| Category | Package | Started | Completed | Duration | Logs | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| FILE | vbs | 2026-03-29 10:43:55 | 2026-03-29 10:47:02 | 187s |
|
|||||
| Reports | JSON | |||||||||
2026-03-05 20:34:41,819 [root] INFO: Date set to: 20260329T10:44:56, timeout set to: 60
2026-03-29 10:44:56,129 [root] DEBUG: Starting analyzer from: C:\r4q0i2l_
2026-03-29 10:44:56,222 [root] DEBUG: Storing results at: C:\QpXCaNVtFy
2026-03-29 10:44:56,222 [root] DEBUG: Pipe server name: \\.\PIPE\uIZyuiWWjQ
2026-03-29 10:44:56,222 [root] DEBUG: Python path: C:\Python310
2026-03-29 10:44:56,238 [root] INFO: analysis running as an admin
2026-03-29 10:44:56,238 [root] INFO: analysis package specified: "vbs"
2026-03-29 10:44:56,238 [root] DEBUG: importing analysis package module: "modules.packages.vbs"...
2026-03-29 10:44:56,254 [root] DEBUG: imported analysis package "vbs"
2026-03-29 10:44:56,269 [root] DEBUG: initializing analysis package "vbs"...
2026-03-29 10:44:56,332 [lib.common.common] INFO: wrapping
2026-03-29 10:44:56,379 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation
2026-03-29 10:44:56,566 [root] DEBUG: New location of moved file: C:\Users\cape\AppData\Local\Temp\rknrl_1_.vbs
2026-03-29 10:44:56,566 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a DLL option
2026-03-29 10:44:56,566 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a DLL_64 option
2026-03-29 10:44:56,566 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a loader option
2026-03-29 10:44:56,566 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a loader_64 option
2026-03-29 10:44:56,785 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-03-29 10:44:56,910 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-03-29 10:44:56,941 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-03-29 10:44:57,035 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-03-29 10:44:57,082 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-03-29 10:44:57,410 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2026-03-29 10:44:57,426 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2026-03-29 10:44:58,441 [lib.api.screenshot] INFO: Please upgrade Pillow to >= 5.4.1 for best performance
2026-03-29 10:44:58,441 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-03-29 10:44:58,441 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-03-29 10:44:58,441 [root] DEBUG: Initialized auxiliary module "Browser"
2026-03-29 10:44:58,441 [root] DEBUG: attempting to configure 'Browser' from data
2026-03-29 10:44:58,457 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-03-29 10:44:58,457 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-03-29 10:44:58,457 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-03-29 10:44:58,457 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-03-29 10:44:58,472 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-03-29 10:44:58,472 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-03-29 10:44:58,472 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-03-29 10:44:58,472 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature
2026-03-29 10:45:00,910 [modules.auxiliary.digisig] DEBUG: File is not signed
2026-03-29 10:45:00,910 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2026-03-29 10:45:00,910 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-03-29 10:45:00,910 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-03-29 10:45:00,910 [root] DEBUG: attempting to configure 'Disguise' from data
2026-03-29 10:45:00,910 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-03-29 10:45:00,926 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-03-29 10:45:00,973 [modules.auxiliary.disguise] INFO: Disguising GUID to b9542fba-9de4-47ef-a7fe-7f63f9768db5
2026-03-29 10:45:00,973 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-03-29 10:45:00,973 [root] DEBUG: Initialized auxiliary module "Human"
2026-03-29 10:45:00,973 [root] DEBUG: attempting to configure 'Human' from data
2026-03-29 10:45:00,973 [root] DEBUG: module Human does not support data configuration, ignoring
2026-03-29 10:45:00,973 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-03-29 10:45:00,988 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-03-29 10:45:00,988 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-03-29 10:45:00,988 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-03-29 10:45:01,004 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-03-29 10:45:01,004 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-03-29 10:45:01,098 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-03-29 10:45:01,098 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-03-29 10:45:01,098 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-03-29 10:45:01,098 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-03-29 10:45:01,098 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-03-29 10:45:01,222 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 644
2026-03-29 10:45:01,379 [lib.api.process] INFO: Monitor config for <Process 644 lsass.exe>: C:\r4q0i2l_\dll\644.ini
2026-03-29 10:45:01,379 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2026-03-29 10:45:01,660 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:45:01,941 [root] DEBUG: Loader: Injecting process 644 with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:45:02,926 [root] DEBUG: 644: Python path set to 'C:\Python310'.
2026-03-29 10:45:03,144 [root] DEBUG: 644: Disabling sleep skipping.
2026-03-29 10:45:03,144 [root] DEBUG: 644: TLS secret dump mode enabled.
2026-03-29 10:45:10,691 [root] DEBUG: 644: Yara error: Scanning timed out
2026-03-29 10:45:10,707 [root] DEBUG: 644: Monitor initialised: 64-bit capemon loaded in process 644 at 0x00007FFEABE20000, thread 2800, image base 0x00007FF7C23E0000, stack from 0x0000008E4CB72000-0x0000008E4CB80000
2026-03-29 10:45:10,722 [root] DEBUG: 644: Commandline: C:\Windows\system32\lsass.exe
2026-03-29 10:45:10,754 [root] DEBUG: 644: Hooked 5 out of 5 functions
2026-03-29 10:45:10,754 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-03-29 10:45:10,769 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:45:10,769 [lib.api.process] INFO: Injected into 64-bit <Process 644 lsass.exe>
2026-03-29 10:45:10,769 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-03-29 10:45:15,676 [root] DEBUG: 644: TLS 1.2 secrets logged to: C:\QpXCaNVtFy\tlsdump\tlsdump.log
2026-03-29 10:45:35,879 [root] INFO: Restarting WMI Service
2026-03-29 10:45:38,004 [root] DEBUG: package modules.packages.vbs does not support configure, ignoring
2026-03-29 10:45:38,004 [root] WARNING: configuration error for package modules.packages.vbs: error importing data.packages.vbs: No module named 'data.packages'
2026-03-29 10:45:38,004 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation
2026-03-29 10:45:38,551 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\wscript.exe" with arguments ""C:\Users\cape\AppData\Local\Temp\rknrl_1_.vbs"" with pid 5384
2026-03-29 10:45:38,551 [lib.api.process] INFO: Monitor config for <Process 5384 wscript.exe>: C:\r4q0i2l_\dll\5384.ini
2026-03-29 10:45:38,566 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:45:39,176 [root] DEBUG: Loader: Injecting process 5384 (thread 6328) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:39,332 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:45:39,332 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:39,332 [lib.api.process] INFO: Injected into 32-bit <Process 5384 wscript.exe>
2026-03-29 10:45:41,348 [lib.api.process] INFO: Successfully resumed <Process 5384 wscript.exe>
2026-03-29 10:45:42,441 [root] DEBUG: 5384: Python path set to 'C:\Python310'.
2026-03-29 10:45:42,473 [root] DEBUG: 5384: Disabling sleep skipping.
2026-03-29 10:45:42,473 [root] DEBUG: 5384: Dropped file limit defaulting to 100.
2026-03-29 10:45:42,504 [root] DEBUG: 5384: wscript hook set enabled
2026-03-29 10:45:42,535 [root] DEBUG: 5384: YaraInit: Compiled 44 rule files
2026-03-29 10:45:42,551 [root] DEBUG: 5384: YaraInit: Compiled rules saved to file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:45:42,566 [root] DEBUG: 5384: YaraScan: Scanning 0x00D50000, size 0x26996
2026-03-29 10:45:42,566 [root] DEBUG: 5384: Monitor initialised: 32-bit capemon loaded in process 5384 at 0x73f00000, thread 6328, image base 0xd50000, stack from 0x4f2000-0x500000
2026-03-29 10:45:42,566 [root] DEBUG: 5384: Commandline: "C:\Windows\system32\wscript.exe" "C:\Users\cape\AppData\Local\Temp\rknrl_1_.vbs"
2026-03-29 10:45:43,660 [root] DEBUG: 5384: Yara error: Scanning timed out
2026-03-29 10:45:44,301 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:45:44,301 [root] DEBUG: 5384: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:45:44,316 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:45:44,316 [root] DEBUG: 5384: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:45:44,832 [root] DEBUG: 5384: Hooked 630 out of 632 functions
2026-03-29 10:45:44,847 [root] DEBUG: 5384: Syscall hook installed, syscall logging level 1
2026-03-29 10:45:44,863 [root] DEBUG: 5384: RestoreHeaders: Restored original import table.
2026-03-29 10:45:44,863 [root] INFO: Loaded monitor into process with pid 5384
2026-03-29 10:45:44,863 [root] DEBUG: 5384: caller_dispatch: Added region at 0x00D50000 to tracked regions list (ntdll::NtQueryLicenseValue returns to 0x00D6539F, thread 6328).
2026-03-29 10:45:44,863 [root] DEBUG: 5384: YaraScan: Scanning 0x00D50000, size 0x26996
2026-03-29 10:45:44,879 [root] DEBUG: 5384: ProcessImageBase: Main module image at 0x00D50000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:45:45,551 [root] DEBUG: 5384: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 6328).
2026-03-29 10:45:45,566 [root] DEBUG: 5384: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:45:45,582 [root] DEBUG: 5384: set_hooks_by_export_directory: Hooked 0 out of 632 functions
2026-03-29 10:45:45,582 [root] DEBUG: 5384: DLL loaded at 0x75250000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-03-29 10:45:45,598 [root] DEBUG: 5384: DLL loaded at 0x76D80000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-03-29 10:45:45,598 [root] DEBUG: 5384: DLL loaded at 0x745D0000: C:\Windows\system32\uxtheme (0x74000 bytes).
2026-03-29 10:45:45,926 [root] DEBUG: 5384: DLL loaded at 0x73E70000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-03-29 10:45:46,332 [root] DEBUG: 5384: DLL loaded at 0x76BA0000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-03-29 10:45:46,488 [root] DEBUG: 5384: DLL loaded at 0x77400000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-03-29 10:45:47,176 [root] DEBUG: 5384: DLL loaded at 0x73DE0000: C:\Windows\System32\vbscript (0x86000 bytes).
2026-03-29 10:45:47,332 [root] DEBUG: 5384: DLL loaded at 0x73DC0000: C:\Windows\SYSTEM32\amsi (0x19000 bytes).
2026-03-29 10:45:47,347 [root] DEBUG: 5384: DEBUG:Initialized 9 com hooks
2026-03-29 10:45:47,504 [root] DEBUG: 5384: DLL loaded at 0x756D0000: C:\Windows\SYSTEM32\WLDP (0x27000 bytes).
2026-03-29 10:45:47,644 [root] DEBUG: 5384: DLL loaded at 0x77DD0000: C:\Windows\System32\WINTRUST (0x4e000 bytes).
2026-03-29 10:45:47,644 [root] DEBUG: 5384: DLL loaded at 0x73DB0000: C:\Windows\System32\MSASN1 (0xe000 bytes).
2026-03-29 10:45:47,660 [root] DEBUG: 5384: DLL loaded at 0x75280000: C:\Windows\System32\CRYPTSP (0x13000 bytes).
2026-03-29 10:45:47,660 [root] DEBUG: 5384: DLL loaded at 0x74C10000: C:\Windows\system32\rsaenh (0x2f000 bytes).
2026-03-29 10:45:47,660 [root] DEBUG: 5384: DLL loaded at 0x73DA0000: C:\Windows\System32\MSISIP (0x10000 bytes).
2026-03-29 10:45:47,676 [root] DEBUG: 5384: DLL loaded at 0x77590000: C:\Windows\System32\SHELL32 (0x5b5000 bytes).
2026-03-29 10:45:47,676 [root] DEBUG: 5384: DLL loaded at 0x73D80000: C:\Windows\System32\wshext (0x18000 bytes).
2026-03-29 10:45:47,769 [root] DEBUG: 5384: DLL loaded at 0x73D40000: C:\Windows\System32\scrobj (0x36000 bytes).
2026-03-29 10:45:47,941 [root] DEBUG: 5384: DLL loaded at 0x73BF0000: C:\Windows\System32\msxml3 (0x14f000 bytes).
2026-03-29 10:45:52,379 [root] DEBUG: 5384: api-cap: VbsMid hook disabled due to count: 5000
2026-03-29 10:45:52,394 [root] DEBUG: 5384: api-rate-cap: VbsInStr hook disabled due to rate
2026-03-29 10:45:52,972 [root] DEBUG: 5384: api-cap: VbsChr hook disabled due to count: 5000
2026-03-29 10:45:52,988 [root] DEBUG: 5384: api-cap: VbsMidB hook disabled due to count: 5000
2026-03-29 10:45:52,988 [root] DEBUG: 5384: api-cap: VbsAscB hook disabled due to count: 5000
2026-03-29 10:45:53,347 [root] DEBUG: 5384: DLL loaded at 0x73BA0000: C:\Windows\System32\MPR (0x19000 bytes).
2026-03-29 10:45:53,347 [root] DEBUG: 5384: DLL loaded at 0x73B70000: C:\Windows\System32\ScrRun (0x30000 bytes).
2026-03-29 10:45:53,347 [root] DEBUG: 5384: DLL loaded at 0x73BC0000: C:\Windows\System32\wshom.ocx (0x23000 bytes).
2026-03-29 10:45:53,394 [root] DEBUG: 5384: DLL loaded at 0x75700000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes).
2026-03-29 10:45:53,410 [root] DEBUG: 5384: DLL loaded at 0x76F70000: C:\Windows\System32\SHCORE (0x87000 bytes).
2026-03-29 10:45:53,441 [root] DEBUG: 5384: DLL loaded at 0x73AA0000: C:\Windows\system32\propsys (0xc2000 bytes).
2026-03-29 10:45:53,707 [root] DEBUG: 5384: DLL loaded at 0x77480000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes).
2026-03-29 10:45:53,832 [root] DEBUG: 5384: DLL loaded at 0x75260000: C:\Windows\System32\profapi (0x18000 bytes).
2026-03-29 10:45:54,316 [root] DEBUG: 5384: DLL loaded at 0x73A80000: C:\Windows\System32\edputil (0x1b000 bytes).
2026-03-29 10:45:54,332 [lib.api.process] INFO: Monitor config for <Process 752 svchost.exe>: C:\r4q0i2l_\dll\752.ini
2026-03-29 10:45:54,332 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:45:54,363 [root] DEBUG: Loader: Injecting process 752 with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:45:54,363 [root] DEBUG: 752: Python path set to 'C:\Python310'.
2026-03-29 10:45:54,379 [root] DEBUG: 752: Disabling sleep skipping.
2026-03-29 10:45:54,379 [root] DEBUG: 752: Dropped file limit defaulting to 100.
2026-03-29 10:45:54,379 [root] DEBUG: 752: Services hook set enabled
2026-03-29 10:45:54,379 [root] DEBUG: 752: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:45:54,504 [root] DEBUG: 752: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:45:54,520 [root] DEBUG: 752: Monitor initialised: 64-bit capemon loaded in process 752 at 0x00007FFEABE20000, thread 4468, image base 0x00007FF7AB6E0000, stack from 0x000000AE373F4000-0x000000AE37400000
2026-03-29 10:45:54,520 [root] DEBUG: 752: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-03-29 10:45:54,583 [root] DEBUG: 752: Hooked 69 out of 69 functions
2026-03-29 10:45:54,598 [root] INFO: Loaded monitor into process with pid 752
2026-03-29 10:45:54,598 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-03-29 10:45:54,598 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:45:54,679 [lib.api.process] INFO: Injected into 64-bit <Process 752 svchost.exe>
2026-03-29 10:45:54,879 [root] INFO: Announced starting service "b'edgeupdate'"
2026-03-29 10:45:54,879 [lib.api.process] INFO: Monitor config for <Process 632 services.exe>: C:\r4q0i2l_\dll\632.ini
2026-03-29 10:45:55,004 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:45:55,019 [root] DEBUG: Loader: Injecting process 632 with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:45:55,019 [root] DEBUG: Loader: Copied config file C:\r4q0i2l_\dll\632.ini to system path C:\632.ini
2026-03-29 10:45:55,098 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 632 C:\r4q0i2l_\dll\NSVfWPk.dll
2026-03-29 10:45:55,098 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:45:55,113 [lib.api.process] INFO: Injected into 64-bit <Process 632 services.exe>
2026-03-29 10:45:56,801 [root] DEBUG: 5384: DLL loaded at 0x739E0000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2026-03-29 10:45:57,082 [root] DEBUG: 5384: DLL loaded at 0x73600000: C:\Windows\System32\iertutil (0x22d000 bytes).
2026-03-29 10:45:57,097 [root] DEBUG: 5384: DLL loaded at 0x735E0000: C:\Windows\System32\srvcli (0x1d000 bytes).
2026-03-29 10:45:57,097 [root] DEBUG: 5384: DLL loaded at 0x75440000: C:\Windows\System32\netutils (0xb000 bytes).
2026-03-29 10:45:57,129 [root] DEBUG: 5384: DLL loaded at 0x73830000: C:\Windows\System32\urlmon (0x1a8000 bytes).
2026-03-29 10:45:57,394 [root] DEBUG: 5384: DLL loaded at 0x734A0000: C:\Windows\System32\wintypes (0xdb000 bytes).
2026-03-29 10:45:57,629 [root] DEBUG: 5384: DLL loaded at 0x733D0000: C:\Windows\System32\Bcp47Langs (0x48000 bytes).
2026-03-29 10:45:57,629 [root] DEBUG: 5384: DLL loaded at 0x73360000: C:\Windows\System32\sppc (0x1c000 bytes).
2026-03-29 10:45:57,629 [root] DEBUG: 5384: DLL loaded at 0x733B0000: C:\Windows\System32\SLC (0x1f000 bytes).
2026-03-29 10:45:57,644 [root] DEBUG: 5384: DLL loaded at 0x73380000: C:\Windows\System32\USERENV (0x25000 bytes).
2026-03-29 10:45:57,644 [root] DEBUG: 5384: DLL loaded at 0x73420000: C:\Windows\System32\appresolver (0x71000 bytes).
2026-03-29 10:45:57,832 [root] DEBUG: 5384: DLL loaded at 0x73320000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2026-03-29 10:45:57,910 [root] DEBUG: 5384: DLL loaded at 0x72F10000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes).
2026-03-29 10:45:57,941 [root] DEBUG: 5384: CreateProcessHandler: Injection info set for new process 4480: C:\Windows\System32\cmd.exe, ImageBase: 0x00610000
2026-03-29 10:45:57,941 [root] INFO: Announced 32-bit process name: cmd.exe pid: 4480
2026-03-29 10:45:57,941 [lib.api.process] INFO: Monitor config for <Process 4480 cmd.exe>: C:\r4q0i2l_\dll\4480.ini
2026-03-29 10:45:57,957 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:45:57,972 [root] DEBUG: Loader: Injecting process 4480 (thread 3256) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:57,972 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:45:57,988 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:57,988 [lib.api.process] INFO: Injected into 32-bit <Process 4480 cmd.exe>
2026-03-29 10:45:58,004 [root] DEBUG: 5384: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:45:58,004 [root] INFO: Announced 32-bit process name: cmd.exe pid: 4480
2026-03-29 10:45:58,019 [lib.api.process] INFO: Monitor config for <Process 4480 cmd.exe>: C:\r4q0i2l_\dll\4480.ini
2026-03-29 10:45:58,019 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:45:58,051 [root] DEBUG: Loader: Injecting process 4480 (thread 3256) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:58,051 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:45:58,051 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:58,066 [lib.api.process] INFO: Injected into 32-bit <Process 4480 cmd.exe>
2026-03-29 10:45:58,223 [root] DEBUG: 4480: Python path set to 'C:\Python310'.
2026-03-29 10:45:58,223 [root] DEBUG: 4480: Dropped file limit defaulting to 100.
2026-03-29 10:45:58,238 [root] DEBUG: 4480: Disabling sleep skipping.
2026-03-29 10:45:58,238 [root] DEBUG: 4480: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:45:58,254 [root] DEBUG: 4480: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:45:58,254 [root] DEBUG: 4480: YaraScan hit: FindFixAndRun
2026-03-29 10:45:58,269 [root] DEBUG: 4480: Monitor initialised: 32-bit capemon loaded in process 4480 at 0x73f00000, thread 3256, image base 0x610000, stack from 0x2a63000-0x2b60000
2026-03-29 10:45:58,269 [root] DEBUG: 4480: Commandline: "C:\Windows\System32\cmd.exe" /c regedit /s /q C:\Users\cape\AppData\Local\Temp\rknrl.reg
2026-03-29 10:45:58,363 [root] DEBUG: 4480: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:45:58,410 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:45:58,426 [root] DEBUG: 4480: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:45:58,426 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:45:58,426 [root] DEBUG: 4480: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:45:58,441 [root] DEBUG: 4480: Hooked 630 out of 632 functions
2026-03-29 10:45:58,457 [root] DEBUG: 4480: set_hooks_exe: Hooked FindFixAndRun at 0x0061AD60
2026-03-29 10:45:58,457 [root] DEBUG: 4480: Syscall hook installed, syscall logging level 1
2026-03-29 10:45:58,472 [root] DEBUG: 4480: RestoreHeaders: Restored original import table.
2026-03-29 10:45:58,472 [root] INFO: Loaded monitor into process with pid 4480
2026-03-29 10:45:58,488 [root] DEBUG: 4480: caller_dispatch: Added region at 0x00610000 to tracked regions list (ntdll::NtOpenThread returns to 0x006209DE, thread 3256).
2026-03-29 10:45:58,488 [root] DEBUG: 4480: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:45:58,488 [root] DEBUG: 4480: ProcessImageBase: Main module image at 0x00610000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:45:58,535 [root] DEBUG: 4480: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 3256).
2026-03-29 10:45:58,551 [root] DEBUG: 4480: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:45:58,707 [root] DEBUG: 4480: CreateProcessHandler: Injection info set for new process 4652: C:\Windows\system32\regedit.exe, ImageBase: 0x00010000
2026-03-29 10:45:58,707 [root] INFO: Announced 32-bit process name: regedit.exe pid: 4652
2026-03-29 10:45:58,707 [lib.api.process] INFO: Monitor config for <Process 4652 regedit.exe>: C:\r4q0i2l_\dll\4652.ini
2026-03-29 10:45:58,723 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:45:58,754 [root] DEBUG: Loader: Injecting process 4652 (thread 5160) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:58,769 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:45:58,769 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:45:58,785 [lib.api.process] INFO: Injected into 32-bit <Process 4652 regedit.exe>
2026-03-29 10:45:58,816 [root] DEBUG: 4480: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:45:59,019 [root] DEBUG: 4652: Python path set to 'C:\Python310'.
2026-03-29 10:45:59,035 [root] DEBUG: 4652: Dropped file limit defaulting to 100.
2026-03-29 10:45:59,035 [root] DEBUG: 4652: Disabling sleep skipping.
2026-03-29 10:45:59,051 [root] DEBUG: 4652: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:45:59,051 [root] DEBUG: 4652: YaraScan: Scanning 0x00010000, size 0x96302
2026-03-29 10:45:59,066 [root] DEBUG: 4652: Monitor initialised: 32-bit capemon loaded in process 4652 at 0x73f00000, thread 5160, image base 0x10000, stack from 0x2fd5000-0x2fe0000
2026-03-29 10:45:59,066 [root] DEBUG: 4652: Commandline: regedit /s /q C:\Users\cape\AppData\Local\Temp\rknrl.reg
2026-03-29 10:45:59,129 [root] DEBUG: 4652: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:45:59,176 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:45:59,176 [root] DEBUG: 4652: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:45:59,191 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:45:59,191 [root] DEBUG: 4652: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:45:59,223 [root] DEBUG: 4652: Hooked 630 out of 632 functions
2026-03-29 10:45:59,223 [root] DEBUG: 4652: Syscall hook installed, syscall logging level 1
2026-03-29 10:45:59,238 [root] DEBUG: 4652: RestoreHeaders: Restored original import table.
2026-03-29 10:45:59,238 [root] INFO: Loaded monitor into process with pid 4652
2026-03-29 10:45:59,269 [root] DEBUG: 4652: InstrumentationCallback: Added region at 0x76AD24AC (base 0x76AB0000) to tracked regions list (thread 5160).
2026-03-29 10:45:59,285 [root] DEBUG: 4652: ProcessTrackedRegion: Region at 0x76AB0000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-03-29 10:45:59,379 [root] DEBUG: 4652: ProcessTrackedRegion: Region at 0x76AB0000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-03-29 10:45:59,472 [root] DEBUG: 4652: ProcessTrackedRegion: Region at 0x76AB0000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-03-29 10:45:59,519 [root] DEBUG: 4652: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 5160).
2026-03-29 10:45:59,519 [root] DEBUG: 4652: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:45:59,551 [root] DEBUG: 4652: NtTerminateProcess hook: Attempting to dump process 4652
2026-03-29 10:45:59,551 [root] DEBUG: 4652: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:45:59,676 [root] INFO: Process with pid 4652 has terminated
2026-03-29 10:45:59,691 [root] INFO: Process with pid 4652 appears to have terminated
2026-03-29 10:45:59,785 [root] DEBUG: 4480: NtTerminateProcess hook: Attempting to dump process 4480
2026-03-29 10:45:59,816 [root] DEBUG: 4480: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:45:59,848 [root] DEBUG: 4480: DoProcessDump: Code modification detected, dumping Imagebase at 0x00610000.
2026-03-29 10:45:59,863 [root] DEBUG: 4480: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:45:59,879 [root] DEBUG: 4480: DumpProcess: Instantiating PeParser with address: 0x00610000.
2026-03-29 10:45:59,879 [root] DEBUG: 4480: DumpProcess: Module entry point VA is 0x00626B20.
2026-03-29 10:45:59,988 [lib.common.results] INFO: Uploading file C:\QpXCaNVtFy\CAPE\4480_146798785945729032026 to procdump\999fb03eb3e67cb7820112d132784b074e48891917b608bad7b505e2a289880d; Size is 346624; Max size: 100000000
2026-03-29 10:46:00,019 [root] DEBUG: 4480: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:46:00,051 [root] INFO: Process with pid 4480 has terminated
2026-03-29 10:46:02,691 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 6868: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 10:46:02,707 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 6868
2026-03-29 10:46:02,707 [lib.api.process] INFO: Monitor config for <Process 6868 dllhost.exe>: C:\r4q0i2l_\dll\6868.ini
2026-03-29 10:46:02,723 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:02,816 [root] DEBUG: Loader: Injecting process 6868 (thread 5268) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:02,832 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:02,832 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:02,848 [lib.api.process] INFO: Injected into 64-bit <Process 6868 dllhost.exe>
2026-03-29 10:46:02,848 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 6868
2026-03-29 10:46:02,848 [lib.api.process] INFO: Monitor config for <Process 6868 dllhost.exe>: C:\r4q0i2l_\dll\6868.ini
2026-03-29 10:46:02,863 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:02,894 [root] DEBUG: Loader: Injecting process 6868 (thread 5268) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:02,894 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:02,910 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:02,926 [lib.api.process] INFO: Injected into 64-bit <Process 6868 dllhost.exe>
2026-03-29 10:46:03,035 [root] DEBUG: 6868: Python path set to 'C:\Python310'.
2026-03-29 10:46:03,051 [root] DEBUG: 6868: Dropped file limit defaulting to 100.
2026-03-29 10:46:03,191 [root] DEBUG: 5384: DLL loaded at 0x732F0000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-03-29 10:46:03,191 [root] DEBUG: 6868: Disabling sleep skipping.
2026-03-29 10:46:03,207 [root] DEBUG: 6868: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:03,348 [root] DEBUG: 6868: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:46:03,410 [root] DEBUG: 6868: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 10:46:03,457 [root] DEBUG: 6868: Monitor initialised: 64-bit capemon loaded in process 6868 at 0x00007FFEABE20000, thread 5268, image base 0x00007FF6F2810000, stack from 0x0000005EE1AF4000-0x0000005EE1B00000
2026-03-29 10:46:03,535 [root] DEBUG: 6868: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AA65DD7C-83AC-48C0-A6FD-9B61FEBF8800}
2026-03-29 10:46:03,629 [root] DEBUG: 6868: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:46:03,863 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:46:03,957 [root] DEBUG: 6868: set_hooks: Unable to hook LockResource
2026-03-29 10:46:04,004 [root] DEBUG: 6868: Hooked 627 out of 628 functions
2026-03-29 10:46:04,035 [root] DEBUG: 6868: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:04,129 [root] DEBUG: 6868: RestoreHeaders: Restored original import table.
2026-03-29 10:46:04,129 [root] INFO: Loaded monitor into process with pid 6868
2026-03-29 10:46:04,129 [root] DEBUG: 6868: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28112F2, thread 5268).
2026-03-29 10:46:04,144 [root] DEBUG: 6868: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 10:46:04,144 [root] DEBUG: 6868: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:04,160 [root] DEBUG: 6868: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:46:04,191 [root] DEBUG: 6868: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:46:04,316 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:46:04,348 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:46:04,348 [root] DEBUG: 5384: CreateProcessHandler: Injection info set for new process 452: C:\Users\cape\AppData\Local\Temp\explorer.exe, ImageBase: 0x00DC0000
2026-03-29 10:46:04,363 [root] INFO: Announced 32-bit process name: explorer.exe pid: 452
2026-03-29 10:46:04,363 [lib.api.process] INFO: Monitor config for <Process 452 explorer.exe>: C:\r4q0i2l_\dll\452.ini
2026-03-29 10:46:04,394 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:04,519 [root] DEBUG: Loader: Injecting process 452 (thread 2772) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:04,535 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:04,566 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:04,613 [lib.api.process] INFO: Injected into 32-bit <Process 452 explorer.exe>
2026-03-29 10:46:04,613 [root] DEBUG: 6868: DEBUG:Initialized 9 com hooks
2026-03-29 10:46:04,660 [root] DEBUG: 5384: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:04,691 [root] DEBUG: 5384: DLL loaded at 0x750B0000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-03-29 10:46:04,707 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFB470000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-03-29 10:46:04,707 [root] INFO: Announced 32-bit process name: explorer.exe pid: 452
2026-03-29 10:46:04,707 [lib.api.process] INFO: Monitor config for <Process 452 explorer.exe>: C:\r4q0i2l_\dll\452.ini
2026-03-29 10:46:04,722 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFB390000: C:\Windows\system32\netutils (0xc000 bytes).
2026-03-29 10:46:04,722 [root] DEBUG: 6868: DLL loaded at 0x00007FFEF5F10000: C:\Windows\system32\dhcpcsvc (0x1d000 bytes).
2026-03-29 10:46:04,738 [root] DEBUG: 6868: DLL loaded at 0x00007FFEF5C20000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-03-29 10:46:04,754 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:46:04,754 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:46:04,785 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:04,785 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFB350000: C:\Windows\system32\IPHLPAPI (0x3b000 bytes).
2026-03-29 10:46:04,832 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFBE70000: C:\Windows\system32\USERENV (0x2e000 bytes).
2026-03-29 10:46:04,832 [root] DEBUG: Loader: Injecting process 452 (thread 2772) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:04,848 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFBEB0000: C:\Windows\system32\profapi (0x1f000 bytes).
2026-03-29 10:46:04,848 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:46:04,898 [root] DEBUG: 6868: DLL loaded at 0x00007FFEF60C0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-03-29 10:46:04,910 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:04,910 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFB3A0000: C:\Windows\system32\DNSAPI (0xca000 bytes).
2026-03-29 10:46:04,926 [lib.api.process] INFO: Injected into 32-bit <Process 452 explorer.exe>
2026-03-29 10:46:04,941 [root] DEBUG: 6868: DLL loaded at 0x00007FFEEF070000: C:\Windows\system32\domgmt (0x7e000 bytes).
2026-03-29 10:46:05,019 [root] DEBUG: 5384: NtTerminateProcess hook: Attempting to dump process 5384
2026-03-29 10:46:05,019 [root] DEBUG: 5384: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:05,035 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFE580000: C:\Windows\System32\NSI (0x8000 bytes).
2026-03-29 10:46:05,035 [root] DEBUG: 452: Python path set to 'C:\Python310'.
2026-03-29 10:46:05,051 [root] DEBUG: 452: Dropped file limit defaulting to 100.
2026-03-29 10:46:05,066 [root] INFO: Process with pid 5384 has terminated
2026-03-29 10:46:05,082 [root] DEBUG: 452: Disabling sleep skipping.
2026-03-29 10:46:05,160 [root] DEBUG: 452: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:05,207 [root] DEBUG: 6868: DLL loaded at 0x00007FFEEA210000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-03-29 10:46:05,254 [root] DEBUG: 452: YaraScan: Scanning 0x00DC0000, size 0x26996
2026-03-29 10:46:05,254 [root] DEBUG: 452: Monitor initialised: 32-bit capemon loaded in process 452 at 0x73f00000, thread 2772, image base 0xdc0000, stack from 0x3135000-0x3140000
2026-03-29 10:46:05,269 [root] DEBUG: 452: Commandline: "C:\Users\cape\AppData\Local\Temp\explorer.exe" //B "C:\Users\cape\AppData\Local\Temp\winstart.vbs"
2026-03-29 10:46:05,410 [root] DEBUG: 452: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:05,490 [root] DEBUG: 6868: DLL loaded at 0x00007FFEFB070000: C:\Windows\system32\msvcp110_win (0x8a000 bytes).
2026-03-29 10:46:05,535 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:05,551 [root] DEBUG: 452: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:05,551 [root] DEBUG: 6868: DLL loaded at 0x00007FFEF6370000: C:\Windows\SYSTEM32\policymanager (0xa0000 bytes).
2026-03-29 10:46:05,566 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:05,566 [root] DEBUG: 452: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:05,629 [root] DEBUG: 452: Hooked 630 out of 632 functions
2026-03-29 10:46:05,644 [root] DEBUG: 452: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:05,660 [root] DEBUG: 452: RestoreHeaders: Restored original import table.
2026-03-29 10:46:05,660 [root] INFO: Loaded monitor into process with pid 452
2026-03-29 10:46:05,676 [root] DEBUG: 452: caller_dispatch: Added region at 0x00DC0000 to tracked regions list (ntdll::NtQueryLicenseValue returns to 0x00DD539F, thread 2772).
2026-03-29 10:46:05,676 [root] DEBUG: 452: YaraScan: Scanning 0x00DC0000, size 0x26996
2026-03-29 10:46:05,691 [root] DEBUG: 452: ProcessImageBase: Main module image at 0x00DC0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:05,707 [root] DEBUG: 452: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 2772).
2026-03-29 10:46:05,723 [root] DEBUG: 452: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:05,769 [root] DEBUG: 452: set_hooks_by_export_directory: Hooked 0 out of 632 functions
2026-03-29 10:46:05,785 [root] DEBUG: 452: DLL loaded at 0x75250000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-03-29 10:46:05,801 [root] DEBUG: 452: DLL loaded at 0x76D80000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-03-29 10:46:05,832 [root] DEBUG: 452: DLL loaded at 0x745D0000: C:\Windows\system32\uxtheme (0x74000 bytes).
2026-03-29 10:46:06,004 [root] DEBUG: 452: DLL loaded at 0x73E70000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-03-29 10:46:06,019 [root] DEBUG: 452: DLL loaded at 0x76BA0000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-03-29 10:46:06,066 [root] DEBUG: 452: DLL loaded at 0x77400000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-03-29 10:46:06,144 [root] DEBUG: 452: DLL loaded at 0x73DE0000: C:\Windows\System32\vbscript (0x86000 bytes).
2026-03-29 10:46:06,160 [root] DEBUG: 452: DLL loaded at 0x73DC0000: C:\Windows\SYSTEM32\amsi (0x19000 bytes).
2026-03-29 10:46:06,160 [root] DEBUG: 452: DEBUG:Initialized 9 com hooks
2026-03-29 10:46:06,176 [root] DEBUG: 452: DLL loaded at 0x756D0000: C:\Windows\SYSTEM32\WLDP (0x27000 bytes).
2026-03-29 10:46:06,223 [root] DEBUG: 452: DLL loaded at 0x77DD0000: C:\Windows\System32\WINTRUST (0x4e000 bytes).
2026-03-29 10:46:06,238 [root] DEBUG: 452: DLL loaded at 0x73DB0000: C:\Windows\SYSTEM32\MSASN1 (0xe000 bytes).
2026-03-29 10:46:06,269 [root] DEBUG: 452: DLL loaded at 0x75280000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-03-29 10:46:06,269 [root] DEBUG: 452: DLL loaded at 0x74C10000: C:\Windows\system32\rsaenh (0x2f000 bytes).
2026-03-29 10:46:06,332 [root] DEBUG: 452: DLL loaded at 0x73DA0000: C:\Windows\System32\MSISIP (0x10000 bytes).
2026-03-29 10:46:06,347 [root] DEBUG: 452: DLL loaded at 0x77590000: C:\Windows\System32\SHELL32 (0x5b5000 bytes).
2026-03-29 10:46:06,379 [root] DEBUG: 452: DLL loaded at 0x73D80000: C:\Windows\System32\wshext (0x18000 bytes).
2026-03-29 10:46:06,394 [root] DEBUG: 452: DLL loaded at 0x73D40000: C:\Windows\System32\scrobj (0x36000 bytes).
2026-03-29 10:46:06,426 [root] DEBUG: 452: DLL loaded at 0x73BF0000: C:\Windows\System32\msxml3 (0x14f000 bytes).
2026-03-29 10:46:10,988 [root] INFO: Process with pid 6868 has terminated
2026-03-29 10:46:11,254 [root] DEBUG: 6868: NtTerminateProcess hook: Attempting to dump process 6868
2026-03-29 10:46:11,519 [root] DEBUG: 6868: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:15,785 [root] DEBUG: 452: api-cap: VbsMid hook disabled due to count: 5000
2026-03-29 10:46:16,066 [root] DEBUG: 452: api-rate-cap: VbsInStr hook disabled due to rate
2026-03-29 10:46:18,004 [root] DEBUG: 452: api-cap: VbsChr hook disabled due to count: 5000
2026-03-29 10:46:18,019 [root] DEBUG: 452: api-cap: VbsMidB hook disabled due to count: 5000
2026-03-29 10:46:18,035 [root] DEBUG: 452: api-cap: VbsAscB hook disabled due to count: 5000
2026-03-29 10:46:18,816 [root] DEBUG: 452: DLL loaded at 0x73610000: C:\Windows\System32\MPR (0x19000 bytes).
2026-03-29 10:46:18,848 [root] DEBUG: 452: DLL loaded at 0x735E0000: C:\Windows\System32\ScrRun (0x30000 bytes).
2026-03-29 10:46:18,848 [root] DEBUG: 452: DLL loaded at 0x73630000: C:\Windows\System32\wshom.ocx (0x23000 bytes).
2026-03-29 10:46:18,910 [root] DEBUG: 452: DLL loaded at 0x75700000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes).
2026-03-29 10:46:18,926 [root] DEBUG: 452: DLL loaded at 0x76F70000: C:\Windows\System32\SHCORE (0x87000 bytes).
2026-03-29 10:46:18,941 [root] DEBUG: 452: DLL loaded at 0x73AF0000: C:\Windows\system32\propsys (0xc2000 bytes).
2026-03-29 10:46:18,973 [root] DEBUG: 452: DLL loaded at 0x77480000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes).
2026-03-29 10:46:18,988 [root] DEBUG: 452: DLL loaded at 0x75260000: C:\Windows\SYSTEM32\profapi (0x18000 bytes).
2026-03-29 10:46:19,113 [root] DEBUG: 452: DLL loaded at 0x730A0000: C:\Windows\System32\WININET (0x454000 bytes).
2026-03-29 10:46:19,129 [root] DEBUG: 452: DLL loaded at 0x72E70000: C:\Windows\System32\iertutil (0x22d000 bytes).
2026-03-29 10:46:19,191 [root] DEBUG: 452: DLL loaded at 0x72DC0000: C:\Windows\SYSTEM32\wbemcomn (0x70000 bytes).
2026-03-29 10:46:19,191 [root] DEBUG: 452: DLL loaded at 0x72E30000: C:\Windows\system32\wbem\wbemdisp (0x3f000 bytes).
2026-03-29 10:46:19,223 [root] DEBUG: 452: DLL loaded at 0x72DB0000: C:\Windows\system32\wbem\wbemprox (0xd000 bytes).
2026-03-29 10:46:19,255 [root] DEBUG: 452: DLL loaded at 0x72D90000: C:\Windows\system32\wbem\wmiutils (0x1d000 bytes).
2026-03-29 10:46:19,301 [root] DEBUG: 452: DLL loaded at 0x72D70000: C:\Windows\system32\wbem\wbemsvc (0x10000 bytes).
2026-03-29 10:46:19,394 [root] DEBUG: 452: DLL loaded at 0x72C20000: C:\Windows\system32\wbem\fastprox (0xc9000 bytes).
2026-03-29 10:46:19,582 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 2412: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF7103B0000
2026-03-29 10:46:19,613 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 2412
2026-03-29 10:46:19,613 [lib.api.process] INFO: Monitor config for <Process 2412 SecurityHealthHost.exe>: C:\r4q0i2l_\dll\2412.ini
2026-03-29 10:46:19,644 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:19,691 [root] DEBUG: Loader: Injecting process 2412 (thread 6032) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:19,723 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:19,816 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:20,004 [lib.api.process] INFO: Injected into 64-bit <Process 2412 SecurityHealthHost.exe>
2026-03-29 10:46:20,113 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 2412
2026-03-29 10:46:20,129 [lib.api.process] INFO: Monitor config for <Process 2412 SecurityHealthHost.exe>: C:\r4q0i2l_\dll\2412.ini
2026-03-29 10:46:20,144 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:20,176 [root] DEBUG: Loader: Injecting process 2412 (thread 6032) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:20,191 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:46:20,191 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:20,222 [lib.api.process] INFO: Injected into 64-bit <Process 2412 SecurityHealthHost.exe>
2026-03-29 10:46:20,348 [root] DEBUG: 2412: Python path set to 'C:\Python310'.
2026-03-29 10:46:20,348 [root] DEBUG: 452: DLL loaded at 0x72B60000: C:\Windows\system32\napinsp (0x11000 bytes).
2026-03-29 10:46:20,363 [root] DEBUG: 2412: Dropped file limit defaulting to 100.
2026-03-29 10:46:20,379 [root] DEBUG: 2412: Disabling sleep skipping.
2026-03-29 10:46:20,410 [root] DEBUG: 2412: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:20,426 [root] DEBUG: 452: DLL loaded at 0x72B40000: C:\Windows\system32\pnrpnsp (0x16000 bytes).
2026-03-29 10:46:20,488 [root] DEBUG: 2412: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:46:20,488 [root] DEBUG: 2412: YaraScan: Scanning 0x00007FF7103B0000, size 0x19174
2026-03-29 10:46:20,488 [root] DEBUG: 452: DLL loaded at 0x72B30000: C:\Windows\system32\wshbth (0x10000 bytes).
2026-03-29 10:46:20,504 [root] DEBUG: 2412: Monitor initialised: 64-bit capemon loaded in process 2412 at 0x00007FFEABE20000, thread 6032, image base 0x00007FF7103B0000, stack from 0x0000005567E74000-0x0000005567E80000
2026-03-29 10:46:20,519 [root] DEBUG: 452: DLL loaded at 0x74BB0000: C:\Windows\SYSTEM32\IPHLPAPI (0x32000 bytes).
2026-03-29 10:46:20,519 [root] DEBUG: 2412: Commandline: C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
2026-03-29 10:46:20,551 [root] DEBUG: 452: DLL loaded at 0x72B10000: C:\Windows\system32\NLAapi (0x16000 bytes).
2026-03-29 10:46:20,644 [root] DEBUG: 2412: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:46:20,785 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:46:20,801 [root] DEBUG: 452: DLL loaded at 0x747C0000: C:\Windows\System32\mswsock (0x52000 bytes).
2026-03-29 10:46:20,801 [root] DEBUG: 2412: set_hooks: Unable to hook LockResource
2026-03-29 10:46:20,816 [root] DEBUG: 452: DLL loaded at 0x736D0000: C:\Windows\SYSTEM32\DNSAPI (0x90000 bytes).
2026-03-29 10:46:20,863 [root] DEBUG: 2412: Hooked 627 out of 628 functions
2026-03-29 10:46:20,897 [root] DEBUG: 452: DLL loaded at 0x77E20000: C:\Windows\System32\NSI (0x7000 bytes).
2026-03-29 10:46:20,910 [root] DEBUG: 2412: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:21,051 [root] DEBUG: 2412: RestoreHeaders: Restored original import table.
2026-03-29 10:46:21,097 [root] DEBUG: 452: DLL loaded at 0x72B00000: C:\Windows\System32\winrnr (0xe000 bytes).
2026-03-29 10:46:21,113 [root] INFO: Loaded monitor into process with pid 2412
2026-03-29 10:46:21,176 [root] DEBUG: 452: DLL loaded at 0x73670000: C:\Windows\System32\fwpuclnt (0x59000 bytes).
2026-03-29 10:46:21,223 [root] DEBUG: 2412: caller_dispatch: Added region at 0x00007FF7103B0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF7103BD3B2, thread 6032).
2026-03-29 10:46:21,254 [root] DEBUG: 2412: YaraScan: Scanning 0x00007FF7103B0000, size 0x19174
2026-03-29 10:46:21,269 [root] DEBUG: 452: DLL loaded at 0x73660000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2026-03-29 10:46:21,285 [root] DEBUG: 2412: ProcessImageBase: Main module image at 0x00007FF7103B0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:21,347 [root] DEBUG: 2412: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:46:21,363 [root] DEBUG: 2412: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:46:21,410 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:46:21,426 [root] DEBUG: 2412: DEBUG:Initialized 9 com hooks
2026-03-29 10:46:21,441 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:46:21,597 [root] DEBUG: 452: DLL loaded at 0x72B40000: C:\Windows\system32\mlang (0x34000 bytes).
2026-03-29 10:46:21,613 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFDBE0000: C:\Windows\System32\SHELL32 (0x743000 bytes).
2026-03-29 10:46:21,613 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFB900000: C:\Windows\system32\Wldp (0x30000 bytes).
2026-03-29 10:46:21,629 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:46:21,644 [root] DEBUG: 452: DLL loaded at 0x72970000: C:\Windows\System32\srvcli (0x1d000 bytes).
2026-03-29 10:46:21,644 [root] DEBUG: 2412: DLL loaded at 0x00007FFEEF080000: C:\Windows\system32\SecurityHealthAgent (0x6d000 bytes).
2026-03-29 10:46:21,660 [root] DEBUG: 452: DLL loaded at 0x75440000: C:\Windows\System32\netutils (0xb000 bytes).
2026-03-29 10:46:21,660 [root] DEBUG: 452: DLL loaded at 0x72990000: C:\Windows\System32\urlmon (0x1a8000 bytes).
2026-03-29 10:46:21,773 [root] DEBUG: 2412: DLL loaded at 0x00007FFEECE40000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-03-29 10:46:21,801 [root] DEBUG: 2412: DLL loaded at 0x00007FFEE7170000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2026-03-29 10:46:21,941 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:46:21,941 [root] DEBUG: 452: DLL loaded at 0x72950000: C:\Windows\SYSTEM32\ondemandconnroutehelper (0x12000 bytes).
2026-03-29 10:46:21,957 [root] DEBUG: 2412: DLL loaded at 0x00007FFEF8C40000: C:\Windows\SYSTEM32\wintypes (0x154000 bytes).
2026-03-29 10:46:21,957 [root] DEBUG: 452: DLL loaded at 0x73830000: C:\Windows\SYSTEM32\winhttp (0xc9000 bytes).
2026-03-29 10:46:21,957 [root] DEBUG: 2412: DLL loaded at 0x00007FFEF9CA0000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-03-29 10:46:22,004 [root] DEBUG: 2412: DLL loaded at 0x00007FFEF60C0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-03-29 10:46:22,004 [root] DEBUG: 452: DLL loaded at 0x73760000: C:\Windows\SYSTEM32\WINNSI (0x8000 bytes).
2026-03-29 10:46:22,004 [root] DEBUG: 2412: DLL loaded at 0x00007FFEEF4B0000: C:\Windows\System32\twinapi.appcore (0x200000 bytes).
2026-03-29 10:46:22,066 [root] DEBUG: 2412: DLL loaded at 0x00007FFEE32A0000: C:\Windows\System32\wpnapps (0x156000 bytes).
2026-03-29 10:46:22,113 [root] DEBUG: 2412: DLL loaded at 0x00007FFEF7A20000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-03-29 10:46:22,223 [root] DEBUG: 2412: DLL loaded at 0x00007FFEF09F0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7c9000 bytes).
2026-03-29 10:46:22,254 [root] DEBUG: 2412: DLL loaded at 0x00007FFEE1060000: C:\Windows\System32\ShellCommonCommonProxyStub (0xd0000 bytes).
2026-03-29 10:46:22,519 [root] DEBUG: 2412: DLL loaded at 0x00007FFEFA080000: C:\Windows\SYSTEM32\windows.storage (0x795000 bytes).
2026-03-29 10:46:22,832 [root] DEBUG: 2412: NtTerminateProcess hook: Attempting to dump process 2412
2026-03-29 10:46:22,879 [root] DEBUG: 2412: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:23,004 [root] INFO: Process with pid 2412 has terminated
2026-03-29 10:46:23,035 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4908: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF76BCF0000
2026-03-29 10:46:23,051 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 4908
2026-03-29 10:46:23,066 [lib.api.process] INFO: Monitor config for <Process 4908 ShellExperienceHost.exe>: C:\r4q0i2l_\dll\4908.ini
2026-03-29 10:46:23,519 [root] DEBUG: 452: DLL loaded at 0x72930000: C:\Windows\system32\napinsp (0x11000 bytes).
2026-03-29 10:46:23,519 [root] DEBUG: 452: DLL loaded at 0x72910000: C:\Windows\system32\pnrpnsp (0x16000 bytes).
2026-03-29 10:46:23,535 [root] DEBUG: 452: DLL loaded at 0x72900000: C:\Windows\system32\wshbth (0x10000 bytes).
2026-03-29 10:46:23,551 [root] DEBUG: 452: DLL loaded at 0x728E0000: C:\Windows\system32\NLAapi (0x16000 bytes).
2026-03-29 10:46:23,551 [root] DEBUG: 452: DLL loaded at 0x728D0000: C:\Windows\System32\winrnr (0xe000 bytes).
2026-03-29 10:46:23,566 [root] DEBUG: 452: DLL loaded at 0x73670000: C:\Windows\System32\fwpuclnt (0x59000 bytes).
2026-03-29 10:46:23,894 [root] DEBUG: 452: DLL loaded at 0x728A0000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-03-29 10:46:25,863 [root] DEBUG: 452: DLL loaded at 0x72880000: C:\Windows\SYSTEM32\edputil (0x1b000 bytes).
2026-03-29 10:46:25,926 [root] DEBUG: 452: DLL loaded at 0x727E0000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2026-03-29 10:46:26,035 [root] DEBUG: 452: DLL loaded at 0x72700000: C:\Windows\System32\wintypes (0xdb000 bytes).
2026-03-29 10:46:26,082 [root] DEBUG: 452: DLL loaded at 0x72630000: C:\Windows\System32\Bcp47Langs (0x48000 bytes).
2026-03-29 10:46:26,097 [root] DEBUG: 452: DLL loaded at 0x725F0000: C:\Windows\System32\sppc (0x1c000 bytes).
2026-03-29 10:46:26,097 [root] DEBUG: 452: DLL loaded at 0x72610000: C:\Windows\System32\SLC (0x1f000 bytes).
2026-03-29 10:46:26,113 [root] DEBUG: 452: DLL loaded at 0x73BC0000: C:\Windows\System32\USERENV (0x25000 bytes).
2026-03-29 10:46:26,113 [root] DEBUG: 452: DLL loaded at 0x72680000: C:\Windows\System32\appresolver (0x71000 bytes).
2026-03-29 10:46:26,144 [root] DEBUG: 452: DLL loaded at 0x72B80000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2026-03-29 10:46:26,191 [root] DEBUG: 452: DLL loaded at 0x72230000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes).
2026-03-29 10:46:26,222 [root] DEBUG: 452: CreateProcessHandler: Injection info set for new process 3092: C:\Windows\System32\cmd.exe, ImageBase: 0x00610000
2026-03-29 10:46:26,254 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3092
2026-03-29 10:46:26,254 [lib.api.process] INFO: Monitor config for <Process 3092 cmd.exe>: C:\r4q0i2l_\dll\3092.ini
2026-03-29 10:46:26,285 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:26,348 [root] DEBUG: Loader: Injecting process 3092 (thread 1232) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:26,410 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:26,410 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:26,441 [lib.api.process] INFO: Injected into 32-bit <Process 3092 cmd.exe>
2026-03-29 10:46:26,457 [root] DEBUG: 452: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:26,488 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3092
2026-03-29 10:46:26,488 [lib.api.process] INFO: Monitor config for <Process 3092 cmd.exe>: C:\r4q0i2l_\dll\3092.ini
2026-03-29 10:46:26,535 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:26,582 [root] DEBUG: Loader: Injecting process 3092 (thread 1232) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:26,598 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:46:26,598 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:26,629 [lib.api.process] INFO: Injected into 32-bit <Process 3092 cmd.exe>
2026-03-29 10:46:27,004 [root] DEBUG: 3092: Python path set to 'C:\Python310'.
2026-03-29 10:46:27,019 [root] DEBUG: 452: CreateProcessHandler: Injection info set for new process 6012: C:\Windows\System32\cmd.exe, ImageBase: 0x00610000
2026-03-29 10:46:27,019 [root] DEBUG: 3092: Dropped file limit defaulting to 100.
2026-03-29 10:46:27,035 [root] INFO: Announced 32-bit process name: cmd.exe pid: 6012
2026-03-29 10:46:27,051 [lib.api.process] INFO: Monitor config for <Process 6012 cmd.exe>: C:\r4q0i2l_\dll\6012.ini
2026-03-29 10:46:27,051 [root] DEBUG: 3092: Disabling sleep skipping.
2026-03-29 10:46:27,098 [root] DEBUG: 3092: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:27,113 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:27,176 [root] DEBUG: 3092: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:46:27,223 [root] DEBUG: 3092: YaraScan hit: FindFixAndRun
2026-03-29 10:46:27,223 [root] DEBUG: Loader: Injecting process 6012 (thread 4448) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:27,254 [root] DEBUG: 3092: Monitor initialised: 32-bit capemon loaded in process 3092 at 0x73f00000, thread 1232, image base 0x610000, stack from 0x3203000-0x3300000
2026-03-29 10:46:27,269 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:27,269 [root] DEBUG: 3092: Commandline: "C:\Windows\System32\cmd.exe" /c sc stop RemoteAccess
2026-03-29 10:46:27,285 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:27,457 [lib.api.process] INFO: Injected into 32-bit <Process 6012 cmd.exe>
2026-03-29 10:46:27,488 [root] DEBUG: 3092: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:27,551 [root] DEBUG: 452: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:27,551 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:27,568 [root] INFO: Announced 32-bit process name: cmd.exe pid: 6012
2026-03-29 10:46:27,568 [root] DEBUG: 3092: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:27,582 [lib.api.process] INFO: Monitor config for <Process 6012 cmd.exe>: C:\r4q0i2l_\dll\6012.ini
2026-03-29 10:46:27,582 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:27,582 [root] DEBUG: 3092: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:27,613 [root] DEBUG: 3092: Hooked 630 out of 632 functions
2026-03-29 10:46:27,644 [root] DEBUG: 3092: set_hooks_exe: Hooked FindFixAndRun at 0x0061AD60
2026-03-29 10:46:27,644 [root] DEBUG: 3092: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:27,660 [root] DEBUG: 3092: RestoreHeaders: Restored original import table.
2026-03-29 10:46:27,660 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:27,660 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:27,676 [root] INFO: Loaded monitor into process with pid 3092
2026-03-29 10:46:27,754 [root] DEBUG: Loader: Injecting process 6012 (thread 4448) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:27,769 [root] DEBUG: Loader: Injecting process 4908 (thread 4920) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:27,769 [root] DEBUG: 3092: caller_dispatch: Added region at 0x00610000 to tracked regions list (ntdll::NtOpenThread returns to 0x006209DE, thread 1232).
2026-03-29 10:46:27,785 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:46:27,785 [root] DEBUG: 3092: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:46:27,801 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:27,816 [root] DEBUG: 3092: ProcessImageBase: Main module image at 0x00610000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:27,863 [lib.api.process] INFO: Injected into 32-bit <Process 6012 cmd.exe>
2026-03-29 10:46:27,863 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:28,082 [root] DEBUG: 3092: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 1232).
2026-03-29 10:46:28,097 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:28,191 [root] DEBUG: 3092: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:28,223 [lib.api.process] INFO: Injected into 64-bit <Process 4908 ShellExperienceHost.exe>
2026-03-29 10:46:28,316 [root] DEBUG: 6012: Python path set to 'C:\Python310'.
2026-03-29 10:46:28,316 [root] DEBUG: 3092: CreateProcessHandler: Injection info set for new process 4520: C:\Windows\system32\sc.exe, ImageBase: 0x00D70000
2026-03-29 10:46:28,332 [root] DEBUG: 6012: Dropped file limit defaulting to 100.
2026-03-29 10:46:28,348 [root] DEBUG: 452: CreateProcessHandler: Injection info set for new process 6600: C:\Windows\System32\cmd.exe, ImageBase: 0x00610000
2026-03-29 10:46:28,363 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 4908
2026-03-29 10:46:28,363 [root] INFO: Announced 32-bit process name: sc.exe pid: 4520
2026-03-29 10:46:28,394 [lib.api.process] INFO: Monitor config for <Process 4908 ShellExperienceHost.exe>: C:\r4q0i2l_\dll\4908.ini
2026-03-29 10:46:28,410 [lib.api.process] INFO: Monitor config for <Process 4520 sc.exe>: C:\r4q0i2l_\dll\4520.ini
2026-03-29 10:46:28,410 [root] INFO: Announced 32-bit process name: cmd.exe pid: 6600
2026-03-29 10:46:28,410 [root] DEBUG: 6012: Disabling sleep skipping.
2026-03-29 10:46:28,441 [lib.api.process] INFO: Monitor config for <Process 6600 cmd.exe>: C:\r4q0i2l_\dll\6600.ini
2026-03-29 10:46:28,458 [root] DEBUG: 6012: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:28,491 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:28,491 [root] DEBUG: 6012: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:46:28,504 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:28,566 [root] DEBUG: 6012: YaraScan hit: FindFixAndRun
2026-03-29 10:46:28,613 [root] DEBUG: Loader: Injecting process 4520 (thread 6112) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:28,629 [root] DEBUG: 6012: Monitor initialised: 32-bit capemon loaded in process 6012 at 0x73f00000, thread 4448, image base 0x610000, stack from 0x26b3000-0x27b0000
2026-03-29 10:46:28,629 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:28,644 [root] DEBUG: 6012: Commandline: "C:\Windows\System32\cmd.exe" /c sc config RemoteAccess binpath= "C:\Windows\system32\wscript.exe //B C:\autoexec.vbs" start= auto
2026-03-29 10:46:28,723 [root] DEBUG: Loader: Injecting process 6600 (thread 620) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:28,723 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:28,738 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:28,738 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:28,754 [root] DEBUG: 6012: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:28,769 [lib.api.process] INFO: Injected into 32-bit <Process 4520 sc.exe>
2026-03-29 10:46:28,879 [lib.api.process] INFO: Injected into 32-bit <Process 6600 cmd.exe>
2026-03-29 10:46:28,879 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:28,894 [root] DEBUG: 6012: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:28,972 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:28,988 [root] DEBUG: 3092: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:29,005 [root] DEBUG: 452: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:29,113 [root] DEBUG: 6012: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:29,113 [root] DEBUG: 4520: Python path set to 'C:\Python310'.
2026-03-29 10:46:29,207 [root] INFO: Announced 32-bit process name: cmd.exe pid: 6600
2026-03-29 10:46:29,285 [lib.api.process] INFO: Monitor config for <Process 6600 cmd.exe>: C:\r4q0i2l_\dll\6600.ini
2026-03-29 10:46:29,301 [root] DEBUG: 6012: Hooked 630 out of 632 functions
2026-03-29 10:46:29,301 [root] DEBUG: 4520: Dropped file limit defaulting to 100.
2026-03-29 10:46:29,332 [root] DEBUG: 6012: set_hooks_exe: Hooked FindFixAndRun at 0x0061AD60
2026-03-29 10:46:29,332 [root] DEBUG: 4520: Disabling sleep skipping.
2026-03-29 10:46:29,347 [root] DEBUG: 6012: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:29,363 [root] DEBUG: 4520: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:29,363 [root] DEBUG: 6012: RestoreHeaders: Restored original import table.
2026-03-29 10:46:29,363 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:29,363 [root] DEBUG: 4520: YaraScan: Scanning 0x00D70000, size 0x12a80
2026-03-29 10:46:29,379 [root] INFO: Loaded monitor into process with pid 6012
2026-03-29 10:46:29,457 [root] DEBUG: 4520: Monitor initialised: 32-bit capemon loaded in process 4520 at 0x73f00000, thread 6112, image base 0xd70000, stack from 0x3035000-0x3040000
2026-03-29 10:46:29,457 [root] DEBUG: Loader: Injecting process 6600 (thread 620) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:29,472 [root] DEBUG: 6012: caller_dispatch: Added region at 0x00610000 to tracked regions list (ntdll::NtOpenThread returns to 0x006209DE, thread 4448).
2026-03-29 10:46:29,472 [root] DEBUG: 4520: Commandline: sc stop RemoteAccess
2026-03-29 10:46:29,472 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:46:29,472 [root] DEBUG: 6012: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:46:29,566 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:29,566 [root] DEBUG: 4520: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:29,613 [lib.api.process] INFO: Injected into 32-bit <Process 6600 cmd.exe>
2026-03-29 10:46:29,613 [root] DEBUG: 6012: ProcessImageBase: Main module image at 0x00610000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:29,676 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:29,738 [root] DEBUG: 6012: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 4448).
2026-03-29 10:46:29,754 [root] DEBUG: 4520: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:29,785 [root] DEBUG: 6012: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:29,816 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:29,863 [root] DEBUG: 6012: CreateProcessHandler: Injection info set for new process 1928: C:\Windows\system32\sc.exe, ImageBase: 0x00D70000
2026-03-29 10:46:29,910 [root] DEBUG: 4520: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:30,035 [root] INFO: Announced 32-bit process name: sc.exe pid: 1928
2026-03-29 10:46:30,051 [lib.api.process] INFO: Monitor config for <Process 1928 sc.exe>: C:\r4q0i2l_\dll\1928.ini
2026-03-29 10:46:30,051 [root] DEBUG: 6600: Python path set to 'C:\Python310'.
2026-03-29 10:46:30,082 [root] DEBUG: 6600: Dropped file limit defaulting to 100.
2026-03-29 10:46:30,098 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:30,098 [root] DEBUG: 4520: Hooked 630 out of 632 functions
2026-03-29 10:46:30,285 [root] DEBUG: 4520: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:30,301 [root] DEBUG: 6600: Disabling sleep skipping.
2026-03-29 10:46:30,316 [root] DEBUG: Loader: Injecting process 1928 (thread 1328) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:30,332 [root] DEBUG: 4520: RestoreHeaders: Restored original import table.
2026-03-29 10:46:30,348 [root] DEBUG: 6600: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:30,366 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:30,366 [root] INFO: Loaded monitor into process with pid 4520
2026-03-29 10:46:30,379 [root] DEBUG: 6600: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:46:30,379 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:30,394 [root] DEBUG: 4520: caller_dispatch: Added region at 0x00D70000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00D75DEA, thread 6112).
2026-03-29 10:46:30,410 [root] DEBUG: 6600: YaraScan hit: FindFixAndRun
2026-03-29 10:46:30,410 [lib.api.process] INFO: Injected into 32-bit <Process 1928 sc.exe>
2026-03-29 10:46:30,410 [root] DEBUG: 4520: YaraScan: Scanning 0x00D70000, size 0x12a80
2026-03-29 10:46:30,441 [root] DEBUG: 6600: Monitor initialised: 32-bit capemon loaded in process 6600 at 0x73f00000, thread 620, image base 0x610000, stack from 0x503000-0x600000
2026-03-29 10:46:30,472 [root] DEBUG: 4520: ProcessImageBase: Main module image at 0x00D70000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:30,488 [root] DEBUG: 6012: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:30,566 [root] DEBUG: 6600: Commandline: "C:\Windows\System32\cmd.exe" /c sc start RemoteAccess
2026-03-29 10:46:30,754 [root] DEBUG: 4520: NtTerminateProcess hook: Attempting to dump process 4520
2026-03-29 10:46:30,754 [root] DEBUG: 1928: Python path set to 'C:\Python310'.
2026-03-29 10:46:30,785 [root] DEBUG: 6600: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:30,785 [root] DEBUG: 4520: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:30,847 [root] INFO: Process with pid 4520 has terminated
2026-03-29 10:46:30,832 [root] DEBUG: 1928: Dropped file limit defaulting to 100.
2026-03-29 10:46:30,847 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:30,879 [root] DEBUG: 6600: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:30,879 [root] DEBUG: 3092: NtTerminateProcess hook: Attempting to dump process 3092
2026-03-29 10:46:30,894 [root] DEBUG: 1928: Disabling sleep skipping.
2026-03-29 10:46:30,894 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:30,910 [root] DEBUG: 3092: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:46:30,910 [root] DEBUG: 1928: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:30,926 [root] DEBUG: 6600: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:30,926 [root] DEBUG: 1928: YaraScan: Scanning 0x00D70000, size 0x12a80
2026-03-29 10:46:30,926 [root] DEBUG: 3092: DoProcessDump: Code modification detected, dumping Imagebase at 0x00610000.
2026-03-29 10:46:30,957 [root] DEBUG: 6600: Hooked 630 out of 632 functions
2026-03-29 10:46:30,957 [root] DEBUG: 1928: Monitor initialised: 32-bit capemon loaded in process 1928 at 0x73f00000, thread 1328, image base 0xd70000, stack from 0xaa5000-0xab0000
2026-03-29 10:46:30,972 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:30,988 [root] DEBUG: 3092: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:46:31,004 [root] DEBUG: 6600: set_hooks_exe: Hooked FindFixAndRun at 0x0061AD60
2026-03-29 10:46:31,035 [root] DEBUG: 1928: Commandline: sc config RemoteAccess binpath= "C:\Windows\system32\wscript.exe //B C:\autoexec.vbs" start= auto
2026-03-29 10:46:31,098 [root] DEBUG: 3092: DumpProcess: Instantiating PeParser with address: 0x00610000.
2026-03-29 10:46:31,129 [root] DEBUG: 1928: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:31,207 [root] DEBUG: 6600: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:31,207 [root] DEBUG: 3092: DumpProcess: Module entry point VA is 0x00626B20.
2026-03-29 10:46:31,223 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:31,238 [root] DEBUG: 6600: RestoreHeaders: Restored original import table.
2026-03-29 10:46:31,254 [root] INFO: Loaded monitor into process with pid 6600
2026-03-29 10:46:31,269 [root] DEBUG: 1928: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:31,285 [root] DEBUG: 6600: caller_dispatch: Added region at 0x00610000 to tracked regions list (ntdll::NtOpenThread returns to 0x006209DE, thread 620).
2026-03-29 10:46:31,301 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:31,301 [root] DEBUG: 6600: YaraScan: Scanning 0x00610000, size 0x595ee
2026-03-29 10:46:31,316 [root] DEBUG: 1928: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:31,332 [root] DEBUG: 6600: ProcessImageBase: Main module image at 0x00610000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:31,347 [root] DEBUG: 1928: Hooked 630 out of 632 functions
2026-03-29 10:46:31,394 [root] DEBUG: 1928: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:31,411 [root] DEBUG: 6600: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 620).
2026-03-29 10:46:31,411 [root] DEBUG: 6600: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:31,426 [root] DEBUG: 1928: RestoreHeaders: Restored original import table.
2026-03-29 10:46:31,457 [root] DEBUG: 6600: CreateProcessHandler: Injection info set for new process 812: C:\Windows\system32\sc.exe, ImageBase: 0x00D70000
2026-03-29 10:46:31,457 [root] INFO: Loaded monitor into process with pid 1928
2026-03-29 10:46:31,472 [root] INFO: Announced 32-bit process name: sc.exe pid: 812
2026-03-29 10:46:31,472 [root] DEBUG: 1928: caller_dispatch: Added region at 0x00D70000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00D75DEA, thread 1328).
2026-03-29 10:46:31,472 [lib.api.process] INFO: Monitor config for <Process 812 sc.exe>: C:\r4q0i2l_\dll\812.ini
2026-03-29 10:46:31,504 [root] DEBUG: 1928: YaraScan: Scanning 0x00D70000, size 0x12a80
2026-03-29 10:46:31,504 [root] DEBUG: 1928: ProcessImageBase: Main module image at 0x00D70000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:31,519 [lib.api.process] INFO: 32-bit DLL to inject is C:\r4q0i2l_\dll\mUDtKMG.dll, loader C:\r4q0i2l_\bin\kMBifbc.exe
2026-03-29 10:46:31,551 [root] DEBUG: 1928: NtTerminateProcess hook: Attempting to dump process 1928
2026-03-29 10:46:31,566 [root] DEBUG: 1928: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:31,582 [root] INFO: Process with pid 1928 has terminated
2026-03-29 10:46:31,691 [root] DEBUG: Loader: Injecting process 4908 (thread 4920) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:31,707 [root] DEBUG: Loader: Injecting process 812 (thread 4232) with C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:31,722 [root] DEBUG: 6012: NtTerminateProcess hook: Attempting to dump process 6012
2026-03-29 10:46:31,722 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:31,738 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:46:31,738 [root] DEBUG: 6012: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:46:31,738 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\mUDtKMG.dll.
2026-03-29 10:46:31,754 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:31,754 [root] DEBUG: 6012: DoProcessDump: Code modification detected, dumping Imagebase at 0x00610000.
2026-03-29 10:46:31,832 [lib.api.process] INFO: Injected into 32-bit <Process 812 sc.exe>
2026-03-29 10:46:31,879 [root] DEBUG: 6012: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:46:31,894 [root] DEBUG: 6600: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:46:31,894 [lib.api.process] INFO: Injected into 64-bit <Process 4908 ShellExperienceHost.exe>
2026-03-29 10:46:31,926 [lib.common.results] INFO: Uploading file C:\QpXCaNVtFy\CAPE\3092_276216963146729032026 to procdump\76a8f07c1fc31b8902dfab5c2e4da49b522314375c2c307f4783d769575543e6; Size is 346624; Max size: 100000000
2026-03-29 10:46:32,082 [root] DEBUG: 6012: DumpProcess: Instantiating PeParser with address: 0x00610000.
2026-03-29 10:46:32,176 [root] DEBUG: 812: Python path set to 'C:\Python310'.
2026-03-29 10:46:32,426 [root] DEBUG: 3092: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:46:32,566 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 4908
2026-03-29 10:46:32,707 [root] DEBUG: 812: Dropped file limit defaulting to 100.
2026-03-29 10:46:32,707 [lib.api.process] INFO: Monitor config for <Process 4908 ShellExperienceHost.exe>: C:\r4q0i2l_\dll\4908.ini
2026-03-29 10:46:32,832 [root] INFO: Process with pid 3092 has terminated
2026-03-29 10:46:32,972 [root] DEBUG: 6012: DumpProcess: Module entry point VA is 0x00626B20.
2026-03-29 10:46:33,051 [root] DEBUG: 812: Disabling sleep skipping.
2026-03-29 10:46:33,082 [root] DEBUG: 812: YaraInit: Compiled rules loaded from existing file C:\r4q0i2l_\data\yara\capemon.yac
2026-03-29 10:46:33,097 [root] DEBUG: 812: YaraScan: Scanning 0x00D70000, size 0x12a80
2026-03-29 10:46:33,113 [root] DEBUG: 812: Monitor initialised: 32-bit capemon loaded in process 812 at 0x73f00000, thread 4232, image base 0xd70000, stack from 0x2fd4000-0x2fe0000
2026-03-29 10:46:33,113 [root] DEBUG: 812: Commandline: sc start RemoteAccess
2026-03-29 10:46:33,254 [root] DEBUG: 812: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:46:33,270 [lib.common.results] INFO: Uploading file C:\QpXCaNVtFy\CAPE\6012_4546083346729032026 to procdump\09199ccd36e91804f10ee420953691e3715e5944317ccbe0510e9d63241657e7; Size is 346624; Max size: 100000000
2026-03-29 10:46:33,316 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:46:33,332 [root] DEBUG: 6012: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:46:33,332 [root] DEBUG: 812: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:46:33,363 [root] INFO: Process with pid 6012 has terminated
2026-03-29 10:46:33,379 [root] INFO: Process with pid 6012 appears to have terminated
2026-03-29 10:46:33,394 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:46:33,441 [root] DEBUG: 812: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:46:33,472 [root] DEBUG: 812: Hooked 630 out of 632 functions
2026-03-29 10:46:33,488 [root] DEBUG: 812: Syscall hook installed, syscall logging level 1
2026-03-29 10:46:33,519 [root] DEBUG: 812: RestoreHeaders: Restored original import table.
2026-03-29 10:46:33,566 [root] INFO: Loaded monitor into process with pid 812
2026-03-29 10:46:33,597 [root] DEBUG: 812: caller_dispatch: Added region at 0x00D70000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00D75DEA, thread 4232).
2026-03-29 10:46:33,613 [root] DEBUG: 812: YaraScan: Scanning 0x00D70000, size 0x12a80
2026-03-29 10:46:33,629 [root] DEBUG: 812: ProcessImageBase: Main module image at 0x00D70000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:46:33,722 [root] INFO: Announced starting service "b'RemoteAccess'"
2026-03-29 10:46:35,488 [lib.api.process] INFO: 64-bit DLL to inject is C:\r4q0i2l_\dll\NSVfWPk.dll, loader C:\r4q0i2l_\bin\ihiCSzjo.exe
2026-03-29 10:46:35,879 [root] DEBUG: Loader: Injecting process 4908 (thread 4920) with C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:35,926 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:46:36,051 [root] DEBUG: Successfully injected DLL C:\r4q0i2l_\dll\NSVfWPk.dll.
2026-03-29 10:46:36,316 [lib.api.process] INFO: Injected into 64-bit <Process 4908 ShellExperienceHost.exe>
2026-03-29 10:46:41,972 [root] INFO: Analysis timeout hit, terminating analysis
2026-03-29 10:46:42,457 [lib.api.process] INFO: Terminate event set for <Process 752 svchost.exe>
2026-03-29 10:46:42,551 [root] DEBUG: 752: Terminate Event: Attempting to dump process 752
2026-03-29 10:46:42,738 [root] DEBUG: 752: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:42,910 [lib.api.process] INFO: Termination confirmed for <Process 752 svchost.exe>
2026-03-29 10:46:43,004 [root] INFO: Terminate event set for process 752
2026-03-29 10:46:43,019 [root] DEBUG: 752: Terminate Event: monitor shutdown complete for process 752
2026-03-29 10:46:43,097 [lib.api.process] INFO: Terminate event set for <Process 452 explorer.exe>
2026-03-29 10:46:43,207 [root] DEBUG: 452: Terminate Event: Attempting to dump process 452
2026-03-29 10:46:43,738 [root] DEBUG: 452: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:44,347 [root] INFO: Added new file to list with pid 452 and path C:\Users\cape\AppData\Local\Microsoft\Windows\INetCache\IE\NBR01339\TMP[1].TMP
2026-03-29 10:46:44,522 [lib.api.process] INFO: Termination confirmed for <Process 452 explorer.exe>
2026-03-29 10:46:44,676 [root] DEBUG: 452: Terminate Event: monitor shutdown complete for process 452
2026-03-29 10:46:44,676 [root] INFO: Terminate event set for process 452
2026-03-29 10:46:44,832 [lib.api.process] INFO: Terminate event set for <Process 6600 cmd.exe>
2026-03-29 10:46:44,879 [root] DEBUG: 6600: Terminate Event: Attempting to dump process 6600
2026-03-29 10:46:44,910 [root] DEBUG: 6600: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:46:44,926 [root] DEBUG: 6600: DoProcessDump: Code modification detected, dumping Imagebase at 0x00610000.
2026-03-29 10:46:44,957 [root] DEBUG: 6600: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:46:45,004 [root] DEBUG: 6600: DumpProcess: Instantiating PeParser with address: 0x00610000.
2026-03-29 10:46:45,035 [root] DEBUG: 6600: DumpProcess: Module entry point VA is 0x00626B20.
2026-03-29 10:46:45,191 [lib.common.results] INFO: Uploading file C:\QpXCaNVtFy\CAPE\6600_40184546729032026 to procdump\bc284ac9f78bd00d739ed6dcc9fff85206dd87e22447711810065a9e276dff60; Size is 346624; Max size: 100000000
2026-03-29 10:46:45,222 [root] DEBUG: 6600: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:46:45,238 [lib.api.process] INFO: Termination confirmed for <Process 6600 cmd.exe>
2026-03-29 10:46:45,347 [root] DEBUG: 6600: Terminate Event: monitor shutdown complete for process 6600
2026-03-29 10:46:45,347 [root] INFO: Terminate event set for process 6600
2026-03-29 10:46:45,410 [lib.api.process] INFO: Terminate event set for <Process 812 sc.exe>
2026-03-29 10:46:45,457 [root] DEBUG: 812: Terminate Event: Attempting to dump process 812
2026-03-29 10:46:45,551 [root] DEBUG: 812: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:46:45,582 [lib.api.process] INFO: Termination confirmed for <Process 812 sc.exe>
2026-03-29 10:46:45,675 [root] DEBUG: 812: Terminate Event: monitor shutdown complete for process 812
2026-03-29 10:46:45,675 [root] INFO: Terminate event set for process 812
2026-03-29 10:46:45,707 [root] INFO: Created shutdown mutex
2026-03-29 10:46:46,926 [root] INFO: Shutting down package
2026-03-29 10:46:47,019 [root] INFO: Stopping auxiliary modules
2026-03-29 10:46:47,019 [root] INFO: Stopping auxiliary module: Browser
2026-03-29 10:46:47,113 [root] INFO: Stopping auxiliary module: Human
2026-03-29 10:46:49,285 [root] INFO: Process with pid 812 has terminated
2026-03-29 10:46:49,473 [root] INFO: Process with pid 6600 has terminated
2026-03-29 10:46:49,754 [root] INFO: Stopping auxiliary module: Screenshots
2026-03-29 10:46:51,004 [root] INFO: Finishing auxiliary modules
2026-03-29 10:46:51,082 [root] INFO: Shutting down pipe server and dumping dropped files
2026-03-29 10:46:51,223 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\INetCache\IE\NBR01339\TMP[1].TMP to files\4ba1f0b693930843310a83e21ac7aed07c561632c9f3aba958fec8db5350cd14; Size is 34785; Max size: 100000000
2026-03-29 10:46:51,316 [root] WARNING: Folder at path "C:\QpXCaNVtFy\debugger" does not exist, skipping
2026-03-29 10:46:51,363 [root] INFO: Uploading files at path "C:\QpXCaNVtFy\tlsdump"
2026-03-29 10:46:51,504 [lib.common.results] INFO: Uploading file C:\QpXCaNVtFy\tlsdump\tlsdump.log to tlsdump\tlsdump.log; Size is 13152; Max size: 100000000
2026-03-29 10:46:51,629 [root] WARNING: Monitor injection attempted but failed for process 4908
2026-03-29 10:46:51,644 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| win10x64 | win10x64 | KVM | 2026-03-29 10:43:55 | 2026-03-29 10:47:00 | none |
| File Name |
rknrl_1_.vbs
|
|---|---|
| File Type | ASCII text, with very long lines (56625), with CRLF line terminators |
| File Size | 60809 bytes |
| MD5 | b3e5cec5ba0242bd57bf08a33376d2a1 |
| SHA1 | c40b5d8fcc5f76a41ef9384356aab5fd068addd1 |
| SHA256 | ab54f9e017fd5bffdb007e5db38e2d7e23bda9e56caa074d93dc1bf7ae8d19ac VT MWDB Bazaar |
| SHA3-384 | 51f798617792ee332cdf6e1731f172a991a2d3d705ca85119fb02843d7f2f75f0d40befc1c6ea1133185a13d03c995bf |
| CRC32 | 85AB071E |
| TLSH | T12C53B71778D214E473EBCC30A51F9D394A37AD96384D2C12A23D6334697208BFBD691E |
| Ssdeep | 1536:V4r5VxgaQ1PSzmKawovDJekHEPz5jlJLmxF5njrrZlv+C:V+TgafzBovo9z5jllmJnNR+C |
yM = "Z46|U1rP2Xu|U1Q4hzB|U1kbzbq|U1uqujI|U1Ywgv9|U1PjZYl|U1rbyJ3|U1t8Pwj|U1UU4by|U1X2HMZ|U146rP2|U1XuQ4h|U1zBkbz|U1b9GYK|U10t8Qr|U1u4O2s|U18Q4hy|U1q2X4O|U11XIc0|U1tYO2b|U1rd0tc|U1Y2dJp|U14XAR4|U1t8L2X|U1uQ4hz|U1Art4O|U12tiY1|U1bEP57|U1IYwjU|U1X2HMZ|U146rP5|U16iJ1X|U1Yb06i|U1Y1LzA|U1rwrSm|U1zJp1H|U18JrtM|U1P3HAb|U13bzAr|U1smV47|U1MR2Hq|U1ToXmL|U147uJ4|U16mV2G|U1qJ5G8|U1JrxcZ|U11XYH4|U1hEN56|U1iVrx5|U1drYNb|U1rxzXr|U1xrdrb|U1zXrt4|U1O2tiY|U11XEc2|U179dqb|U1zboXM|U1P3LrU|U1rzJpr|U1xzdrt|U1MP3HA|U1b3bEG|U137EZ2|U1G0K0s|U1YR4hz|U1Arw1m|U1xbzdr|U1xyR2X|U1QO5XV|U1P0tuL|U14H8J1|U1tuJ3x|U1zArxq|U1a27jP|U146cYr|U1dJprx|U1zdrtM|U1P3HAb|U13bEG2|U1GqS37|U1EW4tY|U1L47mJ|U12GqEr|U1wJdrb|U1rmxbz|U1drxyR|U12XQO5|U1XVP56|U1qW07I|U1Y2WiK|U1rwJdr|U1bAars|U1mJ56q|U1Jruqu|U1jIYwg|U1uML3G|U1qRoW4|U1b1L4K|U10tuL0|U1xzY1G|U1YK0t8|U1Q1XAO|U10x814|U16cN2t|U1AL46r|U1drbzX|U1rtmV1|U1W1VnK|U1jUrx5|U1d4XAR|U14t8L2|U1XuQ4h|U1zXrtm|U1V1W1V|U1nKjUw|U1jVdrx|U1zd4XA|U1R4t8L|U137mO2|U1bzArs|U1mV47M|U1R2HqT|U1oWqY4|U1GqY57|U1jdpxq|U1rhJ84|U16JMkj|U1Jun6J|U1IyjJc|U1qgZ81|U11HAX0|U1s0c1X|U1815HM|U1c1GmY|U11IMX2|U1HMZ46|U1q14t8|U1X568R|U10tYa2|U1HE1rb|U1ZdwjV|U1drxzd|U1375dr|U1tYP1G|U1iLrxc|U1X2HMZ|U146qU5|U1HAPox|U1rRrbZ|U1dkhzN|U1rsiV4|U17Fmxb|U1zdrxz|U1drxzd|U12tES2|U1HqToX|U1Ya2HE|U1R2Hmc|U10tYO2|U1bzArt|U14O2ti|U1Y1bEN|U156iVw|U1jVdrx|U1zd47M|U1K4hzm|U1xbzdr|U1xzdrx|U1zd2tE|U1S2HqT|U1oXYa2|U1HER2H|U1mc0tY|U1O2bzA|U1rt4O2|U1tiY1X|U1Ya2HF|U1mxbzd|U1rxyY2|U1Xjd37|U15mxbz|U1drtMP|U13HAb3|U1bEK56|U14YpxZ|U1mxX8P|U14xyU4|U1dJp47|U1EZrtY|U1XwjUY|U12Xjd3|U175mxX|U18P4xy|U1U4dJp|U147EZr|U1tYXwj|U1UP46c|U1JwjVm|U1xX8P4|U1xyq4d|U1Jp47E|U1ZrvYX|U1wjUY2|U1Xjd37|U15mxXE|U1Yfsjm|U1xX8L1|U1bEa2t|U18c1dJ|U1p47EZ|U1rsmI5|U1dJpiW|U18P5Gi|U1U2HFd|U15HcS4|U1tYLpx|U1ZmxXA|U1Prt8L|U11XALr|U1sqY1G|U18Q4hy|U1P46cJ|U1wjUU4|U1byP2G|U1jd4XY|U1R46mE|U11GiY2|U17Ab3b|U1Et2HM|U1Z46qu|U1ftYK0|U1sndpt|U1MY4Wj|U1V4XYR|U146mE1|U1GiY27|U1Ab3bE|U1W46iK|U11t8a3|U17uR4X|U1AR4t8|U1LpwzU|U1ownUr|U1x5drY|U1qujIY|U1wgxrU|U1rxyJ3|U1t8Pwj|U1Vdrxz|U1d4XYR|U146mE1|U1GiY27|U1Ab3bE|U1w1X8c|U10t8t2|U1HMZ46|U1rV2t8|U1X0xcX|U137MY1|U1GYK0t|U18Q2Hq|U1ToX0Y|U10smN4|U17mU57|U1MX2HM|U1Z46rV|U1nxZRn|U1LZdqb|U1zb9Z8|U1w79mn|U1rbZmx|U1bzdrx|U1yX37M|U1Y1GYK|U10t8Q2|U1HqToX|U10Y0t4|U1O2tiY|U11bcR4|U174Jpt|U14U2t8|U1Kf6mJ|U147IO5|U1XVP4H|U18J1Gy|U1Y5HYc|U12t4O2|U1tiY1b|U1dNphN|U1KphzX|U1rxqhi|U19m4jJ|U1NbphE|U1c0siL|U137qI0|U1t8Krw|U1JdnbR|U1JwjUY|U12Xjd3|U175mxX|U1YXrt4|U1U2t8K|U1f6mJ4|U17IO5X|U1VPiXA|U1R4t8L|U1i6cU1|U1GiKrx|U1cR474|U1Jpt4U|U12t8Kf|U16mJ47|U1IO5XV|U1P4H8J|U11GyY5|U1HYc2t|U14O2ti|U1Y1bdN|U1phNKp|U1hzXrx|U1qhi9m|U14jJNb|U1phzd0|U1tcY2d|U1Jp5Hc|U1S4tYL|U1rwJd2|U1t8X0x|U1cX37M|U1Y1GYK|U10t8Q2|U1HqToX|U10Y0sm|U1N47mU|U157MX2|U1HMZ46|U1rVnxZ|U1RnLZd|U1qbzb9|U1Z8w79|U1mnrdJ|U1p47MK|U14jJp5|U1HcS4t|U1YLrwJ|U1d1HcY|U12tMO5|U1XVP1G|U1yY5HY|U1c2t4O|U12tiY1|U1WnVng|U15UwjU|U1Y2Xjd|U1375mx|U1Z8P4x|U1yt07E|U1a0tYO|U12dJp1|U1G8brt|U1YP1Gi|U1c2tNd|U1ptAJf|U16yYpj|U1Jp2HF|U1d46qL|U12Grd1|U1X8K07|U1IYrtE|U1Yfsjm|U1xXAX4|U1XYa46|U14Y1Wm|U1U2HFd|U1khyK3|U1t8R2t|U1Ab3bE|U1L470L|U147uZr|U1xdbhv|U1Qu78A|U1ngJmy|U1guAmj|U19mrh9|U1Eu6sm|U1O4WiG|U156qY6|U1vIU5G|U1qO1HA|U1X0uML|U13HEL2|U1uMO4X|U14U5H8|U1H46qK|U137APr|U1bZmxX|U1YXrt4|U1U2t8K|U1f6mJ4|U17IO5X|U1VPiXA|U1R4t8L|U1i6cU1|U1GiKpt|U1MY4Wj|U1V4XYR|U146mE1|U1GiY27|U1Ab3bE|U1s46ig|U11t8a3|U17uRiX|U1AR4t8|U1LpwzU|U1ownUq|U1bqI1H|U18L1Lr|U1UrsiV|U147Fmx|U1WmE1G|U1yc0td|U1dkhyR|U1474Jp|U1t4U2t|U18Kf6m|U1J47IO|U15XVPi|U1H8J9G|U1yY5HY|U1c2v4O|U12tiY1|U1bdNph|U1NKph5|U1b06mY|U11Wnbw|U1jUR2X|U1Qa3t1|U1d2t8X|U10xcX3|U17MY1G|U1YK0t8|U1Q2HqT|U1oZ0Y0|U1umN47|U1mU57M|U1t2HMZ|U146rVn|U1xZRnL|U1ZXrYy|U1L2H0L|U157Iv5|U16ic6v|U1IU5Gq|U1O1HAX|U10uM63|U17EZ2G|U10K6um|U1J56qJ|U1rvIY2|U1W819s|U1qO4Gq|U1c26nb|U1otAJf|U16yYwj|U1UX2Gr|U1d47ua|U13xyX2|U1HMZ46|U1rd37F|U1d4XYR|U146mE1|U1GiY27|U1Ab3bE|U1W46iX|U12HMZ4|U16rV1G|U1YK1tu|U1J3xZP|U11G8b4|U1XAR4t|U18L1NJ|U1prxzd|U1rtMP3|U1HmV4L|U1yX2HM|U1Z46rP|U11tuJ3|U1x5b6v|U1uN1vi|U1c0tu1|U19XAc2|U17YP4I|U1Mm37m|U1L2GmO|U14Wi1h|U17EJ46|U1qP46j|U1di6cN|U12tAL4|U16rbot|U1AJf6y|U1YwjVd|U1rxzd2|U1tES5H|U1cWrt4|U1O2tiY|U11bEN5|U16iVqb|U1q1it8|U1K3GiO|U11xrR2|U1GiE1t|U19mxXE|U1Yfsjm|U1xX8R1|U1H9mxW|U1mE1Gy|U1c0tdd|U1khyR4|U174Jpt|U14U2t8|U1Kf6mJ|U147IO5|U1XVPiH|U18J9Gy|U1Y5HYc|U12v4O2|U1tiY1b|U1dNphN|U1Kph5b|U1itAa0|U17IY2W|U1iKrtu|U1P4xyK|U146iJ3|U17EW1L|U1rmxXM|U1P3HmV|U14LyKf|U16mN56|U1iVqbq|U11j7MR|U1ru8K4|U16qKrb|U1MO0sY|U1N4jJp|U14XALr|U1t8c5H|U1dd4XA|U1R4t8L|U1rtYPr|U1t4U2t|U18Kf6m|U1J47IO|U15XVP4|U1H8J4X|U1AR4t8|U1LpsmE|U11Gyc0|U1tdUoW|U1mI5X4|U1O2tiY|U11Wnmx|U1bzdrx|U1yR2XQ|U1a3t1d|U14XAR4|U1t8LoW|U1yc0td|U1XrYMy|U11syR3|U17mc0t|U1YO2by|U1v56ic|U16vIU5|U1GqO1H|U1AX0uM|U1q2WiY|U11XEY0|U1xyufs|U1yR2Gq|U1Y1brR|U12GiE1|U1t9mxb|U1zdrxy|U1R2XQa|U13t1d4|U1XAR4t|U18LoWy|U1c0tdX|U1rYMv4|U16mS0t|U1ANrbM|U1O0sYN|U14jJp2|U1X8F0z|U1Jp47E|U1ZrtYX|U1wjUY2|U1Xjd1G|U18bwjU|U1K07rd|U12tES5|U1HcWpt|U14O2tj|U1R2GiE|U11t9Uw|U1jUO2b|U1yY1Wq|U1O1byL|U146mI2|U179d2X|U18F0zJ|U1pwjUR|U12XQX3|U17MYrt|U14O2tj|U1R2GiE|U11t9mx|U1X4O1b|U1yY57m|U1Vrt4O|U12tiY1|U1byU2b|U1yX37M|U1Y1GYK|U10t8Q2|U1HqToX|U10Y0t4|U1O2tiY|U11bcX2|U1HMZph|U1EK07q|U1X2HMZ|U146qKw|U1jVdrx|U1zd2tE|U1S4XYR|U14hyX2|U1HMZ46|U1rP1tu|U1J3xMO|U10sYN4|U1jJprx|U1zdrtY|U1Xrt4U|U12t8Kf|U16mJ47|U1IO5XV|U1P4H8J|U14XAR4|U1t8Lpt|U14O2ti|U1Y1bEN|U156iVp|U1hEK07|U1qX2HM|U1Z46qK|U1oXmO0|U17EJrw|U1N+rwz|U1d0tcY|U12dJpr|U1xzdrx|U1zdrtm|U1c2tNd|U12tES5|U1HcWrx|U1cX2HM|U1Z46rP|U11tuJ3|U1xMO0s|U1YN4hZ|U1mxbzd|U1rxyY2|U1Xjd37|U15mxXE|U1Yfsjm|U1xX8P4|U1xyK07|U1rmxWm|U1I5byR|U12XQX3|U17MYpt|U14O2tj|U1R2GiE|U11t9Uw|U1jUO2b|U1yY1Wq|U1O1byL|U146mI2|U179d2X|U18F0zJ|U1p4XAL|U1rxyY5|U17mVrt|U14U2t9|U1d37Fd|U14XYR4|U16mE1G|U1iY27A|U1b3bEW|U146iX2|U1HMZ46|U1rdpt4|U1O2tjU|U1oX4U2|U1t8Kwj|U1Vq375|U1drtMa|U156mYr|U1xcK1t|U1MU0xc|U1X37MY|U1oXEc2|U179Rrx|U1rPrbZ|U1V07qO|U107EZp|U1smN2t|U1YJpt4|U1U2t9P|U12XuQ4|U1hNdrb|U1FbphZ|U1UphzA|U1rxqR2|U1XRbrs|U1iV47F|U1mxdZd|U1rxyQ2|U17IQrw|U1Jd4XY|U1R4hEN|U156iVw|U1jVqrx|U1zd4tA|U1a5XMc|U12XRdk|U1hzbrd|U1Jpxhz|U1drscR|U11HqR5|U17ESrw|U1Jdrbr|U1mxdZd|U1rxyK4|U16jd2t|U1ES2Hq|U1TnbzA|U1rsmV4|U17MR2H|U1qToXm|U1L47uJ|U146mV2|U1GqJ5G|U18Jrxc|U1Q27IQ|U1phzmx|U1dZdrx|U1yU4bz|U1V2tES|U12HqTn|U1bEJ56|U1qW46i|U1N56iV|U1rwJdr|U1brd57|U1EZrtY|U1P1GiL|U1pt4U2|U1t9P2X|U1uQ4hN|U1bgH4X|U137mYr|U1u0O1X|U1jbphz|U1BkbzN|U1phyO1|U1bzV27|U1YZptM|U1P3HAb|U13arP0|U1tuL4H|U18J1tu|U1J3xNd|U137EK0|U1sqL46|U15V2tE|U1S2HqT|U1nbEJ5|U16qW46|U1iN56i|U1Voxq1|U1rbZSn|U1hZdkh|U1zb8JY|U1l8JAh|U1ixEu7|U1v9brt|U1uP4xy|U1R2XQO|U15XVLo|U1XuL4G|U18Q47E|U1J1LzB|U1kbzbo|U1H5drb|U14a3sr|U1VnKjU|U1qbyP4|U1tAa1t|U1uJ3xz|U1X5HcL|U1pwnJp|U1hZd0t|U1cY2dJ|U1pxhzd|U1rtiO5|U1HqR57|U1ESrwJ|U1drWYY|U11Lrmx|U1dZdrx|U1yY2Xj|U1d375m|U1xdZdr|U1xyU4b|U1zV2tE|U1S2HqT|U1nbEJ5|U16qW46|U1iN56i|U1VrwJd|U1rbrd5|U17EZrt|U1YP1Gi|U1Lpt4U|U12t9P2|U1XuQ4h|U1NbgH4|U1X37mY|U1rv8F5|U1H8Rrb|U1ZdkwF|U1dnxZd|U12Grdp|U1tIU4x|U1cR2XQ|U1O5XVL|U1oWic1|U1X0Y0s|U1yc0td|U1RrtYP|U11GiL1|U1X8Hpt|U1MP3HA|U1b3arP|U10tuL4|U1H8J1t|U1uJ3xN|U1b6xrU|U1pKvUr|U1wJdrZ|U185jJ8|U1noZ85|U1ihrd5|U17EZrt|U1MP3HA|U1b3arP|U156qW0|U17IY2W|U1iKrwN|U1+rxrO|U12bzbq|U1XmV1b|U1dKmxZ|U1XrtEF|U12smN5|U16iVrx|U14a3sr|U1VnKjU|U1phyJ3|U1t8Pwj|U1Vqrxz|U1dftMK|U15XMc2|U1XRdkh|U1zbf78|U1KrdJp|U1xhzdr|U1t8P4x|U1yU4dJ|U1pxhzd|U1rtYXr|U1tAJf6|U1yYkhq|U1Z2Hnb|U1rsiV4|U17Fmxb|U1zdrxz|U1drxyU|U14byQ3|U17jV2t|U1ES2Hq|U1TnbEJ|U156qW4|U16iN56|U1iVoxy|U1U2WmJ|U11WqY0|U1bcR2X|U1QO5XV|U1LoWic|U11X0Y0|U1syc0t|U1dRrYN|U1bphRM|U1phzAr|U1xqG2G|U1qZ37m|U1O2bEY|U1ft9br|U1tALrt|U1iO5Hq|U1R57ES|U1rwJdr|U1WYY1L|U1rd0tc|U1Y2dJp|U1rxzdr|U1xzdrt|U14U2t8|U1Kf6mJ|U147IO5|U1XVP4t|U18R46i|U1Y4XYR|U14hzV4|U1XYR4h|U1EN56i|U1VpjJp|U1rxzdr|U1xzdrs|U1mY0xy|U1R2XQO|U15XVdk|U1hyK3t|U18R2tA|U1b3bEa|U11X8c0|U1t8K3t|U1AL0tm|U1I0xzV|U127IQ2|U1hZdwj|U1Vdrxz|U1drxzd|U12tES2|U1HqToW|U10U2Xi|U1O0GmJ|U1f7MYr|U1wJdnj|U1Jprxz|U1drxzd|U1rtMP3|U1HAb3b|U1EJ56q|U1W46iN|U156iVr|U1wJd5H|U1cLpwn|U1Jph4O|U14X4U5|U1H8N56|U1iVqbq|U16h9E6|U1gIqvo|U1Z85ih|U1rX5Hc|U1LpwnJ|U1pjJpr|U1xzdrx|U1zdrtM|U1P3HAb|U13bEG2|U1GqS37|U1EW4tY|U1L47mJ|U12GqEr|U1wJdrb|U1rmxbz|U1drxzd|U1rxyR2|U1XQO5X|U1VP56q|U1W07IY|U12WiKr|U1wJdrb|U1AXrxr|U1X5HcL|U1pwnJp|U1h5d2X|U1iO5Gy|U1c0tdd|U1qXmV1|U1bdKmx|U1Zmxbz|U1drxzd|U1rxyR2|U1XQO5X|U1VP1Hu|U1H4hdU|U1wjVdr|U1xzdrx|U1zd47E|U1ZrtYX|U1wjVdr|U1xzdrx|U1yY2Xj|U1d375m|U1xbzd <truncated>
| Process: wscript.exe (5384) | ||||||||
| file | C:\Users\cape\AppData\Local\Microsoft\Windows\INetCookies | |||||||
| Process: explorer.exe (452) | ||||||||
| file | C:\Users\cape\AppData\Local\Microsoft\Windows\INetCookies | |||||||
| Process: explorer.exe (452) | ||||||||
| file | C:\Users\cape\AppData\Local\Microsoft\Windows\INetCookies | |||||||
| Process: explorer.exe (452) | ||||||||
| file | C:\Users\cape\AppData\Local\Microsoft\Windows\INetCookies | |||||||
| Process: explorer.exe (452) | ||||||||
| file | C:\Users\cape\AppData\Local\Microsoft\Windows\INetCookies | |||||||
No results found.
No behavioral analysis data available.
No dropped files found.