaded at 0x72470000: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSPTLS (0x116000 bytes).
2026-04-13 05:04:05,640 [root] DEBUG: 908: DLL loaded at 0x764A0000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes).
2026-04-13 05:04:05,640 [root] DEBUG: 908: DLL loaded at 0x77430000: C:\Windows\syswow64\profapi (0xb000 bytes).
2026-04-13 05:04:05,734 [root] DEBUG: 908: DLL loaded at 0x73CE0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\Comctl32 (0x19e000 bytes).
2026-04-13 05:04:05,812 [root] DEBUG: 908: DLL loaded at 0x744E0000: C:\Windows\system32\d3d10_1 (0x2c000 bytes).
2026-04-13 05:04:05,812 [root] DEBUG: 908: DLL loaded at 0x74490000: C:\Windows\system32\d3d10_1core (0x41000 bytes).
2026-04-13 05:04:05,828 [root] DEBUG: 908: DLL loaded at 0x71F70000: C:\Windows\system32\d3d11 (0x175000 bytes).
2026-04-13 05:04:05,828 [root] DEBUG: 908: DLL loaded at 0x71D80000: C:\Windows\system32\D3D10Warp (0x1e9000 bytes).
2026-04-13 05:04:05,828 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:05,828 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:05,828 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:05,843 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:05,843 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:05,843 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:05,875 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:05,875 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:05,875 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:05,890 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:05,890 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:05,890 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:06,000 [root] DEBUG: 908: DLL loaded at 0x71C50000: C:\Windows\system32\WindowsCodecs (0x130000 bytes).
2026-04-13 05:04:06,000 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:06,000 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:06,000 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:06,015 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\setupapi (0x19d000 bytes).
2026-04-13 05:04:06,015 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:06,015 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:06,031 [root] DEBUG: 908: DLL loaded at 0x6DEC0000: C:\Windows\system32\DWrite (0x135000 bytes).
2026-04-13 05:04:06,046 [root] DEBUG: 908: DLL loaded at 0x74440000: C:\Windows\system32\mscoree (0x4a000 bytes).
2026-04-13 05:04:06,046 [root] DEBUG: 908: DLL loaded at 0x71BC0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x8d000 bytes).
2026-04-13 05:04:06,062 [root] DEBUG: 908: DLL loaded at 0x6DE00000: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\adal (0xb5000 bytes).
2026-04-13 05:04:06,062 [root] DEBUG: 908: DLL loaded at 0x71B60000: C:\Windows\system32\WINHTTP (0x58000 bytes).
2026-04-13 05:04:06,078 [root] DEBUG: 908: DLL loaded at 0x6DDB0000: C:\Windows\system32\webio (0x50000 bytes).
2026-04-13 05:04:06,078 [root] DEBUG: 908: DLL loaded at 0x76270000: C:\Windows\syswow64\WININET (0x1e4000 bytes).
2026-04-13 05:04:06,078 [root] DEBUG: 908: DLL loaded at 0x77820000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x75D00000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x75EB0000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x77850000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x77810000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x771E0000: C:\Windows\syswow64\iertutil (0x232000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x77420000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x77760000: C:\Windows\syswow64\USERENV (0x17000 bytes).
2026-04-13 05:04:06,093 [root] DEBUG: 908: DLL loaded at 0x74FF0000: C:\Windows\system32\Secur32 (0x8000 bytes).
2026-04-13 05:04:06,187 [root] DEBUG: 908: DLL loaded at 0x77150000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2026-04-13 05:04:06,203 [root] DEBUG: 908: DLL loaded at 0x6DD50000: C:\Windows\System32\netprofm (0x5a000 bytes).
2026-04-13 05:04:06,203 [root] DEBUG: 908: DLL loaded at 0x74BD0000: C:\Windows\System32\nlaapi (0x10000 bytes).
2026-04-13 05:04:06,203 [root] DEBUG: 908: DLL loaded at 0x73B50000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2026-04-13 05:04:06,218 [root] DEBUG: 908: DLL loaded at 0x73B10000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2026-04-13 05:04:06,234 [root] DEBUG: 908: DLL loaded at 0x74330000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2026-04-13 05:04:06,234 [root] DEBUG: 908: DLL loaded at 0x74B60000: C:\Windows\System32\npmproxy (0x8000 bytes).
2026-04-13 05:04:06,390 [root] DEBUG: 908: DLL loaded at 0x6DBC0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\riched20 (0x18e000 bytes).
2026-04-13 05:04:07,843 [root] DEBUG: 908: DLL loaded at 0x68EA0000: C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppc (0x2d000 bytes).
2026-04-13 05:04:07,843 [root] DEBUG: 908: DLL loaded at 0x68E40000: C:\Windows\system32\WINSPOOL.DRV (0x51000 bytes).
2026-04-13 05:04:07,937 [root] DEBUG: 908: DLL loaded at 0x75EC0000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2026-04-13 05:04:07,937 [root] DEBUG: 908: DLL loaded at 0x761E0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2026-04-13 05:04:07,937 [root] DEBUG: 908: DLL loaded at 0x77830000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2026-04-13 05:04:07,953 [root] DEBUG: 908: DLL loaded at 0x68D40000: C:\Windows\system32\propsys (0xf5000 bytes).
2026-04-13 05:04:07,953 [root] DEBUG: 908: DLL loaded at 0x73BA0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2026-04-13 05:04:07,953 [root] DEBUG: 908: DLL loaded at 0x77100000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2026-04-13 05:04:08,000 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Roaming\Microsoft\Templates\Normal.dotm
2026-04-13 05:04:08,031 [root] DEBUG: 908: DLL loaded at 0x68BE0000: C:\Windows\System32\msxml6 (0x158000 bytes).
2026-04-13 05:04:08,125 [root] DEBUG: 908: DLL loaded at 0x68BB0000: C:\Windows\system32\XmlLite (0x2f000 bytes).
2026-04-13 05:04:08,249 [root] DEBUG: 908: DLL loaded at 0x75D60000: C:\Windows\SysWOW64\urlmon (0x14a000 bytes).
2026-04-13 05:04:08,249 [root] DEBUG: 908: DLL loaded at 0x77930000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2026-04-13 05:04:08,265 [root] DEBUG: 908: DLL loaded at 0x74430000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2026-04-13 05:04:08,281 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Temp\~$34_as_password_ha.docx
2026-04-13 05:04:08,468 [root] DEBUG: 908: DLL loaded at 0x68B50000: C:\Windows\system32\SXS (0x5f000 bytes).
2026-04-13 05:04:09,973 [lib.common.results] INFO: File c:\olddocs\1776081844968.saz size is 4617, Max size: 100000000
2026-04-13 05:04:09,997 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:04:11,342 [root] DEBUG: 908: DLL loaded at 0x68B20000: C:\Windows\system32\POWRPROF (0x25000 bytes).
