Category | Package | Started | Completed | Duration | Log |
---|---|---|---|---|---|
FILE | Extraction | 2019-02-11 19:07:17 | 2019-02-11 19:08:39 | 82 seconds | Show Log |
2019-02-11 19:07:17,000 [root] INFO: Date set to: 02-11-19, time set to: 19:07:17, timeout set to: 60 2019-02-11 19:07:17,015 [root] DEBUG: Starting analyzer from: C:\gsgcnm 2019-02-11 19:07:17,015 [root] DEBUG: Storing results at: C:\tmbLefbSYs 2019-02-11 19:07:17,015 [root] DEBUG: Pipe server name: \\.\PIPE\ViVbbgPY 2019-02-11 19:07:17,015 [root] INFO: Analysis package "Extraction" has been specified. 2019-02-11 19:07:17,249 [root] DEBUG: Started auxiliary module Browser 2019-02-11 19:07:17,249 [root] DEBUG: Started auxiliary module Curtain 2019-02-11 19:07:17,249 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, signtool.exe was not found in bin/ 2019-02-11 19:07:17,249 [root] DEBUG: Started auxiliary module DigiSig 2019-02-11 19:07:17,249 [root] DEBUG: Started auxiliary module Disguise 2019-02-11 19:07:17,249 [root] DEBUG: Started auxiliary module Human 2019-02-11 19:07:17,249 [root] DEBUG: Started auxiliary module Screenshots 2019-02-11 19:07:17,279 [root] DEBUG: Started auxiliary module Sysmon 2019-02-11 19:07:17,279 [root] DEBUG: Started auxiliary module Usage 2019-02-11 19:07:17,279 [root] INFO: Analyzer: DLL set to Extraction.dll from package modules.packages.Extraction 2019-02-11 19:07:17,279 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a DLL_64 option 2019-02-11 19:07:17,404 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\aYzke.exe" with arguments "" with pid 2908 2019-02-11 19:07:17,404 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 19:07:17,404 [lib.api.process] INFO: 32-bit DLL to inject is C:\gsgcnm\dll\WdtHvL.dll, loader C:\gsgcnm\bin\OqRKbaP.exe 2019-02-11 19:07:17,436 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2908 2019-02-11 19:07:19,448 [lib.api.process] INFO: Successfully resumed process with pid 2908 2019-02-11 19:07:19,448 [root] INFO: Added new process to list with pid: 2908 2019-02-11 19:07:19,448 [root] INFO: Enabled timeout enforce, running for the full timeout. 2019-02-11 19:07:19,588 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 19:07:19,588 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x160000 2019-02-11 19:07:19,588 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 19:07:19,651 [root] INFO: Monitor successfully loaded in process with pid 2908. 2019-02-11 19:07:19,697 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x1c0000, RegionSize: 0x1a000. 2019-02-11 19:07:19,697 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x1c0000, AllocationSize: 0x1a000, ThreadId: 0xb60 2019-02-11 19:07:19,697 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x1c0000 and Type=0x1. 2019-02-11 19:07:19,697 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x1c0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:19,697 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x1c0000 2019-02-11 19:07:19,713 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x1c0000. 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:19,713 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x1c0000. 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 19:07:19,713 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x1c003c and Type=0x1. 2019-02-11 19:07:19,713 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x1c003c (EIP = 0xd9253a) 2019-02-11 19:07:19,713 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:19,713 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,713 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 19:07:19,713 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x1c003c. 2019-02-11 19:07:19,713 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x1c0080 and Type=0x1. 2019-02-11 19:07:19,713 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,730 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x1c0080 (EIP = 0xd9253a) 2019-02-11 19:07:19,730 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 19:07:19,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,730 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x1c0080. 2019-02-11 19:07:19,730 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 19:07:19,730 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:19,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,730 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x1c0080. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x1c00a8 and Type=0x1. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,730 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0xd9253a). 2019-02-11 19:07:19,730 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:19,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c0095 and Type=0x0. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x1c0095 (EIP = 0xd9253a). 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c2e95 and Type=0x0. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x1c2e95 (EIP = 0xd9253a). 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,730 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,730 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:19,730 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c2e95 and Type=0x0. 2019-02-11 19:07:19,744 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,744 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x1c2e95 (EIP = 0xd9253a). 2019-02-11 19:07:19,744 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,744 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,744 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:19,744 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c2e95 and Type=0x0. 2019-02-11 19:07:19,744 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,744 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x1c2e95 (EIP = 0xd9253a). 2019-02-11 19:07:19,744 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,744 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x290000, RegionSize: 0x18000. 2019-02-11 19:07:19,744 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x1c0000. 2019-02-11 19:07:19,744 [root] DEBUG: DumpPEsInRange: Scanning range 0x1c0000 - 0x1da000. 2019-02-11 19:07:19,744 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x1c0000 2019-02-11 19:07:19,744 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,744 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x1c0000 2019-02-11 19:07:19,744 [root] DEBUG: DumpProcess: Module entry point VA is 0x1c2e95 2019-02-11 19:07:19,744 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2908_745197112222019 2019-02-11 19:07:19,744 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,744 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x1c0000. 2019-02-11 19:07:19,744 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1c0001-0x1da000. 2019-02-11 19:07:19,760 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 19:07:19,760 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x1c0000 - 0x1da000. 2019-02-11 19:07:19,760 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x1c00a8. 2019-02-11 19:07:19,760 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x1c2e95. 2019-02-11 19:07:19,760 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x290000, AllocationSize: 0x18000, ThreadId: 0xb60 2019-02-11 19:07:19,760 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x290000 and Type=0x1. 2019-02-11 19:07:19,760 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x290000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:19,760 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x290000 2019-02-11 19:07:19,760 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x1c2903 2019-02-11 19:07:19,760 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x290000. 2019-02-11 19:07:19,760 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x290000: 0x0. 2019-02-11 19:07:19,760 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x290000 and Type=0x0. 2019-02-11 19:07:19,760 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,760 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x290000, AllocationBaseExecBpSet = 1 (EIP = 0x1c2903) 2019-02-11 19:07:19,760 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:19,760 [root] DEBUG: ProtectionHandler: Address: 0x221000, RegionSize: 0x10000 2019-02-11 19:07:19,760 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x290000. 2019-02-11 19:07:19,760 [root] DEBUG: DumpPEsInRange: Scanning range 0x220000 - 0x230000. 2019-02-11 19:07:19,760 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x220000 2019-02-11 19:07:19,760 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,760 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x220000 2019-02-11 19:07:19,760 [root] DEBUG: DumpProcess: Module entry point VA is 0x22f5e0 2019-02-11 19:07:19,776 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2908_761197112222019 2019-02-11 19:07:19,776 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,776 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x220000. 2019-02-11 19:07:19,776 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x220001-0x230000. 2019-02-11 19:07:19,776 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 19:07:19,776 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x290000 - 0x2a8000. 2019-02-11 19:07:19,776 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x290000. 2019-02-11 19:07:19,776 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x290000. 2019-02-11 19:07:19,776 [root] DEBUG: DumpPEsInRange: Scanning range 0x220000 - 0x230000. 2019-02-11 19:07:19,776 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x220000 2019-02-11 19:07:19,776 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,776 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x220000 2019-02-11 19:07:19,776 [root] DEBUG: DumpProcess: Module entry point VA is 0x22f5e0 2019-02-11 19:07:19,776 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2908_776197112222019 2019-02-11 19:07:19,776 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,776 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x220000. 2019-02-11 19:07:19,776 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x220001-0x230000. 2019-02-11 19:07:19,776 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 19:07:19,792 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x221000 and Type=0x0. 2019-02-11 19:07:19,792 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x221000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 19:07:19,792 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x221000, AllocationBaseExecBpSet = 1 2019-02-11 19:07:19,792 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x221000 2019-02-11 19:07:19,792 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x221000. 2019-02-11 19:07:19,792 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x220000, size 0x11000). 2019-02-11 19:07:19,792 [root] DEBUG: DumpPEsInRange: Scanning range 0x220000 - 0x231000. 2019-02-11 19:07:19,792 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x220000 2019-02-11 19:07:19,792 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,792 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x220000 2019-02-11 19:07:19,792 [root] DEBUG: DumpProcess: Module entry point VA is 0x22f5e0 2019-02-11 19:07:19,792 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2908_792197112222019 2019-02-11 19:07:19,792 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,792 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x220000. 2019-02-11 19:07:19,792 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x220001-0x231000. 2019-02-11 19:07:19,808 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 19:07:19,808 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 19:07:19,838 [root] INFO: Announced 32-bit process name: aYzke.exe pid: 3008 2019-02-11 19:07:19,838 [root] INFO: Added new process to list with pid: 3008 2019-02-11 19:07:19,838 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 19:07:19,838 [lib.api.process] INFO: 32-bit DLL to inject is C:\gsgcnm\dll\WdtHvL.dll, loader C:\gsgcnm\bin\OqRKbaP.exe 2019-02-11 19:07:19,854 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3008 2019-02-11 19:07:19,854 [root] INFO: Disabling sleep skipping. 2019-02-11 19:07:19,854 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 19:07:19,854 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x160000 2019-02-11 19:07:19,854 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 19:07:19,854 [root] INFO: Disabling sleep skipping. 2019-02-11 19:07:19,869 [root] INFO: Monitor successfully loaded in process with pid 3008. 2019-02-11 19:07:19,869 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x3b0000, RegionSize: 0x1a000. 2019-02-11 19:07:19,869 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x3b0000, AllocationSize: 0x1a000, ThreadId: 0xbfc 2019-02-11 19:07:19,869 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x3b0000 and Type=0x1. 2019-02-11 19:07:19,869 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x3b0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:19,869 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x3b0000 2019-02-11 19:07:19,869 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x3b0000. 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:19,869 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x3b0000. 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 19:07:19,869 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x3b003c and Type=0x1. 2019-02-11 19:07:19,869 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x3b003c (EIP = 0xd9253a) 2019-02-11 19:07:19,869 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:19,869 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,869 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 19:07:19,869 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x3b003c. 2019-02-11 19:07:19,869 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x3b0080 and Type=0x1. 2019-02-11 19:07:19,869 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,885 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x3b0080 (EIP = 0xd9253a) 2019-02-11 19:07:19,885 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 19:07:19,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,885 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x3b0080. 2019-02-11 19:07:19,885 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 19:07:19,885 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:19,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,885 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x3b0080. 2019-02-11 19:07:19,885 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x3b00a8 and Type=0x1. 2019-02-11 19:07:19,885 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,885 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0xd9253a). 2019-02-11 19:07:19,885 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:19,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,885 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3b00a8. 2019-02-11 19:07:19,885 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x3b0095 and Type=0x0. 2019-02-11 19:07:19,885 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,885 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x3b0095 (EIP = 0xd9253a). 2019-02-11 19:07:19,885 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,885 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3b00a8. 2019-02-11 19:07:19,885 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x3b2e95 and Type=0x0. 2019-02-11 19:07:19,885 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,885 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x3b2e95 (EIP = 0xd9253a). 2019-02-11 19:07:19,885 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,885 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,901 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3b00a8. 2019-02-11 19:07:19,901 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x3b2e95 and Type=0x0. 2019-02-11 19:07:19,901 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,901 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x3b2e95 (EIP = 0xd9253a). 2019-02-11 19:07:19,901 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,901 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:19,901 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x3b00a8. 2019-02-11 19:07:19,901 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x3b2e95 and Type=0x0. 2019-02-11 19:07:19,901 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,901 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x3b2e95 (EIP = 0xd9253a). 2019-02-11 19:07:19,901 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:19,901 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x540000, RegionSize: 0x18000. 2019-02-11 19:07:19,901 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x3b0000. 2019-02-11 19:07:19,901 [root] DEBUG: DumpPEsInRange: Scanning range 0x3b0000 - 0x3ca000. 2019-02-11 19:07:19,901 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3b0000 2019-02-11 19:07:19,901 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,901 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x3b0000 2019-02-11 19:07:19,901 [root] DEBUG: DumpProcess: Module entry point VA is 0x3b2e95 2019-02-11 19:07:19,901 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\3008_901197112222019 2019-02-11 19:07:19,917 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,917 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x3b0000. 2019-02-11 19:07:19,917 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3b0001-0x3ca000. 2019-02-11 19:07:19,917 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 19:07:19,917 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3b0000 - 0x3ca000. 2019-02-11 19:07:19,917 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x3b00a8. 2019-02-11 19:07:19,917 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x3b2e95. 2019-02-11 19:07:19,917 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x540000, AllocationSize: 0x18000, ThreadId: 0xbfc 2019-02-11 19:07:19,917 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x540000 and Type=0x1. 2019-02-11 19:07:19,917 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x540000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:19,917 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x540000 2019-02-11 19:07:19,917 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x3b2903 2019-02-11 19:07:19,917 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x540000. 2019-02-11 19:07:19,917 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x540000: 0x0. 2019-02-11 19:07:19,917 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x540000 and Type=0x0. 2019-02-11 19:07:19,917 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:19,917 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x540000, AllocationBaseExecBpSet = 1 (EIP = 0x3b2903) 2019-02-11 19:07:19,917 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:19,917 [root] DEBUG: ProtectionHandler: Address: 0x411000, RegionSize: 0x10000 2019-02-11 19:07:19,917 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x540000. 2019-02-11 19:07:19,917 [root] DEBUG: DumpPEsInRange: Scanning range 0x410000 - 0x420000. 2019-02-11 19:07:19,917 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x410000 2019-02-11 19:07:19,917 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,917 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x410000 2019-02-11 19:07:19,917 [root] DEBUG: DumpProcess: Module entry point VA is 0x41f5e0 2019-02-11 19:07:19,931 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\3008_932197112222019 2019-02-11 19:07:19,931 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,931 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x410000. 2019-02-11 19:07:19,931 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x410001-0x420000. 2019-02-11 19:07:19,931 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 19:07:19,931 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x540000 - 0x558000. 2019-02-11 19:07:19,931 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x540000. 2019-02-11 19:07:19,931 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x540000. 2019-02-11 19:07:19,931 [root] DEBUG: DumpPEsInRange: Scanning range 0x410000 - 0x420000. 2019-02-11 19:07:19,931 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x410000 2019-02-11 19:07:19,931 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,931 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x410000 2019-02-11 19:07:19,931 [root] DEBUG: DumpProcess: Module entry point VA is 0x41f5e0 2019-02-11 19:07:19,931 [root] DEBUG: savePeFileToDisk: Name clash, trying to obtain new name... 2019-02-11 19:07:19,931 [root] DEBUG: Error 183 (0xb7) - savePeFileToDisk: Failed twice to rename file: Cannot create a file when that file already exists. 2019-02-11 19:07:19,931 [root] DEBUG: Error 183 (0xb7) - DumpProcess: Error - Cannot dump image: Cannot create a file when that file already exists. 2019-02-11 19:07:19,931 [root] DEBUG: DumpImageInCurrentProcess: Failed to dump PE as virtual image. 2019-02-11 19:07:19,947 [root] DEBUG: DumpPEsInRange: Failed to dump PE image from 0x410000. 2019-02-11 19:07:19,947 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x410001-0x420000. 2019-02-11 19:07:19,947 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x411000 and Type=0x0. 2019-02-11 19:07:19,947 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x411000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 19:07:19,947 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x411000, AllocationBaseExecBpSet = 1 2019-02-11 19:07:19,947 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x411000 2019-02-11 19:07:19,947 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x411000. 2019-02-11 19:07:19,947 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x410000, size 0x11000). 2019-02-11 19:07:19,947 [root] DEBUG: DumpPEsInRange: Scanning range 0x410000 - 0x421000. 2019-02-11 19:07:19,947 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x410000 2019-02-11 19:07:19,947 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:19,947 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x410000 2019-02-11 19:07:19,947 [root] DEBUG: DumpProcess: Module entry point VA is 0x41f5e0 2019-02-11 19:07:19,963 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\3008_948197112222019 2019-02-11 19:07:19,963 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:19,963 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x410000. 2019-02-11 19:07:19,963 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x410001-0x421000. 2019-02-11 19:07:19,963 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 19:07:19,963 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 19:07:19,963 [root] INFO: Notified of termination of process with pid 2908. 2019-02-11 19:07:25,282 [root] INFO: Announced starting service "dafpanes" 2019-02-11 19:07:25,282 [root] INFO: Attaching to Service Control Manager (services.exe - pid 460) 2019-02-11 19:07:25,282 [lib.api.process] DEBUG: Using CreateRemoteThread injection. 2019-02-11 19:07:25,282 [lib.api.process] INFO: 64-bit DLL to inject is C:\gsgcnm\dll\QQnbbo.dll, loader C:\gsgcnm\bin\ssVsjshq.exe 2019-02-11 19:07:25,299 [root] DEBUG: Terminate processes on terminate_event disabled. 2019-02-11 19:07:25,299 [root] DEBUG: Process dumps enabled. 2019-02-11 19:07:25,299 [root] INFO: Disabling sleep skipping. 2019-02-11 19:07:25,313 [root] WARNING: Unable to place hook on LockResource 2019-02-11 19:07:25,329 [root] WARNING: Unable to hook LockResource 2019-02-11 19:07:25,345 [root] DEBUG: CAPE initialised: 64-bit base package loaded in process 460 at 0x0000000074110000, image base 0x00000000FFA10000, stack from 0x0000000001756000-0x0000000001760000 2019-02-11 19:07:25,345 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe. 2019-02-11 19:07:25,345 [root] INFO: Added new process to list with pid: 460 2019-02-11 19:07:25,345 [root] INFO: Monitor successfully loaded in process with pid 460. 2019-02-11 19:07:26,328 [root] INFO: Announced 32-bit process name: dafpanes.exe pid: 2876 2019-02-11 19:07:26,328 [root] INFO: Added new process to list with pid: 2876 2019-02-11 19:07:26,344 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 19:07:26,359 [lib.api.process] INFO: 32-bit DLL to inject is C:\gsgcnm\dll\WdtHvL.dll, loader C:\gsgcnm\bin\OqRKbaP.exe 2019-02-11 19:07:26,359 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2876 2019-02-11 19:07:26,405 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 19:07:26,405 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x220000 2019-02-11 19:07:26,405 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 19:07:26,405 [root] INFO: Disabling sleep skipping. 2019-02-11 19:07:26,453 [root] INFO: Monitor successfully loaded in process with pid 2876. 2019-02-11 19:07:26,453 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x290000, RegionSize: 0x1a000. 2019-02-11 19:07:26,453 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x290000, AllocationSize: 0x1a000, ThreadId: 0xb40 2019-02-11 19:07:26,453 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x290000 and Type=0x1. 2019-02-11 19:07:26,453 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x290000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:26,453 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x290000 2019-02-11 19:07:26,453 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,453 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x290000. 2019-02-11 19:07:26,453 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 19:07:26,469 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:26,469 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,469 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x290000. 2019-02-11 19:07:26,469 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 19:07:26,469 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x29003c and Type=0x1. 2019-02-11 19:07:26,483 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,483 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x29003c (EIP = 0xd9253a) 2019-02-11 19:07:26,500 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:26,500 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,500 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 19:07:26,500 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x29003c. 2019-02-11 19:07:26,516 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x290080 and Type=0x1. 2019-02-11 19:07:26,516 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,530 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x290080 (EIP = 0xd9253a) 2019-02-11 19:07:26,530 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 19:07:26,530 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,530 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x290080. 2019-02-11 19:07:26,530 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 19:07:26,530 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:26,546 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,546 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x290080. 2019-02-11 19:07:26,546 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x2900a8 and Type=0x1. 2019-02-11 19:07:26,546 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,546 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0xd9253a). 2019-02-11 19:07:26,546 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:26,546 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,546 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2900a8. 2019-02-11 19:07:26,546 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x290095 and Type=0x0. 2019-02-11 19:07:26,546 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,562 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x290095 (EIP = 0xd9253a). 2019-02-11 19:07:26,562 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:26,562 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,562 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2900a8. 2019-02-11 19:07:26,562 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x292e95 and Type=0x0. 2019-02-11 19:07:26,562 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,562 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x292e95 (EIP = 0xd9253a). 2019-02-11 19:07:26,562 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:26,562 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,562 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2900a8. 2019-02-11 19:07:26,562 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x292e95 and Type=0x0. 2019-02-11 19:07:26,562 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,578 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x292e95 (EIP = 0xd9253a). 2019-02-11 19:07:26,578 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:26,578 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,578 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x2900a8. 2019-02-11 19:07:26,578 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x292e95 and Type=0x0. 2019-02-11 19:07:26,578 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,578 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x292e95 (EIP = 0xd9253a). 2019-02-11 19:07:26,578 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:26,578 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x430000, RegionSize: 0x18000. 2019-02-11 19:07:26,578 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x290000. 2019-02-11 19:07:26,594 [root] DEBUG: DumpPEsInRange: Scanning range 0x290000 - 0x2aa000. 2019-02-11 19:07:26,594 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x290000 2019-02-11 19:07:26,594 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:26,594 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x290000 2019-02-11 19:07:26,594 [root] DEBUG: DumpProcess: Module entry point VA is 0x292e95 2019-02-11 19:07:26,608 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2876_594267112222019 2019-02-11 19:07:26,608 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:26,608 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x290000. 2019-02-11 19:07:26,608 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x290001-0x2aa000. 2019-02-11 19:07:26,608 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 19:07:26,608 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x290000 - 0x2aa000. 2019-02-11 19:07:26,608 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x2900a8. 2019-02-11 19:07:26,625 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x292e95. 2019-02-11 19:07:26,625 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x430000, AllocationSize: 0x18000, ThreadId: 0xb40 2019-02-11 19:07:26,625 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x430000 and Type=0x1. 2019-02-11 19:07:26,625 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x430000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:26,625 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x430000 2019-02-11 19:07:26,625 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x292903 2019-02-11 19:07:26,625 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x430000. 2019-02-11 19:07:26,625 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x430000: 0x0. 2019-02-11 19:07:26,625 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x430000 and Type=0x0. 2019-02-11 19:07:26,625 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,640 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x430000, AllocationBaseExecBpSet = 1 (EIP = 0x292903) 2019-02-11 19:07:26,640 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:26,640 [root] DEBUG: ProtectionHandler: Address: 0x411000, RegionSize: 0x10000 2019-02-11 19:07:26,640 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x430000. 2019-02-11 19:07:26,640 [root] DEBUG: DumpPEsInRange: Scanning range 0x410000 - 0x420000. 2019-02-11 19:07:26,640 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x410000 2019-02-11 19:07:26,640 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:26,640 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x410000 2019-02-11 19:07:26,640 [root] DEBUG: DumpProcess: Module entry point VA is 0x41f5e0 2019-02-11 19:07:26,655 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2876_640267112222019 2019-02-11 19:07:26,655 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:26,655 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x410000. 2019-02-11 19:07:26,655 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x410001-0x420000. 2019-02-11 19:07:26,655 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 19:07:26,687 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x430000 - 0x448000. 2019-02-11 19:07:26,687 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x430000. 2019-02-11 19:07:26,703 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x430000. 2019-02-11 19:07:26,703 [root] DEBUG: DumpPEsInRange: Scanning range 0x410000 - 0x420000. 2019-02-11 19:07:26,717 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x410000 2019-02-11 19:07:26,717 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:26,717 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x410000 2019-02-11 19:07:26,717 [root] DEBUG: DumpProcess: Module entry point VA is 0x41f5e0 2019-02-11 19:07:26,717 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2876_718267112222019 2019-02-11 19:07:26,717 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:26,717 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x410000. 2019-02-11 19:07:26,717 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x410001-0x420000. 2019-02-11 19:07:26,733 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 19:07:26,733 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x411000 and Type=0x0. 2019-02-11 19:07:26,733 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x411000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 19:07:26,733 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x411000, AllocationBaseExecBpSet = 1 2019-02-11 19:07:26,750 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x411000 2019-02-11 19:07:26,750 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x411000. 2019-02-11 19:07:26,750 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x410000, size 0x11000). 2019-02-11 19:07:26,750 [root] DEBUG: DumpPEsInRange: Scanning range 0x410000 - 0x421000. 2019-02-11 19:07:26,780 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x410000 2019-02-11 19:07:26,780 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:26,796 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x410000 2019-02-11 19:07:26,796 [root] DEBUG: DumpProcess: Module entry point VA is 0x41f5e0 2019-02-11 19:07:26,812 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2876_243341112222019 2019-02-11 19:07:26,812 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:26,828 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x410000. 2019-02-11 19:07:26,828 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x410001-0x421000. 2019-02-11 19:07:26,828 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 19:07:26,842 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 19:07:26,858 [root] INFO: Announced 32-bit process name: dafpanes.exe pid: 2696 2019-02-11 19:07:26,858 [root] INFO: Added new process to list with pid: 2696 2019-02-11 19:07:26,858 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 19:07:26,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\gsgcnm\dll\WdtHvL.dll, loader C:\gsgcnm\bin\OqRKbaP.exe 2019-02-11 19:07:26,890 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2696 2019-02-11 19:07:26,905 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77110000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7716124a, Wow64PrepareForException: 0x0 2019-02-11 19:07:26,905 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x120000 2019-02-11 19:07:26,905 [root] DEBUG: CAPE initialised (32-bit). 2019-02-11 19:07:26,905 [root] INFO: Disabling sleep skipping. 2019-02-11 19:07:26,921 [root] INFO: Monitor successfully loaded in process with pid 2696. 2019-02-11 19:07:26,921 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x1c0000, RegionSize: 0x1a000. 2019-02-11 19:07:26,921 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x1c0000, AllocationSize: 0x1a000, ThreadId: 0xb68 2019-02-11 19:07:26,921 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x1c0000 and Type=0x1. 2019-02-11 19:07:26,921 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x1c0000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:26,921 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x1c0000 2019-02-11 19:07:26,967 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,967 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x1c0000. 2019-02-11 19:07:26,967 [root] DEBUG: BaseAddressWriteCallback: M written to first byte, awaiting next byte. 2019-02-11 19:07:26,967 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:26,967 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:26,967 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x1c0000. 2019-02-11 19:07:26,967 [root] DEBUG: BaseAddressWriteCallback: MZ header found. 2019-02-11 19:07:26,983 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x1c003c and Type=0x1. 2019-02-11 19:07:26,983 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:26,983 [root] DEBUG: BaseAddressWriteCallback: set write bp on e_lfanew write location: 0x1c003c (EIP = 0xd9253a) 2019-02-11 19:07:26,983 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:27,015 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,015 [root] DEBUG: PEPointerWriteCallback entry. 2019-02-11 19:07:27,015 [root] DEBUG: PEPointerWriteCallback: Breakpoint 0 at Address 0x1c003c. 2019-02-11 19:07:27,015 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x1c0080 and Type=0x1. 2019-02-11 19:07:27,015 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,029 [root] DEBUG: PEPointerWriteCallback: set write bp on e_lfanew write location 0x1c0080 (EIP = 0xd9253a) 2019-02-11 19:07:27,046 [root] DEBUG: PEPointerWriteCallback executed successfully. 2019-02-11 19:07:27,046 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,046 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x1c0080. 2019-02-11 19:07:27,062 [root] DEBUG: PEHeaderWriteCallback: PE header has: 0x50. 2019-02-11 19:07:27,062 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:27,062 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,062 [root] DEBUG: PEHeaderWriteCallback: Breakpoint 0 at Address 0x1c0080. 2019-02-11 19:07:27,076 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 0 within Context, Size=0x4, Address=0x1c00a8 and Type=0x1. 2019-02-11 19:07:27,092 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,092 [root] DEBUG: PEHeaderWriteCallback: set write bp on AddressOfEntryPoint location (EIP = 0xd9253a). 2019-02-11 19:07:27,092 [root] DEBUG: PEHeaderWriteCallback executed successfully. 2019-02-11 19:07:27,092 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,108 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:27,124 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c0095 and Type=0x0. 2019-02-11 19:07:27,124 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,124 [root] DEBUG: EntryPointWriteCallback: Execution bp 1 set on EntryPoint 0x1c0095 (EIP = 0xd9253a). 2019-02-11 19:07:27,124 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:27,124 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,124 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:27,124 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c2e95 and Type=0x0. 2019-02-11 19:07:27,124 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,124 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x1c2e95 (EIP = 0xd9253a). 2019-02-11 19:07:27,124 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:27,140 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,140 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:27,140 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c2e95 and Type=0x0. 2019-02-11 19:07:27,140 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,140 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x1c2e95 (EIP = 0xd9253a). 2019-02-11 19:07:27,140 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:27,140 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0xd9253a 2019-02-11 19:07:27,140 [root] DEBUG: EntryPointWriteCallback: Breakpoint 0 at Address 0x1c00a8. 2019-02-11 19:07:27,154 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x1c2e95 and Type=0x0. 2019-02-11 19:07:27,154 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,171 [root] DEBUG: EntryPointWriteCallback: Updated EntryPoint execution bp 1 to 0x1c2e95 (EIP = 0xd9253a). 2019-02-11 19:07:27,171 [root] DEBUG: EntryPointWriteCallback executed successfully. 2019-02-11 19:07:27,171 [root] DEBUG: NtAllocateVirtualMemory hook, BaseAddress:0x940000, RegionSize: 0x18000. 2019-02-11 19:07:27,186 [root] DEBUG: NtAllocateVirtualMemory hook: attempting CAPE dump on previous region: 0x1c0000. 2019-02-11 19:07:27,201 [root] DEBUG: DumpPEsInRange: Scanning range 0x1c0000 - 0x1da000. 2019-02-11 19:07:27,217 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x1c0000 2019-02-11 19:07:27,217 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:27,217 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x1c0000 2019-02-11 19:07:27,217 [root] DEBUG: DumpProcess: Module entry point VA is 0x1c2e95 2019-02-11 19:07:27,217 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2696_218277112222019 2019-02-11 19:07:27,217 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:27,249 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x1c0000. 2019-02-11 19:07:27,263 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1c0001-0x1da000. 2019-02-11 19:07:27,263 [root] DEBUG: NtAllocateVirtualMemory hook: PE image(s) detected and dumped. 2019-02-11 19:07:27,279 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x1c0000 - 0x1da000. 2019-02-11 19:07:27,279 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x1c00a8. 2019-02-11 19:07:27,279 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x1c2e95. 2019-02-11 19:07:27,279 [root] DEBUG: SetInitialWriteBreakpoint: AllocationBase: 0x940000, AllocationSize: 0x18000, ThreadId: 0xb68 2019-02-11 19:07:27,279 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x2, Address=0x940000 and Type=0x1. 2019-02-11 19:07:27,279 [root] DEBUG: SetBreakpoint: Set bp 0 type 1 at address 0x940000, size 2 with Callback 0x74493100, ThreadHandle = 0xb8. 2019-02-11 19:07:27,279 [root] DEBUG: SetInitialWriteBreakpoint: Breakpoint 0 set write on word at base address: 0x940000 2019-02-11 19:07:27,279 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x1c2903 2019-02-11 19:07:27,279 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x940000. 2019-02-11 19:07:27,279 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x940000: 0x0. 2019-02-11 19:07:27,296 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 1 within Context, Size=0x0, Address=0x940000 and Type=0x0. 2019-02-11 19:07:27,296 [root] DEBUG: ContextSetBreakpoint: Call to ContextSetDebugRegister succeeded. 2019-02-11 19:07:27,296 [root] DEBUG: BaseAddressWriteCallback: Execution breakpoint 1 set base address: 0x940000, AllocationBaseExecBpSet = 1 (EIP = 0x1c2903) 2019-02-11 19:07:27,296 [root] DEBUG: BaseAddressWriteCallback executed successfully. 2019-02-11 19:07:27,296 [root] DEBUG: ProtectionHandler: Address: 0x271000, RegionSize: 0x10000 2019-02-11 19:07:27,296 [root] DEBUG: ProtectionHandler: attempting CAPE dump on region: 0x940000. 2019-02-11 19:07:27,311 [root] DEBUG: DumpPEsInRange: Scanning range 0x270000 - 0x280000. 2019-02-11 19:07:27,311 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x270000 2019-02-11 19:07:27,311 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:27,311 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x270000 2019-02-11 19:07:27,311 [root] DEBUG: DumpProcess: Module entry point VA is 0x27f5e0 2019-02-11 19:07:27,326 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2696_311277112222019 2019-02-11 19:07:27,326 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:27,326 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x270000. 2019-02-11 19:07:27,326 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x270001-0x280000. 2019-02-11 19:07:27,326 [root] DEBUG: ProtectionHandler: PE image(s) detected and dumped. 2019-02-11 19:07:27,326 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x940000 - 0x958000. 2019-02-11 19:07:27,342 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x940000. 2019-02-11 19:07:27,358 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x940000. 2019-02-11 19:07:27,358 [root] DEBUG: DumpPEsInRange: Scanning range 0x270000 - 0x280000. 2019-02-11 19:07:27,374 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x270000 2019-02-11 19:07:27,374 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:27,374 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x270000 2019-02-11 19:07:27,374 [root] DEBUG: DumpProcess: Module entry point VA is 0x27f5e0 2019-02-11 19:07:27,388 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2696_374277112222019 2019-02-11 19:07:27,388 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:27,388 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x270000. 2019-02-11 19:07:27,388 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x270001-0x280000. 2019-02-11 19:07:27,388 [root] DEBUG: ProtectionHandler: Found and dumped PE image(s). 2019-02-11 19:07:27,388 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xb8, Size=0x0, Address=0x271000 and Type=0x0. 2019-02-11 19:07:27,388 [root] DEBUG: SetBreakpoint: Set bp 0 type 0 at address 0x271000, size 0 with Callback 0x74492e90, ThreadHandle = 0xb8. 2019-02-11 19:07:27,388 [root] DEBUG: ProtectionHandler: Execution breakpoint 0 set base address: 0x271000, AllocationBaseExecBpSet = 1 2019-02-11 19:07:27,404 [root] DEBUG: Entering CAPEExceptionFilter: breakpoint hit: 0x271000 2019-02-11 19:07:27,420 [root] DEBUG: MidPageExecCallback: Breakpoint 0 at Address 0x271000. 2019-02-11 19:07:27,420 [root] DEBUG: MidPageExecCallback: Debug: About to scan region for a PE image (base 0x270000, size 0x11000). 2019-02-11 19:07:27,420 [root] DEBUG: DumpPEsInRange: Scanning range 0x270000 - 0x281000. 2019-02-11 19:07:27,420 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x270000 2019-02-11 19:07:27,420 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image. 2019-02-11 19:07:27,420 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x270000 2019-02-11 19:07:27,420 [root] DEBUG: DumpProcess: Module entry point VA is 0x27f5e0 2019-02-11 19:07:27,436 [root] INFO: Added new CAPE file to list with path: C:\gsgcnm\CAPE\2696_5735841112222019 2019-02-11 19:07:27,436 [root] DEBUG: DumpProcess: Module image dump success 2019-02-11 19:07:27,436 [root] DEBUG: DumpPEsInRange: Dumped PE image from 0x270000. 2019-02-11 19:07:27,436 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x270001-0x281000. 2019-02-11 19:07:27,436 [root] DEBUG: MidPageExecCallback: PE image(s) detected and dumped. 2019-02-11 19:07:27,451 [root] DEBUG: MidPageExecCallback executed successfully. 2019-02-11 19:07:27,451 [root] INFO: Notified of termination of process with pid 2876. 2019-02-11 19:07:27,451 [root] WARNING: Unable to open termination event for pid 2876. 2019-02-11 19:07:27,451 [root] INFO: Notified of termination of process with pid 3008. 2019-02-11 19:08:19,275 [root] INFO: Analysis timeout hit (60 seconds), terminating analysis. 2019-02-11 19:08:19,275 [root] INFO: Created shutdown mutex. 2019-02-11 19:08:20,289 [root] INFO: Setting terminate event for process 2696. 2019-02-11 19:08:20,803 [root] INFO: Shutting down package. 2019-02-11 19:08:20,803 [root] INFO: Stopping auxiliary modules. 2019-02-11 19:08:20,803 [root] INFO: Finishing auxiliary modules. 2019-02-11 19:08:20,803 [root] INFO: Shutting down pipe server and dumping dropped files. 2019-02-11 19:08:20,803 [root] INFO: Analysis completed.
Name | Label | Manager | Started On | Shutdown On |
---|---|---|---|---|
target-01 | target-01 | ESX | 2019-02-11 19:07:17 | 2019-02-11 19:08:35 |
File Name | d5cb1a67ec286e5e2527ef477ab2bef6b5c8f8c4c505e880c902192334259211 |
---|---|
File Size | 274432 bytes |
File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5 | 1a3d310bda08ae68ace6c68a93322ba3 |
SHA1 | ceffd4b96589e36a118be8073c5b8cc5972b7e78 |
SHA256 | d5cb1a67ec286e5e2527ef477ab2bef6b5c8f8c4c505e880c902192334259211 |
SHA512 | 8e2aadd5a886e94c7bafec3ff4506ca1342359eede7de9427f38dc1c035740c579028b55d351852a03aacc6b92f6c21bb3d761358fedb43b67a36e53d5a8e4fe |
CRC32 | 92856309 |
Ssdeep | 3072:50ZGtNicGW0JBNkGGqCENAwbqVN0O/eFs+PxiCWW0Ndas60YvZdLqk5O:5otcGFlYENAumNgs0xDH0kdL5 |
TrID |
|
ClamAV | None matched |
Yara | None matched |
CAPE Yara | None matched |
Download Download ZIP Resubmit sample |
No domains contacted.
Image Base | 0x00400000 |
---|---|
Entry Point | 0x004021d9 |
Reported Checksum | 0x00000000 |
Actual Checksum | 0x000493d5 |
Minimum OS Version | 6.0 |
PDB Path | YmAGxf1R..pdb |
Compile Time | 2019-02-11 19:00:30 |
Import Hash | c91520ccf85eb42b50755031f4e6d199 |
Name | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00002a4e | 0x00003000 | IMAGE_SCN_TYPE_NO_PAD|IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_LNK_INFO|IMAGE_SCN_LNK_REMOVE|IMAGE_SCN_GPREL|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.28 |
.rdata | 0x00004000 | 0x0001ae0c | 0x0001b000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 7.76 |
.data | 0x0001f000 | 0x00002120 | 0x00001000 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_LNK_COMDAT|IMAGE_SCN_NO_DEFER_SPEC_EXC|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 5.08 |
.s2u | 0x00022000 | 0x00021190 | 0x00022000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 3.31 |
.reloc | 0x00044000 | 0x000001dc | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 1.14 |
Source | Source Port | Destination | Destination Port |
---|---|---|---|
192.168.35.21 | 49184 | 189.163.137.10 | 20 |
192.168.35.21 | 49183 | 76.94.226.173 | 20 |
No UDP connections recorded.
No domains contacted.
No HTTP requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP
No JA3 hashes found.
File name | dafpanes.exe |
---|---|
Associated Filenames |
C:\Windows\SysWOW64\dafpanes.exe
|
File Size | 274432 bytes |
File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5 | 1a3d310bda08ae68ace6c68a93322ba3 |
SHA1 | ceffd4b96589e36a118be8073c5b8cc5972b7e78 |
SHA256 | d5cb1a67ec286e5e2527ef477ab2bef6b5c8f8c4c505e880c902192334259211 |
CRC32 | 92856309 |
Ssdeep | 3072:50ZGtNicGW0JBNkGGqCENAwbqVN0O/eFs+PxiCWW0Ndas60YvZdLqk5O:5otcGFlYENAumNgs0xDH0kdL5 |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
Type | Emotet Config |
---|---|
RSA public key |
-----BEGIN PUBLIC KEY-----
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMPLgcO0RQdJg/LTgiku57nH4KcLwHCx
S0lbynOUhHhKjTnmENrMA2idUbK6hI0JRZtii9oJSlb3e5NZiCK+Qr/NB2u7ZNRc
hG87aibm0ndS9xKDRXcmWwaQkF0PFuOHpwIDAQAB
-----END PUBLIC KEY-----
|
address |
76.94.226.173:20
189.163.137.10:20
70.55.70.230:7080
174.79.240.46:8080
50.93.34.66:443
64.87.26.16:80
133.242.164.31:7080
115.71.233.127:443
153.121.36.202:7080
50.31.0.160:8080
187.151.226.219:465
24.227.158.234:21
190.40.100.7:8080
5.230.147.179:8080
50.80.9.93:143
94.76.200.114:8080
169.0.85.74:465
83.222.124.62:8080
174.96.7.155:80
174.80.166.76:21
24.173.121.154:993
97.100.88.65:80
100.35.190.8:443
178.62.37.188:443
87.106.210.123:80
189.225.165.11:995
184.186.222.145:8443
45.123.3.54:443
208.107.52.29:80
71.7.15.240:22
211.115.111.19:443
66.57.212.114:50000
45.63.17.206:8080
108.190.34.69:20
186.3.223.3:995
173.255.196.209:8080
73.119.47.209:22
61.69.20.54:22
67.205.149.117:443
217.13.106.160:7080
68.192.249.20:143
62.75.187.192:8080
107.13.149.212:8443
24.228.124.151:7080
69.198.17.7:8080
169.57.61.42:80
190.114.242.130:20
62.75.191.231:8080
96.234.162.118:22
75.101.48.184:995
198.74.58.47:443
71.167.42.74:53
208.78.100.202:8080
|
Download |
Type | Extracted PE Image: 32-bit executable |
---|---|
Size | 20992 bytes |
Virtual Address | 0x1c0000 |
Process | aYzke.exe |
PID | 2908 |
Path | C:\Users\user\AppData\Local\Temp\aYzke.exe |
MD5 | a43683df8b1f90eb9bb04e1b0330a8aa |
SHA1 | f6c038d551cca3b4da4e5331ec259dee818925bb |
SHA256 | c995bfff8f9408785172df0649b8444fb888844309a29e88f9a794bd587a39d8 |
CRC32 | 5B489233 |
Ssdeep | 384:jIAyXcLpiql7SGNieL1GgPSO7u8t/7hCSs79Xidq8:8yLGGNL31/wSs7didt |
Yara | None matched |
CAPE Yara | None matched |
Download Download ZIP |
Type | Emotet Payload: 32-bit executable |
---|---|
Size | 78336 bytes |
Virtual Address | 0x220000 |
Process | aYzke.exe |
PID | 2908 |
Path | C:\Users\user\AppData\Local\Temp\aYzke.exe |
MD5 | abb625221ed68bd73288ec758679c84f |
SHA1 | 1fcb2ee7005d74a3b9f87e643c13d8e0a6fcde1d |
SHA256 | 25b580f10099c6308845df5504fcc142153180cb656dad986732c7ccb9ad2ecf |
CRC32 | D9216938 |
Ssdeep | 1536:UmyDjnL2BEBvQWnnQfBqEMWvf4dzWQz3OW8WGyDdUbLHrbzm8rDlxqbfGWG:H6Li2BNnQfYA+93XGyDCbLHnz3/lxwu |
Yara | None matched |
CAPE Yara |
|
Download Download ZIP |
Type | Emotet Payload: 32-bit executable |
---|---|
Size | 82432 bytes |
Virtual Address | 0x220000 |
Process | aYzke.exe |
PID | 2908 |
Path | C:\Users\user\AppData\Local\Temp\aYzke.exe |
MD5 | b990ffeb36387aeffd5c6acc1f730d2f |
SHA1 | 3f545a9aab647d30dc51766e2fa685058da7af0e |
SHA256 | 3b3202f0db8b393abd30a8e2ca6ad2955cd56ca2bf9042fd70922452e0984da2 |
CRC32 | A0D088E0 |
Ssdeep | 1536:NyDjnL2BEBvQWnnQfBqEMWvf4dzWQz3OW8WGyDdUbLHrbzm8rDlxqbfGWGf:N6Li2BNnQfYA+93XGyDCbLHnz3/lxwud |
Yara | None matched |
CAPE Yara |
|
Download Download ZIP |
Task ID | 36417 |
---|---|
Mongo ID | 5c61c8cdf284884f69b30b59 |
Cuckoo release | 1.3-CAPE |
Delete |