Options

vnc_port=5900

Analysis Log

2026-06-30 06:08:42,598 [root] INFO: Date set to: 20260630T16:11:14, timeout set to: 150
2026-06-30 16:11:14,082 [root] DEBUG: Starting analyzer from: C:\1quxgwlh
2026-06-30 16:11:14,084 [root] DEBUG: Storing results at: C:\ybKuGCDHA
2026-06-30 16:11:14,085 [root] DEBUG: Pipe server name: \\.\PIPE\mymFpBV
2026-06-30 16:11:14,085 [root] DEBUG: Python path: C:\Users\Rajesh\AppData\Local\Programs\Python\Python314
2026-06-30 16:11:14,086 [root] INFO: analysis running as an admin
2026-06-30 16:11:14,086 [root] DEBUG: no analysis package configured, picking one for you
2026-06-30 16:11:14,087 [root] INFO: analysis package selected: "batch"
2026-06-30 16:11:14,087 [root] DEBUG: importing analysis package module: "modules.packages.batch"...
2026-06-30 16:11:14,095 [root] DEBUG: imported analysis package "batch"
2026-06-30 16:11:14,095 [root] DEBUG: initializing analysis package "batch"...
2026-06-30 16:11:14,096 [lib.common.common] INFO: no wrapping
2026-06-30 16:11:14,096 [lib.core.compound] INFO: C:\Users\Rajesh\AppData\Local\Temp already exists, skipping creation
2026-06-30 16:11:14,097 [root] DEBUG: New location of moved file: C:\Users\Rajesh\AppData\Local\Temp\testt.bat
2026-06-30 16:11:14,097 [root] INFO: Analyzer: Package modules.packages.batch does not specify a dll option
2026-06-30 16:11:14,097 [root] INFO: Analyzer: Package modules.packages.batch does not specify a dll_64 option
2026-06-30 16:11:14,097 [root] INFO: Analyzer: Package modules.packages.batch does not specify a loader option
2026-06-30 16:11:14,097 [root] INFO: Analyzer: Package modules.packages.batch does not specify a loader_64 option
2026-06-30 16:11:14,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-06-30 16:11:14,222 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-06-30 16:11:14,603 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-06-30 16:11:15,908 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-06-30 16:11:15,912 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-06-30 16:11:15,913 [root] DEBUG: Initialized auxiliary module "Browser"
2026-06-30 16:11:15,914 [root] DEBUG: attempting to configure 'Browser' from data
2026-06-30 16:11:15,916 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-06-30 16:11:15,916 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-06-30 16:11:15,968 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-06-30 16:11:15,968 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-06-30 16:11:15,969 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-06-30 16:11:15,970 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-06-30 16:11:15,970 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-06-30 16:11:15,970 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature
2026-06-30 16:11:16,504 [modules.auxiliary.digisig] DEBUG: File has an invalid signature
2026-06-30 16:11:16,505 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2026-06-30 16:11:16,506 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-06-30 16:11:16,506 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-06-30 16:11:16,506 [root] DEBUG: attempting to configure 'Disguise' from data
2026-06-30 16:11:16,507 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-06-30 16:11:16,507 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-06-30 16:11:16,512 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 2728)
2026-06-30 16:11:16,518 [modules.auxiliary.disguise] INFO: Disguising GUID to 3e02f164-72bf-4b30-b527-684cb02b52d5
2026-06-30 16:11:16,519 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-06-30 16:11:16,519 [root] DEBUG: Initialized auxiliary module "Human"
2026-06-30 16:11:16,519 [root] DEBUG: attempting to configure 'Human' from data
2026-06-30 16:11:16,520 [root] DEBUG: module Human does not support data configuration, ignoring
2026-06-30 16:11:16,520 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-06-30 16:11:16,530 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-06-30 16:11:16,531 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-06-30 16:11:16,531 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-06-30 16:11:16,533 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-06-30 16:11:16,539 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-06-30 16:11:16,624 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-06-30 16:11:16,625 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-06-30 16:11:23,526 [root] INFO: Restarting WMI Service
2026-06-30 16:11:25,697 [root] DEBUG: package modules.packages.batch does not support configure, ignoring
2026-06-30 16:11:25,702 [root] WARNING: configuration error for package modules.packages.batch: error importing data.packages.batch: No module named 'data.packages'
2026-06-30 16:11:25,704 [lib.core.compound] INFO: C:\Users\Rajesh\AppData\Local\Temp already exists, skipping creation
2026-06-30 16:11:25,710 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\cmd.exe" with arguments "/c start /wait "" "C:\Users\Rajesh\AppData\Local\Temp\testt.bat"" with pid 540
2026-06-30 16:11:26,057 [lib.api.process] INFO: Monitor config for process 540: C:\1quxgwlh\dll\540.ini
2026-06-30 16:11:26,117 [lib.api.process] INFO: 64-bit DLL to inject is C:\1quxgwlh\dll\DcRWkaHN.dll, loader C:\1quxgwlh\bin\mKZTghWt.exe
2026-06-30 16:11:26,144 [root] DEBUG: Loader: Injecting process 540 (thread 1432) with C:\1quxgwlh\dll\DcRWkaHN.dll.
2026-06-30 16:11:26,146 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-06-30 16:11:26,147 [root] DEBUG: Successfully injected DLL C:\1quxgwlh\dll\DcRWkaHN.dll.
2026-06-30 16:11:26,151 [lib.api.process] INFO: Injected into 64-bit <Process 540 cmd.exe>
2026-06-30 16:11:28,159 [lib.api.process] INFO: Successfully resumed process with pid 540
2026-06-30 16:11:28,372 [root] DEBUG: 540: Python path set to 'C:\Users\Rajesh\AppData\Local\Programs\Python\Python314'.
2026-06-30 16:11:28,376 [root] DEBUG: 540: Disabling sleep skipping.
2026-06-30 16:11:28,378 [root] DEBUG: 540: Dropped file limit defaulting to 100.
2026-06-30 16:11:28,403 [root] DEBUG: 540: YaraInit: Compiled 44 rule files
2026-06-30 16:11:28,407 [root] DEBUG: 540: YaraInit: Compiled rules saved to file C:\1quxgwlh\data\yara\capemon.yac
2026-06-30 16:11:28,496 [root] DEBUG: 540: RtlInsertInvertedFunctionTable 0x00007FF82D5E090E, LdrpInvertedFunctionTableSRWLock 0x00007FF82D73B4F0
2026-06-30 16:11:28,498 [root] DEBUG: 540: YaraScan: Scanning 0x00007FF60E030000, size 0x6630a
2026-06-30 16:11:28,505 [root] DEBUG: 540: YaraScan hit: FindFixAndRun
2026-06-30 16:11:28,506 [root] DEBUG: 540: Monitor initialised: 64-bit capemon loaded in process 540 at 0x00007FF801740000, thread 1432, image base 0x00007FF60E030000, stack from 0x000000EDAD4D4000-0x000000EDAD5D0000
2026-06-30 16:11:28,507 [root] DEBUG: 540: Commandline: "C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\Rajesh\AppData\Local\Temp\testt.bat"
2026-06-30 16:11:28,525 [root] DEBUG: 540: hook_api: LdrpCallInitRoutine export address 0x00007FF82D5E99BC obtained via GetFunctionAddress
2026-06-30 16:11:28,585 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-06-30 16:11:28,586 [root] DEBUG: 540: set_hooks: Unable to hook LockResource
2026-06-30 16:11:28,606 [root] DEBUG: 540: Hooked 630 out of 631 functions
2026-06-30 16:11:28,614 [root] DEBUG: 540: set_hooks_exe: Hooked FindFixAndRun at 0x00007FF60E03C620
2026-06-30 16:11:28,617 [root] DEBUG: 540: Syscall hook installed, syscall logging level 1
2026-06-30 16:11:28,639 [root] DEBUG: 540: RestoreHeaders: Restored original import table.
2026-06-30 16:11:28,640 [root] INFO: Loaded monitor into process with pid 540
2026-06-30 16:11:28,645 [root] DEBUG: 540: caller_dispatch: Added region at 0x00007FF60E030000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF60E0493C1, thread 1432).
2026-06-30 16:11:28,647 [root] DEBUG: 540: YaraScan: Scanning 0x00007FF60E030000, size 0x6630a
2026-06-30 16:11:28,656 [root] DEBUG: 540: ProcessImageBase: Main module image at 0x00007FF60E030000 unmodified (entropy change 0.000000e+00)
2026-06-30 16:11:28,682 [root] DEBUG: 540: DLL loaded at 0x00007FF82A670000: C:\Windows\system32\Wldp (0x2c000 bytes).
2026-06-30 16:11:28,684 [root] DEBUG: 540: DLL loaded at 0x00007FF828E10000: C:\Windows\SYSTEM32\windows.storage (0x790000 bytes).
2026-06-30 16:11:28,689 [root] DEBUG: 540: DLL loaded at 0x00007FF82C9E0000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-06-30 16:11:28,693 [root] DEBUG: 540: CreateProcessHandler: Injection info set for new process 3712: C:\Windows\system32\cmd.exe, ImageBase: 0x00007FF60E030000
2026-06-30 16:11:28,695 [root] INFO: Announced 64-bit process name: cmd.exe pid: 3712
2026-06-30 16:11:28,696 [lib.api.process] INFO: Monitor config for process 3712: C:\1quxgwlh\dll\3712.ini
2026-06-30 16:11:28,706 [lib.api.process] INFO: 64-bit DLL to inject is C:\1quxgwlh\dll\DcRWkaHN.dll, loader C:\1quxgwlh\bin\mKZTghWt.exe
2026-06-30 16:11:28,720 [root] DEBUG: Loader: Injecting process 3712 (thread 4076) with C:\1quxgwlh\dll\DcRWkaHN.dll.
2026-06-30 16:11:28,721 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-06-30 16:11:28,722 [root] DEBUG: Successfully injected DLL C:\1quxgwlh\dll\DcRWkaHN.dll.
2026-06-30 16:11:28,725 [lib.api.process] INFO: Injected into 64-bit <Process 3712 cmd.exe>
2026-06-30 16:11:28,728 [root] INFO: Announced 64-bit process name: cmd.exe pid: 3712
2026-06-30 16:11:28,728 [lib.api.process] INFO: Monitor config for process 3712: C:\1quxgwlh\dll\3712.ini
2026-06-30 16:11:28,730 [lib.api.process] INFO: 64-bit DLL to inject is C:\1quxgwlh\dll\DcRWkaHN.dll, loader C:\1quxgwlh\bin\mKZTghWt.exe
2026-06-30 16:11:28,742 [root] DEBUG: Loader: Injecting process 3712 (thread 4076) with C:\1quxgwlh\dll\DcRWkaHN.dll.
2026-06-30 16:11:28,744 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-06-30 16:11:28,745 [root] DEBUG: Successfully injected DLL C:\1quxgwlh\dll\DcRWkaHN.dll.
2026-06-30 16:11:28,748 [lib.api.process] INFO: Injected into 64-bit <Process 3712 cmd.exe>
2026-06-30 16:11:28,938 [root] DEBUG: 3712: Python path set to 'C:\Users\Rajesh\AppData\Local\Programs\Python\Python314'.
2026-06-30 16:11:28,940 [root] DEBUG: 3712: Dropped file limit defaulting to 100.
2026-06-30 16:11:28,945 [root] DEBUG: 3712: Disabling sleep skipping.
2026-06-30 16:11:28,956 [root] DEBUG: 3712: YaraInit: Compiled rules loaded from existing file C:\1quxgwlh\data\yara\capemon.yac
2026-06-30 16:11:28,977 [root] DEBUG: 3712: RtlInsertInvertedFunctionTable 0x00007FF82D5E090E, LdrpInvertedFunctionTableSRWLock 0x00007FF82D73B4F0
2026-06-30 16:11:28,979 [root] DEBUG: 3712: YaraScan: Scanning 0x00007FF60E030000, size 0x6630a
2026-06-30 16:11:28,990 [root] DEBUG: 3712: YaraScan hit: FindFixAndRun
2026-06-30 16:11:28,991 [root] DEBUG: 3712: Monitor initialised: 64-bit capemon loaded in process 3712 at 0x00007FF801740000, thread 4076, image base 0x00007FF60E030000, stack from 0x0000007587D04000-0x0000007587E00000
2026-06-30 16:11:28,993 [root] DEBUG: 3712: Commandline: C:\Windows\system32\cmd.exe  /K "C:\Users\Rajesh\AppData\Local\Temp\testt.bat"
2026-06-30 16:11:29,051 [root] DEBUG: 3712: hook_api: LdrpCallInitRoutine export address 0x00007FF82D5E99BC obtained via GetFunctionAddress
2026-06-30 16:11:29,118 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-06-30 16:11:29,119 [root] DEBUG: 3712: set_hooks: Unable to hook LockResource
2026-06-30 16:11:29,136 [root] DEBUG: 3712: Hooked 630 out of 631 functions
2026-06-30 16:11:29,153 [root] DEBUG: 3712: set_hooks_exe: Hooked FindFixAndRun at 0x00007FF60E03C620
2026-06-30 16:11:29,156 [root] DEBUG: 3712: Syscall hook installed, syscall logging level 1
2026-06-30 16:11:29,172 [root] DEBUG: 3712: RestoreHeaders: Restored original import table.
2026-06-30 16:11:29,174 [root] INFO: Loaded monitor into process with pid 3712
2026-06-30 16:11:29,178 [root] DEBUG: 3712: caller_dispatch: Added region at 0x00007FF60E030000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF60E0493C1, thread 4076).
2026-06-30 16:11:29,179 [root] DEBUG: 3712: YaraScan: Scanning 0x00007FF60E030000, size 0x6630a
2026-06-30 16:11:29,199 [root] DEBUG: 3712: ProcessImageBase: Main module image at 0x00007FF60E030000 unmodified (entropy change 0.000000e+00)
2026-06-30 16:11:29,262 [root] DEBUG: 3712: DLL loaded at 0x00007FF8247A0000: C:\Windows\SYSTEM32\cmdext (0xc000 bytes).
2026-06-30 16:13:58,693 [root] INFO: Analysis timeout hit, terminating analysis
2026-06-30 16:13:58,696 [lib.api.process] INFO: Terminate event set for process 540
2026-06-30 16:13:58,699 [root] DEBUG: 540: Terminate Event: Attempting to dump process 540
2026-06-30 16:13:58,704 [root] DEBUG: 540: VerifyCodeSection: Executable code does not match, 0xb620 of 0x30ef9 matching
2026-06-30 16:13:58,705 [root] DEBUG: 540: DoProcessDump: Code modification detected, dumping Imagebase at 0x00007FF60E030000.
2026-06-30 16:13:58,706 [root] DEBUG: 540: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-06-30 16:13:58,707 [root] DEBUG: 540: DumpProcess: Instantiating PeParser with address: 0x00007FF60E030000.
2026-06-30 16:13:58,709 [root] DEBUG: 540: DumpProcess: Module entry point VA is 0x00007FF60E048F50.
2026-06-30 16:13:58,738 [lib.common.results] INFO: Uploading file C:\ybKuGCDHA\CAPE\540_2902858132330262026 to procdump\31aefc078054212033b91771ef3f0278cf9dfc7b96bb677b3cd64ff4940aaaf3; Size is 401920; Max size: 100000000
2026-06-30 16:13:58,774 [root] DEBUG: 540: DumpProcess: Module image dump success - dump size 0x62200.
2026-06-30 16:13:58,789 [root] DEBUG: 540: Terminate Event: Shutdown complete for process 540 but failed to inform analyzer.
2026-06-30 16:14:03,705 [lib.api.process] INFO: Termination confirmed for process 540
2026-06-30 16:14:03,706 [root] INFO: Terminate event set for process 540
2026-06-30 16:14:03,706 [lib.api.process] INFO: Terminate event set for process 3712
2026-06-30 16:14:03,709 [root] DEBUG: 3712: Terminate Event: Attempting to dump process 3712
2026-06-30 16:14:03,711 [root] DEBUG: 3712: VerifyCodeSection: Executable code does not match, 0xb620 of 0x30ef9 matching
2026-06-30 16:14:03,712 [root] DEBUG: 3712: DoProcessDump: Code modification detected, dumping Imagebase at 0x00007FF60E030000.
2026-06-30 16:14:03,714 [root] DEBUG: 3712: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-06-30 16:14:03,715 [root] DEBUG: 3712: DumpProcess: Instantiating PeParser with address: 0x00007FF60E030000.
2026-06-30 16:14:03,716 [root] DEBUG: 3712: DumpProcess: Module entry point VA is 0x00007FF60E048F50.
2026-06-30 16:14:03,727 [lib.common.results] INFO: Uploading file C:\ybKuGCDHA\CAPE\3712_295613142330262026 to procdump\c1f45c0a3f5ca544584ee7c67ac1c6836867e503969d246fee58443e574a9acc; Size is 403456; Max size: 100000000
2026-06-30 16:14:03,759 [root] DEBUG: 3712: DumpProcess: Module image dump success - dump size 0x62800.
2026-06-30 16:14:03,772 [lib.api.process] INFO: Termination confirmed for process 3712
2026-06-30 16:14:03,773 [root] INFO: Terminate event set for process 3712
2026-06-30 16:14:03,773 [root] INFO: Created shutdown mutex
2026-06-30 16:14:03,773 [root] DEBUG: 3712: Terminate Event: monitor shutdown complete for process 3712
2026-06-30 16:14:04,782 [root] INFO: Shutting down package
2026-06-30 16:14:04,784 [root] INFO: Stopping auxiliary modules
2026-06-30 16:14:04,784 [root] INFO: Stopping auxiliary module: Browser
2026-06-30 16:14:04,784 [root] INFO: Stopping auxiliary module: Human
2026-06-30 16:14:08,914 [root] INFO: Finishing auxiliary modules
2026-06-30 16:14:08,916 [root] INFO: Shutting down pipe server and dumping dropped files
2026-06-30 16:14:08,916 [root] WARNING: Folder at path "C:\ybKuGCDHA\debugger" does not exist, skipping
2026-06-30 16:14:08,917 [root] WARNING: Folder at path "C:\ybKuGCDHA\tlsdump" does not exist, skipping
2026-06-30 16:14:08,918 [root] INFO: Analysis completed

Process Log

Pre-Script Log

During-Script Log