2026-04-13 05:04:17,420 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:04:17,689 [lib.common.results] INFO: File 1776081857628906200.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:04:17,705 [lib.common.results] INFO: File 1776081857628906200.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:04:17,705 [lib.common.results] INFO: File 1776081857629882800.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:04:17,712 [lib.common.results] INFO: File 1776081857628906200.Application.evtx.gz size is 6839, Max size: 100000000
2026-04-13 05:04:17,744 [lib.common.results] INFO: File 1776081857681640600.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:17,751 [lib.common.results] INFO: File 1776081857689453100.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:17,751 [lib.common.results] INFO: File 1776081857689453100.Security.evtx.gz size is 7930, Max size: 100000000
2026-04-13 05:04:17,751 [lib.common.results] INFO: File 1776081857689453100.System.evtx.gz size is 8655, Max size: 100000000
2026-04-13 05:04:17,791 [lib.common.results] INFO: File 1776081857744140600.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:04:19,142 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:04:24,247 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081864.2470703.sysmon.evtx.gz to host
2026-04-13 05:04:24,262 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 55416, Max size: 100000000
2026-04-13 05:04:30,107 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:04:32,829 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:04:33,063 [lib.common.results] INFO: File 1776081873016601500.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:04:33,079 [lib.common.results] INFO: File 1776081873024414000.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:04:33,079 [lib.common.results] INFO: File 1776081873016601500.Application.evtx.gz size is 6839, Max size: 100000000
2026-04-13 05:04:33,094 [lib.common.results] INFO: File 1776081873024414000.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:04:33,125 [lib.common.results] INFO: File 1776081873063476500.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:33,125 [lib.common.results] INFO: File 1776081873079101500.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:33,125 [lib.common.results] INFO: File 1776081873063476500.Security.evtx.gz size is 7993, Max size: 100000000
2026-04-13 05:04:33,141 [lib.common.results] INFO: File 1776081873079101500.System.evtx.gz size is 8190, Max size: 100000000
2026-04-13 05:04:33,172 [lib.common.results] INFO: File 1776081873125976500.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:04:39,291 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:04:44,368 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081884.368164.sysmon.evtx.gz to host
2026-04-13 05:04:44,375 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 7899, Max size: 100000000
2026-04-13 05:04:48,192 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:04:48,450 [lib.common.results] INFO: File 1776081888395507800.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:04:48,450 [lib.common.results] INFO: File 1776081888395507800.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:04:48,458 [lib.common.results] INFO: File 1776081888387695300.Application.evtx.gz size is 6839, Max size: 100000000
2026-04-13 05:04:48,458 [lib.common.results] INFO: File 1776081888395507800.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:04:48,512 [lib.common.results] INFO: File 1776081888442382800.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:48,520 [lib.common.results] INFO: File 1776081888458007800.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:04:48,520 [lib.common.results] INFO: File 1776081888458007800.System.evtx.gz size is 8167, Max size: 100000000
2026-04-13 05:04:48,528 [lib.common.results] INFO: File 1776081888450195300.Security.evtx.gz size is 7859, Max size: 100000000
2026-04-13 05:04:48,559 [lib.common.results] INFO: File 1776081888512695300.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:04:50,201 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:04:59,401 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:05:03,606 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:05:03,824 [lib.common.results] INFO: File 1776081903777343700.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:05:03,839 [lib.common.results] INFO: File 1776081903777343700.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:05:03,839 [lib.common.results] INFO: File 1776081903777343700.Application.evtx.gz size is 6926, Max size: 100000000
2026-04-13 05:05:03,847 [lib.common.results] INFO: File 1776081903777343700.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:05:03,886 [lib.common.results] INFO: File 1776081903824218700.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:03,894 [lib.common.results] INFO: File 1776081903832031200.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:03,902 [lib.common.results] INFO: File 1776081903839843700.System.evtx.gz size is 8186, Max size: 100000000
2026-04-13 05:05:03,917 [lib.common.results] INFO: File 1776081903832031200.Security.evtx.gz size is 7884, Max size: 100000000
2026-04-13 05:05:03,941 [lib.common.results] INFO: File 1776081903886718700.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:05:04,480 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081904.4804688.sysmon.evtx.gz to host
2026-04-13 05:05:04,480 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 7703, Max size: 100000000
2026-04-13 05:05:10,305 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:05:18,973 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:05:19,208 [lib.common.results] INFO: File 1776081919161132800.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:05:19,208 [lib.common.results] INFO: File 1776081919161132800.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:05:19,223 [lib.common.results] INFO: File 1776081919161132800.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:05:19,223 [lib.common.results] INFO: File 1776081919161132800.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:05:19,254 [lib.common.results] INFO: File 1776081919208007800.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:19,270 [lib.common.results] INFO: File 1776081919208007800.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:19,270 [lib.common.results] INFO: File 1776081919208007800.Security.evtx.gz size is 7918, Max size: 100000000
2026-04-13 05:05:19,270 [lib.common.results] INFO: File 1776081919208007800.System.evtx.gz size is 8166, Max size: 100000000
