Options

vnc_port=5900

Analysis Log

2026-06-29 14:58:59,573 [root] INFO: Date set to: 20260629T16:58:31, timeout set to: 200
2026-06-29 16:58:31,620 [root] DEBUG: Starting analyzer from: C:\2_6me6uj
2026-06-29 16:58:31,621 [root] DEBUG: Storing results at: C:\QonFocsg
2026-06-29 16:58:31,622 [root] DEBUG: Pipe server name: \\.\PIPE\ZkVqIBDyaH
2026-06-29 16:58:31,623 [root] DEBUG: Python path: C:\Users\Rajesh\AppData\Local\Programs\Python\Python314
2026-06-29 16:58:31,624 [root] INFO: analysis running as an admin
2026-06-29 16:58:31,625 [root] INFO: analysis package specified: "chrome"
2026-06-29 16:58:31,626 [root] DEBUG: importing analysis package module: "modules.packages.chrome"...
2026-06-29 16:58:31,634 [root] DEBUG: imported analysis package "chrome"
2026-06-29 16:58:31,635 [root] DEBUG: initializing analysis package "chrome"...
2026-06-29 16:58:31,637 [lib.common.common] INFO: no wrapping
2026-06-29 16:58:31,638 [lib.core.compound] INFO: C:\Users\Rajesh\AppData\Local\Temp already exists, skipping creation
2026-06-29 16:58:31,639 [root] DEBUG: New location of moved file: C:\Users\Rajesh\AppData\Local\Temp\philip website fixed.html
2026-06-29 16:58:31,639 [root] INFO: Analyzer: Package modules.packages.chrome does not specify a dll option
2026-06-29 16:58:31,640 [root] INFO: Analyzer: Package modules.packages.chrome does not specify a dll_64 option
2026-06-29 16:58:31,640 [root] INFO: Analyzer: Package modules.packages.chrome does not specify a loader option
2026-06-29 16:58:31,641 [root] INFO: Analyzer: Package modules.packages.chrome does not specify a loader_64 option
2026-06-29 16:58:31,669 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-06-29 16:58:31,680 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-06-29 16:58:31,703 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-06-29 16:58:31,731 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-06-29 16:58:31,738 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-06-29 16:58:31,739 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-06-29 16:58:31,740 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-06-29 16:58:31,744 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-06-29 16:58:31,744 [root] DEBUG: Initialized auxiliary module "Browser"
2026-06-29 16:58:31,745 [root] DEBUG: attempting to configure 'Browser' from data
2026-06-29 16:58:31,747 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-06-29 16:58:31,747 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-06-29 16:58:31,794 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-06-29 16:58:31,795 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-06-29 16:58:31,795 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-06-29 16:58:31,796 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-06-29 16:58:31,797 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-06-29 16:58:31,797 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature
2026-06-29 16:58:33,209 [modules.auxiliary.digisig] DEBUG: File has an invalid signature
2026-06-29 16:58:33,210 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2026-06-29 16:58:33,212 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-06-29 16:58:33,212 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-06-29 16:58:33,212 [root] DEBUG: attempting to configure 'Disguise' from data
2026-06-29 16:58:33,213 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-06-29 16:58:33,213 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-06-29 16:58:33,220 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 2848)
2026-06-29 16:58:33,228 [modules.auxiliary.disguise] INFO: Disguising GUID to fa0ac19c-b40c-4caf-91d3-7eb1460f4ffc
2026-06-29 16:58:33,228 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-06-29 16:58:33,229 [root] DEBUG: Initialized auxiliary module "Human"
2026-06-29 16:58:33,229 [root] DEBUG: attempting to configure 'Human' from data
2026-06-29 16:58:33,230 [root] DEBUG: module Human does not support data configuration, ignoring
2026-06-29 16:58:33,230 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-06-29 16:58:33,248 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-06-29 16:58:33,249 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-06-29 16:58:33,259 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-06-29 16:58:33,263 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-06-29 16:58:33,263 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-06-29 16:58:33,322 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2026-06-29 16:58:33,323 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-06-29 16:58:33,323 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-06-29 16:58:33,324 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-06-29 16:58:33,324 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-06-29 16:58:33,325 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-06-29 16:58:33,330 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-06-29 16:58:33,330 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-06-29 16:58:39,219 [root] INFO: Restarting WMI Service
2026-06-29 16:58:41,382 [root] DEBUG: package modules.packages.chrome does not support configure, ignoring
2026-06-29 16:58:41,385 [root] WARNING: configuration error for package modules.packages.chrome: error importing data.packages.chrome: No module named 'data.packages'
2026-06-29 16:58:41,386 [lib.core.compound] INFO: C:\Users\Rajesh\AppData\Local\Temp already exists, skipping creation
2026-06-29 16:58:41,389 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" with arguments "--disable-features=RendererCodeIntegrity "C:\Users\Rajesh\AppData\Local\Temp\philip website fixed.html"" with pid 612
2026-06-29 16:58:41,704 [lib.api.process] INFO: Monitor config for process 612: C:\2_6me6uj\dll\612.ini
2026-06-29 16:58:41,725 [lib.api.process] INFO: 64-bit DLL to inject is C:\2_6me6uj\dll\sssfxwQ.dll, loader C:\2_6me6uj\bin\fKGEvqpn.exe
2026-06-29 16:58:41,745 [root] DEBUG: Loader: Injecting process 612 (thread 3864) with C:\2_6me6uj\dll\sssfxwQ.dll.
2026-06-29 16:58:41,746 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-06-29 16:58:41,747 [root] DEBUG: Successfully injected DLL C:\2_6me6uj\dll\sssfxwQ.dll.
2026-06-29 16:58:41,750 [lib.api.process] INFO: Injected into 64-bit <Process 612 chrome.exe>
2026-06-29 16:58:43,761 [lib.api.process] INFO: Successfully resumed process with pid 612
2026-06-29 16:58:43,796 [root] DEBUG: 612: Python path set to 'C:\Users\Rajesh\AppData\Local\Programs\Python\Python314'.
2026-06-29 16:58:43,798 [root] DEBUG: 612: Disabling sleep skipping.
2026-06-29 16:58:43,799 [root] DEBUG: 612: Dropped file limit defaulting to 100.
2026-06-29 16:58:43,808 [root] DEBUG: 612: Chrome-specific hook-set enabled.
2026-06-29 16:58:43,866 [root] DEBUG: 612: RtlInsertInvertedFunctionTable 0x00007FF9AAA0090E, LdrpInvertedFunctionTableSRWLock 0x00007FF9AAB5B4F0
2026-06-29 16:58:43,867 [root] DEBUG: 612: Monitor initialised: 64-bit capemon loaded in process 612 at 0x00007FF987A90000, thread 3864, image base 0x00007FF619E70000, stack from 0x000000EB379F1000-0x000000EB37A00000
2026-06-29 16:58:43,868 [root] DEBUG: 612: Commandline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --disable-features=RendererCodeIntegrity "C:\Users\Rajesh\AppData\Local\Temp\philip website fixed.html"
2026-06-29 16:58:43,888 [root] DEBUG: 612: Hooked 2 out of 2 functions
2026-06-29 16:58:43,908 [root] DEBUG: 612: Syscall hook installed, syscall logging level 1
2026-06-29 16:58:43,926 [root] DEBUG: 612: RestoreHeaders: Restored original import table.
2026-06-29 16:58:43,927 [root] INFO: Loaded monitor into process with pid 612
2026-06-29 16:58:43,961 [root] DEBUG: 612: InstrumentationCallback: Added region at 0x00007FF99922B014 (base 0x00007FF999150000) to tracked regions list (thread 3864).
2026-06-29 16:58:43,964 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:43,972 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.295220e+00 (from 6.295142e+00)
2026-06-29 16:58:43,974 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:43,976 [root] DEBUG: 612: DLL loaded at 0x00007FF9A8700000: C:\Windows\System32\bcryptPrimitives (0x83000 bytes).
2026-06-29 16:58:43,983 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.295404e+00 (from 6.295142e+00)
2026-06-29 16:58:43,984 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:43,991 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:43,992 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:43,995 [root] DEBUG: 612: DLL loaded at 0x00007FF9A9D30000: C:\Windows\System32\shcore (0xad000 bytes).
2026-06-29 16:58:44,006 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,007 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,029 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,030 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,039 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,040 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,046 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,048 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,057 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,058 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,064 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,065 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,078 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,079 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,088 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,089 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,095 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,096 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,106 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,107 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,125 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,126 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,133 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,135 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,144 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,146 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,156 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,158 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,161 [root] DEBUG: 612: DLL loaded at 0x00007FF9A74E0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-06-29 16:58:44,163 [root] DEBUG: 612: DLL loaded at 0x00007FF997DF0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-06-29 16:58:44,168 [root] DEBUG: 612: DLL loaded at 0x00007FF997F60000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-06-29 16:58:44,170 [root] DEBUG: 612: DLL loaded at 0x00007FF9A7F80000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-06-29 16:58:44,172 [root] DEBUG: 612: DLL loaded at 0x00007FF9A82A0000: C:\Windows\System32\WINTRUST (0x60000 bytes).
2026-06-29 16:58:44,173 [root] DEBUG: 612: DLL loaded at 0x00007FF9A2720000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-06-29 16:58:44,174 [root] DEBUG: 612: DLL loaded at 0x00007FF98EF90000: C:\Windows\SYSTEM32\UIAutomationCore (0x2f5000 bytes).
2026-06-29 16:58:44,175 [root] DEBUG: 612: DLL loaded at 0x00007FF99A5A0000: C:\Windows\SYSTEM32\DWrite (0x283000 bytes).
2026-06-29 16:58:44,177 [root] DEBUG: 612: DLL loaded at 0x00007FF997130000: C:\Windows\SYSTEM32\WINSPOOL.DRV (0x95000 bytes).
2026-06-29 16:58:44,179 [root] DEBUG: 612: DLL loaded at 0x00007FF997630000: C:\Windows\SYSTEM32\dbghelp (0x1e4000 bytes).
2026-06-29 16:58:44,180 [root] DEBUG: 612: DLL loaded at 0x00007FF9A1C10000: C:\Windows\SYSTEM32\WINHTTP (0x108000 bytes).
2026-06-29 16:58:44,181 [root] DEBUG: 612: DLL loaded at 0x00007FF9A3290000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-06-29 16:58:44,183 [root] DEBUG: 612: DLL loaded at 0x00007FF978040000: C:\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome (0x7b0c000 bytes).
2026-06-29 16:58:44,190 [root] DEBUG: 612: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FF999150000: 6.296009e+00 (from 6.295142e+00)
2026-06-29 16:58:44,191 [root] DEBUG: 612: ProcessTrackedRegion: Region at 0x00007FF999150000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Google\Chrome\Application\80.0.3987.149\chrome_elf.dll is in known range, skipping
2026-06-29 16:58:44,192 [root] DEBUG: 612: DLL loaded at 0x00007FF9A7C20000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-06-29 16:58:44,780 [root] INFO: Process with pid 612 appears to have terminated
2026-06-29 16:58:49,849 [root] INFO: Process list is empty, terminating analysis
2026-06-29 16:58:50,860 [root] INFO: Created shutdown mutex
2026-06-29 16:58:51,867 [root] INFO: Shutting down package
2026-06-29 16:58:51,868 [root] INFO: Stopping auxiliary modules
2026-06-29 16:58:51,868 [root] INFO: Stopping auxiliary module: Browser
2026-06-29 16:58:51,869 [root] INFO: Stopping auxiliary module: Human
2026-06-29 16:58:53,129 [root] INFO: Stopping auxiliary module: Screenshots
2026-06-29 16:58:53,130 [root] INFO: Finishing auxiliary modules
2026-06-29 16:58:53,131 [root] INFO: Shutting down pipe server and dumping dropped files
2026-06-29 16:58:53,132 [root] WARNING: Folder at path "C:\QonFocsg\debugger" does not exist, skipping
2026-06-29 16:58:53,132 [root] WARNING: Folder at path "C:\QonFocsg\tlsdump" does not exist, skipping
2026-06-29 16:58:53,137 [root] INFO: Analysis completed

Process Log

Pre-Script Log

During-Script Log