Cuckoo Sandbox

URL Details

URL
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://lookmovie2-official.lol/&ved=2ahUKEwju-d2_i8-OAxXk_7sIHaONMfUQFnoECB0QAQ&usg=AOvVaw25e3jOdgjMwgR1_VG_wvub

Score

This url shows some signs of potential malicious behavior.

The score of this url is 1.9 out of 10.

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
URL	July 23, 2025, 3:41 p.m.	July 23, 2025, 3:42 p.m.	62 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-07-23 15:41:01,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpblqbwr
2025-07-23 15:41:01,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\xYHsJqIsyFMRgeHXihIXXdXORQ
2025-07-23 15:41:01,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\YnaEeBColfcFmudbKQdlsSaoh
2025-07-23 15:41:01,328 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-23 15:41:01,328 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-23 15:41:01,750 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-23 15:41:01,953 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-07-23 15:41:01,953 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-23 15:41:01,953 [analyzer] DEBUG: Started auxiliary module Human
2025-07-23 15:41:01,953 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-23 15:41:01,967 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-23 15:41:02,046 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-23 15:41:02,046 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-23 15:41:02,046 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-23 15:41:02,046 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-23 15:41:02,171 [lib.api.process] INFO: Successfully executed process from path 'C:\\Program Files\\Internet Explorer\\iexplore.exe' with arguments ['https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://lookmovie2-official.lol/&ved=2ahUKEwju-d2_i8-OAxXk_7sIHaONMfUQFnoECB0QAQ&usg=AOvVaw25e3jOdgjMwgR1_VG_wvub'] and pid 352
2025-07-23 15:41:02,328 [analyzer] DEBUG: Loaded monitor into process with pid 352
2025-07-23 15:41:03,812 [analyzer] DEBUG: Following legitimate IE11 process: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:352 CREDAT:275457 /prefetch:2!
2025-07-23 15:41:03,890 [analyzer] INFO: Injected into process with pid 1428 and name u'iexplore.exe'
2025-07-23 15:41:03,983 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1428.
2025-07-23 15:41:04,108 [analyzer] INFO: Added new file to list with pid 352 and path C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{AC03C6CF-67CA-11F0-A5CD-D8386987CDBA}.dat
2025-07-23 15:41:04,155 [analyzer] INFO: Added new file to list with pid 352 and path C:\Users\Administrator\AppData\Local\Temp\~DF9664713300231141.TMP
2025-07-23 15:41:04,171 [analyzer] DEBUG: Loaded monitor into process with pid 1428
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2025-07-23 15:41:04,375 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2025-07-23 15:41:04,608 [analyzer] INFO: Added new file to list with pid 352 and path C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AC03C6D1-67CA-11F0-A5CD-D8386987CDBA}.dat
2025-07-23 15:41:04,625 [analyzer] INFO: Added new file to list with pid 352 and path C:\Users\Administrator\AppData\Local\Temp\~DFE78F461C371630BA.TMP
2025-07-23 15:41:10,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A9377E7E528F7E56B69A81C500ABC24
2025-07-23 15:41:10,062 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A9377E7E528F7E56B69A81C500ABC24
2025-07-23 15:41:10,062 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab7CDB.tmp
2025-07-23 15:41:10,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar7CDC.tmp
2025-07-23 15:41:10,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab7CFC.tmp
2025-07-23 15:41:10,108 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar7CFD.tmp
2025-07-23 15:41:10,265 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
2025-07-23 15:41:10,265 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
2025-07-23 15:41:10,280 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab7DBA.tmp
2025-07-23 15:41:10,296 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar7DBB.tmp
2025-07-23 15:41:10,312 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab7DDB.tmp
2025-07-23 15:41:10,328 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar7DDC.tmp
2025-07-23 15:41:10,483 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
2025-07-23 15:41:10,483 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
2025-07-23 15:41:10,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
2025-07-23 15:41:10,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199
2025-07-23 15:41:10,733 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_3AD96F919C2C7818D117658580034187
2025-07-23 15:41:10,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_3AD96F919C2C7818D117658580034187
2025-07-23 15:41:10,765 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab7F92.tmp
2025-07-23 15:41:10,780 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar7F93.tmp
2025-07-23 15:41:10,842 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\YRGXP9BH.txt
2025-07-23 15:41:10,858 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\url[1].htm
2025-07-23 15:41:10,858 [analyzer] DEBUG: Error resolving function mshtml!CDocument_write through our custom callback.
2025-07-23 15:41:10,858 [analyzer] DEBUG: Error resolving function mshtml!CElement_put_innerHTML through our custom callback.
2025-07-23 15:41:10,858 [analyzer] DEBUG: Error resolving function mshtml!CHyperlink_SetUrlComponent through our custom callback.
2025-07-23 15:41:10,875 [analyzer] DEBUG: Error resolving function mshtml!CIFrameElement_CreateElement through our custom callback.
2025-07-23 15:41:10,875 [analyzer] DEBUG: Error resolving function mshtml!CImgElement_put_src through our custom callback.
2025-07-23 15:41:10,875 [analyzer] DEBUG: Error resolving function mshtml!CScriptElement_put_src through our custom callback.
2025-07-23 15:41:10,875 [analyzer] DEBUG: Error resolving function mshtml!CWindow_AddTimeoutCode through our custom callback.
2025-07-23 15:41:11,500 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-07-23 15:41:11,500 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
2025-07-23 15:41:11,562 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
2025-07-23 15:41:11,592 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
2025-07-23 15:41:11,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\JDOHHDD2.htm
2025-07-23 15:41:11,733 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V3H7R42A\fonts[1].css
2025-07-23 15:41:11,765 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QE0WSA5Y\app[1].css
2025-07-23 15:41:11,780 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QE0WSA5Y\lookmovie-logo[1].webp
2025-07-23 15:41:11,812 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\app[1].js
2025-07-23 15:41:11,875 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_54D3C27D5957D30DBA4BE92894CB2BAA
2025-07-23 15:41:11,875 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_54D3C27D5957D30DBA4BE92894CB2BAA
2025-07-23 15:41:11,905 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V3H7R42A\css[1].css
2025-07-23 15:41:12,233 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
2025-07-23 15:41:12,233 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
2025-07-23 15:41:12,250 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8570.tmp
2025-07-23 15:41:12,250 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8571.tmp
2025-07-23 15:41:12,265 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8582.tmp
2025-07-23 15:41:12,280 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8583.tmp
2025-07-23 15:41:12,328 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab85B3.tmp
2025-07-23 15:41:12,328 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar85C4.tmp
2025-07-23 15:41:12,342 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab85C5.tmp
2025-07-23 15:41:12,342 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar85D5.tmp
2025-07-23 15:41:12,358 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab85E6.tmp
2025-07-23 15:41:12,358 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar85E7.tmp
2025-07-23 15:41:12,375 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab85F7.tmp
2025-07-23 15:41:12,375 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar85F8.tmp
2025-07-23 15:41:12,421 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8628.tmp
2025-07-23 15:41:12,421 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8629.tmp
2025-07-23 15:41:12,437 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab863A.tmp
2025-07-23 15:41:12,437 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar863B.tmp
2025-07-23 15:41:12,453 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab864C.tmp
2025-07-23 15:41:12,453 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar864D.tmp
2025-07-23 15:41:12,467 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab865D.tmp
2025-07-23 15:41:12,467 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar865E.tmp
2025-07-23 15:41:12,515 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab868E.tmp
2025-07-23 15:41:12,515 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar868F.tmp
2025-07-23 15:41:12,530 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab86A0.tmp
2025-07-23 15:41:12,530 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar86A1.tmp
2025-07-23 15:41:12,546 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab86B1.tmp
2025-07-23 15:41:12,546 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar86B2.tmp
2025-07-23 15:41:12,562 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab86C3.tmp
2025-07-23 15:41:12,562 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar86C4.tmp
2025-07-23 15:41:12,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab86F4.tmp
2025-07-23 15:41:12,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar86F5.tmp
2025-07-23 15:41:12,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8705.tmp
2025-07-23 15:41:12,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8706.tmp
2025-07-23 15:41:12,640 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8717.tmp
2025-07-23 15:41:12,655 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8718.tmp
2025-07-23 15:41:12,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8729.tmp
2025-07-23 15:41:12,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar872A.tmp
2025-07-23 15:41:12,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8788.tmp
2025-07-23 15:41:12,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8789.tmp
2025-07-23 15:41:12,765 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab878A.tmp
2025-07-23 15:41:12,765 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar878B.tmp
2025-07-23 15:41:12,780 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab87AC.tmp
2025-07-23 15:41:12,780 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar87AD.tmp
2025-07-23 15:41:12,796 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab87BD.tmp
2025-07-23 15:41:12,796 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar87BE.tmp
2025-07-23 15:41:12,842 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab87EE.tmp
2025-07-23 15:41:12,842 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar87EF.tmp
2025-07-23 15:41:12,858 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8800.tmp
2025-07-23 15:41:12,858 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8801.tmp
2025-07-23 15:41:12,875 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8811.tmp
2025-07-23 15:41:12,890 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8812.tmp
2025-07-23 15:41:12,890 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8823.tmp
2025-07-23 15:41:12,890 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8824.tmp
2025-07-23 15:41:12,937 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8854.tmp
2025-07-23 15:41:12,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8855.tmp
2025-07-23 15:41:12,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8866.tmp
2025-07-23 15:41:12,967 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8867.tmp
2025-07-23 15:41:12,983 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8877.tmp
2025-07-23 15:41:12,983 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8878.tmp
2025-07-23 15:41:12,983 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8889.tmp
2025-07-23 15:41:13,000 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar888A.tmp
2025-07-23 15:41:13,030 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab88BA.tmp
2025-07-23 15:41:13,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar88BB.tmp
2025-07-23 15:41:13,062 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab88CB.tmp
2025-07-23 15:41:13,062 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar88CC.tmp
2025-07-23 15:41:13,078 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab88DD.tmp
2025-07-23 15:41:13,078 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar88DE.tmp
2025-07-23 15:41:13,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab88EF.tmp
2025-07-23 15:41:13,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar88F0.tmp
2025-07-23 15:41:13,125 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab891F.tmp
2025-07-23 15:41:13,140 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8920.tmp
2025-07-23 15:41:13,155 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8931.tmp
2025-07-23 15:41:13,155 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8932.tmp
2025-07-23 15:41:13,500 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8A9A.tmp
2025-07-23 15:41:13,515 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8A9B.tmp
2025-07-23 15:41:13,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8AFA.tmp
2025-07-23 15:41:13,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8AFB.tmp
2025-07-23 15:41:13,655 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8B3B.tmp
2025-07-23 15:41:13,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8B3C.tmp
2025-07-23 15:41:13,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8B9A.tmp
2025-07-23 15:41:13,765 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8B9B.tmp
2025-07-23 15:41:13,812 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8BCB.tmp
2025-07-23 15:41:13,812 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8BCC.tmp
2025-07-23 15:41:13,890 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8C2B.tmp
2025-07-23 15:41:13,905 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8C2C.tmp
2025-07-23 15:41:13,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8C6C.tmp
2025-07-23 15:41:13,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8C6D.tmp
2025-07-23 15:41:14,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8CBC.tmp
2025-07-23 15:41:14,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8CBD.tmp
2025-07-23 15:41:14,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8CFC.tmp
2025-07-23 15:41:14,108 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8CFD.tmp
2025-07-23 15:41:14,187 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8D5C.tmp
2025-07-23 15:41:14,203 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8D5D.tmp
2025-07-23 15:41:14,250 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8D9C.tmp
2025-07-23 15:41:14,265 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8D9D.tmp
2025-07-23 15:41:14,358 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab8DFC.tmp
2025-07-23 15:41:14,358 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar8DFD.tmp
2025-07-23 15:41:14,592 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V3H7R42A\icomoon[1].htm
2025-07-23 15:41:14,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_ABD70F49F41DF0495D5ECF5A70ADEFF5
2025-07-23 15:41:14,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_ABD70F49F41DF0495D5ECF5A70ADEFF5
2025-07-23 15:41:14,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\js15_as[1].js
2025-07-23 15:41:14,640 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1APEGMY\9UVN7108.htm
2025-07-23 15:41:14,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\RK5CN0FX.txt
2025-07-23 15:41:14,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\P5sdzZCDf9_T_10c3i9MeUcyat4iJY9jQyrNfQA[1].woff
2025-07-23 15:41:14,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\icon-search[1].svg
2025-07-23 15:41:14,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\V5SVW2C6.txt
2025-07-23 15:41:14,687 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V3H7R42A\P5sdzZCDf9_T_10c3i9MeUcyat4iJY-ERCrNfQA[1].woff
2025-07-23 15:41:14,687 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\KRWZSRAA.txt
2025-07-23 15:41:14,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\2W1RGUMV.txt
2025-07-23 15:41:14,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V3H7R42A\P5sfzZCDf9_T_3cV7NCUECyoxNk37cxcDhrH[1].woff
2025-07-23 15:41:14,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V3H7R42A\ajax-spinner[1].htm
2025-07-23 15:41:14,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QE0WSA5Y\controls[1].htm
2025-07-23 15:41:14,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\EBZI2BZG.txt
2025-07-23 15:41:14,717 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1APEGMY\P5sfzZCDf9_T_3cV7NCUECyoxNk3CstcDhrH[1].woff
2025-07-23 15:41:14,717 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\051205LF.txt
2025-07-23 15:41:14,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\FULUH6ZO.txt
2025-07-23 15:41:14,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QE0WSA5Y\HO8U5E9F.htm
2025-07-23 15:41:14,780 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QE0WSA5Y\icomoon[1].woff
2025-07-23 15:41:14,780 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QE0WSA5Y\AYE4DTX1.htm
2025-07-23 15:41:15,187 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab914A.tmp
2025-07-23 15:41:15,203 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab914C.tmp
2025-07-23 15:41:15,203 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar914B.tmp
2025-07-23 15:41:15,203 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar914D.tmp
2025-07-23 15:41:15,296 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab91AC.tmp
2025-07-23 15:41:15,296 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab91BD.tmp
2025-07-23 15:41:15,296 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar91AD.tmp
2025-07-23 15:41:15,312 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar91BE.tmp
2025-07-23 15:41:15,342 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab91EE.tmp
2025-07-23 15:41:15,342 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar91EF.tmp
2025-07-23 15:41:15,342 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab91F0.tmp
2025-07-23 15:41:15,358 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar91F1.tmp
2025-07-23 15:41:15,405 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9231.tmp
2025-07-23 15:41:15,405 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9232.tmp
2025-07-23 15:41:15,421 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9233.tmp
2025-07-23 15:41:15,421 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9234.tmp
2025-07-23 15:41:15,437 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9254.tmp
2025-07-23 15:41:15,437 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9255.tmp
2025-07-23 15:41:15,453 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9266.tmp
2025-07-23 15:41:15,453 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9267.tmp
2025-07-23 15:41:15,500 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9296.tmp
2025-07-23 15:41:15,500 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9297.tmp
2025-07-23 15:41:15,515 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab92A8.tmp
2025-07-23 15:41:15,515 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar92A9.tmp
2025-07-23 15:41:15,530 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab92BA.tmp
2025-07-23 15:41:15,546 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar92BB.tmp
2025-07-23 15:41:15,546 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab92CB.tmp
2025-07-23 15:41:15,562 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar92CC.tmp
2025-07-23 15:41:15,592 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab92FC.tmp
2025-07-23 15:41:15,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar92FD.tmp
2025-07-23 15:41:15,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab930E.tmp
2025-07-23 15:41:15,608 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar930F.tmp
2025-07-23 15:41:15,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab931F.tmp
2025-07-23 15:41:15,640 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9320.tmp
2025-07-23 15:41:15,640 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9331.tmp
2025-07-23 15:41:15,655 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9332.tmp
2025-07-23 15:41:15,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9362.tmp
2025-07-23 15:41:15,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9363.tmp
2025-07-23 15:41:15,703 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9374.tmp
2025-07-23 15:41:15,717 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9375.tmp
2025-07-23 15:41:15,733 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9395.tmp
2025-07-23 15:41:15,733 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9396.tmp
2025-07-23 15:41:15,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9397.tmp
2025-07-23 15:41:15,765 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar93A7.tmp
2025-07-23 15:41:15,828 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab93F7.tmp
2025-07-23 15:41:15,828 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar93F8.tmp
2025-07-23 15:41:15,858 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9418.tmp
2025-07-23 15:41:15,858 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9419.tmp
2025-07-23 15:41:15,875 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9429.tmp
2025-07-23 15:41:15,875 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar942A.tmp
2025-07-23 15:41:15,905 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab944B.tmp
2025-07-23 15:41:15,921 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar944C.tmp
2025-07-23 15:41:15,921 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab945C.tmp
2025-07-23 15:41:15,921 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar945D.tmp
2025-07-23 15:41:15,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab947E.tmp
2025-07-23 15:41:15,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar947F.tmp
2025-07-23 15:41:15,967 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab948F.tmp
2025-07-23 15:41:15,967 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9490.tmp
2025-07-23 15:41:16,000 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab94B0.tmp
2025-07-23 15:41:16,000 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar94B1.tmp
2025-07-23 15:41:16,015 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab94C2.tmp
2025-07-23 15:41:16,015 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar94C3.tmp
2025-07-23 15:41:16,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab94E3.tmp
2025-07-23 15:41:16,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar94E4.tmp
2025-07-23 15:41:16,046 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab94E5.tmp
2025-07-23 15:41:16,062 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar94E6.tmp
2025-07-23 15:41:16,078 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9507.tmp
2025-07-23 15:41:16,078 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9508.tmp
2025-07-23 15:41:16,108 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9528.tmp
2025-07-23 15:41:16,108 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9529.tmp
2025-07-23 15:41:16,140 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9549.tmp
2025-07-23 15:41:16,140 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar954A.tmp
2025-07-23 15:41:16,530 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab96D2.tmp
2025-07-23 15:41:16,530 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar96D3.tmp
2025-07-23 15:41:16,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9722.tmp
2025-07-23 15:41:16,625 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9723.tmp
2025-07-23 15:41:16,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9762.tmp
2025-07-23 15:41:16,671 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9763.tmp
2025-07-23 15:41:16,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab97B2.tmp
2025-07-23 15:41:16,750 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar97B3.tmp
2025-07-23 15:41:16,796 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab97E3.tmp
2025-07-23 15:41:16,796 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar97E4.tmp
2025-07-23 15:41:16,890 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9833.tmp
2025-07-23 15:41:16,890 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9844.tmp
2025-07-23 15:41:16,937 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9874.tmp
2025-07-23 15:41:16,953 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9875.tmp
2025-07-23 15:41:17,030 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab98D4.tmp
2025-07-23 15:41:17,030 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar98D5.tmp
2025-07-23 15:41:17,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9905.tmp
2025-07-23 15:41:17,092 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9906.tmp
2025-07-23 15:41:17,171 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9964.tmp
2025-07-23 15:41:17,187 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9965.tmp
2025-07-23 15:41:17,233 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab9995.tmp
2025-07-23 15:41:17,233 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar9996.tmp
2025-07-23 15:41:17,328 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Cab99F5.tmp
2025-07-23 15:41:17,328 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Temp\Tar99F6.tmp
2025-07-23 15:41:17,467 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1APEGMY\android-icon-192x192[1].png
2025-07-23 15:41:17,500 [analyzer] INFO: Added new file to list with pid 1428 and path C:\Users\Administrator\AppData\Local\Microsoft\Internet Explorer\imagestore\0iwdaqg\imagestore.dat
2025-07-23 14:41:51,700 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-23 14:41:51,841 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 352.
2025-07-23 14:41:51,950 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1428.
2025-07-23 14:41:52,232 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-23 14:41:52,232 [lib.api.process] INFO: Successfully terminated process with pid 352.
2025-07-23 14:41:52,246 [lib.api.process] INFO: Successfully terminated process with pid 1428.
2025-07-23 14:41:52,246 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab97b2.tmp' does not exist, skip.
2025-07-23 14:41:52,246 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab944b.tmp' does not exist, skip.
2025-07-23 14:41:52,246 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab87ac.tmp' does not exist, skip.
2025-07-23 14:41:52,263 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab945c.tmp' does not exist, skip.
2025-07-23 14:41:52,263 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8583.tmp' does not exist, skip.
2025-07-23 14:41:52,279 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar872a.tmp' does not exist, skip.
2025-07-23 14:41:52,279 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8afb.tmp' does not exist, skip.
2025-07-23 14:41:52,279 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8717.tmp' does not exist, skip.
2025-07-23 14:41:52,279 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar91ef.tmp' does not exist, skip.
2025-07-23 14:41:52,279 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9395.tmp' does not exist, skip.
2025-07-23 14:41:52,279 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar94b1.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab87ee.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9332.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8931.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9490.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\roaming\\microsoft\\windows\\cookies\\krwzsraa.txt' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8855.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar94e4.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9267.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\~df9664713300231141.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab92fc.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar92bb.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar97b3.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab96d2.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9995.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab864c.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9996.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab97e3.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9723.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8824.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8932.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8706.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8718.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar85f8.tmp' does not exist, skip.
2025-07-23 14:41:52,293 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9320.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8788.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar863b.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab94e3.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab99f5.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8b3b.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab948f.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8cbd.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8d9c.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar7ddc.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\v3h7r42a\\css[1].css' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8b9b.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab878a.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab914a.tmp' does not exist, skip.
2025-07-23 14:41:52,309 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8705.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab94e5.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8d5c.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab88ef.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8cfc.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8866.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8bcc.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9528.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab88dd.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar88bb.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8b9a.tmp' does not exist, skip.
2025-07-23 14:41:52,325 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar91f1.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8cbc.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab947e.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9418.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab85f7.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar88cc.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8c2b.tmp' does not exist, skip.
2025-07-23 14:41:52,341 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab7f92.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab7cdb.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab92a8.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab91f0.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9722.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab868e.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9231.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9397.tmp' does not exist, skip.
2025-07-23 14:41:52,357 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar914d.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar87be.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\qe0wsa5y\\ho8u5e9f.htm' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8878.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab7cfc.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar86f5.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8628.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9374.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar888a.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab914c.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8854.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8d5d.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar865e.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8cfd.tmp' does not exist, skip.
2025-07-23 14:41:52,371 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar99f6.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9508.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar92cc.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8582.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab86f4.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9233.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab93f7.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9844.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9297.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8811.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar96d3.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8570.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar7dbb.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab86a0.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8c6c.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab7dba.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab85e6.tmp' does not exist, skip.
2025-07-23 14:41:52,388 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\r9aybgsx\\url[1].htm' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab931f.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8571.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar914b.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9549.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8c2c.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8bcb.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8800.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar86b2.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar91ad.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab88ba.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\roaming\\microsoft\\windows\\cookies\\v5svw2c6.txt' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\roaming\\microsoft\\windows\\cookies\\051205lf.txt' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar93f8.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar92a9.tmp' does not exist, skip.
2025-07-23 14:41:52,404 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar93a7.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9964.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar94c3.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar7cdc.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab88cb.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab91ac.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8d9d.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab92cb.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar947f.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar94e6.tmp' does not exist, skip.
2025-07-23 14:41:52,418 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8812.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9507.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9363.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar864d.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9362.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar87ad.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\roaming\\microsoft\\windows\\cookies\\rk5cn0fx.txt' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8823.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar945d.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8afa.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9234.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8877.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab930e.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8c6d.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab91bd.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9429.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8629.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar91be.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\~dfe78f461c371630ba.tmp' does not exist, skip.
2025-07-23 14:41:52,434 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab94c2.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab91ee.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar868f.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar7f93.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab87bd.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab7ddb.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab92ba.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8a9b.tmp' does not exist, skip.
2025-07-23 14:41:52,450 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar97e4.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8867.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab85b3.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9331.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab865d.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9905.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8dfd.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9254.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab98d4.tmp' does not exist, skip.
2025-07-23 14:41:52,466 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9874.tmp' does not exist, skip.
2025-07-23 14:41:52,482 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab86b1.tmp' does not exist, skip.
2025-07-23 14:41:52,482 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar98d5.tmp' does not exist, skip.
2025-07-23 14:41:52,482 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab86c3.tmp' does not exist, skip.
2025-07-23 14:41:52,482 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9266.tmp' does not exist, skip.
2025-07-23 14:41:52,482 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar86a1.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9419.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9965.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8a9a.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8729.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9255.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9296.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8920.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar92fd.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar88f0.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\roaming\\microsoft\\windows\\cookies\\ebzi2bzg.txt' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar878b.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab85c5.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar7cfd.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9762.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar85d5.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar87ef.tmp' does not exist, skip.
2025-07-23 14:41:52,496 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8b3c.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar86c4.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab9833.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9232.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar88de.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9396.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab863a.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9763.tmp' does not exist, skip.
2025-07-23 14:41:52,513 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar942a.tmp' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9529.tmp' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar85e7.tmp' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar944c.tmp' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar85c4.tmp' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8789.tmp' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\roaming\\microsoft\\windows\\cookies\\2w1rgumv.txt' does not exist, skip.
2025-07-23 14:41:52,529 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9906.tmp' does not exist, skip.
2025-07-23 14:41:52,543 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8889.tmp' does not exist, skip.
2025-07-23 14:41:52,543 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar8801.tmp' does not exist, skip.
2025-07-23 14:41:52,543 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar954a.tmp' does not exist, skip.
2025-07-23 14:41:52,543 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab8dfc.tmp' does not exist, skip.
2025-07-23 14:41:52,543 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab891f.tmp' does not exist, skip.
2025-07-23 14:41:52,543 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\cab94b0.tmp' does not exist, skip.
2025-07-23 14:41:52,559 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9375.tmp' does not exist, skip.
2025-07-23 14:41:52,559 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar930f.tmp' does not exist, skip.
2025-07-23 14:41:52,559 [analyzer] WARNING: File at path u'c:\\users\\administrator\\appdata\\local\\temp\\tar9875.tmp' does not exist, skip.
2025-07-23 14:41:52,559 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-23 15:41:01,927 [cuckoo.core.scheduler] INFO: Task #6756768: acquired machine win7x6418 (label=win7x6418)
2025-07-23 15:41:01,928 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.218 for task #6756768
2025-07-23 15:41:02,431 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2817018 (interface=vboxnet0, host=192.168.168.218)
2025-07-23 15:41:02,453 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6418
2025-07-23 15:41:03,739 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6418 to vmcloak
2025-07-23 15:41:14,131 [cuckoo.core.guest] INFO: Starting analysis #6756768 on guest (id=win7x6418, ip=192.168.168.218)
2025-07-23 15:41:15,137 [cuckoo.core.guest] DEBUG: win7x6418: not ready yet
2025-07-23 15:41:20,164 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6418, ip=192.168.168.218)
2025-07-23 15:41:20,268 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6418, ip=192.168.168.218, monitor=latest, size=6660546)
2025-07-23 15:41:21,516 [cuckoo.core.resultserver] DEBUG: Task #6756768: live log analysis.log initialized.
2025-07-23 15:41:22,421 [cuckoo.core.resultserver] DEBUG: Task #6756768 is sending a BSON stream
2025-07-23 15:41:22,797 [cuckoo.core.resultserver] DEBUG: Task #6756768 is sending a BSON stream
2025-07-23 15:41:23,686 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0001.jpg'
2025-07-23 15:41:23,708 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 133453
2025-07-23 15:41:24,638 [cuckoo.core.resultserver] DEBUG: Task #6756768 is sending a BSON stream
2025-07-23 15:41:25,783 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0002.jpg'
2025-07-23 15:41:25,786 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 24434
2025-07-23 15:41:26,892 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0003.jpg'
2025-07-23 15:41:26,895 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 30591
2025-07-23 15:41:28,000 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0004.jpg'
2025-07-23 15:41:28,003 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 31055
2025-07-23 15:41:32,180 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0005.jpg'
2025-07-23 15:41:32,183 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 30689
2025-07-23 15:41:33,239 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0006.jpg'
2025-07-23 15:41:33,247 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 30305
2025-07-23 15:41:36,092 [cuckoo.core.guest] DEBUG: win7x6418: analysis #6756768 still processing
2025-07-23 15:41:36,357 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0007.jpg'
2025-07-23 15:41:36,391 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 96395
2025-07-23 15:41:38,531 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0008.jpg'
2025-07-23 15:41:38,543 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 97806
2025-07-23 15:41:41,698 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0009.jpg'
2025-07-23 15:41:41,710 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 96405
2025-07-23 15:41:51,179 [cuckoo.core.guest] DEBUG: win7x6418: analysis #6756768 still processing
2025-07-23 15:41:52,097 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'curtain/1753274512.09.curtain.log'
2025-07-23 15:41:52,100 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 36
2025-07-23 15:41:52,240 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'sysmon/1753274512.23.sysmon.xml'
2025-07-23 15:41:52,247 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 343810
2025-07-23 15:41:52,255 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/3c2edb025b6d298c_yrgxp9bh.txt'
2025-07-23 15:41:52,258 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 333
2025-07-23 15:41:52,271 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/18a025847c878151_jdohhdd2.htm'
2025-07-23 15:41:52,275 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 29257
2025-07-23 15:41:52,286 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/2f0b6d2124e2a2b0_4a9377e7e528f7e56b69a81c500abc24'
2025-07-23 15:41:52,289 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 176
2025-07-23 15:41:52,309 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/4067c156bd6c9013_imagestore.dat'
2025-07-23 15:41:52,312 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 26619
2025-07-23 15:41:52,322 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/2a61d3de4e3fbbc7_{ac03c6d1-67ca-11f0-a5cd-d8386987cdba}.dat'
2025-07-23 15:41:52,325 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 6656
2025-07-23 15:41:52,332 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/4c847e0c28733ed3_94308059b57b3142e455b38a6eb92015'
2025-07-23 15:41:52,335 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 73513
2025-07-23 15:41:52,337 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/6fb1b8e593cb0388_b46811c17859ffb409cf0e904a4aa8f8'
2025-07-23 15:41:52,353 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 530
2025-07-23 15:41:52,355 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/78405d4dd102de56_recoverystore.{ac03c6cf-67ca-11f0-a5cd-d8386987cdba}.dat'
2025-07-23 15:41:52,358 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 5632
2025-07-23 15:41:52,359 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/ebd41040e4bb3ec7_4a9377e7e528f7e56b69a81c500abc24'
2025-07-23 15:41:52,361 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 889
2025-07-23 15:41:52,363 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/023518d4b4d60e63_b3513d73a177a2707d910183759b389b_3ad96f919c2c7818d117658580034187'
2025-07-23 15:41:52,365 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 402
2025-07-23 15:41:52,366 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/38fe96c34e2d963f_fonts[1].css'
2025-07-23 15:41:52,368 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 1316
2025-07-23 15:41:52,369 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/332ec1d337a38ad4_icomoon[1].woff'
2025-07-23 15:41:52,384 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 3560
2025-07-23 15:41:52,386 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/7979b74cd085b855_4fa45ae1010e09657982d8d28b3bd38e_abd70f49f41df0495d5ecf5a70adeff5'
2025-07-23 15:41:52,403 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 472
2025-07-23 15:41:52,404 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/96bcec06264976f3_2d85f72862b55c4eadd9e66e06947f3d'
2025-07-23 15:41:52,406 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 1391
2025-07-23 15:41:52,407 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/8f86dd748f4ac37b_p5sdzzcdf9_t_10c3i9meucyat4ijy9jqyrnfqa[1].woff'
2025-07-23 15:41:52,410 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/100defb02cedc8d9_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-07-23 15:41:52,412 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 174
2025-07-23 15:41:52,413 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/2defe59e357a7d06_js15_as[1].js'
2025-07-23 15:41:52,415 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 11440
2025-07-23 15:41:52,416 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 88188
2025-07-23 15:41:52,418 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/22925143d03e0516_4fa45ae1010e09657982d8d28b3bd38e_abd70f49f41df0495d5ecf5a70adeff5'
2025-07-23 15:41:52,419 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 398
2025-07-23 15:41:52,420 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/2f39944e184881fd_c02877841121cc45139cb51404116b25_54d3c27d5957d30dba4be92894cb2baa'
2025-07-23 15:41:52,422 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 410
2025-07-23 15:41:52,425 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/66d95dff62bbe863_b46811c17859ffb409cf0e904a4aa8f8'
2025-07-23 15:41:52,427 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 170
2025-07-23 15:41:52,429 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/4ac9619b436cff9d_p5sfzzcdf9_t_3cv7ncuecyoxnk37cxcdhrh[1].woff'
2025-07-23 15:41:52,432 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 78316
2025-07-23 15:41:52,436 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/6d5725c29ff47c48_fuluh6zo.txt'
2025-07-23 15:41:52,438 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 650
2025-07-23 15:41:52,441 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/81b7fa53b692b4d2_8b2b9a00839eed1dfdccc3bfc2f5df12'
2025-07-23 15:41:52,443 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 1739
2025-07-23 15:41:52,454 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/7a2c003cd1ba7a9a_05ddc6aa91765aacacdb0a5f96df8199'
2025-07-23 15:41:52,457 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 170
2025-07-23 15:41:52,460 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/4bd95af495e6d825_c02877841121cc45139cb51404116b25_54d3c27d5957d30dba4be92894cb2baa'
2025-07-23 15:41:52,462 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 472
2025-07-23 15:41:52,468 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/fc6907a0c65422fd_app[1].css'
2025-07-23 15:41:52,472 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 119631
2025-07-23 15:41:52,475 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/7a2938f8fdfbe274_94308059b57b3142e455b38a6eb92015'
2025-07-23 15:41:52,476 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 344
2025-07-23 15:41:52,481 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/b91a8aa6c2599c10_lookmovie-logo[1].webp'
2025-07-23 15:41:52,484 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 10856
2025-07-23 15:41:52,487 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/4a2957a40caa6038_p5sfzzcdf9_t_3cv7ncuecyoxnk3cstcdhrh[1].woff'
2025-07-23 15:41:52,490 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 78092
2025-07-23 15:41:52,493 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/1d3766a87712c953_icon-search[1].svg'
2025-07-23 15:41:52,496 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 894
2025-07-23 15:41:52,504 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/29604ea3544e65da_24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea'
2025-07-23 15:41:52,506 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 1446
2025-07-23 15:41:52,509 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/bc4eed04a01efe0e_icomoon[1].htm'
2025-07-23 15:41:52,512 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 800
2025-07-23 15:41:52,516 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/b14f0b06c8f1592c_android-icon-192x192[1].png'
2025-07-23 15:41:52,518 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 26092
2025-07-23 15:41:52,522 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/1c821bdab262418e_app[1].js'
2025-07-23 15:41:52,525 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 162596
2025-07-23 15:41:52,529 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/008ec5386e12cc98_controls[1].htm'
2025-07-23 15:41:52,531 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 800
2025-07-23 15:41:52,535 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/9825e5a49f9a2cfe_p5sdzzcdf9_t_10c3i9meucyat4ijy-ercrnfqa[1].woff'
2025-07-23 15:41:52,538 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 87576
2025-07-23 15:41:52,540 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/0205fda5957190ab_2d85f72862b55c4eadd9e66e06947f3d'
2025-07-23 15:41:52,542 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 192
2025-07-23 15:41:52,547 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/eac173f6aa2de93a_05ddc6aa91765aacacdb0a5f96df8199'
2025-07-23 15:41:52,549 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 993
2025-07-23 15:41:52,553 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/94695f2409a30f0c_ajax-spinner[1].htm'
2025-07-23 15:41:52,555 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 800
2025-07-23 15:41:52,557 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/2fb6f3814c767de7_b3513d73a177a2707d910183759b389b_3ad96f919c2c7818d117658580034187'
2025-07-23 15:41:52,559 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 471
2025-07-23 15:41:52,562 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'files/c08b4bed1a197f1a_24bd96d5497f70b3f510a6b53cd43f3e_3a89246fb90c5ee6620004f1ae0eb0ea'
2025-07-23 15:41:52,564 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 410
2025-07-23 15:41:53,113 [cuckoo.core.resultserver] DEBUG: Task #6756768: File upload for 'shots/0010.jpg'
2025-07-23 15:41:53,131 [cuckoo.core.resultserver] DEBUG: Task #6756768 uploaded file length: 133458
2025-07-23 15:41:53,146 [cuckoo.core.resultserver] DEBUG: Task #6756768 had connection reset for <Context for LOG>
2025-07-23 15:41:54,192 [cuckoo.core.guest] INFO: win7x6418: analysis completed successfully
2025-07-23 15:41:54,203 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-23 15:41:54,240 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-23 15:41:55,735 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6418 to path /srv/cuckoo/cwd/storage/analyses/6756768/memory.dmp
2025-07-23 15:41:55,736 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6418
2025-07-23 15:42:04,296 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.218 for task #6756768
2025-07-23 15:42:04,615 [cuckoo.core.scheduler] DEBUG: Released database task #6756768
2025-07-23 15:42:04,632 [cuckoo.core.scheduler] INFO: Task #6756768: analysis procedure completed

Signatures

Allocates read-write-execute memory (usually to unpack itself) (50 out of 329 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feffad8000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feffad8000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feffad8000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe38f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe366000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe366000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe366000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb4eb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3cc4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd274000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa50c000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa524000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa48b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d74000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb02a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd492000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2de2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefbddb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef532e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc4b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd9d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd84f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 352 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd878000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00956000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x769f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e57000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e57000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e57000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x751d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x757e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75930000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77231000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75731000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x775a1000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\js15_as[1].js
file	C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9AYBGSX\app[1].js

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 23, 2025, 4:41 p.m.	process_identifier: 1428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 16 (PAGE_EXECUTE) base_address: 0x06080000 process_handle: 0xffffffff	1	0	0