2026-04-13 05:05:19,301 [lib.common.results] INFO: File 1776081919254882800.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:05:19,489 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:05:24,562 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081924.5625.sysmon.evtx.gz to host
2026-04-13 05:05:24,562 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 7694, Max size: 100000000
2026-04-13 05:05:30,416 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:05:34,336 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:05:34,563 [lib.common.results] INFO: File 1776081934508789000.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:05:34,563 [lib.common.results] INFO: File 1776081934508789000.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:05:34,563 [lib.common.results] INFO: File 1776081934508789000.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:05:34,563 [lib.common.results] INFO: File 1776081934508789000.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:05:34,625 [lib.common.results] INFO: File 1776081934563476500.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:34,625 [lib.common.results] INFO: File 1776081934563476500.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:34,625 [lib.common.results] INFO: File 1776081934563476500.System.evtx.gz size is 8173, Max size: 100000000
2026-04-13 05:05:34,625 [lib.common.results] INFO: File 1776081934563476500.Security.evtx.gz size is 7217, Max size: 100000000
2026-04-13 05:05:34,672 [lib.common.results] INFO: File 1776081934625976500.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:05:39,578 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:05:44,653 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081944.65332.sysmon.evtx.gz to host
2026-04-13 05:05:44,653 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5406, Max size: 100000000
2026-04-13 05:05:49,708 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:05:49,935 [lib.common.results] INFO: File 1776081949888671800.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:05:49,943 [lib.common.results] INFO: File 1776081949880859300.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:05:49,943 [lib.common.results] INFO: File 1776081949888671800.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:05:49,951 [lib.common.results] INFO: File 1776081949880859300.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:05:49,982 [lib.common.results] INFO: File 1776081949943359300.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:49,990 [lib.common.results] INFO: File 1776081949935546800.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:05:49,990 [lib.common.results] INFO: File 1776081949935546800.Security.evtx.gz size is 7289, Max size: 100000000
2026-04-13 05:05:50,005 [lib.common.results] INFO: File 1776081949951171800.System.evtx.gz size is 8071, Max size: 100000000
2026-04-13 05:05:50,037 [lib.common.results] INFO: File 1776081949982421800.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:05:50,498 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:05:59,683 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:06:04,757 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081964.7578125.sysmon.evtx.gz to host
2026-04-13 05:06:04,757 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5715, Max size: 100000000
2026-04-13 05:06:05,085 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:06:05,304 [lib.common.results] INFO: File 1776081965257812500.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:06:05,304 [lib.common.results] INFO: File 1776081965257812500.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:06:05,320 [lib.common.results] INFO: File 1776081965242187500.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:06:05,337 [lib.common.results] INFO: File 1776081965257812500.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:06:05,391 [lib.common.results] INFO: File 1776081965304687500.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:05,399 [lib.common.results] INFO: File 1776081965320312500.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:05,399 [lib.common.results] INFO: File 1776081965320312500.Security.evtx.gz size is 7321, Max size: 100000000
2026-04-13 05:06:05,399 [lib.common.results] INFO: File 1776081965320312500.System.evtx.gz size is 8081, Max size: 100000000
2026-04-13 05:06:05,430 [lib.common.results] INFO: File 1776081965383789000.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:06:10,582 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:06:19,781 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:06:20,469 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:06:20,734 [lib.common.results] INFO: File 1776081980679687500.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:06:20,742 [lib.common.results] INFO: File 1776081980679687500.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:06:20,750 [lib.common.results] INFO: File 1776081980679687500.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:06:20,757 [lib.common.results] INFO: File 1776081980695312500.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:06:20,789 [lib.common.results] INFO: File 1776081980734375000.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:20,796 [lib.common.results] INFO: File 1776081980734375000.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:20,796 [lib.common.results] INFO: File 1776081980734375000.Security.evtx.gz size is 7184, Max size: 100000000
2026-04-13 05:06:20,828 [lib.common.results] INFO: File 1776081980757812500.System.evtx.gz size is 8079, Max size: 100000000
2026-04-13 05:06:20,851 [lib.common.results] INFO: File 1776081980789062500.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:06:24,856 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776081984.856445.sysmon.evtx.gz to host
2026-04-13 05:06:24,856 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 5565, Max size: 100000000
2026-04-13 05:06:30,664 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:06:34,359 [root] INFO: Analysis timeout hit, terminating analysis
2026-04-13 05:06:34,367 [lib.api.process] INFO: Terminate event set for process 908
2026-04-13 05:06:34,367 [root] DEBUG: 908: Terminate Event: Attempting to dump process 908
2026-04-13 05:06:34,367 [root] DEBUG: 908: VerifyCodeSection: Executable code does not match, 0x64c of 0x154f matching
2026-04-13 05:06:34,367 [root] DEBUG: 908: DoProcessDump: Code modification detected, dumping Imagebase at 0x01110000.
2026-04-13 05:06:34,375 [root] DEBUG: 908: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-04-13 05:06:34,375 [root] DEBUG: 908: DumpProcess: Instantiating PeParser with address: 0x01110000.
2026-04-13 05:06:34,375 [root] DEBUG: 908: DumpProcess: Module entry point VA is 0x000010D4.
2026-04-13 05:06:34,406 [lib.common.results] INFO: File C:\ejbiTUmAt\CAPE\908_156623461213142026 size is 1915904, Max size: 100000000
2026-04-13 05:06:34,445 [root] DEBUG: 908: DumpProcess: Module image dump success - dump size 0x1d3c00.
2026-04-13 05:06:34,468 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Temp\1234_as_password_ha.docx
2026-04-13 05:06:34,468 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Microsoft\Office\Word15.customUI
2026-04-13 05:06:34,468 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C864F2ED-86BE-4610-A4C5-42D94537243F}.tmp
2026-04-13 05:06:34,468 [lib.api.process] INFO: Termination confirmed for process 908
2026-04-13 05:06:34,468 [root] DEBUG: 908: Terminate Event: monitor shutdown complete for process 908
2026-04-13 05:06:34,468 [root] INFO: Terminate event set for process 908
2026-04-13 05:06:34,468 [root] INFO: Created shutdown mutex
2026-04-13 05:06:35,469 [root] INFO: Shutting down package
2026-04-13 05:06:35,469 [root] INFO: Stopping auxiliary modules
2026-04-13 05:06:35,469 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [WinError 6] The handle is invalid
2026-04-13 05:06:35,477 [lib.common.results] INFO: File C:\curtain.log size is 0, Max size: 100000000
2026-04-13 05:06:35,493 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:06:35,711 [lib.common.results] INFO: File 1776081995665039000.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:06:35,727 [lib.common.results] INFO: File 1776081995665039000.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:06:35,743 [lib.common.results] INFO: File 1776081995665039000.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:06:35,743 [lib.common.results] INFO: File 1776081995665039000.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:06:35,774 [lib.common.results] INFO: File 1776081995727539000.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:35,790 [lib.common.results] INFO: File 1776081995711914000.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:35,790 [lib.common.results] INFO: File 1776081995727539000.System.evtx.gz size is 8047, Max size: 100000000
2026-04-13 05:06:35,805 [lib.common.results] INFO: File 1776081995711914000.Security.evtx.gz size is 7455, Max size: 100000000
2026-04-13 05:06:35,836 [lib.common.results] INFO: File 1776081995774414000.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:06:35,899 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell
2026-04-13 05:06:36,112 [lib.common.results] INFO: File 1776081996068359300.HardwareEvents.evtx.gz size is 251, Max size: 100000000
2026-04-13 05:06:36,127 [lib.common.results] INFO: File 1776081996068359300.Application.evtx.gz size is 6855, Max size: 100000000
2026-04-13 05:06:36,135 [lib.common.results] INFO: File 1776081996085937500.InternetExplorer.evtx.gz size is 252, Max size: 100000000
2026-04-13 05:06:36,143 [lib.common.results] INFO: File 1776081996095703100.KeyManagementService.evtx.gz size is 3246, Max size: 100000000
2026-04-13 05:06:36,166 [lib.common.results] INFO: File 1776081996112304600.OAlerts.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:36,174 [lib.common.results] INFO: File 1776081996127929600.Setup.evtx.gz size is 246, Max size: 100000000
2026-04-13 05:06:36,182 [lib.common.results] INFO: File 1776081996127929600.Security.evtx.gz size is 7441, Max size: 100000000
2026-04-13 05:06:36,206 [lib.common.results] INFO: File 1776081996143554600.System.evtx.gz size is 8075, Max size: 100000000
2026-04-13 05:06:36,221 [lib.common.results] INFO: File 1776081996166992100.WindowsPowerShell.evtx.gz size is 7990, Max size: 100000000
2026-04-13 05:06:39,857 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs
2026-04-13 05:06:41,092 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine
2026-04-13 05:06:41,092 [modules.auxiliary.sysmon] INFO: Doing final sysmon log dump
2026-04-13 05:06:44,952 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776082004.9521484.sysmon.evtx.gz to host
2026-04-13 05:06:44,952 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 11594, Max size: 100000000
2026-04-13 05:06:46,170 [modules.auxiliary.sysmon] ERROR: Sysmon log file C:\Sysmon.evtx not found in guest machine
2026-04-13 05:06:46,170 [root] INFO: Finishing auxiliary modules
2026-04-13 05:06:46,170 [root] INFO: Shutting down pipe server and dumping dropped files
2026-04-13 05:06:46,170 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Roaming\Microsoft\Templates\Normal.dotm size is 17789, Max size: 100000000
2026-04-13 05:06:46,186 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\~$34_as_password_ha.docx size is 162, Max size: 100000000
2026-04-13 05:06:46,202 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\1234_as_password_ha.docx size is 107520, Max size: 100000000
2026-04-13 05:06:46,217 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\Word15.customUI size is 3514, Max size: 100000000
2026-04-13 05:06:46,233 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C864F2ED-86BE-4610-A4C5-42D94537243F}.tmp size is 1024, Max size: 100000000
2026-04-13 05:06:46,233 [root] WARNING: Folder at path "C:\ejbiTUmAt\debugger" does not exist, skipping
2026-04-13 05:06:46,233 [root] WARNING: Folder at path "C:\ejbiTUmAt\tlsdump" does not exist, skipping
2026-04-13 05:06:46,233 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7office2k3flash2800137TWN3H102 | win7office2k3flash2800137TWN3H102 | KVM | 2026-04-13 11:03:46 | 2026-04-13 11:06:56 | internet |
| File Name | 1234_as_password_ha.docx |
|---|---|
| File Size | 107520 bytes |
| File Type | CDFV2 Encrypted |
| MD5 | 31ecd43e3606e0e4fe8ed3dc515e8b69 |
| SHA1 | b5f7856b2a0ca9bce5355bfb6e81e5991183ebf4 |
| SHA256 | af46d415f384795c00d2c08071848cf6c304e116b0db05e85a74ca3aeb783af0 |
| SHA512 | 077abf6135aa0927ec816fab927a5665eb826b3620174749c954c5b3c950889cef2693d86a065aaf036591b9bc29e96275ce54663754a032146a9fc29dc65ec6 |
| SHA3-384 | 5681b7a8afe9ce13719632b96a2cec0a09512fd2fa77d030f5077867fc5ea0e313c2e0a52c993a9359be977ce86776d2 |
| CRC32 | 445C5EE7 |
| TLSH | T1B5B31276C4A4CCDBE0222DB97247D40550236D8ED6813E663FAAB5050AF02B66FEC5FD |
| Ssdeep | 3072:SKoFaUTc1xuMY8n2+IuyiVVZOTAduwe/N/:JoRT8k+ZwAkw4 |
File
|
|
| Direct | IP | Country Name |
|---|---|---|
| Y | 8.8.8.8 [VT] | United States |
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP