Category | Package | Started | Completed | Duration | Log |
---|---|---|---|---|---|
FILE | Extraction | 2019-02-11 18:26:12 | 2019-02-11 18:27:42 | 90 seconds | Show Log |
2019-02-11 18:26:13,000 [root] INFO: Date set to: 02-11-19, time set to: 18:26:13, timeout set to: 60 2019-02-11 18:26:13,015 [root] DEBUG: Starting analyzer from: C:\whprbueeo 2019-02-11 18:26:13,015 [root] DEBUG: Storing results at: C:\baWRaIQSTf 2019-02-11 18:26:13,015 [root] DEBUG: Pipe server name: \\.\PIPE\sdAtjlBUF 2019-02-11 18:26:13,015 [root] INFO: Analysis package "Extraction" has been specified. 2019-02-11 18:26:13,342 [root] DEBUG: Started auxiliary module Browser 2019-02-11 18:26:13,342 [root] DEBUG: Started auxiliary module Curtain 2019-02-11 18:26:13,342 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, signtool.exe was not found in bin/ 2019-02-11 18:26:13,342 [root] DEBUG: Started auxiliary module DigiSig 2019-02-11 18:26:13,358 [root] DEBUG: Started auxiliary module Disguise 2019-02-11 18:26:13,358 [root] DEBUG: Started auxiliary module Human 2019-02-11 18:26:13,358 [root] DEBUG: Started auxiliary module Screenshots 2019-02-11 18:26:13,358 [root] DEBUG: Started auxiliary module Sysmon 2019-02-11 18:26:13,358 [root] DEBUG: Started auxiliary module Usage 2019-02-11 18:26:13,358 [root] INFO: Analyzer: DLL set to Extraction.dll from package modules.packages.Extraction 2019-02-11 18:26:13,358 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a DLL_64 option 2019-02-11 18:26:13,513 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\VaiPmlRWuo2dxL.exe" with arguments "" with pid 2952 2019-02-11 18:26:13,513 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 18:26:13,513 [lib.api.process] INFO: 32-bit DLL to inject is C:\whprbueeo\dll\UjjAEMn.dll, loader C:\whprbueeo\bin\LogBewe.exe 2019-02-11 18:26:13,561 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2952 2019-02-11 18:26:15,573 [lib.api.process] INFO: Successfully resumed process with pid 2952 2019-02-11 18:26:15,573 [root] INFO: Added new process to list with pid: 2952 2019-02-11 18:26:15,573 [root] INFO: Enabled timeout enforce, running for the full timeout. 2019-02-11 18:26:15,651 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 18:26:15,651 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x260000 2019-02-11 18:26:15,651 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 18:26:15,683 [root] INFO: Monitor successfully loaded in process with pid 2952. 2019-02-11 18:26:15,713 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x2d0000, RegionSize: 0x1a000. 2019-02-11 18:26:15,713 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x2d0000, AllocationSize: 0x1a000, ThreadId: 0xb8c 2019-02-11 18:26:15,713 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x2d0000 and Type=0x1. 2019-02-11 18:26:15,713 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x2d0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:15,713 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x2d0000 2019-02-11 18:26:15,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x2d0000. 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:15,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x2d0000. 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 18:26:15,730 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2d003c and Type=0x1. 2019-02-11 18:26:15,730 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x2d003c (EIP = 0x10f2927) 2019-02-11 18:26:15,730 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:15,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,730 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 18:26:15,730 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x2d003c. 2019-02-11 18:26:15,730 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2d0080 and Type=0x1. 2019-02-11 18:26:15,730 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,730 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x2d0080 (EIP = 0x10f2927) 2019-02-11 18:26:15,730 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 18:26:15,744 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,744 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x2d0080. 2019-02-11 18:26:15,744 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 18:26:15,744 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:15,744 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,744 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x2d0080. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2d00a8 and Type=0x1. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,744 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0x10f2927). 2019-02-11 18:26:15,744 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:15,744 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2d00a8. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2d0075 and Type=0x0. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x2d0075 (EIP = 0x10f2927). 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,744 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2d00a8. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2d2e75 and Type=0x0. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x2d2e75 (EIP = 0x10f2927). 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,744 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,744 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2d00a8. 2019-02-11 18:26:15,744 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2d2e75 and Type=0x0. 2019-02-11 18:26:15,760 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,760 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x2d2e75 (EIP = 0x10f2927). 2019-02-11 18:26:15,760 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,760 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,760 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2d00a8. 2019-02-11 18:26:15,760 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2d2e75 and Type=0x0. 2019-02-11 18:26:15,760 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,760 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x2d2e75 (EIP = 0x10f2927). 2019-02-11 18:26:15,760 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,760 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x4e0000, RegionSize: 0x18000. 2019-02-11 18:26:15,760 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x2d0000. 2019-02-11 18:26:15,760 [root] DEBUG: DumpPEsInRange: Scanning range 0x2d0000 - 0x2ea000. 2019-02-11 18:26:15,760 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x2d0000 2019-02-11 18:26:15,760 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,760 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x2d0000 2019-02-11 18:26:15,760 [root] DEBUG: DumpProcess: Module entry point VA is 0x2d2e75 2019-02-11 18:26:15,760 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2952_76115261911122019 2019-02-11 18:26:15,760 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,760 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x2d0000. 2019-02-11 18:26:15,776 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2d0001-0x2ea000. 2019-02-11 18:26:15,776 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 18:26:15,776 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x2d0000 - 0x2ea000. 2019-02-11 18:26:15,776 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x2d00a8. 2019-02-11 18:26:15,776 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x2d2e75. 2019-02-11 18:26:15,776 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x4e0000, AllocationSize: 0x18000, ThreadId: 0xb8c 2019-02-11 18:26:15,776 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x4e0000 and Type=0x1. 2019-02-11 18:26:15,776 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x4e0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:15,776 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x4e0000 2019-02-11 18:26:15,776 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x2d28ee 2019-02-11 18:26:15,776 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x4e0000. 2019-02-11 18:26:15,776 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x4e0000: 0x0. 2019-02-11 18:26:15,776 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x4e0000 and Type=0x0. 2019-02-11 18:26:15,776 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,776 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x4e0000, AllocationBaseExecBpSet = 1 (EIP = 0x2d28ee) 2019-02-11 18:26:15,776 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:15,776 [root] DEBUG: ProtectionHandler: Address: 0x3f1000, RegionSize: 0x10000 2019-02-11 18:26:15,776 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x4e0000. 2019-02-11 18:26:15,776 [root] DEBUG: DumpPEsInRange: Scanning range 0x3f0000 - 0x400000. 2019-02-11 18:26:15,776 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3f0000 2019-02-11 18:26:15,776 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,776 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x3f0000 2019-02-11 18:26:15,776 [root] DEBUG: DumpProcess: Module entry point VA is 0x3ff5e0 2019-02-11 18:26:15,792 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2952_77615261911122019 2019-02-11 18:26:15,792 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,792 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x3f0000. 2019-02-11 18:26:15,792 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3f0001-0x400000. 2019-02-11 18:26:15,792 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 18:26:15,792 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x4e0000 - 0x4f8000. 2019-02-11 18:26:15,792 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x4e0000. 2019-02-11 18:26:15,792 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x4e0000. 2019-02-11 18:26:15,792 [root] DEBUG: DumpPEsInRange: Scanning range 0x3f0000 - 0x400000. 2019-02-11 18:26:15,792 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3f0000 2019-02-11 18:26:15,792 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,792 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x3f0000 2019-02-11 18:26:15,792 [root] DEBUG: DumpProcess: Module entry point VA is 0x3ff5e0 2019-02-11 18:26:15,808 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2952_79215261911122019 2019-02-11 18:26:15,808 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,808 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x3f0000. 2019-02-11 18:26:15,808 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3f0001-0x400000. 2019-02-11 18:26:15,808 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 18:26:15,808 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x3f1000 and Type=0x0. 2019-02-11 18:26:15,808 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x3f1000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 18:26:15,808 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x3f1000, AllocationBaseExecBpSet = 1 2019-02-11 18:26:15,808 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x3f1000 2019-02-11 18:26:15,808 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x3f1000. 2019-02-11 18:26:15,808 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x3f0000, size 0x11000). 2019-02-11 18:26:15,808 [root] DEBUG: DumpPEsInRange: Scanning range 0x3f0000 - 0x401000. 2019-02-11 18:26:15,808 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3f0000 2019-02-11 18:26:15,808 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,808 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x3f0000 2019-02-11 18:26:15,822 [root] DEBUG: DumpProcess: Module entry point VA is 0x3ff5e0 2019-02-11 18:26:15,822 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2952_82315261911122019 2019-02-11 18:26:15,822 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,822 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x3f0000. 2019-02-11 18:26:15,822 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3f0001-0x401000. 2019-02-11 18:26:15,822 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 18:26:15,822 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 18:26:15,838 [root] INFO: Announced 32-bit process name: VaiPmlRWuo2dxL.exe pid: 3040 2019-02-11 18:26:15,854 [root] INFO: Added new process to list with pid: 3040 2019-02-11 18:26:15,854 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 18:26:15,854 [lib.api.process] INFO: 32-bit DLL to inject is C:\whprbueeo\dll\UjjAEMn.dll, loader C:\whprbueeo\bin\LogBewe.exe 2019-02-11 18:26:15,854 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3040 2019-02-11 18:26:15,854 [root] INFO: Disabling sleep skipping. 2019-02-11 18:26:15,854 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 18:26:15,854 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x2e0000 2019-02-11 18:26:15,854 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 18:26:15,869 [root] INFO: Disabling sleep skipping. 2019-02-11 18:26:15,869 [root] INFO: Monitor successfully loaded in process with pid 3040. 2019-02-11 18:26:15,869 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x4e0000, RegionSize: 0x1a000. 2019-02-11 18:26:15,869 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x4e0000, AllocationSize: 0x1a000, ThreadId: 0x83c 2019-02-11 18:26:15,869 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x4e0000 and Type=0x1. 2019-02-11 18:26:15,869 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x4e0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:15,869 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x4e0000 2019-02-11 18:26:15,869 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,869 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x4e0000. 2019-02-11 18:26:15,885 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 18:26:15,885 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:15,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,885 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x4e0000. 2019-02-11 18:26:15,885 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 18:26:15,885 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x4e003c and Type=0x1. 2019-02-11 18:26:15,885 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,885 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x4e003c (EIP = 0x10f2927) 2019-02-11 18:26:15,885 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:15,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,885 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 18:26:15,885 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x4e003c. 2019-02-11 18:26:15,885 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x4e0080 and Type=0x1. 2019-02-11 18:26:15,885 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,885 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x4e0080 (EIP = 0x10f2927) 2019-02-11 18:26:15,885 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 18:26:15,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,885 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x4e0080. 2019-02-11 18:26:15,885 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 18:26:15,885 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:15,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,885 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x4e0080. 2019-02-11 18:26:15,885 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x4e00a8 and Type=0x1. 2019-02-11 18:26:15,885 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,885 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0x10f2927). 2019-02-11 18:26:15,885 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:15,901 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x4e00a8. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x4e0075 and Type=0x0. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x4e0075 (EIP = 0x10f2927). 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,901 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x4e00a8. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x4e2e75 and Type=0x0. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x4e2e75 (EIP = 0x10f2927). 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,901 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x4e00a8. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x4e2e75 and Type=0x0. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x4e2e75 (EIP = 0x10f2927). 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,901 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:15,901 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x4e00a8. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x4e2e75 and Type=0x0. 2019-02-11 18:26:15,901 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,917 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x4e2e75 (EIP = 0x10f2927). 2019-02-11 18:26:15,917 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:15,917 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x520000, RegionSize: 0x18000. 2019-02-11 18:26:15,917 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x4e0000. 2019-02-11 18:26:15,917 [root] DEBUG: DumpPEsInRange: Scanning range 0x4e0000 - 0x4fa000. 2019-02-11 18:26:15,917 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x4e0000 2019-02-11 18:26:15,917 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,917 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x4e0000 2019-02-11 18:26:15,917 [root] DEBUG: DumpProcess: Module entry point VA is 0x4e2e75 2019-02-11 18:26:15,917 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\3040_91715261911122019 2019-02-11 18:26:15,917 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,917 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x4e0000. 2019-02-11 18:26:15,917 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x4e0001-0x4fa000. 2019-02-11 18:26:15,917 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 18:26:15,917 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x4e0000 - 0x4fa000. 2019-02-11 18:26:15,917 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x4e00a8. 2019-02-11 18:26:15,931 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x4e2e75. 2019-02-11 18:26:15,931 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x520000, AllocationSize: 0x18000, ThreadId: 0x83c 2019-02-11 18:26:15,931 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x520000 and Type=0x1. 2019-02-11 18:26:15,931 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x520000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:15,931 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x520000 2019-02-11 18:26:15,931 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x4e28ee 2019-02-11 18:26:15,931 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x520000. 2019-02-11 18:26:15,931 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x520000: 0x0. 2019-02-11 18:26:15,931 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x520000 and Type=0x0. 2019-02-11 18:26:15,931 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:15,931 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x520000, AllocationBaseExecBpSet = 1 (EIP = 0x4e28ee) 2019-02-11 18:26:15,931 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:15,931 [root] DEBUG: ProtectionHandler: Address: 0x501000, RegionSize: 0x10000 2019-02-11 18:26:15,931 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x520000. 2019-02-11 18:26:15,931 [root] DEBUG: DumpPEsInRange: Scanning range 0x500000 - 0x510000. 2019-02-11 18:26:15,931 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x500000 2019-02-11 18:26:15,931 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,931 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x500000 2019-02-11 18:26:15,931 [root] DEBUG: DumpProcess: Module entry point VA is 0x50f5e0 2019-02-11 18:26:15,947 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\3040_93215261911122019 2019-02-11 18:26:15,947 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,947 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x500000. 2019-02-11 18:26:15,947 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x500001-0x510000. 2019-02-11 18:26:15,947 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 18:26:15,947 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x520000 - 0x538000. 2019-02-11 18:26:15,947 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x520000. 2019-02-11 18:26:15,947 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x520000. 2019-02-11 18:26:15,947 [root] DEBUG: DumpPEsInRange: Scanning range 0x500000 - 0x510000. 2019-02-11 18:26:15,947 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x500000 2019-02-11 18:26:15,947 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,947 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x500000 2019-02-11 18:26:15,947 [root] DEBUG: DumpProcess: Module entry point VA is 0x50f5e0 2019-02-11 18:26:15,963 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\3040_94815261911122019 2019-02-11 18:26:15,963 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,963 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x500000. 2019-02-11 18:26:15,963 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x500001-0x510000. 2019-02-11 18:26:15,963 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 18:26:15,963 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x501000 and Type=0x0. 2019-02-11 18:26:15,963 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x501000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 18:26:15,963 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x501000, AllocationBaseExecBpSet = 1 2019-02-11 18:26:15,963 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x501000 2019-02-11 18:26:15,963 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x501000. 2019-02-11 18:26:15,963 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x500000, size 0x11000). 2019-02-11 18:26:15,963 [root] DEBUG: DumpPEsInRange: Scanning range 0x500000 - 0x511000. 2019-02-11 18:26:15,963 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x500000 2019-02-11 18:26:15,979 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:15,979 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x500000 2019-02-11 18:26:15,979 [root] DEBUG: DumpProcess: Module entry point VA is 0x50f5e0 2019-02-11 18:26:15,979 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\3040_97915261911122019 2019-02-11 18:26:15,979 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:15,979 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x500000. 2019-02-11 18:26:15,979 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x500001-0x511000. 2019-02-11 18:26:15,979 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 18:26:15,979 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 18:26:15,979 [root] INFO: Notified of termination of process with pid 2952. 2019-02-11 18:26:22,921 [root] INFO: Announced starting service "dafpanes" 2019-02-11 18:26:22,921 [root] INFO: Attaching to Service Control Manager (services.exe - pid 460) 2019-02-11 18:26:22,921 [lib.api.process] DEBUG: Using CreateRemoteThread injection. 2019-02-11 18:26:22,951 [lib.api.process] INFO: 64-bit DLL to inject is C:\whprbueeo\dll\aSeKHm.dll, loader C:\whprbueeo\bin\NMZeuqqI.exe 2019-02-11 18:26:22,967 [root] DEBUG: Terminate processes on terminate_event disabled. 2019-02-11 18:26:22,967 [root] DEBUG: Process dumps enabled. 2019-02-11 18:26:22,983 [root] INFO: Disabling sleep skipping. 2019-02-11 18:26:22,999 [root] WARNING: Unable to place hook on LockResource 2019-02-11 18:26:22,999 [root] WARNING: Unable to hook LockResource 2019-02-11 18:26:23,015 [root] DEBUG: CAPE initialised: 64-bit base package loaded in process 460 at 0x0000000074110000, image base 0x00000000FFA10000, stack from 0x0000000002E46000-0x0000000002E50000 2019-02-11 18:26:23,015 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe. 2019-02-11 18:26:23,029 [root] INFO: Added new process to list with pid: 460 2019-02-11 18:26:23,029 [root] INFO: Monitor successfully loaded in process with pid 460. 2019-02-11 18:26:24,013 [root] INFO: Announced 32-bit process name: dafpanes.exe pid: 2904 2019-02-11 18:26:24,013 [root] INFO: Added new process to list with pid: 2904 2019-02-11 18:26:24,013 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 18:26:24,029 [lib.api.process] INFO: 32-bit DLL to inject is C:\whprbueeo\dll\UjjAEMn.dll, loader C:\whprbueeo\bin\LogBewe.exe 2019-02-11 18:26:24,029 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2904 2019-02-11 18:26:24,059 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 18:26:24,059 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x160000 2019-02-11 18:26:24,059 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 18:26:24,075 [root] INFO: Disabling sleep skipping. 2019-02-11 18:26:24,075 [root] INFO: Monitor successfully loaded in process with pid 2904. 2019-02-11 18:26:24,091 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x390000, RegionSize: 0x1a000. 2019-02-11 18:26:24,091 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x390000, AllocationSize: 0x1a000, ThreadId: 0xb5c 2019-02-11 18:26:24,107 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x390000 and Type=0x1. 2019-02-11 18:26:24,107 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x390000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:24,107 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x390000 2019-02-11 18:26:24,138 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,138 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x390000. 2019-02-11 18:26:24,138 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 18:26:24,154 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:24,154 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,168 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x390000. 2019-02-11 18:26:24,168 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 18:26:24,184 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x39003c and Type=0x1. 2019-02-11 18:26:24,184 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,200 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x39003c (EIP = 0x10f2927) 2019-02-11 18:26:24,216 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:24,232 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,232 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 18:26:24,232 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x39003c. 2019-02-11 18:26:24,246 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x390080 and Type=0x1. 2019-02-11 18:26:24,246 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,246 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x390080 (EIP = 0x10f2927) 2019-02-11 18:26:24,246 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 18:26:24,246 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,246 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x390080. 2019-02-11 18:26:24,246 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 18:26:24,263 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:24,263 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,263 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x390080. 2019-02-11 18:26:24,278 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x3900a8 and Type=0x1. 2019-02-11 18:26:24,293 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,293 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0x10f2927). 2019-02-11 18:26:24,309 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:24,325 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,325 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3900a8. 2019-02-11 18:26:24,325 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x390075 and Type=0x0. 2019-02-11 18:26:24,325 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,325 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x390075 (EIP = 0x10f2927). 2019-02-11 18:26:24,325 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:24,325 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,355 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3900a8. 2019-02-11 18:26:24,355 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x392e75 and Type=0x0. 2019-02-11 18:26:24,355 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,355 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x392e75 (EIP = 0x10f2927). 2019-02-11 18:26:24,355 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:24,355 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,371 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3900a8. 2019-02-11 18:26:24,371 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x392e75 and Type=0x0. 2019-02-11 18:26:24,371 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,371 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x392e75 (EIP = 0x10f2927). 2019-02-11 18:26:24,371 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:24,371 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:24,388 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3900a8. 2019-02-11 18:26:24,388 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x392e75 and Type=0x0. 2019-02-11 18:26:24,388 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,388 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x392e75 (EIP = 0x10f2927). 2019-02-11 18:26:24,403 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:24,403 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x920000, RegionSize: 0x18000. 2019-02-11 18:26:24,418 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x390000. 2019-02-11 18:26:24,434 [root] DEBUG: DumpPEsInRange: Scanning range 0x390000 - 0x3aa000. 2019-02-11 18:26:24,434 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x390000 2019-02-11 18:26:24,434 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:24,434 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x390000 2019-02-11 18:26:24,434 [root] DEBUG: DumpProcess: Module entry point VA is 0x392e75 2019-02-11 18:26:24,466 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2904_43424261911122019 2019-02-11 18:26:24,466 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:24,480 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x390000. 2019-02-11 18:26:24,480 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x390001-0x3aa000. 2019-02-11 18:26:24,496 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 18:26:24,496 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x390000 - 0x3aa000. 2019-02-11 18:26:24,496 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x3900a8. 2019-02-11 18:26:24,496 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x392e75. 2019-02-11 18:26:24,496 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x920000, AllocationSize: 0x18000, ThreadId: 0xb5c 2019-02-11 18:26:24,496 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x920000 and Type=0x1. 2019-02-11 18:26:24,528 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x920000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:24,528 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x920000 2019-02-11 18:26:24,559 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x3928ee 2019-02-11 18:26:24,559 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x920000. 2019-02-11 18:26:24,559 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x920000: 0x0. 2019-02-11 18:26:24,559 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x920000 and Type=0x0. 2019-02-11 18:26:24,575 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:24,575 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x920000, AllocationBaseExecBpSet = 1 (EIP = 0x3928ee) 2019-02-11 18:26:24,575 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:24,589 [root] DEBUG: ProtectionHandler: Address: 0x511000, RegionSize: 0x10000 2019-02-11 18:26:24,589 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x920000. 2019-02-11 18:26:24,589 [root] DEBUG: DumpPEsInRange: Scanning range 0x510000 - 0x520000. 2019-02-11 18:26:24,589 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x510000 2019-02-11 18:26:24,589 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:24,589 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x510000 2019-02-11 18:26:24,589 [root] DEBUG: DumpProcess: Module entry point VA is 0x51f5e0 2019-02-11 18:26:24,605 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2904_59024261911122019 2019-02-11 18:26:24,605 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:24,605 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x510000. 2019-02-11 18:26:24,605 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x510001-0x520000. 2019-02-11 18:26:24,605 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 18:26:24,605 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x920000 - 0x938000. 2019-02-11 18:26:24,605 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x920000. 2019-02-11 18:26:24,605 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x920000. 2019-02-11 18:26:24,621 [root] DEBUG: DumpPEsInRange: Scanning range 0x510000 - 0x520000. 2019-02-11 18:26:24,621 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x510000 2019-02-11 18:26:24,653 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:24,667 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x510000 2019-02-11 18:26:24,667 [root] DEBUG: DumpProcess: Module entry point VA is 0x51f5e0 2019-02-11 18:26:24,887 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2904_66824261911122019 2019-02-11 18:26:24,887 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:24,887 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x510000. 2019-02-11 18:26:24,887 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x510001-0x520000. 2019-02-11 18:26:24,917 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 18:26:24,917 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x511000 and Type=0x0. 2019-02-11 18:26:24,917 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x511000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 18:26:24,917 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x511000, AllocationBaseExecBpSet = 1 2019-02-11 18:26:24,934 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x511000 2019-02-11 18:26:24,934 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x511000. 2019-02-11 18:26:24,948 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x510000, size 0x11000). 2019-02-11 18:26:24,948 [root] DEBUG: DumpPEsInRange: Scanning range 0x510000 - 0x521000. 2019-02-11 18:26:24,948 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x510000 2019-02-11 18:26:24,948 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:24,948 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x510000 2019-02-11 18:26:24,948 [root] DEBUG: DumpProcess: Module entry point VA is 0x51f5e0 2019-02-11 18:26:25,198 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\2904_878902011122019 2019-02-11 18:26:25,198 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:25,198 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x510000. 2019-02-11 18:26:25,198 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x510001-0x521000. 2019-02-11 18:26:25,213 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 18:26:25,213 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 18:26:25,213 [root] INFO: Announced 32-bit process name: dafpanes.exe pid: 1856 2019-02-11 18:26:25,213 [root] INFO: Added new process to list with pid: 1856 2019-02-11 18:26:25,213 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 18:26:25,230 [lib.api.process] INFO: 32-bit DLL to inject is C:\whprbueeo\dll\UjjAEMn.dll, loader C:\whprbueeo\bin\LogBewe.exe 2019-02-11 18:26:25,260 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1856 2019-02-11 18:26:25,276 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 18:26:25,308 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x1e0000 2019-02-11 18:26:25,308 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 18:26:25,308 [root] INFO: Disabling sleep skipping. 2019-02-11 18:26:25,308 [root] INFO: Monitor successfully loaded in process with pid 1856. 2019-02-11 18:26:25,323 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x2e0000, RegionSize: 0x1a000. 2019-02-11 18:26:25,323 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x2e0000, AllocationSize: 0x1a000, ThreadId: 0xb24 2019-02-11 18:26:25,323 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x2e0000 and Type=0x1. 2019-02-11 18:26:25,338 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x2e0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:25,338 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x2e0000 2019-02-11 18:26:25,338 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,338 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x2e0000. 2019-02-11 18:26:25,338 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 18:26:25,338 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:25,338 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,338 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x2e0000. 2019-02-11 18:26:25,355 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 18:26:25,355 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2e003c and Type=0x1. 2019-02-11 18:26:25,355 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,355 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x2e003c (EIP = 0x10f2927) 2019-02-11 18:26:25,369 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:25,369 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,369 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 18:26:25,369 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x2e003c. 2019-02-11 18:26:25,369 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2e0080 and Type=0x1. 2019-02-11 18:26:25,369 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,385 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x2e0080 (EIP = 0x10f2927) 2019-02-11 18:26:25,385 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 18:26:25,385 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,385 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x2e0080. 2019-02-11 18:26:25,385 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 18:26:25,385 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:25,385 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,385 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x2e0080. 2019-02-11 18:26:25,401 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2e00a8 and Type=0x1. 2019-02-11 18:26:25,401 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,401 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0x10f2927). 2019-02-11 18:26:25,401 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 18:26:25,401 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,417 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2e00a8. 2019-02-11 18:26:25,417 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2e0075 and Type=0x0. 2019-02-11 18:26:25,417 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,417 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x2e0075 (EIP = 0x10f2927). 2019-02-11 18:26:25,417 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:25,417 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,417 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2e00a8. 2019-02-11 18:26:25,433 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2e2e75 and Type=0x0. 2019-02-11 18:26:25,433 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,433 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x2e2e75 (EIP = 0x10f2927). 2019-02-11 18:26:25,433 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:25,433 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,433 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2e00a8. 2019-02-11 18:26:25,433 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2e2e75 and Type=0x0. 2019-02-11 18:26:25,447 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,447 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x2e2e75 (EIP = 0x10f2927). 2019-02-11 18:26:25,447 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:25,447 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x10f2927 2019-02-11 18:26:25,447 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2e00a8. 2019-02-11 18:26:25,463 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x2e2e75 and Type=0x0. 2019-02-11 18:26:25,463 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,463 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x2e2e75 (EIP = 0x10f2927). 2019-02-11 18:26:25,463 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 18:26:25,463 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x960000, RegionSize: 0x18000. 2019-02-11 18:26:25,463 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x2e0000. 2019-02-11 18:26:25,480 [root] DEBUG: DumpPEsInRange: Scanning range 0x2e0000 - 0x2fa000. 2019-02-11 18:26:25,480 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x2e0000 2019-02-11 18:26:25,480 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:25,480 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x2e0000 2019-02-11 18:26:25,494 [root] DEBUG: DumpProcess: Module entry point VA is 0x2e2e75 2019-02-11 18:26:25,510 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\1856_49525261911122019 2019-02-11 18:26:25,510 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:25,526 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x2e0000. 2019-02-11 18:26:25,542 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x2e0001-0x2fa000. 2019-02-11 18:26:25,542 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 18:26:25,542 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x2e0000 - 0x2fa000. 2019-02-11 18:26:25,558 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x2e00a8. 2019-02-11 18:26:25,558 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x2e2e75. 2019-02-11 18:26:25,558 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x960000, AllocationSize: 0x18000, ThreadId: 0xb24 2019-02-11 18:26:25,572 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x960000 and Type=0x1. 2019-02-11 18:26:25,588 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x960000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 18:26:25,604 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x960000 2019-02-11 18:26:25,604 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x2e28ee 2019-02-11 18:26:25,604 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x960000. 2019-02-11 18:26:25,619 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x960000: 0x0. 2019-02-11 18:26:25,635 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x960000 and Type=0x0. 2019-02-11 18:26:25,635 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 18:26:25,635 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x960000, AllocationBaseExecBpSet = 1 (EIP = 0x2e28ee) 2019-02-11 18:26:25,635 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 18:26:25,635 [root] DEBUG: ProtectionHandler: Address: 0x301000, RegionSize: 0x10000 2019-02-11 18:26:25,635 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x960000. 2019-02-11 18:26:25,635 [root] DEBUG: DumpPEsInRange: Scanning range 0x300000 - 0x310000. 2019-02-11 18:26:25,635 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x300000 2019-02-11 18:26:25,635 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:25,651 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x300000 2019-02-11 18:26:25,651 [root] DEBUG: DumpProcess: Module entry point VA is 0x30f5e0 2019-02-11 18:26:25,651 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\1856_65125261911122019 2019-02-11 18:26:25,651 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:25,667 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x300000. 2019-02-11 18:26:25,667 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x300001-0x310000. 2019-02-11 18:26:25,681 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 18:26:25,681 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x960000 - 0x978000. 2019-02-11 18:26:25,713 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x960000. 2019-02-11 18:26:25,713 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x960000. 2019-02-11 18:26:25,713 [root] DEBUG: DumpPEsInRange: Scanning range 0x300000 - 0x310000. 2019-02-11 18:26:25,713 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x300000 2019-02-11 18:26:25,713 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:25,713 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x300000 2019-02-11 18:26:25,713 [root] DEBUG: DumpProcess: Module entry point VA is 0x30f5e0 2019-02-11 18:26:25,729 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\1856_71425261911122019 2019-02-11 18:26:25,729 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:25,729 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x300000. 2019-02-11 18:26:25,729 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x300001-0x310000. 2019-02-11 18:26:25,729 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 18:26:25,729 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x301000 and Type=0x0. 2019-02-11 18:26:25,744 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x301000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 18:26:25,744 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x301000, AllocationBaseExecBpSet = 1 2019-02-11 18:26:25,759 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x301000 2019-02-11 18:26:25,776 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x301000. 2019-02-11 18:26:25,776 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x300000, size 0x11000). 2019-02-11 18:26:25,776 [root] DEBUG: DumpPEsInRange: Scanning range 0x300000 - 0x311000. 2019-02-11 18:26:25,792 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x300000 2019-02-11 18:26:25,792 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 18:26:25,792 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x300000 2019-02-11 18:26:25,792 [root] DEBUG: DumpProcess: Module entry point VA is 0x30f5e0 2019-02-11 18:26:25,822 [root] INFO: Added new CAPE file to list with path: C:\whprbueeo\CAPE\1856_7701102011122019 2019-02-11 18:26:25,838 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 18:26:25,854 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x300000. 2019-02-11 18:26:25,854 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x300001-0x311000. 2019-02-11 18:26:25,854 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 18:26:25,869 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 18:26:25,869 [root] INFO: Notified of termination of process with pid 2904. 2019-02-11 18:26:25,869 [root] WARNING: Unable to open termination event for pid 2904. 2019-02-11 18:26:25,869 [root] INFO: Notified of termination of process with pid 3040. 2019-02-11 18:27:15,461 [root] INFO: Analysis timeout hit (60 seconds), terminating analysis. 2019-02-11 18:27:15,477 [root] INFO: Created shutdown mutex. 2019-02-11 18:27:16,506 [root] INFO: Setting terminate event for process 1856. 2019-02-11 18:27:17,022 [root] INFO: Shutting down package. 2019-02-11 18:27:17,022 [root] INFO: Stopping auxiliary modules. 2019-02-11 18:27:17,022 [root] INFO: Finishing auxiliary modules. 2019-02-11 18:27:17,022 [root] INFO: Shutting down pipe server and dumping dropped files. 2019-02-11 18:27:17,022 [root] INFO: Analysis completed.
Name | Label | Manager | Started On | Shutdown On |
---|---|---|---|---|
target-01 | target-01 | ESX | 2019-02-11 18:26:12 | 2019-02-11 18:27:38 |
File Name | b18c064545fb00660dceebf2d7266702cb583dd658d4bdfea3545e1cdfd5732f |
---|---|
File Size | 278528 bytes |
File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5 | 91c332f5a5c7c4ec44e181b80ae3bc36 |
SHA1 | 6627756f9a17a0ac4ea31efa4c155645c2e425ac |
SHA256 | b18c064545fb00660dceebf2d7266702cb583dd658d4bdfea3545e1cdfd5732f |
SHA512 | 058665199c3695978abc4f846ae17bf20962d96a04eb0c970e8c3d1ce8a7b2da056e0b20f866a944b40650d863e984016ccabd3a8779b547b7850d6e876cf8b0 |
CRC32 | 54C5B8B9 |
Ssdeep | 3072:p+PtttttZlqp2nI8FkmbzEs8ttttttttttttttttttttmgRyZ6waEdW2NiCIYRAy:Q+ikyZeEA2NisAr0kdL5 |
TrID |
|
ClamAV | None matched |
Yara | None matched |
CAPE Yara | None matched |
Download Download ZIP Resubmit sample |
No domains contacted.
Image Base | 0x00400000 |
---|---|
Entry Point | 0x004024f9 |
Reported Checksum | 0x00000000 |
Actual Checksum | 0x0004f5d6 |
Minimum OS Version | 6.0 |
PDB Path | YmAGxf1R..pdb |
Compile Time | 2019-02-11 18:21:28 |
Import Hash | ec86a106f044de478d157890f20225dd |
Name | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00003048 | 0x00004000 | IMAGE_SCN_TYPE_NO_PAD|IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_LNK_INFO|IMAGE_SCN_LNK_REMOVE|IMAGE_SCN_GPREL|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 5.60 |
.rdata | 0x00005000 | 0x0001ae22 | 0x0001b000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 7.77 |
.data | 0x00020000 | 0x00002208 | 0x00001000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_LNK_COMDAT|IMAGE_SCN_NO_DEFER_SPEC_EXC|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 5.55 |
.s2u | 0x00023000 | 0x00021190 | 0x00022000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.31 |
.reloc | 0x00045000 | 0x0000020c | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 1.24 |
Source | Source Port | Destination | Destination Port |
---|---|---|---|
192.168.35.21 | 49189 | 189.163.137.10 | 20 |
192.168.35.21 | 49188 | 76.94.226.173 | 20 |
No UDP connections recorded.
No domains contacted.
No HTTP requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP
No JA3 hashes found.
File name | dafpanes.exe |
---|---|
Associated Filenames |
C:\Windows\SysWOW64\dafpanes.exe
|
File Size | 278528 bytes |
File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5 | 91c332f5a5c7c4ec44e181b80ae3bc36 |
SHA1 | 6627756f9a17a0ac4ea31efa4c155645c2e425ac |
SHA256 | b18c064545fb00660dceebf2d7266702cb583dd658d4bdfea3545e1cdfd5732f |
CRC32 | 54C5B8B9 |
Ssdeep | 3072:p+PtttttZlqp2nI8FkmbzEs8ttttttttttttttttttttmgRyZ6waEdW2NiCIYRAy:Q+ikyZeEA2NisAr0kdL5 |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
Type | Emotet Config |
---|---|
RSA public key |
-----BEGIN PUBLIC KEY-----
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx
S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc
hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB
-----END PUBLIC KEY-----
|
address |
76.94.226.173:20
189.163.137.10:20
70.55.70.230:7080
174.79.240.46:8080
50.93.34.66:443
64.87.26.16:80
133.242.164.31:7080
115.71.233.127:443
153.121.36.202:7080
50.31.0.160:8080
187.151.226.219:465
24.227.158.234:21
190.40.100.7:8080
5.230.147.179:8080
50.80.9.93:143
94.76.200.114:8080
169.0.85.74:465
83.222.124.62:8080
174.96.7.155:80
174.80.166.76:21
24.173.121.154:993
97.100.88.65:80
100.35.190.8:443
178.62.37.188:443
87.106.210.123:80
189.225.165.11:995
184.186.222.145:8443
45.123.3.54:443
208.107.52.29:80
71.7.15.240:22
211.115.111.19:443
66.57.212.114:50000
45.63.17.206:8080
108.190.34.69:20
186.3.223.3:995
173.255.196.209:8080
73.119.47.209:22
61.69.20.54:22
67.205.149.117:443
217.13.106.160:7080
68.192.249.20:143
62.75.187.192:8080
107.13.149.212:8443
24.228.124.151:7080
69.198.17.7:8080
169.57.61.42:80
190.114.242.130:20
62.75.191.231:8080
96.234.162.118:22
75.101.48.184:995
198.74.58.47:443
71.167.42.74:53
208.78.100.202:8080
|
Download |
Type | Extracted PE Image: 32-bit executable |
---|---|
Size | 20992 bytes |
Virtual Address | 0x2d0000 |
Process | VaiPmlRWuo2dxL.exe |
PID | 2952 |
Path | C:\Users\user\AppData\Local\Temp\VaiPmlRWuo2dxL.exe |
MD5 | 13498d590986080faf7669bef9e6d176 |
SHA1 | e86f87751098b578768d5f7330664eb2a8fb7e07 |
SHA256 | cd10fa9887bb2348035b99c594fe606e87f43fa83cba50c7b3c7a50e637621fb |
CRC32 | FE1A2D26 |
Ssdeep | 384:7V4HiynLNmcSoqauxTx6SjS+T8kZse4GhpUW9vhCSs79XidHM:7VsiynwcSnxTxjPT8SpU9Ss7dids |
Yara | None matched |
CAPE Yara | None matched |
Download Download ZIP |
Type | Emotet Payload: 32-bit executable |
---|---|
Size | 78336 bytes |
Virtual Address | 0x3f0000 |
Process | VaiPmlRWuo2dxL.exe |
PID | 2952 |
Path | C:\Users\user\AppData\Local\Temp\VaiPmlRWuo2dxL.exe |
MD5 | 6a4147bb1d0fe8b0c931e9c3f2330000 |
SHA1 | 6797be469809c422e38ad459173937f29352eecd |
SHA256 | be2ed63b2c583799e382bba6559ed99f5a601c61e8b95095d41a44068843190f |
CRC32 | 39408F74 |
Ssdeep | 1536:UMiOLwU2ZEsvb5DRhtfBGQMWff4zzWQD3OW8ZlC65dULLHrbzm5WqDlxqbfGWG:FHsxeI9DtfcMc93slT5CLLHnzwWWlxwu |
Yara | None matched |
CAPE Yara |
|
Download Download ZIP |
Type | Emotet Payload: 32-bit executable |
---|---|
Size | 82432 bytes |
Virtual Address | 0x3f0000 |
Process | VaiPmlRWuo2dxL.exe |
PID | 2952 |
Path | C:\Users\user\AppData\Local\Temp\VaiPmlRWuo2dxL.exe |
MD5 | e333157838fc105c79b94cb443db0bb4 |
SHA1 | 63d73a34f2322abb2b3438f429e98ac1935a078c |
SHA256 | c2fa7fcc2440a2df81e7653fd70e70cb2c1b9c9a7a5a9124fe46570023d1ef56 |
CRC32 | 1E219973 |
Ssdeep | 1536:SiOLwU2ZEsvb5DRhtfBGQMWff4zzWQD3OW8ZlC65dULLHrbzm5WqDlxqbfGWGf:SHsxeI9DtfcMc93slT5CLLHnzwWWlxw0 |
Yara | None matched |
CAPE Yara |
|
Download Download ZIP |
Task ID | 36414 |
---|---|
Mongo ID | 5c61c8bef284884f68b2c6e7 |
Cuckoo release | 1.3-CAPE |
Delete |