| Category | Package | Started | Completed | Duration | Options | Log | MalScore |
|---|---|---|---|---|---|---|---|
| FILE | xls | 2026-04-15 08:25:17 | 2026-04-15 08:27:20 | 123 seconds | Show Options | Show Log | 1.5 |
procdump=1
amsidump=1
2025-12-02 01:29:41,656 [root] INFO: Date set to: 20260415T01:25:17, timeout set to: 150 2026-04-15 02:25:17,015 [root] DEBUG: Starting analyzer from: C:\tmpvsvg3hfz 2026-04-15 02:25:17,015 [root] DEBUG: Storing results at: C:\VCWKikfMVz 2026-04-15 02:25:17,015 [root] DEBUG: Pipe server name: \\.\PIPE\yYooHVcuS 2026-04-15 02:25:17,015 [root] DEBUG: Python path: C:\olddocs 2026-04-15 02:25:17,015 [root] INFO: Analysis package "xls" has been specified 2026-04-15 02:25:17,015 [root] DEBUG: Importing analysis package "xls"... 2026-04-15 02:25:17,031 [root] DEBUG: Initializing analysis package "xls"... 2026-04-15 02:25:17,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL option 2026-04-15 02:25:17,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a DLL_64 option 2026-04-15 02:25:17,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a loader option 2026-04-15 02:25:17,031 [root] INFO: Analyzer: Package modules.packages.xls does not specify a loader_64 option 2026-04-15 02:25:17,062 [root] DEBUG: Importing auxiliary module "modules.auxiliary.browser"... 2026-04-15 02:25:17,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.curtain"... 2026-04-15 02:25:17,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.default_apps"... 2026-04-15 02:25:17,078 [root] DEBUG: Importing auxiliary module "modules.auxiliary.digisig"... 2026-04-15 02:25:17,093 [root] DEBUG: Importing auxiliary module "modules.auxiliary.disguise"... 2026-04-15 02:25:17,109 [root] DEBUG: Importing auxiliary module "modules.auxiliary.evtx"... 2026-04-15 02:25:17,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.fiddler"... 2026-04-15 02:25:17,125 [root] DEBUG: Importing auxiliary module "modules.auxiliary.human"... 2026-04-15 02:25:17,140 [root] DEBUG: Importing auxiliary module "modules.auxiliary.screenshots"... 2026-04-15 02:25:17,140 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops' 2026-04-15 02:25:17,234 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab' 2026-04-15 02:25:17,234 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw' 2026-04-15 02:25:17,249 [root] DEBUG: Importing auxiliary module "modules.auxiliary.sysmon"... 2026-04-15 02:25:17,249 [root] DEBUG: Importing auxiliary module "modules.auxiliary.tlsdump"... 2026-04-15 02:25:17,265 [root] DEBUG: Importing auxiliary module "modules.auxiliary.usage"... 2026-04-15 02:25:17,265 [root] DEBUG: Initializing auxiliary module "Browser"... 2026-04-15 02:25:17,265 [root] DEBUG: Started auxiliary module Browser 2026-04-15 02:25:17,265 [root] DEBUG: Initializing auxiliary module "Curtain"... 2026-04-15 02:25:17,265 [root] DEBUG: Started auxiliary module Curtain 2026-04-15 02:25:17,265 [root] DEBUG: Initializing auxiliary module "DefaultApps"... 2026-04-15 02:25:17,343 [modules.auxiliary.default_apps] DEBUG: Getting current user SID using WinAPI 2026-04-15 02:25:17,343 [root] DEBUG: Started auxiliary module DefaultApps 2026-04-15 02:25:17,343 [root] DEBUG: Initializing auxiliary module "DigiSig"... 2026-04-15 02:25:17,343 [modules.auxiliary.digisig] INFO: signtool.exe was not found in bin/ 2026-04-15 02:25:17,343 [modules.auxiliary.digisig] INFO: xls 2026-04-15 02:25:17,343 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, unsupported analyzer package 2026-04-15 02:25:17,343 [root] DEBUG: Started auxiliary module DigiSig 2026-04-15 02:25:17,343 [root] DEBUG: Initializing auxiliary module "Disguise"... 2026-04-15 02:25:17,687 [modules.auxiliary.disguise] INFO: Setting NoRecentDocsHistory 2026-04-15 02:25:17,687 [root] WARNING: Cannot execute auxiliary module Disguise: [WinError 2] The system cannot find the file specified 2026-04-15 02:25:17,687 [root] DEBUG: Initializing auxiliary module "Evtx"... 2026-04-15 02:25:17,687 [modules.auxiliary.evtx] INFO: Loading audit policy C:\tmpvsvg3hfz\bin\auditpol.csv 2026-04-15 02:25:17,937 [modules.auxiliary.evtx] INFO: Wiping logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:25:18,796 [root] DEBUG: Started auxiliary module Evtx 2026-04-15 02:25:18,796 [root] DEBUG: Initializing auxiliary module "Fiddler"... 2026-04-15 02:25:18,796 [modules.auxiliary.fiddler] INFO: fiddler package: xls 2026-04-15 02:25:18,796 [root] DEBUG: Started auxiliary module Fiddler 2026-04-15 02:25:18,812 [root] DEBUG: Initializing auxiliary module "Human"... 2026-04-15 02:25:18,812 [root] DEBUG: Started auxiliary module Human 2026-04-15 02:25:18,812 [root] DEBUG: Initializing auxiliary module "Screenshots"... 2026-04-15 02:25:18,812 [root] DEBUG: Started auxiliary module Screenshots 2026-04-15 02:25:18,812 [root] DEBUG: Initializing auxiliary module "Sysmon"... 2026-04-15 02:25:18,812 [modules.auxiliary.sysmon] INFO: Seeing if we need to update sysmon config 2026-04-15 02:25:18,812 [modules.auxiliary.sysmon] INFO: Found Sysmon Executable 2026-04-15 02:25:18,812 [modules.auxiliary.sysmon] INFO: Found Sysmon config 2026-04-15 02:25:18,812 [root] DEBUG: Started auxiliary module Sysmon 2026-04-15 02:25:18,812 [root] DEBUG: Initializing auxiliary module "TLSDumpMasterSecrets"... 2026-04-15 02:25:18,828 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 556 2026-04-15 02:25:18,828 [lib.api.process] INFO: Monitor config for process 556: C:\tmpvsvg3hfz\dll\556.ini 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'office' with value '1' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'yarascan' with value '0' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor 2026-04-15 02:25:18,828 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpvsvg3hfz\dll\bxzxAcPZ.dll, loader C:\tmpvsvg3hfz\bin\NqLyMbvu.exe 2026-04-15 02:25:18,843 [root] DEBUG: Loader: IAT patching disabled. 2026-04-15 02:25:18,859 [root] DEBUG: Loader: Injecting process 556 with C:\tmpvsvg3hfz\dll\bxzxAcPZ.dll. 2026-04-15 02:25:18,906 [root] DEBUG: 556: Python path set to 'C:\olddocs'. 2026-04-15 02:25:18,906 [root] DEBUG: 556: Disabling sleep skipping. 2026-04-15 02:25:18,906 [root] DEBUG: 556: Process dumps enabled. 2026-04-15 02:25:18,906 [root] DEBUG: 556: AMSI dumping enabled. 2026-04-15 02:25:18,906 [root] DEBUG: 556: Monitor config - unrecognised key office. 2026-04-15 02:25:18,906 [root] DEBUG: 556: In-monitor YARA scans disabled. 2026-04-15 02:25:18,906 [root] DEBUG: 556: TLS secret dump mode enabled. 2026-04-15 02:25:18,906 [root] DEBUG: 556: Monitor initialised: 64-bit capemon loaded in process 556 at 0x000007FEF5860000, thread 2180, image base 0x00000000FF650000, stack from 0x00000000018C3000-0x00000000018D0000 2026-04-15 02:25:18,921 [root] DEBUG: 556: Commandline: C:\Windows\system32\lsass.exe 2026-04-15 02:25:18,921 [root] DEBUG: 556: Hooked 5 out of 5 functions 2026-04-15 02:25:18,921 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread. 2026-04-15 02:25:18,921 [root] DEBUG: Successfully injected DLL C:\tmpvsvg3hfz\dll\bxzxAcPZ.dll. 2026-04-15 02:25:18,937 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 556 2026-04-15 02:25:18,937 [root] DEBUG: Started auxiliary module TLSDumpMasterSecrets 2026-04-15 02:25:18,937 [root] DEBUG: Initializing auxiliary module "Usage"... 2026-04-15 02:25:18,937 [root] DEBUG: Started auxiliary module Usage 2026-04-15 02:25:21,000 [modules.auxiliary.sysmon] INFO: Clearing existing sysmon logs 2026-04-15 02:25:21,718 [root] INFO: Restarting WMI Service 2026-04-15 02:25:28,828 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" with arguments ""C:\Users\pgabriel\AppData\Local\Temp\2026-04-14 SWASFT A.xlsx" /dde" with pid 1212 2026-04-15 02:25:28,828 [lib.api.process] INFO: Monitor config for process 1212: C:\tmpvsvg3hfz\dll\1212.ini 2026-04-15 02:25:28,843 [lib.api.process] INFO: Option 'procdump' with value '1' sent to monitor 2026-04-15 02:25:28,843 [lib.api.process] INFO: Option 'amsidump' with value '1' sent to monitor 2026-04-15 02:25:28,843 [lib.api.process] INFO: Option 'disable_hook_content' with value '4' sent to monitor 2026-04-15 02:25:28,843 [lib.api.process] INFO: Option 'office' with value '1' sent to monitor 2026-04-15 02:25:28,843 [lib.api.process] INFO: Option 'yarascan' with value '0' sent to monitor 2026-04-15 02:25:28,843 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor 2026-04-15 02:25:28,843 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpvsvg3hfz\dll\WBFYFYp.dll, loader C:\tmpvsvg3hfz\bin\ijTwoMn.exe 2026-04-15 02:25:28,875 [root] DEBUG: Loader: IAT patching disabled. 2026-04-15 02:25:28,875 [root] DEBUG: Loader: Injecting process 1212 (thread 1852) with C:\tmpvsvg3hfz\dll\WBFYFYp.dll. 2026-04-15 02:25:28,875 [root] DEBUG: InjectDllViaQueuedAPC: APC injection queued. 2026-04-15 02:25:28,890 [root] DEBUG: Successfully injected DLL C:\tmpvsvg3hfz\dll\WBFYFYp.dll. 2026-04-15 02:25:28,890 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1212 2026-04-15 02:25:30,890 [lib.api.process] INFO: Successfully resumed process with pid 1212 2026-04-15 02:25:31,000 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-15 02:25:31,234 [root] DEBUG: 1212: Python path set to 'C:\olddocs'. 2026-04-15 02:25:31,234 [root] DEBUG: 1212: Disabling sleep skipping. 2026-04-15 02:25:31,234 [root] DEBUG: 1212: Process dumps enabled. 2026-04-15 02:25:31,234 [root] DEBUG: 1212: AMSI dumping enabled. 2026-04-15 02:25:31,234 [root] DEBUG: 1212: Monitor config - unrecognised key office. 2026-04-15 02:25:31,234 [root] DEBUG: 1212: In-monitor YARA scans disabled. 2026-04-15 02:25:31,234 [root] DEBUG: 1212: Dropped file limit defaulting to 100. 2026-04-15 02:25:31,390 [root] DEBUG: 1212: Microsoft Office settings enabled. 2026-04-15 02:25:31,406 [root] DEBUG: 1212: Monitor initialised: 32-bit capemon loaded in process 1212 at 0x71f80000, thread 1852, image base 0x200000, stack from 0x1bc3000-0x1bd0000 2026-04-15 02:25:31,406 [root] DEBUG: 1212: Commandline: "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" "C:\Users\pgabriel\AppData\Local\Temp\2026-04-14 SWASFT A.xlsx" /dde 2026-04-15 02:25:31,406 [root] DEBUG: 1212: add_all_dlls_to_dll_ranges: skipping C:\Program Files (x86)\Microsoft Office\Office15\oart.dll 2026-04-15 02:25:31,437 [root] DEBUG: 1212: Hooked 456 out of 456 functions 2026-04-15 02:25:31,546 [root] INFO: Loaded monitor into process with pid 1212 2026-04-15 02:25:31,859 [root] DEBUG: 1212: DLL loaded at 0x6EDF0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso (0x18e4000 bytes). 2026-04-15 02:25:31,859 [root] DEBUG: 1212: DLL loaded at 0x72CF0000: C:\Windows\system32\MSIMG32 (0x5000 bytes). 2026-04-15 02:25:31,875 [root] DEBUG: 1212: DLL loaded at 0x72EE0000: C:\Windows\system32\uxtheme (0x80000 bytes). 2026-04-15 02:25:31,890 [root] DEBUG: 1212: DLL loaded at 0x72E10000: C:\Windows\system32\WTSAPI32 (0xd000 bytes). 2026-04-15 02:25:31,890 [root] DEBUG: 1212: DLL loaded at 0x741A0000: C:\Windows\system32\WINSTA (0x29000 bytes). 2026-04-15 02:25:31,906 [root] DEBUG: 1212: DLL loaded at 0x73770000: C:\Windows\system32\dxgi (0x4c000 bytes). 2026-04-15 02:25:31,906 [root] DEBUG: 1212: DLL loaded at 0x72ED0000: C:\Windows\system32\VERSION (0x9000 bytes). 2026-04-15 02:25:31,906 [root] DEBUG: 1212: DLL loaded at 0x74130000: C:\Windows\system32\dwmapi (0x13000 bytes). 2026-04-15 02:25:31,937 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:31,953 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:31,953 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:31,953 [root] DEBUG: 1212: DLL loaded at 0x76A50000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes). 2026-04-15 02:25:31,968 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:31,968 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:31,968 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:31,984 [root] DEBUG: 1212: DLL loaded at 0x71D40000: C:\Windows\system32\msi (0x240000 bytes). 2026-04-15 02:25:32,156 [root] DEBUG: 1212: DLL loaded at 0x72F70000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\Comctl32 (0x19e000 bytes). 2026-04-15 02:25:32,234 [root] DEBUG: 1212: DLL loaded at 0x73F90000: C:\Windows\system32\d3d10_1 (0x2c000 bytes). 2026-04-15 02:25:32,249 [root] DEBUG: 1212: DLL loaded at 0x73720000: C:\Windows\system32\d3d10_1core (0x41000 bytes). 2026-04-15 02:25:32,265 [root] DEBUG: 1212: DLL loaded at 0x716C0000: C:\Windows\system32\d3d11 (0x175000 bytes). 2026-04-15 02:25:32,296 [root] DEBUG: 1212: DLL loaded at 0x714D0000: C:\Windows\system32\D3D10Warp (0x1e9000 bytes). 2026-04-15 02:25:32,296 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:32,296 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:32,296 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:32,312 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:32,312 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:32,312 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:32,328 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:32,328 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:32,328 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:32,375 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:32,375 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:32,375 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:32,390 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\setupapi (0x19d000 bytes). 2026-04-15 02:25:32,390 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:32,390 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:32,593 [root] DEBUG: 1212: DLL loaded at 0x736D0000: C:\Windows\system32\mscoree (0x4a000 bytes). 2026-04-15 02:25:32,625 [root] DEBUG: 1212: DLL loaded at 0x6E9E0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x8d000 bytes). 2026-04-15 02:25:32,750 [root] DEBUG: 1212: DLL loaded at 0x6E920000: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\adal (0xb5000 bytes). 2026-04-15 02:25:32,750 [root] DEBUG: 1212: DLL loaded at 0x725E0000: C:\Windows\system32\WINHTTP (0x58000 bytes). 2026-04-15 02:25:32,765 [root] DEBUG: 1212: DLL loaded at 0x6E8D0000: C:\Windows\system32\webio (0x50000 bytes). 2026-04-15 02:25:32,796 [root] DEBUG: 1212: DLL loaded at 0x76AF0000: C:\Windows\syswow64\WININET (0x1e4000 bytes). 2026-04-15 02:25:32,812 [root] DEBUG: 1212: DLL loaded at 0x74CE0000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes). 2026-04-15 02:25:32,812 [root] DEBUG: 1212: DLL loaded at 0x756B0000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes). 2026-04-15 02:25:32,812 [root] DEBUG: 1212: DLL loaded at 0x74E30000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes). 2026-04-15 02:25:32,812 [root] DEBUG: 1212: DLL loaded at 0x74B00000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes). 2026-04-15 02:25:32,812 [root] DEBUG: 1212: DLL loaded at 0x74AF0000: C:\Windows\syswow64\normaliz (0x3000 bytes). 2026-04-15 02:25:32,843 [root] DEBUG: 1212: DLL loaded at 0x74E40000: C:\Windows\syswow64\iertutil (0x232000 bytes). 2026-04-15 02:25:32,843 [root] DEBUG: 1212: DLL loaded at 0x751A0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes). 2026-04-15 02:25:32,843 [root] DEBUG: 1212: DLL loaded at 0x767F0000: C:\Windows\syswow64\USERENV (0x17000 bytes). 2026-04-15 02:25:32,843 [root] DEBUG: 1212: DLL loaded at 0x74B30000: C:\Windows\syswow64\profapi (0xb000 bytes). 2026-04-15 02:25:32,859 [root] DEBUG: 1212: DLL loaded at 0x74280000: C:\Windows\system32\Secur32 (0x8000 bytes). 2026-04-15 02:25:32,953 [root] DEBUG: 1212: DLL loaded at 0x75540000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes). 2026-04-15 02:25:32,953 [root] DEBUG: 1212: DLL loaded at 0x6E870000: C:\Windows\System32\netprofm (0x5a000 bytes). 2026-04-15 02:25:32,953 [root] DEBUG: 1212: DLL loaded at 0x74190000: C:\Windows\System32\nlaapi (0x10000 bytes). 2026-04-15 02:25:32,968 [root] DEBUG: 1212: DLL loaded at 0x72540000: C:\Windows\system32\CRYPTSP (0x17000 bytes). 2026-04-15 02:25:32,984 [root] DEBUG: 1212: DLL loaded at 0x72500000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2026-04-15 02:25:32,984 [root] DEBUG: 1212: DLL loaded at 0x735C0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2026-04-15 02:25:33,000 [root] DEBUG: 1212: DLL loaded at 0x740E0000: C:\Windows\System32\npmproxy (0x8000 bytes). 2026-04-15 02:25:33,187 [root] DEBUG: 1212: DLL loaded at 0x6E6E0000: C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\riched20 (0x18e000 bytes). 2026-04-15 02:25:33,796 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:25:34,109 [lib.common.results] INFO: File 1776245134031250000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:25:34,125 [lib.common.results] INFO: File 1776245134031250000.Application.evtx.gz size is 6726, Max size: 100000000 2026-04-15 02:25:34,125 [lib.common.results] INFO: File 1776245134046875000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:25:34,156 [lib.common.results] INFO: File 1776245134093750000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:25:34,156 [lib.common.results] INFO: File 1776245134109375000.OAlerts.evtx.gz size is 245, Max size: 100000000 2026-04-15 02:25:34,171 [root] DEBUG: 1212: DLL loaded at 0x714A0000: C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppc (0x2d000 bytes). 2026-04-15 02:25:34,187 [root] DEBUG: 1212: DLL loaded at 0x69830000: C:\Windows\system32\DWrite (0x135000 bytes). 2026-04-15 02:25:34,187 [lib.common.results] INFO: File 1776245134125000000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:25:34,203 [root] DEBUG: 1212: DLL loaded at 0x73630000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes). 2026-04-15 02:25:34,203 [root] DEBUG: 1212: DLL loaded at 0x73620000: C:\Windows\system32\WINNSI (0x7000 bytes). 2026-04-15 02:25:34,203 [root] DEBUG: 1212: DLL loaded at 0x740D0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes). 2026-04-15 02:25:34,203 [root] DEBUG: 1212: DLL loaded at 0x725C0000: C:\Windows\system32\dhcpcsvc (0x12000 bytes). 2026-04-15 02:25:34,203 [lib.common.results] INFO: File 1776245134125000000.Security.evtx.gz size is 15448, Max size: 100000000 2026-04-15 02:25:34,218 [root] DEBUG: 1212: DLL loaded at 0x73F80000: C:\Windows\system32\credssp (0x8000 bytes). 2026-04-15 02:25:34,218 [lib.common.results] INFO: File 1776245134156250000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:25:34,218 [root] DEBUG: 1212: DLL loaded at 0x73580000: C:\Windows\system32\mswsock (0x3c000 bytes). 2026-04-15 02:25:34,218 [root] DEBUG: 1212: DLL loaded at 0x73570000: C:\Windows\System32\wshtcpip (0x5000 bytes). 2026-04-15 02:25:34,218 [root] DEBUG: 1212: DLL loaded at 0x73560000: C:\Windows\System32\wship6 (0x6000 bytes). 2026-04-15 02:25:34,218 [root] DEBUG: 1212: DLL loaded at 0x699A0000: C:\Windows\system32\DNSAPI (0x44000 bytes). 2026-04-15 02:25:34,234 [lib.common.results] INFO: File 1776245134156250000.System.evtx.gz size is 8922, Max size: 100000000 2026-04-15 02:25:34,328 [root] DEBUG: 1212: DLL loaded at 0x697E0000: C:\Windows\SysWOW64\schannel (0x41000 bytes). 2026-04-15 02:25:34,343 [root] DEBUG: 556: DLL loaded at 0x000007FEF1070000: C:\Windows\system32\dssenh (0x32000 bytes). 2026-04-15 02:25:34,593 [root] DEBUG: 1212: DLL loaded at 0x758F0000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes). 2026-04-15 02:25:34,640 [root] DEBUG: 1212: DLL loaded at 0x69970000: C:\Windows\system32\XmlLite (0x2f000 bytes). 2026-04-15 02:25:34,671 [root] DEBUG: 556: DLL loaded at 0x000007FEF8420000: C:\Windows\system32\keyiso (0xb000 bytes). 2026-04-15 02:25:34,828 [root] DEBUG: 1212: DLL loaded at 0x74B40000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2026-04-15 02:25:34,828 [root] DEBUG: 1212: DLL loaded at 0x74CF0000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2026-04-15 02:25:34,828 [root] DEBUG: 1212: DLL loaded at 0x76A80000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2026-04-15 02:25:34,843 [root] DEBUG: 1212: DLL loaded at 0x696E0000: C:\Windows\system32\propsys (0xf5000 bytes). 2026-04-15 02:25:34,859 [root] DEBUG: 1212: DLL loaded at 0x72E50000: C:\Windows\system32\ntmarta (0x21000 bytes). 2026-04-15 02:25:34,875 [root] DEBUG: 1212: DLL loaded at 0x74AA0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes). 2026-04-15 02:25:34,921 [root] DEBUG: 1212: DLL loaded at 0x766A0000: C:\Windows\SysWOW64\urlmon (0x14a000 bytes). 2026-04-15 02:25:34,921 [root] DEBUG: 1212: DLL loaded at 0x74D20000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes). 2026-04-15 02:25:34,937 [root] DEBUG: 1212: DLL loaded at 0x73D70000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes). 2026-04-15 02:25:34,984 [root] DEBUG: 1212: DLL loaded at 0x696C0000: C:\Windows\system32\MPR (0x12000 bytes). 2026-04-15 02:25:35,046 [root] DEBUG: 1212: DLL loaded at 0x69560000: C:\Windows\System32\msxml6 (0x158000 bytes). 2026-04-15 02:25:35,343 [root] DEBUG: 1212: DLL loaded at 0x69430000: C:\Windows\system32\WindowsCodecs (0x130000 bytes). 2026-04-15 02:25:35,359 [root] DEBUG: 556: TLS 1.2 secrets logged to: C:\VCWKikfMVz\tlsdump\tlsdump.log 2026-04-15 02:25:35,375 [root] DEBUG: 1212: DLL loaded at 0x693F0000: C:\Windows\system32\WINMM (0x32000 bytes). 2026-04-15 02:25:35,453 [root] DEBUG: 556: DLL loaded at 0x000007FEF9F80000: C:\Windows\system32\cryptnet (0x27000 bytes). 2026-04-15 02:25:35,468 [root] DEBUG: 556: DLL loaded at 0x000007FEFE3A0000: C:\Windows\system32\WLDAP32 (0x52000 bytes). 2026-04-15 02:25:35,500 [root] DEBUG: 1212: DLL loaded at 0x693B0000: C:\Windows\system32\ncrypt (0x39000 bytes). 2026-04-15 02:25:35,515 [root] DEBUG: 1212: DLL loaded at 0x69370000: C:\Windows\SysWOW64\bcryptprimitives (0x3d000 bytes). 2026-04-15 02:25:35,640 [root] DEBUG: 1212: DLL loaded at 0x71490000: C:\Windows\system32\msimtf (0xb000 bytes). 2026-04-15 02:25:35,656 [root] DEBUG: 1212: set_hooks_by_export_directory: Hooked 0 out of 456 functions 2026-04-15 02:25:35,718 [root] DEBUG: 1212: DLL loaded at 0x736C0000: C:\Program Files (x86)\Microsoft Office\Office15\MSOSTYLE (0xa000 bytes). 2026-04-15 02:25:35,812 [root] DEBUG: 1212: DLL loaded at 0x69350000: C:\Windows\system32\GPAPI (0x16000 bytes). 2026-04-15 02:25:36,015 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\office15client.microsoft.com\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10 2026-04-15 02:25:36,046 [root] DEBUG: 1212: DLL loaded at 0x69280000: C:\Windows\system32\webservices (0xc2000 bytes). 2026-04-15 02:25:36,062 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma00546271.png0 size is 119666, Max size: 100000000 2026-04-15 02:25:36,078 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma02786999.png0 size is 8127, Max size: 100000000 2026-04-15 02:25:36,093 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900771.png0 size is 10213, Max size: 100000000 2026-04-15 02:25:36,093 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776245136.09375.sysmon.evtx.gz to host 2026-04-15 02:25:36,093 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 8685, Max size: 100000000 2026-04-15 02:25:36,109 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16382936.png0 size is 37573, Max size: 100000000 2026-04-15 02:25:36,140 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16382941.png0 size is 96333, Max size: 100000000 2026-04-15 02:25:36,156 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma02835058.png0 size is 186365, Max size: 100000000 2026-04-15 02:25:36,171 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma03978815.png0 size is 711398, Max size: 100000000 2026-04-15 02:25:36,203 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt78018332.png0 size is 26105, Max size: 100000000 2026-04-15 02:25:36,203 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16392850.png0 size is 280509, Max size: 100000000 2026-04-15 02:25:36,218 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt45325165.png0 size is 9149, Max size: 100000000 2026-04-15 02:25:36,234 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma03982351.png0 size is 12860, Max size: 100000000 2026-04-15 02:25:36,234 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16392877.png0 size is 86215, Max size: 100000000 2026-04-15 02:25:36,249 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16402488.png0 size is 114584, Max size: 100000000 2026-04-15 02:25:36,265 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma16412178.png0 size is 283253, Max size: 100000000 2026-04-15 02:25:36,281 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma56348247.png0 size is 55049, Max size: 100000000 2026-04-15 02:25:36,296 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900720.png0 size is 22877, Max size: 100000000 2026-04-15 02:25:36,328 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-ma88924273.png0 size is 103770, Max size: 100000000 2026-04-15 02:25:36,343 [root] DEBUG: 1212: DLL loaded at 0x69260000: C:\Windows\system32\cryptnet (0x1d000 bytes). 2026-04-15 02:25:36,343 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02836342.png0 size is 26220, Max size: 100000000 2026-04-15 02:25:36,359 [root] DEBUG: 1212: DLL loaded at 0x69250000: C:\Windows\system32\SensApi (0x6000 bytes). 2026-04-15 02:25:36,359 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02892315.png0 size is 20776, Max size: 100000000 2026-04-15 02:25:36,375 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt10002124.png0 size is 11329, Max size: 100000000 2026-04-15 02:25:36,406 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt78500733.png0 size is 10169, Max size: 100000000 2026-04-15 02:25:36,406 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02911863.png0 size is 41743, Max size: 100000000 2026-04-15 02:25:36,437 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900688.png0 size is 8561, Max size: 100000000 2026-04-15 02:25:36,453 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900722.png0 size is 19188, Max size: 100000000 2026-04-15 02:25:36,468 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02900743.png0 size is 33070, Max size: 100000000 2026-04-15 02:25:36,531 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt02923944.png0 size is 4886, Max size: 100000000 2026-04-15 02:25:36,562 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt10002117.png0 size is 4962, Max size: 100000000 2026-04-15 02:25:36,593 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt16402400.png0 size is 33856, Max size: 100000000 2026-04-15 02:25:36,609 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt22746018.png0 size is 18469, Max size: 100000000 2026-04-15 02:25:36,625 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt45088960.png0 size is 40992, Max size: 100000000 2026-04-15 02:25:36,656 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\binaries.templates.cdn.office.net\support-templates-en-us-mt45420242.png0 size is 13339, Max size: 100000000 2026-04-15 02:25:37,046 [root] DEBUG: 1212: DLL loaded at 0x691F0000: C:\Windows\system32\SXS (0x5f000 bytes). 2026-04-15 02:25:38,093 [root] DEBUG: 1212: DLL loaded at 0x691C0000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2026-04-15 02:25:41,921 [lib.common.results] INFO: File c:\olddocs\1776245136906.saz size is 25269, Max size: 100000000 2026-04-15 02:25:41,937 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-15 02:25:49,265 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:25:49,546 [lib.common.results] INFO: File 1776245149484375000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:25:49,562 [lib.common.results] INFO: File 1776245149484375000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:25:49,562 [lib.common.results] INFO: File 1776245149484375000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:25:49,562 [lib.common.results] INFO: File 1776245149484375000.Application.evtx.gz size is 6634, Max size: 100000000 2026-04-15 02:25:49,609 [lib.common.results] INFO: File 1776245149546875000.OAlerts.evtx.gz size is 245, Max size: 100000000 2026-04-15 02:25:49,625 [lib.common.results] INFO: File 1776245149546875000.Security.evtx.gz size is 8289, Max size: 100000000 2026-04-15 02:25:49,625 [lib.common.results] INFO: File 1776245149546875000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:25:49,625 [lib.common.results] INFO: File 1776245149546875000.System.evtx.gz size is 8646, Max size: 100000000 2026-04-15 02:25:49,656 [lib.common.results] INFO: File 1776245149609375000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:25:51,109 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-15 02:25:56,234 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776245156.234375.sysmon.evtx.gz to host 2026-04-15 02:25:56,234 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 98592, Max size: 100000000 2026-04-15 02:26:02,015 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-15 02:26:04,687 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:26:04,921 [lib.common.results] INFO: File 1776245164875000000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:26:04,921 [lib.common.results] INFO: File 1776245164875000000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:26:04,937 [lib.common.results] INFO: File 1776245164875000000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:26:04,937 [lib.common.results] INFO: File 1776245164875000000.Application.evtx.gz size is 6580, Max size: 100000000 2026-04-15 02:26:04,984 [lib.common.results] INFO: File 1776245164921875000.OAlerts.evtx.gz size is 245, Max size: 100000000 2026-04-15 02:26:05,000 [lib.common.results] INFO: File 1776245164921875000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:26:05,000 [lib.common.results] INFO: File 1776245164921875000.Security.evtx.gz size is 7769, Max size: 100000000 2026-04-15 02:26:05,015 [lib.common.results] INFO: File 1776245164921875000.System.evtx.gz size is 8355, Max size: 100000000 2026-04-15 02:26:05,015 [lib.common.results] INFO: File 1776245164984375000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:26:11,249 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-15 02:26:16,328 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776245176.328125.sysmon.evtx.gz to host 2026-04-15 02:26:16,328 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 6280, Max size: 100000000 2026-04-15 02:26:20,046 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:26:20,265 [lib.common.results] INFO: File 1776245180234375000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:26:20,281 [lib.common.results] INFO: File 1776245180234375000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:26:20,281 [lib.common.results] INFO: File 1776245180234375000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:26:20,281 [lib.common.results] INFO: File 1776245180234375000.Application.evtx.gz size is 6580, Max size: 100000000 2026-04-15 02:26:20,312 [lib.common.results] INFO: File 1776245180265625000.OAlerts.evtx.gz size is 245, Max size: 100000000 2026-04-15 02:26:20,343 [lib.common.results] INFO: File 1776245180281250000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:26:20,359 [lib.common.results] INFO: File 1776245180281250000.Security.evtx.gz size is 7983, Max size: 100000000 2026-04-15 02:26:20,375 [lib.common.results] INFO: File 1776245180281250000.System.evtx.gz size is 8317, Max size: 100000000 2026-04-15 02:26:20,390 [lib.common.results] INFO: File 1776245180312500000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:26:22,093 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-15 02:26:22,437 [modules.auxiliary.human] INFO: Doing office click around. 2026-04-15 02:26:31,343 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-15 02:26:35,421 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:26:35,625 [lib.common.results] INFO: File 1776245195578125000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:26:35,640 [lib.common.results] INFO: File 1776245195578125000.Application.evtx.gz size is 6860, Max size: 100000000 2026-04-15 02:26:35,640 [lib.common.results] INFO: File 1776245195578125000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:26:35,640 [lib.common.results] INFO: File 1776245195578125000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:26:35,687 [lib.common.results] INFO: File 1776245195625000000.OAlerts.evtx.gz size is 245, Max size: 100000000 2026-04-15 02:26:35,703 [lib.common.results] INFO: File 1776245195640625000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:26:35,703 [lib.common.results] INFO: File 1776245195640625000.Security.evtx.gz size is 7833, Max size: 100000000 2026-04-15 02:26:35,703 [lib.common.results] INFO: File 1776245195640625000.System.evtx.gz size is 8341, Max size: 100000000 2026-04-15 02:26:35,718 [lib.common.results] INFO: File 1776245195687500000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:26:36,406 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776245196.40625.sysmon.evtx.gz to host 2026-04-15 02:26:36,406 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 6615, Max size: 100000000 2026-04-15 02:26:42,156 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-15 02:26:49,625 [modules.auxiliary.human] INFO: Closing Office window 2026-04-15 02:26:50,625 [modules.auxiliary.human] INFO: Issuing keypress on Office dialog 2026-04-15 02:26:50,750 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:26:50,781 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Temp\2026-04-14 SWASFT A.xlsx 2026-04-15 02:26:50,781 [root] INFO: Added new file to list with pid None and path C:\Users\pgabriel\AppData\Local\Temp\13851000 2026-04-15 02:26:50,812 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\1407522.tmp size is 343378, Max size: 100000000 2026-04-15 02:26:51,015 [lib.common.results] INFO: File 1776245210937500000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:26:51,015 [lib.common.results] INFO: File 1776245210937500000.Application.evtx.gz size is 6790, Max size: 100000000 2026-04-15 02:26:51,031 [lib.common.results] INFO: File 1776245210953125000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:26:51,031 [lib.common.results] INFO: File 1776245210953125000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:26:51,046 [root] DEBUG: 1212: DLL loaded at 0x69190000: C:\Windows\system32\POWRPROF (0x25000 bytes). 2026-04-15 02:26:51,078 [lib.common.results] INFO: File 1776245211015625000.Security.evtx.gz size is 7662, Max size: 100000000 2026-04-15 02:26:51,093 [lib.common.results] INFO: File 1776245211031250000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:26:51,093 [lib.common.results] INFO: File 1776245211015625000.OAlerts.evtx.gz size is 1176, Max size: 100000000 2026-04-15 02:26:51,125 [lib.common.results] INFO: File 1776245211031250000.System.evtx.gz size is 8331, Max size: 100000000 2026-04-15 02:26:51,125 [lib.common.results] INFO: File 1776245211078125000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:26:51,234 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\CVR4F57.tmp.cvr size is 0, Max size: 100000000 2026-04-15 02:26:51,281 [root] DEBUG: 1212: NtTerminateProcess hook: Attempting to dump process 1212 2026-04-15 02:26:51,312 [root] DEBUG: 1212: VerifyCodeSection: Executable code does not match, 0xa86f8 of 0x130f9ab matching 2026-04-15 02:26:51,312 [root] DEBUG: 1212: DoProcessDump: Code modification detected, dumping Imagebase at 0x00200000. 2026-04-15 02:26:51,312 [root] DEBUG: 1212: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2026-04-15 02:26:51,312 [root] DEBUG: 1212: DumpProcess: Instantiating PeParser with address: 0x00200000. 2026-04-15 02:26:51,312 [root] DEBUG: 1212: DumpProcess: Module entry point VA is 0x00003550. 2026-04-15 02:26:51,421 [modules.auxiliary.sysmon] INFO: Dumping sysmon logs 2026-04-15 02:26:51,562 [lib.common.results] INFO: File C:\VCWKikfMVz\CAPE\1212_123013805126915342026 size is 25693184, Max size: 100000000 2026-04-15 02:26:51,765 [root] DEBUG: 1212: DumpProcess: Module image dump success - dump size 0x1880c00. 2026-04-15 02:26:51,796 [root] INFO: Process with pid 1212 has terminated 2026-04-15 02:26:56,500 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776245216.5.sysmon.evtx.gz to host 2026-04-15 02:26:56,500 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 6608, Max size: 100000000 2026-04-15 02:26:57,906 [root] INFO: Process list is empty, terminating analysis 2026-04-15 02:26:58,906 [root] INFO: Created shutdown mutex 2026-04-15 02:26:59,906 [root] INFO: Shutting down package 2026-04-15 02:26:59,906 [root] INFO: Stopping auxiliary modules 2026-04-15 02:26:59,921 [modules.auxiliary.curtain] ERROR: Curtain - Error collecting PowerShell events - [WinError 6] The handle is invalid 2026-04-15 02:26:59,937 [lib.common.results] INFO: File C:\curtain.log size is 0, Max size: 100000000 2026-04-15 02:26:59,937 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:27:00,171 [lib.common.results] INFO: File 1776245220109375000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:27:00,171 [lib.common.results] INFO: File 1776245220093750000.Application.evtx.gz size is 6790, Max size: 100000000 2026-04-15 02:27:00,203 [lib.common.results] INFO: File 1776245220140625000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:27:00,218 [lib.common.results] INFO: File 1776245220171875000.OAlerts.evtx.gz size is 1114, Max size: 100000000 2026-04-15 02:27:00,234 [lib.common.results] INFO: File 1776245220171875000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:27:00,249 [lib.common.results] INFO: File 1776245220171875000.Security.evtx.gz size is 7976, Max size: 100000000 2026-04-15 02:27:00,249 [lib.common.results] INFO: File 1776245220187500000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:27:00,281 [lib.common.results] INFO: File 1776245220234375000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:27:00,281 [lib.common.results] INFO: File 1776245220218750000.System.evtx.gz size is 8379, Max size: 100000000 2026-04-15 02:27:02,234 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-15 02:27:05,359 [modules.auxiliary.fiddler] ERROR: Saz log file not found in guest machine 2026-04-15 02:27:05,359 [modules.auxiliary.sysmon] INFO: Doing final sysmon log dump 2026-04-15 02:27:06,171 [modules.auxiliary.evtx] INFO: Collecting logs: Application, HardwareEvents, Internet Explorer, Key Management Service, OAlerts, Security, Setup, System, Windows PowerShell 2026-04-15 02:27:06,406 [lib.common.results] INFO: File 1776245226375000000.HardwareEvents.evtx.gz size is 214, Max size: 100000000 2026-04-15 02:27:06,421 [lib.common.results] INFO: File 1776245226343750000.Application.evtx.gz size is 6790, Max size: 100000000 2026-04-15 02:27:06,437 [lib.common.results] INFO: File 1776245226375000000.InternetExplorer.evtx.gz size is 252, Max size: 100000000 2026-04-15 02:27:06,437 [lib.common.results] INFO: File 1776245226375000000.KeyManagementService.evtx.gz size is 2798, Max size: 100000000 2026-04-15 02:27:06,484 [lib.common.results] INFO: File 1776245226421875000.Setup.evtx.gz size is 244, Max size: 100000000 2026-04-15 02:27:06,500 [lib.common.results] INFO: File 1776245226406250000.OAlerts.evtx.gz size is 1114, Max size: 100000000 2026-04-15 02:27:06,500 [lib.common.results] INFO: File 1776245226421875000.Security.evtx.gz size is 7873, Max size: 100000000 2026-04-15 02:27:06,500 [lib.common.results] INFO: File 1776245226437500000.System.evtx.gz size is 8362, Max size: 100000000 2026-04-15 02:27:06,515 [lib.common.results] INFO: File 1776245226468750000.WindowsPowerShell.evtx.gz size is 224, Max size: 100000000 2026-04-15 02:27:10,437 [modules.auxiliary.sysmon] INFO: Uploading sysmon/1776245230.4375.sysmon.evtx.gz to host 2026-04-15 02:27:10,437 [lib.common.results] INFO: File C:\Sysmon.evtx.gz size is 14421, Max size: 100000000 2026-04-15 02:27:10,437 [root] INFO: Finishing auxiliary modules 2026-04-15 02:27:10,437 [root] INFO: Shutting down pipe server and dumping dropped files 2026-04-15 02:27:10,437 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Microsoft\Office\15.0\WebServiceCache\AllUsers\office15client.microsoft.com\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10 size is 23349, Max size: 100000000 2026-04-15 02:27:10,453 [lib.common.results] INFO: File C:\Users\pgabriel\AppData\Local\Temp\2026-04-14 SWASFT A.xlsx size is 342662, Max size: 100000000 2026-04-15 02:27:10,453 [root] WARNING: Folder at path "C:\VCWKikfMVz\debugger" does not exist, skipping 2026-04-15 02:27:10,453 [root] INFO: Uploading files at path "C:\VCWKikfMVz\tlsdump" 2026-04-15 02:27:10,453 [lib.common.results] INFO: File C:\VCWKikfMVz\tlsdump\tlsdump.log size is 2466, Max size: 100000000 2026-04-15 02:27:10,468 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win7office2k3flash2800137TWN3H103 | win7office2k3flash2800137TWN3H103 | KVM | 2026-04-15 08:25:17 | 2026-04-15 08:27:20 | internet |
| File Name | 2026-04-14 SWASFT A.xlsx |
|---|---|
| File Size | 343378 bytes |
| File Type | Microsoft Excel 2007+ |
| MD5 | 357d4abe13a806458fdfa37aa9ce33b8 |
| SHA1 | 31cb670adecd43e69679f2461ee59511d2487ba2 |
| SHA256 | cc0a649cb34c935fec91776a06c6dd25b3e50478e87f4344cabf237c826c6d5a |
| SHA512 | 573fac7b8494fedc5a2f6710aa64e7a2cee7f8e1452bdc6923e887b6c14f3fa42f0cbbc402cab4be0294dd8be200d2d92f397b23751fcf2988d321389dbe693b |
| SHA3-384 | 4f471d8046c7f6216099f076178630bb6235617027f12a439774de1c7a2f08faf9a99a2deea49d94f61dc7ac57d314c2 |
| CRC32 | 35B9F042 |
| TLSH | T1D774024E4C8AB76DC394227C0D2921D2445C3F027814A828F7BB379B6A95F5FC6FD662 |
| Ssdeep | 6144:IrROxgH5Eepbrtkifj0l9WAqs9ob6DidTbdNwpPB7eOda2jn2:+RGeh+o6WSm6Di1dNmB7eOdamn2 |
File
|
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| roaming.svc.cloud.microsoft [VT] |
CNAME eur.roaming1.live.com.akadns.net
[VT]
A 52.110.10.74 [VT] A 52.110.10.67 [VT] CNAME roaming-prod-weightedww.trafficmanager.net [VT] A 52.110.10.5 [VT] CNAME atm.office.mira.tm.svc.cloud.microsoft [VT] A 52.110.10.9 [VT] CNAME prod.roaming1.live.com.akadns.net [VT] |
52.110.10.68 [VT] |
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP