| Category | Package | Started | Completed | Duration | Options | Log | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | xls | 2026-04-14 09:27:11 | 2026-04-14 09:29:17 | 126 seconds | Show Options | Show Log | 1.5 |
procdump=1
amsidump=1
resubmitjob=true
2025-12-02 01:31:19,968 [root] INFO: Date set to: 20260414T02:27:11, timeout set to: 90 2026-04-14 03:27:11,015 [root] DEBUG: Starting analyzer from: C:\tmpn7j73yx1 2026-04-14 03:27:11,015 [root] DEBUG: Storing results at: C:\CwTyBYqWl 2026-04-14 03:27:11,015 [root] DEBUG: Pipe server name: \\.\PIPE\AFFAKH 2026-04-14 03:27:11,015 [root] DEBUG: Python path: C:\olddocs 2026-04-14 03:27:11,015 [root] INFO: Analysis package "xls" has been specified 2026-04-14 03:27:11,015 [root] DEBUG: Importing analysis package "xls"... 2026-04-14 03:27:11,031 [root] DEBUG: Initializing analysis package "xls"... 2026-04-14 03:27:11,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL option 2026-04-14 03:27:11,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL_64 option 2026-04-14 03:27:11,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a loader option 2026-04-14 03:27:11,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a loader_64 option 2026-04-14 03:27:11,062 [root] DEBUG: Importing auxiliary module "modules.auxiliary.browser"... 2026-04-14 03:27:11,062 [root] DEBUG: Importing auxiliary module "modules.auxiliary.curtain"... 2026-04-14 03:27:11,062 [root] DEBUG: Importing auxiliary module "modules.auxiliary.default_apps"... 2026-04-14 03:27:11,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.digisig"... 2026-04-14 03:27:11,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.disguise"... 2026-04-14 03:27:11,093 [root] DEBUG: Importing auxiliary module "modules.auxiliary.evtx"... 2026-04-14 03:27:11,109 [root] DEBUG: Importing auxiliary module "modules.auxiliary.fiddler"... 2026-04-14 03:27:11,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.human"... 2026-04-14 03:27:11,140 [root] DEBUG: Importing auxiliary module "modules.auxiliary.screenshots"... 2026-04-14 03:27:11,140 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2026-04-14 03:27:11,234 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2026-04-14 03:27:11,249 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2026-04-14 03:27:11,249 [root] DEBUG: Importing auxiliary module "modules.auxiliary.sysmon"... 2026-04-14 03:27:11,249 [root] DEBUG: Importing auxiliary module "modules.auxiliary.tlsdump"... 2026-04-14 03:27:11,249 [root] DEBUG: Importing auxiliary module "modules.auxiliary.usage"... 2026-04-14 03:27:11,265 [root] DEBUG: Initializing auxiliary module "Browser"... 2026-04-14 03:27:11,265 [root] DEBUG: Started auxiliary module Browser 2026-04-14 03:27:11,265 [root] DEBUG: Initializing auxiliary module "Curtain"... 2026-04-14 03:27:11,265 [root] DEBUG: Started auxiliary module Curtain 2026-04-14 03:27:11,265 [root] DEBUG: Initializing auxiliary module "DefaultApps"... 2026-04-14 03:27:11,296 [modules.auxiliary.default_apps] DEBUG: Getting current user SID using WinAPI 2026-04-14 03:27:11,296 [root] DEBUG: Started auxiliary module DefaultApps 2026-04-14 03:27:11,296 [root] DEBUG: Initializing auxiliary module "DigiSig"... 2026-04-14 03:27:11,296 [modules.auxiliary.digisig] INFO: signtool.exe was not found in bin/ 2026-04-14 03:27:11,296 [modules.auxiliary.digisig] INFO: xls 2026-04-14 03:27:11,296 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, unsupported analyzer package 2026-04-14 03:27:11,296 [root] DEBUG: Started auxiliary module DigiSig 2026-04-14 03:27:11,296 [root] DEBUG: Initializing auxiliary module "Disguise"... 2026-04-14 03:27:11,593 [modules.auxiliary.disguise] INFO: Setting NoRecentDocsHistory 2026-04-14 03:27:11,609 [root] WARNING: Cannot execute auxiliary module Disguise: [WinError 2] The system cannot find the file specified 2026-04-14 03:27:11,609 [root] DEBUG: Initializing auxiliary module "Evtx"... 2026-04-14 03:27:11,609 [modules.auxiliary.evtx] INFO: Loading audit policy C:\tmpn7j73yx1\bin\auditpol.csv 2026-04-14 03:27:11,765 [modules.auxiliary.evtx] INFO: Wiping logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:27:12,671 [root] DEBUG: Started auxiliary module Evtx 2026-04-14 03:27:12,671 [root] DEBUG: Initializing auxiliary module "Fiddler"... 2026-04-14 03:27:12,687 [modules.auxiliary.fiddler] INFO: fiddler package: xls 2026-04-14 03:27:12,687 [root] DEBUG: Started auxiliary module Fiddler 2026-04-14 03:27:12,687 [root] DEBUG: Initializing auxiliary module "Human"... 2026-04-14 03:27:12,687 [root] DEBUG: Started auxiliary module Human 2026-04-14 03:27:12,687 [root] DEBUG: Initializing auxiliary module "Screenshots"... 2026-04-14 03:27:12,687 [root] DEBUG: Started auxiliary module Screenshots 2026-04-14 03:27:12,687 [root] DEBUG: Initializing auxiliary module "Sysmon"... 2026-04-14 03:27:12,703 [modules.auxiliary.sysmon] INFO: Seeing if we need to update sysmon config 2026-04-14 03:27:12,703 [root] DEBUG: Started auxiliary module Sysmon 2026-04-14 03:27:12,703 [modules.auxiliary.sysmon] INFO: Found Sysmon Executable 2026-04-14 03:27:12,703 [root] DEBUG: Initializing auxiliary module "TLSDumpMasterSecrets"... 2026-04-14 03:27:12,703 [modules.auxiliary.sysmon] INFO: Found Sysmon config 2026-04-14 03:27:12,703 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 560 2026-04-14 03:27:12,703 [lib.api.process] INFO: Monitor config for process 560: C:\tmpn7j73yx1\dll\560.ini 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'resubmitjob' with value 'true' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'office' with value '1' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'yarascan' with value '0' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2026-04-14 03:27:12,703 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpn7j73yx1\dll\sRORWg.dll, loader C:\tmpn7j73yx1\bin\BKMfXcBK.exe 2026-04-14 03:27:12,718 [root] DEBUG: Loader: IAT patching disabled. 2026-04-14 03:27:12,718 [root] DEBUG: Loader: Injecting process 560 with C:\tmpn7j73yx1\dll\sRORWg.dll. 2026-04-14 03:27:12,984 [root] DEBUG: 560: Python path set to 'C:\olddocs'. 2026-04-14 03:27:12,984 [root] DEBUG: 560: Disabling sleep skipping. 2026-04-14 03:27:13,000 [root] DEBUG: 560: Process dumps enabled. 2026-04-14 03:27:13,000 [root] DEBUG: 560: AMSI dumping enabled. 2026-04-14 03:27:13,000 [root] DEBUG: 560: Monitor config - unrecognised key resubmitjob. 2026-04-14 03:27:13,000 [root] DEBUG: 560: Monitor config - unrecognised key office. 2026-04-14 03:27:13,000 [root] DEBUG: 560: In-monitor YARA scans disabled. 2026-04-14 03:27:13,000 [root] DEBUG: 560: TLS secret dump mode enabled. 2026-04-14 03:27:13,000 [root] DEBUG: 560: Monitor initialised: 64-bit capemon loaded in process 560 at 0x000007FEF5BE0000, thread 384, image base 0x00000000FF510000, stack from 0x0000000001D92000-0x0000000001DA0000 2026-04-14 03:27:13,000 [root] DEBUG: 560: Commandline: C:\Windows\system32\lsass.exe 2026-04-14 03:27:13,015 [root] DEBUG: 560: Hooked 5 out of 5 functions 2026-04-14 03:27:13,015 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2026-04-14 03:27:13,015 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 560 2026-04-14 03:27:13,015 [root] DEBUG: Started auxiliary module TLSDumpMasterSecrets 2026-04-14 03:27:13,015 [root] DEBUG: Initializing auxiliary module "Usage"... 2026-04-14 03:27:13,015 [root] DEBUG: Started auxiliary module Usage 2026-04-14 03:27:15,046 [modules.auxiliary.sysmon] INFO: Clearing existing sysmon logs 2026-04-14 03:27:15,734 [root] INFO: Restarting WMI Service 2026-04-14 03:27:22,812 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" with arguments ""C:\Users\pgabriel\AppData\Local\Temp\Rothmans Table 3.xlsx" /dde" with pid 2120 2026-04-14 03:27:22,812 [lib.api.process] INFO: Monitor config for process 2120: C:\tmpn7j73yx1\dll\2120.ini 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'resubmitjob' with value 'true' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'office' with value '1' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'yarascan' with value '0' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2026-04-14 03:27:22,812 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpn7j73yx1\dll\QOKNojk.dll, loader C:\tmpn7j73yx1\bin\LZPXUDm.exe 2026-04-14 03:27:22,843 [root] DEBUG: Loader: IAT patching disabled. 2026-04-14 03:27:22,843 [root] DEBUG: Loader: Injecting process 2120 (thread 2184) with C:\tmpn7j73yx1\dll\QOKNojk.dll. 2026-04-14 03:27:22,843 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued. 2026-04-14 03:27:22,843 [root] DEBUG: Successfully injected DLL C:\tmpn7j73yx1\dll\QOKNojk.dll. 2026-04-14 03:27:22,843 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2120 2026-04-14 03:27:24,843 [lib.api.process] INFO: Successfully resumed process with pid 2120 2026-04-14 03:27:25,062 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-14 03:27:25,078 [root] DEBUG: 2120: Python path set to 'C:\olddocs'. 2026-04-14 03:27:25,078 [root] DEBUG: 2120: Disabling sleep skipping. 2026-04-14 03:27:25,078 [root] DEBUG: 2120: Process dumps enabled. 2026-04-14 03:27:25,078 [root] DEBUG: 2120: AMSI dumping enabled. 2026-04-14 03:27:25,078 [root] DEBUG: 2120: Monitor config - unrecognised key resubmitjob. 2026-04-14 03:27:25,078 [root] DEBUG: 2120: Monitor config - unrecognised key office. 2026-04-14 03:27:25,093 [root] DEBUG: 2120: In-monitor YARA scans disabled. 2026-04-14 03:27:25,093 [root] DEBUG: 2120: Dropped file limit defaulting to 100. 2026-04-14 03:27:25,171 [root] DEBUG: 2120: Microsoft Office settings enabled. 2026-04-14 03:27:25,187 [root] DEBUG: 2120: Monitor initialised: 32-bit capemon loaded in process 2120 at 0x725f0000, thread 2184, image base 0xf00000, stack from 0x3b3000-0x3c0000 2026-04-14 03:27:25,187 [root] DEBUG: 2120: Commandline: "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" "C:\Users\pgabriel\AppData\Local\Temp\Rothmans Table 3.xlsx" /dde 2026-04-14 03:27:25,187 [root] DEBUG: 2120: add_all_dlls_to_dll_ranges: skipping C:\Program Files (x86)\Microsoft Office\Office15\oart.dll 2026-04-14 03:27:25,218 [root] DEBUG: 2120: Hooked 456 out of 456 functions 2026-04-14 03:27:25,328 [root] INFO: Loaded monitor into process with pid 2120 2026-04-14 03:27:25,343 [root] DEBUG: 2120: DLL loaded at 0x6F7B0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso (0x18e4000 bytes). 2026-04-14 03:27:25,343 [root] DEBUG: 2120: DLL loaded at 0x73440000: C:\Windows\system32\MSIMG32 (0x5000 bytes). 2026-04-14 03:27:25,343 [root] DEBUG: 2120: DLL loaded at 0x73510000: C:\Windows\system32\uxtheme (0x80000 bytes). 2026-04-14 03:27:25,359 [root] DEBUG: 2120: DLL loaded at 0x73750000: C:\Windows\system32\WTSAPI32 (0xd000 bytes). 2026-04-14 03:27:25,359 [root] DEBUG: 2120: DLL loaded at 0x74450000: C:\Windows\system32\WINSTA (0x29000 bytes). 2026-04-14 03:27:25,359 [root] DEBUG: 2120: DLL loaded at 0x73D60000: C:\Windows\system32\dxgi (0x4c000 bytes). 2026-04-14 03:27:25,359 [root] DEBUG: 2120: DLL loaded at 0x73760000: C:\Windows\system32\VERSION (0x9000 bytes). 2026-04-14 03:27:25,359 [root] DEBUG: 2120: DLL loaded at 0x74430000: C:\Windows\system32\dwmapi (0x13000 bytes). 2026-04-14 03:27:25,375 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,375 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,375 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,375 [root] DEBUG: 2120: DLL loaded at 0x75730000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes). 2026-04-14 03:27:25,390 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,390 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,390 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,390 [root] DEBUG: 2120: DLL loaded at 0x723B0000: C:\Windows\system32\msi (0x240000 bytes). 2026-04-14 03:27:25,453 [root] DEBUG: 2120: DLL loaded at 0x73590000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\Comctl32 (0x19e000 bytes). 2026-04-14 03:27:25,531 [root] DEBUG: 2120: DLL loaded at 0x74260000: C:\Windows\system32\d3d10_1 (0x2c000 bytes). 2026-04-14 03:27:25,531 [root] DEBUG: 2120: DLL loaded at 0x73D10000: C:\Windows\system32\d3d10_1core (0x41000 bytes). 2026-04-14 03:27:25,546 [root] DEBUG: 2120: DLL loaded at 0x6F630000: C:\Windows\system32\d3d11 (0x175000 bytes). 2026-04-14 03:27:25,546 [root] DEBUG: 2120: DLL loaded at 0x6F440000: C:\Windows\system32\D3D10Warp (0x1e9000 bytes). 2026-04-14 03:27:25,546 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,546 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,546 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,562 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,562 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,562 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,578 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,578 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,578 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,593 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,593 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,609 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,625 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-14 03:27:25,625 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:25,625 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:25,781 [root] DEBUG: 2120: DLL loaded at 0x731B0000: C:\Windows\system32\mscoree (0x4a000 bytes). 2026-04-14 03:27:25,781 [root] DEBUG: 2120: DLL loaded at 0x6F030000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x8d000 bytes). 2026-04-14 03:27:25,796 [root] DEBUG: 2120: DLL loaded at 0x6EF70000: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\adal (0xb5000 bytes). 2026-04-14 03:27:25,812 [root] DEBUG: 2120: DLL loaded at 0x71E50000: C:\Windows\system32\WINHTTP (0x58000 bytes). 2026-04-14 03:27:25,812 [root] DEBUG: 2120: DLL loaded at 0x73160000: C:\Windows\system32\webio (0x50000 bytes). 2026-04-14 03:27:25,812 [root] DEBUG: 2120: DLL loaded at 0x75C70000: C:\Windows\syswow64\WININET (0x1e4000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x75F70000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x75720000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x75A20000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x752B0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x77020000: C:\Windows\syswow64\normaliz (0x3000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x753C0000: C:\Windows\syswow64\iertutil (0x232000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x77300000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x77310000: C:\Windows\syswow64\USERENV (0x17000 bytes). 2026-04-14 03:27:25,828 [root] DEBUG: 2120: DLL loaded at 0x753B0000: C:\Windows\syswow64\profapi (0xb000 bytes). 2026-04-14 03:27:25,843 [root] DEBUG: 2120: DLL loaded at 0x74520000: C:\Windows\system32\Secur32 (0x8000 bytes). 2026-04-14 03:27:25,921 [root] DEBUG: 2120: DLL loaded at 0x752D0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes). 2026-04-14 03:27:25,921 [root] DEBUG: 2120: DLL loaded at 0x6EF10000: C:\Windows\System32\netprofm (0x5a000 bytes). 2026-04-14 03:27:25,921 [root] DEBUG: 2120: DLL loaded at 0x74420000: C:\Windows\System32\nlaapi (0x10000 bytes). 2026-04-14 03:27:25,937 [root] DEBUG: 2120: DLL loaded at 0x73240000: C:\Windows\system32\CRYPTSP (0x17000 bytes). 2026-04-14 03:27:25,937 [root] DEBUG: 2120: DLL loaded at 0x73200000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2026-04-14 03:27:25,937 [root] DEBUG: 2120: DLL loaded at 0x73C10000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2026-04-14 03:27:25,953 [root] DEBUG: 2120: DLL loaded at 0x743B0000: C:\Windows\System32\npmproxy (0x8000 bytes). 2026-04-14 03:27:26,125 [root] DEBUG: 2120: DLL loaded at 0x6ED80000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\riched20 (0x18e000 bytes). 2026-04-14 03:27:26,203 [root] DEBUG: 2120: DLL loaded at 0x6A060000: C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppc (0x2d000 bytes). 2026-04-14 03:27:26,203 [root] DEBUG: 2120: DLL loaded at 0x69F20000: C:\Windows\system32\DWrite (0x135000 bytes). 2026-04-14 03:27:26,203 [root] DEBUG: 2120: DLL loaded at 0x73C40000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes). 2026-04-14 03:27:26,218 [root] DEBUG: 2120: DLL loaded at 0x73C30000: C:\Windows\system32\WINNSI (0x7000 bytes). 2026-04-14 03:27:26,218 [root] DEBUG: 2120: DLL loaded at 0x743A0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes). 2026-04-14 03:27:26,218 [root] DEBUG: 2120: DLL loaded at 0x69F00000: C:\Windows\system32\dhcpcsvc (0x12000 bytes). 2026-04-14 03:27:26,218 [root] DEBUG: 2120: DLL loaded at 0x74250000: C:\Windows\system32\credssp (0x8000 bytes). 2026-04-14 03:27:26,234 [root] DEBUG: 2120: DLL loaded at 0x73BD0000: C:\Windows\system32\mswsock (0x3c000 bytes). 2026-04-14 03:27:26,234 [root] DEBUG: 2120: DLL loaded at 0x73BC0000: C:\Windows\System32\wshtcpip (0x5000 bytes). 2026-04-14 03:27:26,234 [root] DEBUG: 2120: DLL loaded at 0x73BB0000: C:\Windows\System32\wship6 (0x6000 bytes). 2026-04-14 03:27:26,234 [root] DEBUG: 2120: DLL loaded at 0x69EB0000: C:\Windows\system32\DNSAPI (0x44000 bytes). 2026-04-14 03:27:26,343 [root] DEBUG: 2120: DLL loaded at 0x69E60000: C:\Windows\SysWOW64\schannel (0x41000 bytes). 2026-04-14 03:27:26,375 [root] DEBUG: 560: DLL loaded at 0x000007FEF1C60000: C:\Windows\system32\dssenh (0x32000 bytes). 2026-04-14 03:27:26,515 [root] DEBUG: 2120: DLL loaded at 0x760F0000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes). 2026-04-14 03:27:26,546 [root] DEBUG: 2120: DLL loaded at 0x69E30000: C:\Windows\system32\XmlLite (0x2f000 bytes). 2026-04-14 03:27:26,640 [root] DEBUG: 560: DLL loaded at 0x000007FEF9290000: C:\Windows\system32\keyiso (0xb000 bytes). 2026-04-14 03:27:26,671 [root] DEBUG: 2120: DLL loaded at 0x757C0000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2026-04-14 03:27:26,671 [root] DEBUG: 2120: DLL loaded at 0x75B40000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-14 03:27:26,671 [root] DEBUG: 2120: DLL loaded at 0x75B20000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-14 03:27:26,687 [root] DEBUG: 2120: DLL loaded at 0x69D30000: C:\Windows\system32\propsys (0xf5000 bytes). 2026-04-14 03:27:26,687 [root] DEBUG: 2120: DLL loaded at 0x73460000: C:\Windows\system32\ntmarta (0x21000 bytes). 2026-04-14 03:27:26,687 [root] DEBUG: 2120: DLL loaded at 0x751C0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes). 2026-04-14 03:27:26,734 [root] DEBUG: 2120: DLL loaded at 0x770E0000: C:\Windows\SysWOW64\urlmon (0x14a000 bytes). 2026-04-14 03:27:26,734 [root] DEBUG: 2120: DLL loaded at 0x772F0000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes). 2026-04-14 03:27:26,750 [root] DEBUG: 2120: DLL loaded at 0x74010000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes). 2026-04-14 03:27:26,796 [root] DEBUG: 2120: DLL loaded at 0x69D10000: C:\Windows\system32\MPR (0x12000 bytes). 2026-04-14 03:27:26,859 [root] DEBUG: 2120: DLL loaded at 0x69BB0000: C:\Windows\System32\msxml6 (0x158000 bytes). 2026-04-14 03:27:26,953 [root] DEBUG: 2120: DLL loaded at 0x69A80000: C:\Windows\system32\WindowsCodecs (0x130000 bytes). 2026-04-14 03:27:26,968 [root] DEBUG: 2120: DLL loaded at 0x69A40000: C:\Windows\system32\WINMM (0x32000 bytes). 2026-04-14 03:27:27,078 [root] DEBUG: 2120: DLL loaded at 0x699E0000: C:\Windows\system32\WINSPOOL.DRV (0x51000 bytes). 2026-04-14 03:27:27,093 [root] DEBUG: 2120: CreateProcessHandler: Injection info set for new process 832: C:\Windows\splwow64.exe, ImageBase: 0xFF790000 2026-04-14 03:27:27,109 [root] INFO: Announced 64-bit process name: splwow64.exe pid: 832 2026-04-14 03:27:27,109 [root] DEBUG: 2120: DLL loaded at 0x733F0000: C:\Windows\system32\apphelp (0x4c000 bytes). 2026-04-14 03:27:27,109 [root] WARNING: Received request to inject process with pid 832, skipped alredy in inject list 2026-04-14 03:27:27,265 [root] DEBUG: 560: TLS 1.2 secrets logged to: C:\CwTyBYqWl\tlsdump\tlsdump.log 2026-04-14 03:27:27,343 [root] DEBUG: 560: DLL loaded at 0x000007FEFA580000: C:\Windows\system32\cryptnet (0x27000 bytes). 2026-04-14 03:27:27,343 [root] DEBUG: 560: DLL loaded at 0x000007FEFF190000: C:\Windows\system32\WLDAP32 (0x52000 bytes). 2026-04-14 03:27:27,390 [root] DEBUG: 2120: DLL loaded at 0x699A0000: C:\Windows\system32\ncrypt (0x39000 bytes). 2026-04-14 03:27:27,406 [root] DEBUG: 2120: DLL loaded at 0x69960000: C:\Windows\SysWOW64\bcryptprimitives (0x3d000 bytes). 2026-04-14 03:27:27,671 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:27:27,703 [root] DEBUG: 2120: DLL loaded at 0x69940000: C:\Windows\system32\GPAPI (0x16000 bytes). 2026-04-14 03:27:27,904 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\office15client.microsoft.com\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10 2026-04-14 03:27:27,932 [root] DEBUG: 2120: DLL loaded at 0x69870000: C:\Windows\system32\webservices (0xc2000 bytes). 2026-04-14 03:27:27,940 [root] DEBUG: 2120: DLL loaded at 0x73360000: C:\Windows\system32\msimtf (0xb000 bytes). 2026-04-14 03:27:27,956 [root] DEBUG: 2120: set_hooks_by_export_directory: Hooked 0 out of 456 functions 2026-04-14 03:27:27,956 [root] DEBUG: 2120: DLL loaded at 0x69860000: C:\Program Files (x86)\Microsoft Office\Office15\MSOSTYLE (0xa000 bytes). 2026-04-14 03:27:27,963 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma00546271.png0 size is 119666, Max size: 100000000 2026-04-14 03:27:27,987 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma02786999.png0 size is 8127, Max size: 100000000 2026-04-14 03:27:28,000 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900771.png0 size is 10213, Max size: 100000000 2026-04-14 03:27:28,007 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16382936.png0 size is 37573, Max size: 100000000 2026-04-14 03:27:28,023 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16382941.png0 size is 96333, Max size: 100000000 2026-04-14 03:27:28,031 [lib.common.results] INFO: File 1776162447924804600.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:27:28,039 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma02835058.png0 size is 186365, Max size: 100000000 2026-04-14 03:27:28,046 [lib.common.results] INFO: File 1776162447930664000.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:27:28,062 [lib.common.results] INFO: File 1776162447912109300.Application.evtx.gz size is 6966, Max size: 100000000 2026-04-14 03:27:28,071 [lib.common.results] INFO: File 1776162447940429600.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:27:28,072 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma03978815.png0 size is 711398, Max size: 100000000 2026-04-14 03:27:28,085 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt78018332.png0 size is 26105, Max size: 100000000 2026-04-14 03:27:28,098 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16392850.png0 size is 280509, Max size: 100000000 2026-04-14 03:27:28,114 [lib.common.results] INFO: File 1776162448023437500.OAlerts.evtx.gz size is 1240, Max size: 100000000 2026-04-14 03:27:28,114 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt45325165.png0 size is 9149, Max size: 100000000 2026-04-14 03:27:28,122 [lib.common.results] INFO: File 1776162448031250000.Security.evtx.gz size is 7826, Max size: 100000000 2026-04-14 03:27:28,129 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma03982351.png0 size is 12860, Max size: 100000000 2026-04-14 03:27:28,137 [lib.common.results] INFO: File 1776162448039062500.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:27:28,145 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16392877.png0 size is 86215, Max size: 100000000 2026-04-14 03:27:28,145 [lib.common.results] INFO: File 1776162448062500000.System.evtx.gz size is 8755, Max size: 100000000 2026-04-14 03:27:28,153 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16402488.png0 size is 114584, Max size: 100000000 2026-04-14 03:27:28,184 [lib.common.results] INFO: File 1776162448106445300.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:27:28,184 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16412178.png0 size is 283253, Max size: 100000000 2026-04-14 03:27:28,208 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma56348247.png0 size is 55049, Max size: 100000000 2026-04-14 03:27:28,223 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900720.png0 size is 22877, Max size: 100000000 2026-04-14 03:27:28,239 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma88924273.png0 size is 103770, Max size: 100000000 2026-04-14 03:27:28,247 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02836342.png0 size is 26220, Max size: 100000000 2026-04-14 03:27:28,270 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02892315.png0 size is 20776, Max size: 100000000 2026-04-14 03:27:28,278 [root] DEBUG: 2120: DLL loaded at 0x69840000: C:\Windows\system32\cryptnet (0x1d000 bytes). 2026-04-14 03:27:28,300 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt10002124.png0 size is 11329, Max size: 100000000 2026-04-14 03:27:28,301 [root] DEBUG: 2120: DLL loaded at 0x69830000: C:\Windows\system32\SensApi (0x6000 bytes). 2026-04-14 03:27:28,310 [modules.auxiliary.human] INFO: Found button "&Continue", clicking it 2026-04-14 03:27:28,326 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt78500733.png0 size is 10169, Max size: 100000000 2026-04-14 03:27:28,357 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02911863.png0 size is 41743, Max size: 100000000 2026-04-14 03:27:28,388 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900688.png0 size is 8561, Max size: 100000000 2026-04-14 03:27:28,396 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900722.png0 size is 19188, Max size: 100000000 2026-04-14 03:27:28,404 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900743.png0 size is 33070, Max size: 100000000 2026-04-14 03:27:28,443 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02923944.png0 size is 4886, Max size: 100000000 2026-04-14 03:27:28,474 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt10002117.png0 size is 4962, Max size: 100000000 2026-04-14 03:27:28,498 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt16402400.png0 size is 33856, Max size: 100000000 2026-04-14 03:27:28,529 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt22746018.png0 size is 18469, Max size: 100000000 2026-04-14 03:27:28,544 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt45088960.png0 size is 40992, Max size: 100000000 2026-04-14 03:27:28,552 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt45420242.png0 size is 13339, Max size: 100000000 2026-04-14 03:27:30,154 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776162450.1542969.sysmon.evtx.gz to host 2026-04-14 03:27:30,154 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 8799, Max size: 100000000 2026-04-14 03:27:31,060 [root] DEBUG: 2120: DLL loaded at 0x69800000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2026-04-14 03:27:35,638 [root] DEBUG: 2120: DLL loaded at 0x697D0000: C:\Windows\system32\SXS (0x5f000 bytes). 2026-04-14 03:27:35,794 [lib.common.results] INFO: File c:\olddocs\1776162450810.saz size is 25326, Max size: 100000000 2026-04-14 03:27:35,810 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-14 03:27:43,232 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:27:43,466 [lib.common.results] INFO: File 1776162463419921800.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:27:43,482 [lib.common.results] INFO: File 1776162463419921800.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:27:43,482 [lib.common.results] INFO: File 1776162463419921800.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:27:43,482 [lib.common.results] INFO: File 1776162463419921800.Application.evtx.gz size is 6886, Max size: 100000000 2026-04-14 03:27:43,529 [lib.common.results] INFO: File 1776162463482421800.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:27:43,544 [lib.common.results] INFO: File 1776162463482421800.System.evtx.gz size is 8507, Max size: 100000000 2026-04-14 03:27:43,544 [lib.common.results] INFO: File 1776162463482421800.Security.evtx.gz size is 8223, Max size: 100000000 2026-04-14 03:27:43,544 [lib.common.results] INFO: File 1776162463466796800.OAlerts.evtx.gz size is 1183, Max size: 100000000 2026-04-14 03:27:43,576 [lib.common.results] INFO: File 1776162463529296800.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:27:45,169 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-14 03:27:50,326 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776162470.3261719.sysmon.evtx.gz to host 2026-04-14 03:27:50,341 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 115062, Max size: 100000000 2026-04-14 03:27:55,904 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-14 03:27:58,607 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:27:58,857 [lib.common.results] INFO: File 1776162478794921800.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:27:58,857 [lib.common.results] INFO: File 1776162478794921800.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:27:58,857 [lib.common.results] INFO: File 1776162478794921800.Application.evtx.gz size is 6832, Max size: 100000000 2026-04-14 03:27:58,857 [lib.common.results] INFO: File 1776162478794921800.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:27:58,904 [lib.common.results] INFO: File 1776162478857421800.Security.evtx.gz size is 7895, Max size: 100000000 2026-04-14 03:27:58,919 [lib.common.results] INFO: File 1776162478841796800.OAlerts.evtx.gz size is 1183, Max size: 100000000 2026-04-14 03:27:58,935 [lib.common.results] INFO: File 1776162478857421800.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:27:58,951 [lib.common.results] INFO: File 1776162478857421800.System.evtx.gz size is 8126, Max size: 100000000 2026-04-14 03:27:58,966 [lib.common.results] INFO: File 1776162478904296800.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:28:05,357 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-14 03:28:10,419 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776162490.4199219.sysmon.evtx.gz to host 2026-04-14 03:28:10,419 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 7800, Max size: 100000000 2026-04-14 03:28:14,013 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:28:14,279 [lib.common.results] INFO: File 1776162494216796800.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:14,294 [lib.common.results] INFO: File 1776162494216796800.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:14,294 [lib.common.results] INFO: File 1776162494216796800.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:28:14,294 [lib.common.results] INFO: File 1776162494216796800.Application.evtx.gz size is 6832, Max size: 100000000 2026-04-14 03:28:14,341 [lib.common.results] INFO: File 1776162494279296800.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:28:14,357 [lib.common.results] INFO: File 1776162494279296800.OAlerts.evtx.gz size is 1183, Max size: 100000000 2026-04-14 03:28:14,373 [lib.common.results] INFO: File 1776162494279296800.Security.evtx.gz size is 7890, Max size: 100000000 2026-04-14 03:28:14,373 [lib.common.results] INFO: File 1776162494279296800.System.evtx.gz size is 8122, Max size: 100000000 2026-04-14 03:28:14,388 [lib.common.results] INFO: File 1776162494341796800.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:28:15,998 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-14 03:28:17,310 [modules.auxiliary.human] INFO: Doing office click around. 2026-04-14 03:28:25,451 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-14 03:28:29,404 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:28:29,654 [lib.common.results] INFO: File 1776162509607421800.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:29,654 [lib.common.results] INFO: File 1776162509607421800.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:29,669 [lib.common.results] INFO: File 1776162509607421800.Application.evtx.gz size is 6965, Max size: 100000000 2026-04-14 03:28:29,669 [lib.common.results] INFO: File 1776162509607421800.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:28:29,716 [lib.common.results] INFO: File 1776162509669921800.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:28:29,716 [lib.common.results] INFO: File 1776162509654296800.OAlerts.evtx.gz size is 1183, Max size: 100000000 2026-04-14 03:28:29,716 [lib.common.results] INFO: File 1776162509654296800.Security.evtx.gz size is 7913, Max size: 100000000 2026-04-14 03:28:29,732 [lib.common.results] INFO: File 1776162509669921800.System.evtx.gz size is 8128, Max size: 100000000 2026-04-14 03:28:29,763 [lib.common.results] INFO: File 1776162509716796800.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:28:30,529 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776162510.5292969.sysmon.evtx.gz to host 2026-04-14 03:28:30,529 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 7521, Max size: 100000000 2026-04-14 03:28:36,107 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-14 03:28:44,498 [modules.auxiliary.human] INFO: Closing Office window 2026-04-14 03:28:44,560 [modules.auxiliary.human] INFO: Issuing keypress on Office dialog 2026-04-14 03:28:44,670 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Temp\Rothmans Table 3.xlsx 2026-04-14 03:28:44,670 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Temp\86151000 2026-04-14 03:28:44,686 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\6F608ED1.tmp size is 53434, Max size: 100000000 2026-04-14 03:28:44,795 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:28:44,986 [root] DEBUG: 2120: DLL loaded at 0x697A0000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2026-04-14 03:28:45,077 [lib.common.results] INFO: File 1776162524994140600.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:45,084 [lib.common.results] INFO: File 1776162524994140600.Application.evtx.gz size is 6898, Max size: 100000000 2026-04-14 03:28:45,100 [lib.common.results] INFO: File 1776162525016601500.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:45,124 [lib.common.results] INFO: File 1776162525030273400.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:28:45,155 [lib.common.results] INFO: File 1776162525077148400.OAlerts.evtx.gz size is 1235, Max size: 100000000 2026-04-14 03:28:45,186 [lib.common.results] INFO: File 1776162525084960900.Security.evtx.gz size is 7915, Max size: 100000000 2026-04-14 03:28:45,202 [lib.common.results] INFO: File 1776162525100585900.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:28:45,217 [lib.common.results] INFO: File 1776162525108398400.System.evtx.gz size is 8165, Max size: 100000000 2026-04-14 03:28:45,217 [lib.common.results] INFO: File 1776162525155273400.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:28:45,256 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\CVRE11C.tmp.cvr size is 0, Max size: 100000000 2026-04-14 03:28:45,295 [root] DEBUG: 2120: NtTerminateProcess hook: Attempting to dump process 2120 2026-04-14 03:28:45,334 [root] DEBUG: 2120: VerifyCodeSection: Executable code does not match, 0xa86f8 of 0x130f9ab matching 2026-04-14 03:28:45,358 [root] DEBUG: 2120: DoProcessDump: Code modification detected, dumping Imagebase at 0x00F00000. 2026-04-14 03:28:45,374 [root] DEBUG: 2120: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2026-04-14 03:28:45,374 [root] DEBUG: 2120: DumpProcess: Instantiating PeParser with address: 0x00F00000. 2026-04-14 03:28:45,389 [root] DEBUG: 2120: DumpProcess: Module entry point VA is 0x00003550. 2026-04-14 03:28:45,545 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-14 03:28:45,655 [lib.common.results] INFO: File C:\CwTyBYqWl\CAPE\2120_1051076945281014242026 size is 25693184, Max size: 100000000 2026-04-14 03:28:45,842 [root] DEBUG: 2120: DumpProcess: Module image dump success - dump size 0x1880c00. 2026-04-14 03:28:45,874 [root] INFO: Process with pid 2120 has terminated 2026-04-14 03:28:50,624 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776162530.6240232.sysmon.evtx.gz to host 2026-04-14 03:28:50,624 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 14720, Max size: 100000000 2026-04-14 03:28:54,920 [root] INFO: Analysis timeout hit, terminating analysis 2026-04-14 03:28:54,920 [root] INFO: Created shutdown mutex 2026-04-14 03:28:55,920 [root] INFO: Shutting down package 2026-04-14 03:28:55,920 [root] INFO: Stopping auxiliary modules 2026-04-14 03:28:55,920 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [WinError 6] The handle is invalid 2026-04-14 03:28:55,920 [lib.common.results] INFO: File C:\curtain.log size is 0, Max size: 100000000 2026-04-14 03:28:55,936 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:28:56,170 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-14 03:28:56,186 [lib.common.results] INFO: File 1776162536124023400.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:56,186 [lib.common.results] INFO: File 1776162536139648400.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:28:56,202 [lib.common.results] INFO: File 1776162536124023400.Application.evtx.gz size is 6898, Max size: 100000000 2026-04-14 03:28:56,202 [lib.common.results] INFO: File 1776162536124023400.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:28:56,249 [lib.common.results] INFO: File 1776162536170898400.OAlerts.evtx.gz size is 1174, Max size: 100000000 2026-04-14 03:28:56,264 [lib.common.results] INFO: File 1776162536186523400.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:28:56,264 [lib.common.results] INFO: File 1776162536186523400.Security.evtx.gz size is 8069, Max size: 100000000 2026-04-14 03:28:56,264 [lib.common.results] INFO: File 1776162536186523400.System.evtx.gz size is 8147, Max size: 100000000 2026-04-14 03:28:56,295 [lib.common.results] INFO: File 1776162536233398400.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:29:00,249 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-14 03:29:00,514 [lib.common.results] INFO: File 1776162540452148400.KeyManagementService.evtx.gz size is 2105, Max size: 100000000 2026-04-14 03:29:00,514 [lib.common.results] INFO: File 1776162540452148400.InternetExplorer.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:29:00,530 [lib.common.results] INFO: File 1776162540452148400.HardwareEvents.evtx.gz size is 250, Max size: 100000000 2026-04-14 03:29:00,545 [lib.common.results] INFO: File 1776162540436523400.Application.evtx.gz size is 6898, Max size: 100000000 2026-04-14 03:29:00,577 [lib.common.results] INFO: File 1776162540514648400.Setup.evtx.gz size is 241, Max size: 100000000 2026-04-14 03:29:00,608 [lib.common.results] INFO: File 1776162540514648400.Security.evtx.gz size is 7317, Max size: 100000000 2026-04-14 03:29:00,608 [lib.common.results] INFO: File 1776162540514648400.System.evtx.gz size is 8144, Max size: 100000000 2026-04-14 03:29:00,608 [lib.common.results] INFO: File 1776162540499023400.OAlerts.evtx.gz size is 1174, Max size: 100000000 2026-04-14 03:29:00,639 [lib.common.results] INFO: File 1776162540577148400.WindowsPowerShell.evtx.gz size is 2058, Max size: 100000000 2026-04-14 03:29:01,389 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-14 03:29:01,389 [modules.auxiliary.sysmon] INFO: Doing final sysmon log dump 2026-04-14 03:29:05,639 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-14 03:29:06,467 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776162546.4677734.sysmon.evtx.gz to host 2026-04-14 03:29:06,467 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 6944, Max size: 100000000 2026-04-14 03:29:06,467 [root] INFO: Finishing auxiliary modules 2026-04-14 03:29:06,467 [root] INFO: Shutting down pipe server and dumping dropped files 2026-04-14 03:29:06,467 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\office15client.microsoft.com\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10 size is 23349, Max size: 100000000 2026-04-14 03:29:06,483 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\Rothmans Table 3.xlsx size is 53446, Max size: 100000000 2026-04-14 03:29:06,499 [root] WARNING: Folder at path "C:\CwTyBYqWl\debugger" does not exist, skipping 2026-04-14 03:29:06,499 [root] INFO: Uploading files at path "C:\CwTyBYqWl\tlsdump" 2026-04-14 03:29:06,499 [lib.common.results] INFO: File C:\CwTyBYqWl\tlsdump\tlsdump.log size is 2466, Max size: 100000000 2026-04-14 03:29:06,499 [root] WARNING: Monitor injection attempted but failed for process 832 2026-04-14 03:29:06,499 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7office2k3flash2800137TWN3H105 | win7office2k3flash2800137TWN3H105 | KVM | 2026-04-14 09:27:11 | 2026-04-14 09:29:17 | internet |
| File Name | Rothmans Table 3.xlsx |
|---|---|
| File Size | 53434 bytes |
| File Type | Microsoft Excel 2007+ |
| MD5 | 5999177cc680a5021a3f35c4150f74e7 |
| SHA1 | 63f59b2b17d6edca5e9b3c84b159529c49332262 |
| SHA256 | 84b7de9ae9c3fff2241ac9928427ff37c1f9a824f1722db4952a515306a57633 |
| SHA512 | b99507de4e9cd1d4af8326253ebd74863167bc534dd761dc14319f701330867a6d2b89417ea98de54d014d5a7c82428422c8666bf46ed4e10b7b82eafa82c6f1 |
| SHA3-384 | 81befa4f219c05f9a8a7bdba68ab3def9df5485411a260563bf4c0950be7bf78649168c067d7eb887af03f998cf6d720 |
| CRC32 | 4546306F |
| TLSH | T1C633D02C6305B49DDB26C8BDDA0806D0A9811C12C59AFAAC27A0F69D57476F713FE7CC |
| Ssdeep | 768:tQ1Nwb2jp/jCCd1hcioDHLCX4cVDnr4+rT5KZS1MpJGy85HHqDIgLp6+VoGebOGu:tQnwipxjZRc+r6S1QGL5HHiZB |
File
|
|
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| roaming.svc.cloud.microsoft [VT] |
CNAME prod.roaming1.live.com.akadns.net
[VT]
A 52.110.10.11 [VT] CNAME atm.office.mira.tm.svc.cloud.microsoft [VT] A 52.110.10.3 [VT] A 52.110.10.68 [VT] A 52.110.10.40 [VT] CNAME roaming-prod-weightedww.trafficmanager.net [VT] CNAME eur.roaming1.live.com.akadns.net [VT] |
52.110.10.13 [VT] |
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP