Options

interactive=1
nohuman=yes
vnc_port=5910

Analysis Log

2026-05-28 19:52:07,631 [root] INFO: Date set to: 20260528T20:19:23, timeout set to: 200
2026-05-28 20:19:23,012 [root] DEBUG: Starting analyzer from: C:\6lreqs2g
2026-05-28 20:19:23,013 [root] DEBUG: Storing results at: C:\wqmrdiqI
2026-05-28 20:19:23,013 [root] DEBUG: Pipe server name: \\.\PIPE\TzZYUYj
2026-05-28 20:19:23,013 [root] DEBUG: Python path: C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64
2026-05-28 20:19:23,014 [root] INFO: analysis running as an admin
2026-05-28 20:19:23,014 [root] INFO: analysis package specified: "edge"
2026-05-28 20:19:23,014 [root] DEBUG: importing analysis package module: "modules.packages.edge"...
2026-05-28 20:19:23,017 [root] DEBUG: imported analysis package "edge"
2026-05-28 20:19:23,018 [root] DEBUG: initializing analysis package "edge"...
2026-05-28 20:19:23,019 [root] DEBUG: New location of moved file: https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Artemis/Artemis.zip
2026-05-28 20:19:23,019 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option
2026-05-28 20:19:23,019 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option
2026-05-28 20:19:23,019 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option
2026-05-28 20:19:23,019 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option
2026-05-28 20:19:23,096 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-05-28 20:19:23,110 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-05-28 20:19:23,117 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-05-28 20:19:23,127 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-05-28 20:19:23,138 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-05-28 20:19:23,139 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-05-28 20:19:23,139 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-05-28 20:19:23,141 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-05-28 20:19:23,141 [root] DEBUG: Initialized auxiliary module "Browser"
2026-05-28 20:19:23,141 [root] DEBUG: attempting to configure 'Browser' from data
2026-05-28 20:19:23,142 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-05-28 20:19:23,142 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-05-28 20:19:23,142 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-05-28 20:19:23,142 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-05-28 20:19:23,142 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-05-28 20:19:23,143 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-05-28 20:19:23,143 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-05-28 20:19:23,143 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file
2026-05-28 20:19:23,143 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-05-28 20:19:23,143 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-05-28 20:19:23,143 [root] DEBUG: attempting to configure 'Disguise' from data
2026-05-28 20:19:23,144 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-05-28 20:19:23,144 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-05-28 20:19:23,146 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 788)
2026-05-28 20:19:23,146 [modules.auxiliary.disguise] INFO: Disguising GUID to 050523df-a43c-4839-b57c-226b0b8b3f3c
2026-05-28 20:19:23,147 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-05-28 20:19:23,147 [root] DEBUG: Initialized auxiliary module "Human"
2026-05-28 20:19:23,147 [root] DEBUG: attempting to configure 'Human' from data
2026-05-28 20:19:23,147 [root] DEBUG: module Human does not support data configuration, ignoring
2026-05-28 20:19:23,147 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-05-28 20:19:23,150 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-05-28 20:19:23,151 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-05-28 20:19:23,151 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-05-28 20:19:23,151 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-05-28 20:19:23,152 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-05-28 20:19:23,152 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2026-05-28 20:19:23,152 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-05-28 20:19:23,153 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-05-28 20:19:23,153 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-05-28 20:19:23,153 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-05-28 20:19:23,154 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-05-28 20:19:23,156 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-05-28 20:19:23,156 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-05-28 20:19:23,156 [root] INFO: Interactive mode enabled - injecting into explorer shell
2026-05-28 20:19:23,224 [lib.api.process] INFO: Monitor config for process 4372: C:\6lreqs2g\dll\4372.ini
2026-05-28 20:19:23,225 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:23,228 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:23,280 [root] DEBUG: Loader: Injecting process 4372 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:23,449 [root] DEBUG: 4372: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:19:23,452 [root] DEBUG: 4372: Disabling sleep skipping.
2026-05-28 20:19:23,453 [root] DEBUG: 4372: Interactive desktop enabled.
2026-05-28 20:19:23,454 [root] DEBUG: 4372: Dropped file limit defaulting to 100.
2026-05-28 20:19:23,455 [root] DEBUG: 4372: Interactive desktop - injecting Explorer Shell
2026-05-28 20:19:23,465 [root] DEBUG: 4372: YaraInit: Compiled 44 rule files
2026-05-28 20:19:23,466 [root] DEBUG: 4372: YaraInit: Compiled rules saved to file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:19:23,542 [root] DEBUG: 4372: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:19:23,543 [root] DEBUG: 4372: YaraScan: Scanning 0x00007FF65F9E0000, size 0x545316
2026-05-28 20:19:23,635 [root] DEBUG: 4372: Monitor initialised: 64-bit capemon loaded in process 4372 at 0x00007FFEAF1A0000, thread 2664, image base 0x00007FF65F9E0000, stack from 0x000000000A7C1000-0x000000000A7D0000
2026-05-28 20:19:23,637 [root] DEBUG: 4372: Commandline: C:\Windows\Explorer.EXE
2026-05-28 20:19:23,650 [root] DEBUG: 4372: Hooked 69 out of 69 functions
2026-05-28 20:19:23,680 [root] DEBUG: 4372: Syscall hook installed, syscall logging level 1
2026-05-28 20:19:23,686 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 20:19:23,687 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:23,688 [lib.api.process] INFO: Injected into 64-bit <Process 4372 explorer.exe>
2026-05-28 20:19:30,801 [root] INFO: Restarting WMI Service
2026-05-28 20:19:32,834 [root] DEBUG: package modules.packages.edge does not support configure, ignoring
2026-05-28 20:19:32,836 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'
2026-05-28 20:19:32,837 [lib.core.compound] INFO: C:\Users\admin\AppData\Local\Temp already exists, skipping creation
2026-05-28 20:19:32,839 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" with arguments ""https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Artemis/Artemis.zip"" with pid 1144
2026-05-28 20:19:32,841 [lib.api.process] INFO: Monitor config for process 1144: C:\6lreqs2g\dll\1144.ini
2026-05-28 20:19:32,843 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:32,844 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:32,849 [root] DEBUG: Loader: Injecting process 1144 (thread 1132) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:32,849 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:32,850 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:32,851 [lib.api.process] INFO: Injected into 64-bit <Process 1144 msedge.exe>
2026-05-28 20:19:34,854 [lib.api.process] INFO: Successfully resumed process with pid 1144
2026-05-28 20:19:34,917 [root] DEBUG: 1144: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:19:34,918 [root] DEBUG: 1144: Disabling sleep skipping.
2026-05-28 20:19:34,918 [root] DEBUG: 1144: Interactive desktop enabled.
2026-05-28 20:19:34,919 [root] DEBUG: 1144: Dropped file limit defaulting to 100.
2026-05-28 20:19:34,926 [root] DEBUG: 1144: Edge-specific hook-set enabled.
2026-05-28 20:19:34,928 [root] DEBUG: 1144: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:19:34,940 [root] DEBUG: 1144: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:19:34,941 [root] DEBUG: 1144: Monitor initialised: 64-bit capemon loaded in process 1144 at 0x00007FFEAF1A0000, thread 1132, image base 0x00007FF60A060000, stack from 0x000000B1575F4000-0x000000B157600000
2026-05-28 20:19:34,941 [root] DEBUG: 1144: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Artemis/Artemis.zip"
2026-05-28 20:19:34,950 [root] DEBUG: 1144: Hooked 2 out of 2 functions
2026-05-28 20:19:34,985 [root] DEBUG: 1144: Syscall hook installed, syscall logging level 1
2026-05-28 20:19:34,989 [root] DEBUG: 1144: RestoreHeaders: Restored original import table.
2026-05-28 20:19:34,990 [root] INFO: Loaded monitor into process with pid 1144
2026-05-28 20:19:34,992 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 20:19:34,997 [root] DEBUG: 1144: DLL loaded at 0x00007FFED9040000: C:\Windows\SYSTEM32\version (0xa000 bytes).
2026-05-28 20:19:34,998 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:19:34,999 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 20:19:35,000 [root] DEBUG: 1144: DLL loaded at 0x00007FFEED7F0000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 20:19:35,001 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-28 20:19:35,001 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:19:35,148 [root] DEBUG: 1144: DLL loaded at 0x00007FFED8180000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 20:19:35,149 [root] DEBUG: 1144: DLL loaded at 0x00007FFE9B620000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-28 20:19:35,152 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDD470000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 20:19:35,155 [root] DEBUG: 1144: DLL loaded at 0x00007FFEED0B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 20:19:35,160 [root] DEBUG: 1144: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:19:35,160 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 8052: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:35,161 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 8052
2026-05-28 20:19:35,161 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:19:35,161 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 8052
2026-05-28 20:19:35,162 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE8480000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-28 20:19:35,163 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:19:35,163 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:19:35,169 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF5C0000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 20:19:35,170 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEDFA0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 20:19:35,171 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE870000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 20:19:35,172 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 20:19:35,173 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:19:35,173 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE5A50000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 20:19:35,174 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:19:35,175 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEFD0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 20:19:35,175 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF0F0000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 20:19:35,176 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF1ED0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 20:19:35,176 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE6C20000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 20:19:35,176 [root] DEBUG: 1144: DLL loaded at 0x00007FFED4750000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 20:19:35,177 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE5A10000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 20:19:35,178 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF550000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 20:19:35,178 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF0B0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 20:19:35,180 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 20:19:35,180 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:19:35,181 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEFD0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 20:19:35,181 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEB400000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 20:19:35,182 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF640000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 20:19:35,190 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE5AA0000: C:\Windows\System32\AssignedAccessRuntime (0x14000 bytes).
2026-05-28 20:19:35,191 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0BA0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 20:19:35,192 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE6360000: C:\Windows\System32\SystemSettings.DataModel (0x74000 bytes).
2026-05-28 20:19:35,193 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:19:35,193 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF550000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 20:19:35,195 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE23A0000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 20:19:35,197 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDB070000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 20:19:35,199 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF430000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 20:19:35,200 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE7C90000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 20:19:35,201 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEAD0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 20:19:35,201 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEAE30000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 20:19:35,202 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0990000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 20:19:35,203 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE8E40000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 20:19:35,204 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE8D30000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 20:19:35,205 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF710000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-28 20:19:35,205 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE5AC0000: C:\Windows\System32\StructuredQuery (0xa6000 bytes).
2026-05-28 20:19:35,206 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEB10000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 20:19:35,207 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEB280000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-05-28 20:19:35,210 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDF8A0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 20:19:35,211 [root] DEBUG: 1144: DLL loaded at 0x00007FFEECCF0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 20:19:35,211 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEB550000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 20:19:35,212 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEC530000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 20:19:35,212 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE3AB0000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 20:19:35,217 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDF7D0000: C:\Windows\system32\Windows.Storage.Search (0xc6000 bytes).
2026-05-28 20:19:35,218 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE94D0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 20:19:35,219 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDAFC0000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 20:19:35,221 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDF190000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-28 20:19:35,222 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE9A90000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 20:19:35,226 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE96E0000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 20:19:35,226 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE3950000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 20:19:35,226 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE3BB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 20:19:35,227 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDEC10000: C:\Windows\SYSTEM32\edputil (0x24000 bytes).
2026-05-28 20:19:35,230 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEB3E0000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 20:19:35,232 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF440000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 20:19:35,254 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE8F40000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 20:19:35,254 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE8F60000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 20:19:35,256 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE4BE0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 20:19:35,257 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDEB40000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-28 20:19:35,260 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 20:19:35,273 [root] DEBUG: 1144: DLL loaded at 0x00007FFE99CC0000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneauth (0x5c4000 bytes).
2026-05-28 20:19:35,291 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE2620000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 20:19:35,294 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 1624: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:35,294 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE0DA0000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 20:19:35,295 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 1624
2026-05-28 20:19:35,296 [root] DEBUG: 1144: caller_dispatch: Added region at 0x00007FF60A060000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF60A157D66, thread 896).
2026-05-28 20:19:35,296 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 1624
2026-05-28 20:19:35,301 [root] DEBUG: 1144: ProcessImageBase: Main module image at 0x00007FF60A060000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:19:35,302 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 1908: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:35,302 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 1908
2026-05-28 20:19:35,303 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 1908
2026-05-28 20:19:35,312 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF4A0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 20:19:35,314 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 4616: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:35,315 [root] DEBUG: 1144: DLL loaded at 0x00007FFED7420000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 20:19:35,317 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 4616
2026-05-28 20:19:35,318 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 4616
2026-05-28 20:19:35,321 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEADA0000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 20:19:35,328 [root] DEBUG: 1144: DLL loaded at 0x00007FFED6CB0000: C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).
2026-05-28 20:19:35,347 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 20:19:35,348 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEBC70000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 20:19:35,348 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEC340000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 20:19:35,349 [root] DEBUG: 1144: DLL loaded at 0x00007FFED88A0000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 20:19:35,370 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE59E0000: C:\Windows\System32\Windows.System.Profile.RetailInfo (0x28000 bytes).
2026-05-28 20:19:35,387 [root] DEBUG: 1144: DLL loaded at 0x00007FFEED220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 20:19:35,394 [root] DEBUG: 1144: DLL loaded at 0x00007FFED8910000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 20:19:35,395 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 8276: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:35,396 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 8224: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:35,396 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 8276
2026-05-28 20:19:35,397 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE1330000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 20:19:35,397 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 8224
2026-05-28 20:19:35,397 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 8276
2026-05-28 20:19:35,398 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 8224
2026-05-28 20:19:35,415 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDA250000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xf4000 bytes).
2026-05-28 20:19:35,421 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 20:19:35,459 [root] DEBUG: 4372: YaraScan: Scanning 0x00007FF65F9E0000, size 0x545316
2026-05-28 20:19:35,462 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDCBB0000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0x11d000 bytes).
2026-05-28 20:19:35,464 [root] DEBUG: 4372: caller_dispatch: Added region at 0x00007FF65F9E0000 to tracked regions list (combase::CoCreateInstance returns to 0x00007FF65FA499CA, thread 5632).
2026-05-28 20:19:35,470 [root] DEBUG: 4372: YaraScan: Scanning 0x00007FF65F9E0000, size 0x545316
2026-05-28 20:19:35,495 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDFA10000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains (0x9e000 bytes).
2026-05-28 20:19:35,500 [root] DEBUG: 4372: ProcessImageBase: Main module image at 0x00007FF65F9E0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:19:35,511 [root] DEBUG: 4372: ProcessImageBase: Main module image at 0x00007FF65F9E0000 unmodified (entropy change 1.609085e-06)
2026-05-28 20:19:35,548 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE0FD0000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 20:19:35,550 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:19:35,554 [root] DEBUG: 1144: DLL loaded at 0x00007FFED9A80000: C:\Windows\System32\vaultcli (0x51000 bytes).
2026-05-28 20:19:35,555 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEFD0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 20:19:35,556 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE710000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 20:19:35,581 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE5860000: C:\Windows\System32\aadWamExtension (0x36000 bytes).
2026-05-28 20:19:35,583 [root] DEBUG: 1144: DLL loaded at 0x00007FFED99F0000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x8c000 bytes).
2026-05-28 20:19:36,688 [root] DEBUG: 1144: DLL loaded at 0x00007FFED5C90000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-28 20:19:37,353 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:19:37,355 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:19:39,693 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\SETUPAPI (0x46e000 bytes).
2026-05-28 20:19:39,695 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 2468: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:19:39,695 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF3D0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 20:19:39,696 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 2468
2026-05-28 20:19:39,696 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEADC0000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-05-28 20:19:39,698 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 2468
2026-05-28 20:19:39,892 [root] DEBUG: 1144: DLL loaded at 0x00007FFED8C50000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\telclient (0x3ed000 bytes).
2026-05-28 20:19:40,543 [root] DEBUG: 1144: DLL loaded at 0x00007FFE96BA0000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneds (0x33f000 bytes).
2026-05-28 20:19:40,730 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:19:40,735 [root] DEBUG: 1144: DLL loaded at 0x00007FFE99850000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\ffmpeg (0x467000 bytes).
2026-05-28 20:19:40,739 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE8E60000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-28 20:19:40,782 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE59C0000: C:\Windows\system32\TenantRestrictionsPlugin (0x1b000 bytes).
2026-05-28 20:19:40,795 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE330000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-28 20:19:40,796 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE2C0000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-28 20:19:40,816 [root] DEBUG: 1144: DLL loaded at 0x00007FFED9970000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\microsoft_shell_integration (0x78000 bytes).
2026-05-28 20:19:40,916 [root] DEBUG: 1144: DLL loaded at 0x00007FFEED4F0000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 20:19:40,918 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEB240000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 20:19:40,919 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDA690000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 20:19:42,307 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 4516: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe, ImageBase: 0x00007FF7CA2A0000
2026-05-28 20:19:42,311 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 4516
2026-05-28 20:19:42,312 [lib.api.process] INFO: Monitor config for process 4516: C:\6lreqs2g\dll\4516.ini
2026-05-28 20:19:42,314 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:42,972 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 20:19:42,973 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-28 20:19:42,976 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:42,980 [root] DEBUG: Loader: Injecting process 4516 (thread 1180) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:42,981 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:42,981 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:42,982 [lib.api.process] INFO: Injected into 64-bit <Process 4516 identity_helper.exe>
2026-05-28 20:19:42,996 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE6C40000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2026-05-28 20:19:43,002 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE0440000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-05-28 20:19:43,003 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 6596: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe, ImageBase: 0x00007FF7CA2A0000
2026-05-28 20:19:43,004 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 6596
2026-05-28 20:19:43,004 [lib.api.process] INFO: Monitor config for process 6596: C:\6lreqs2g\dll\6596.ini
2026-05-28 20:19:43,005 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:43,063 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDFE80000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 20:19:43,063 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE6BA0000: C:\Windows\system32\wlanapi (0x74000 bytes).
2026-05-28 20:19:43,064 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEA040000: C:\Windows\System32\AppXDeploymentClient (0x102000 bytes).
2026-05-28 20:19:43,079 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 20:19:43,079 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-28 20:19:43,081 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:43,085 [root] DEBUG: Loader: Injecting process 6596 (thread 6600) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:43,085 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:43,085 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:43,086 [lib.api.process] INFO: Injected into 64-bit <Process 6596 identity_helper.exe>
2026-05-28 20:19:43,088 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 6596
2026-05-28 20:19:43,088 [lib.api.process] INFO: Monitor config for process 6596: C:\6lreqs2g\dll\6596.ini
2026-05-28 20:19:43,089 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:43,158 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 20:19:43,158 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-28 20:19:43,160 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:43,164 [root] DEBUG: Loader: Injecting process 6596 (thread 6600) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:43,164 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:19:43,164 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:43,166 [lib.api.process] INFO: Injected into 64-bit <Process 6596 identity_helper.exe>
2026-05-28 20:19:43,199 [root] DEBUG: 6596: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:19:43,200 [root] DEBUG: 6596: Interactive desktop enabled.
2026-05-28 20:19:43,201 [root] DEBUG: 6596: Dropped file limit defaulting to 100.
2026-05-28 20:19:43,221 [root] DEBUG: 6596: Disabling sleep skipping.
2026-05-28 20:19:43,224 [root] DEBUG: 6596: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:19:43,239 [root] DEBUG: 6596: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:19:43,240 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,256 [root] DEBUG: 6596: Monitor initialised: 64-bit capemon loaded in process 6596 at 0x00007FFEAF1A0000, thread 6600, image base 0x00007FF7CA2A0000, stack from 0x0000005CD12F4000-0x0000005CD1300000
2026-05-28 20:19:43,256 [root] DEBUG: 6596: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5492,i,12544753799722475617,13925887584858051439,524288 --field-trial-handle=2200,i,8520326644370624724,1336781668702219854,262144 --variations-seed-version --pseudonymization-salt-handle=2368,i,5659995974014049908,13784604571096197
2026-05-28 20:19:43,257 [root] DEBUG: 6596: add_all_dlls_to_dll_ranges: skipping C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_elf.dll
2026-05-28 20:19:43,267 [root] DEBUG: 6596: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:19:43,289 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:19:43,289 [root] DEBUG: 6596: set_hooks: Unable to hook LockResource
2026-05-28 20:19:43,294 [root] DEBUG: 6596: Hooked 627 out of 628 functions
2026-05-28 20:19:43,309 [root] DEBUG: 6596: Syscall hook installed, syscall logging level 1
2026-05-28 20:19:43,314 [root] DEBUG: 6596: RestoreHeaders: Restored original import table.
2026-05-28 20:19:43,315 [root] INFO: Loaded monitor into process with pid 6596
2026-05-28 20:19:43,315 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,386 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,410 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,434 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,460 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,487 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,514 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FFEAECE0000, size 0x4b9994
2026-05-28 20:19:43,542 [root] DEBUG: 6596: caller_dispatch: Added region at 0x00007FFEAECE0000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFEAEEDF156, thread 6600).
2026-05-28 20:19:43,543 [root] DEBUG: 6596: caller_dispatch: Scanning calling region at 0x00007FFEAECE0000...
2026-05-28 20:19:43,560 [root] DEBUG: 6596: ProcessTrackedRegion: Region at 0x00007FFEAECE0000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_elf.dll appears unmodified, skipping
2026-05-28 20:19:43,562 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 20:19:43,659 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,695 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,710 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF0F0000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 20:19:43,711 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEF0B0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 20:19:43,711 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,712 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE6DC0000: C:\Windows\system32\PCPKsp (0x118000 bytes).
2026-05-28 20:19:43,713 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF1ED0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 20:19:43,713 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE6C20000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 20:19:43,714 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDBC30000: C:\Windows\system32\ncryptprov (0x5a000 bytes).
2026-05-28 20:19:43,726 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,742 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,757 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,773 [root] DEBUG: 6596: caller_dispatch: Added region at 0x00007FF7CA2A0000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF7CA394096, thread 6600).
2026-05-28 20:19:43,774 [root] DEBUG: 6596: YaraScan: Scanning 0x00007FF7CA2A0000, size 0x28b4d8
2026-05-28 20:19:43,790 [root] DEBUG: 6596: ProcessImageBase: Main module image at 0x00007FF7CA2A0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:19:43,793 [root] DEBUG: 6596: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:19:43,794 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEEDE0000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-05-28 20:19:43,816 [root] DEBUG: 6596: DLL loaded at 0x00007FFE9B620000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-28 20:19:43,819 [root] DEBUG: 6596: DLL loaded at 0x00007FFEED0B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 20:19:43,824 [root] DEBUG: 6596: DLL loaded at 0x00007FFEF0BA0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 20:19:43,857 [root] DEBUG: 6596: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:19:43,863 [root] DEBUG: 6596: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:19:43,870 [root] DEBUG: 6596: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:19:43,871 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEB280000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 20:19:43,871 [root] DEBUG: 6596: DLL loaded at 0x00007FFEECCF0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 20:19:43,872 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDCB10000: C:\Windows\System32\execmodelclient (0x63000 bytes).
2026-05-28 20:19:43,884 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE94D0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 20:19:43,886 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEB550000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 20:19:43,886 [root] DEBUG: 6596: DLL loaded at 0x00007FFEED4F0000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 20:19:43,887 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEB240000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 20:19:43,887 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDA690000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 20:19:43,898 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE0FD0000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 20:19:43,905 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDE2F0000: C:\Windows\system32\execmodelproxy (0x18000 bytes).
2026-05-28 20:19:43,910 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:19:43,910 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:19:43,912 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEADA0000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 20:19:43,921 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE7C90000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 20:19:43,924 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDF8A0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 20:19:43,933 [root] DEBUG: 6596: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:19:43,933 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE6C40000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2026-05-28 20:19:43,935 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEF210000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-05-28 20:19:43,945 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDFE80000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 20:19:43,953 [root] DEBUG: 6596: DLL loaded at 0x0000024A09460000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-28 20:19:43,958 [lib.api.process] INFO: Monitor config for process 848: C:\6lreqs2g\dll\848.ini
2026-05-28 20:19:43,959 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:43,960 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:43,965 [root] DEBUG: Loader: Injecting process 848 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:43,967 [root] DEBUG: 848: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:19:43,967 [root] DEBUG: 848: Disabling sleep skipping.
2026-05-28 20:19:43,968 [root] DEBUG: 848: Interactive desktop enabled.
2026-05-28 20:19:43,968 [root] DEBUG: 848: Dropped file limit defaulting to 100.
2026-05-28 20:19:43,969 [root] DEBUG: 848: Services hook set enabled
2026-05-28 20:19:43,971 [root] DEBUG: 848: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:19:43,983 [root] DEBUG: 848: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:19:43,984 [root] DEBUG: 848: Monitor initialised: 64-bit capemon loaded in process 848 at 0x00007FFEAF1A0000, thread 9380, image base 0x00007FF6A8D80000, stack from 0x0000006A4DD75000-0x0000006A4DD80000
2026-05-28 20:19:43,984 [root] DEBUG: 848: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-05-28 20:19:43,995 [root] DEBUG: 848: Hooked 69 out of 69 functions
2026-05-28 20:19:43,996 [root] INFO: Loaded monitor into process with pid 848
2026-05-28 20:19:43,997 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 20:19:43,997 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:43,999 [lib.api.process] INFO: Injected into 64-bit <Process 848 svchost.exe>
2026-05-28 20:19:46,027 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE5370000: C:\Windows\System32\StateRepository.Core (0xb1000 bytes).
2026-05-28 20:19:46,028 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE4650000: C:\Windows\System32\Windows.StateRepository (0x58e000 bytes).
2026-05-28 20:19:46,029 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDAE80000: C:\Windows\System32\TileDataRepository (0x99000 bytes).
2026-05-28 20:19:46,031 [root] DEBUG: 6596: DLL loaded at 0x00007FFED4AB0000: C:\Windows\System32\biwinrt (0x53000 bytes).
2026-05-28 20:19:46,056 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE9FE0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-28 20:19:46,076 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\System32\dxgi (0xf3000 bytes).
2026-05-28 20:19:46,077 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEBC70000: C:\Windows\System32\d3d11 (0x263000 bytes).
2026-05-28 20:19:46,487 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE1590000: C:\Windows\System32\WININET (0x4d6000 bytes).
2026-05-28 20:19:46,488 [root] DEBUG: 6596: DLL loaded at 0x00007FFED4800000: C:\Windows\System32\windows.internal.shell.broker (0xdd000 bytes).
2026-05-28 20:19:46,500 [root] DEBUG: 6596: DLL loaded at 0x00007FFED5E10000: C:\Windows\System32\PCShellCommonProxyStub (0x13000 bytes).
2026-05-28 20:19:46,524 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEF5C0000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-28 20:19:46,524 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEF080000: C:\Windows\System32\Wldp (0x2d000 bytes).
2026-05-28 20:19:46,525 [root] DEBUG: 6596: DLL loaded at 0x00007FFEED7F0000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 20:19:46,526 [root] DEBUG: 6596: DLL loaded at 0x00007FFEE4250000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-05-28 20:19:46,526 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDA8F0000: C:\Windows\System32\StartTileData (0x58a000 bytes).
2026-05-28 20:19:46,535 [root] DEBUG: 6596: DLL loaded at 0x00007FFED4BF0000: C:\Windows\System32\Windows.Storage.ApplicationData (0x66000 bytes).
2026-05-28 20:19:46,551 [root] DEBUG: 6596: DLL loaded at 0x00007FFEDF190000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-28 20:19:46,576 [root] DEBUG: 6596: DLL loaded at 0x00007FFEEF710000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-28 20:19:56,657 [root] INFO: Process with pid 6596 has terminated
2026-05-28 20:19:56,658 [root] DEBUG: 6596: NtTerminateProcess hook: Attempting to dump process 6596
2026-05-28 20:19:56,660 [root] DEBUG: 6596: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:19:57,925 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDFE20000: C:\Windows\SYSTEM32\ploptin (0x13000 bytes).
2026-05-28 20:19:57,945 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 9652: C:\Windows\system32\ApplicationFrameHost.exe, ImageBase: 0x00007FF6477E0000
2026-05-28 20:19:57,946 [root] INFO: Announced 64-bit process name: ApplicationFrameHost.exe pid: 9652
2026-05-28 20:19:57,946 [lib.api.process] INFO: Monitor config for process 9652: C:\6lreqs2g\dll\9652.ini
2026-05-28 20:19:57,947 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:57,948 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:57,950 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 9708: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe, ImageBase: 0x00007FF66A090000
2026-05-28 20:19:57,951 [root] INFO: Announced 64-bit process name: WinStore.App.exe pid: 9708
2026-05-28 20:19:57,951 [lib.api.process] INFO: Monitor config for process 9708: C:\6lreqs2g\dll\9708.ini
2026-05-28 20:19:57,952 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:57,952 [root] DEBUG: Loader: Injecting process 9652 (thread 9656) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:57,953 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:57,953 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:57,955 [lib.api.process] INFO: Injected into 64-bit <Process 9652 ApplicationFrameHost.exe>
2026-05-28 20:19:57,956 [root] INFO: Announced 64-bit process name: ApplicationFrameHost.exe pid: 9652
2026-05-28 20:19:57,956 [lib.api.process] INFO: Monitor config for process 9652: C:\6lreqs2g\dll\9652.ini
2026-05-28 20:19:57,956 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:57,957 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:57,961 [root] DEBUG: Loader: Injecting process 9652 (thread 9656) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:57,962 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:57,962 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:57,963 [lib.api.process] INFO: Injected into 64-bit <Process 9652 ApplicationFrameHost.exe>
2026-05-28 20:19:57,969 [root] DEBUG: 9652: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:19:57,969 [root] DEBUG: 9652: Interactive desktop enabled.
2026-05-28 20:19:57,970 [root] DEBUG: 9652: Dropped file limit defaulting to 100.
2026-05-28 20:19:57,971 [root] DEBUG: 9652: Disabling sleep skipping.
2026-05-28 20:19:57,972 [root] DEBUG: 9652: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:19:57,984 [root] DEBUG: 9652: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:19:57,985 [root] DEBUG: 9652: YaraScan: Scanning 0x00007FF6477E0000, size 0x14222
2026-05-28 20:19:57,986 [root] DEBUG: 9652: Monitor initialised: 64-bit capemon loaded in process 9652 at 0x00007FFEAF1A0000, thread 9656, image base 0x00007FF6477E0000, stack from 0x0000005D95874000-0x0000005D95880000
2026-05-28 20:19:57,986 [root] DEBUG: 9652: Commandline: C:\Windows\system32\ApplicationFrameHost.exe -Embedding
2026-05-28 20:19:57,996 [root] DEBUG: 9652: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:19:58,017 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:19:58,018 [root] DEBUG: 9652: set_hooks: Unable to hook LockResource
2026-05-28 20:19:58,022 [root] DEBUG: 9652: Hooked 627 out of 628 functions
2026-05-28 20:19:58,023 [root] DEBUG: 9652: Syscall hook installed, syscall logging level 1
2026-05-28 20:19:58,027 [root] DEBUG: 9652: RestoreHeaders: Restored original import table.
2026-05-28 20:19:58,027 [root] INFO: Loaded monitor into process with pid 9652
2026-05-28 20:19:58,031 [root] DEBUG: 9652: caller_dispatch: Added region at 0x00007FF6477E0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6477E2DE1, thread 9656).
2026-05-28 20:19:58,031 [root] DEBUG: 9652: YaraScan: Scanning 0x00007FF6477E0000, size 0x14222
2026-05-28 20:19:58,032 [root] DEBUG: 9652: ProcessImageBase: Main module image at 0x00007FF6477E0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:19:58,034 [root] DEBUG: 9652: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:19:58,035 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:19:58,037 [root] DEBUG: 9652: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:19:58,041 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEB280000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 20:19:58,041 [root] DEBUG: 9652: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-28 20:19:58,042 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE94D0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 20:19:58,043 [root] DEBUG: 9652: DLL loaded at 0x00007FFEED0B0000: C:\Windows\System32\UxTheme (0x9e000 bytes).
2026-05-28 20:19:58,044 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEF710000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 20:19:58,044 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEF3D0000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-05-28 20:19:58,044 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE41E0000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-05-28 20:19:58,045 [root] DEBUG: 9652: DLL loaded at 0x00007FFEDAFC0000: C:\Windows\System32\TWINAPI (0xa9000 bytes).
2026-05-28 20:19:58,045 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEB6B0000: C:\Windows\System32\d2d1 (0x5c0000 bytes).
2026-05-28 20:19:58,046 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEBC70000: C:\Windows\System32\d3d11 (0x263000 bytes).
2026-05-28 20:19:58,046 [root] DEBUG: 9652: DLL loaded at 0x00007FFEED220000: C:\Windows\System32\dwmapi (0x2f000 bytes).
2026-05-28 20:19:58,047 [root] DEBUG: 9652: DLL loaded at 0x00007FFED78B0000: C:\Windows\System32\ApplicationFrame (0xa9000 bytes).
2026-05-28 20:19:58,049 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:58,053 [root] DEBUG: Loader: Injecting process 9708 (thread 9712) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,053 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:58,054 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,055 [lib.api.process] INFO: Injected into 64-bit <Process 9708 WinStore.App.exe>
2026-05-28 20:19:58,057 [root] INFO: Announced 64-bit process name: WinStore.App.exe pid: 9708
2026-05-28 20:19:58,057 [lib.api.process] INFO: Monitor config for process 9708: C:\6lreqs2g\dll\9708.ini
2026-05-28 20:19:58,059 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:58,065 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE7C90000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 20:19:58,071 [root] DEBUG: 9652: DLL loaded at 0x00007FFEF0BA0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 20:19:58,074 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE6F40000: C:\Windows\system32\D3D10Warp (0x6f6000 bytes).
2026-05-28 20:19:58,076 [root] DEBUG: 9652: DLL loaded at 0x00007FFEED200000: C:\Windows\SYSTEM32\resourcepolicyclient (0x14000 bytes).
2026-05-28 20:19:58,083 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE6D80000: C:\Windows\SYSTEM32\dxcore (0x3b000 bytes).
2026-05-28 20:19:58,086 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEC340000: C:\Windows\System32\dcomp (0x1e3000 bytes).
2026-05-28 20:19:58,088 [root] DEBUG: 9652: DLL loaded at 0x00007FFEECCF0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 20:19:58,100 [root] DEBUG: 9652: DLL loaded at 0x00007FFED4310000: C:\Windows\system32\UIAutomationCore (0x2f5000 bytes).
2026-05-28 20:19:58,105 [root] DEBUG: 9652: AllocationHandler: Adding allocation to tracked region list: 0x00007DF46D411000, size: 0x1000.
2026-05-28 20:19:58,108 [root] DEBUG: 9652: AllocationHandler: Adding allocation to tracked region list: 0x00007DF46D401000, size: 0x1000.
2026-05-28 20:19:58,108 [root] DEBUG: 9652: AllocationHandler: Adding allocation to tracked region list: 0x00007DF46D3F1000, size: 0x1000.
2026-05-28 20:19:58,110 [root] DEBUG: 9652: AllocationHandler: Adding allocation to tracked region list: 0x00007DF46D3E1000, size: 0x1000.
2026-05-28 20:19:58,127 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 20:19:58,128 [root] DEBUG: 9652: DLL loaded at 0x00007FFEED7F0000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 20:19:58,131 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEF640000: C:\Windows\System32\profapi (0x25000 bytes).
2026-05-28 20:19:58,134 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE0440000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-05-28 20:19:58,141 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE9310000: C:\Windows\system32\windowscodecs (0x1b4000 bytes).
2026-05-28 20:19:58,146 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE3D00000: C:\Windows\SYSTEM32\mrmcorer (0xf4000 bytes).
2026-05-28 20:19:58,146 [root] DEBUG: 9652: DLL loaded at 0x00007FFEDF8A0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 20:19:58,148 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE4BE0000: C:\Windows\SYSTEM32\iertutil (0x2bc000 bytes).
2026-05-28 20:19:58,151 [root] DEBUG: 9652: api-rate-cap: NtSetInformationThread hook disabled due to rate
2026-05-28 20:19:58,158 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:58,158 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEA040000: C:\Windows\SYSTEM32\AppxDeploymentClient (0x102000 bytes).
2026-05-28 20:19:58,162 [root] DEBUG: Loader: Injecting process 9708 (thread 9712) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,162 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:58,163 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,164 [lib.api.process] INFO: Injected into 64-bit <Process 9708 WinStore.App.exe>
2026-05-28 20:19:58,165 [root] INFO: Announced 64-bit process name: WinStore.App.exe pid: 9708
2026-05-28 20:19:58,165 [lib.api.process] INFO: Monitor config for process 9708: C:\6lreqs2g\dll\9708.ini
2026-05-28 20:19:58,165 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:58,166 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEB550000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 20:19:58,166 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE96E0000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 20:19:58,167 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:19:58,168 [root] DEBUG: 9652: DLL loaded at 0x00007FFEEC530000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 20:19:58,168 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE3AB0000: C:\Windows\System32\TextInputFramework (0xf9000 bytes).
2026-05-28 20:19:58,169 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE3950000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 20:19:58,169 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE3BB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 20:19:58,172 [root] DEBUG: 9652: DLL loaded at 0x00007FFEE0BF0000: C:\Windows\system32\TextShaping (0xac000 bytes).
2026-05-28 20:19:58,180 [root] DEBUG: 9652: AllocationHandler: Adding allocation to tracked region list: 0x00007DF46D3D1000, size: 0x1000.
2026-05-28 20:19:58,247 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:58,251 [root] DEBUG: Loader: Injecting process 9708 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,252 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 9712, handle 0x120
2026-05-28 20:19:58,252 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:19:58,253 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,254 [lib.api.process] INFO: Injected into 64-bit <Process 9708 WinStore.App.exe>
2026-05-28 20:19:58,272 [root] DEBUG: 9652: FreeHandler: Address: 0x00007DF46D3F0000.
2026-05-28 20:19:58,273 [root] DEBUG: 9652: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:19:58,274 [root] DEBUG: 9652: FreeHandler: Address: 0x00007DF46D3D0000.
2026-05-28 20:19:58,274 [root] DEBUG: 9652: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:19:58,275 [root] DEBUG: 9652: FreeHandler: Address: 0x00007DF46D3E0000.
2026-05-28 20:19:58,275 [root] DEBUG: 9652: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:19:58,276 [root] DEBUG: 9652: FreeHandler: Address: 0x00007DF46D400000.
2026-05-28 20:19:58,276 [root] DEBUG: 9652: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:19:58,277 [root] DEBUG: 9652: FreeHandler: Address: 0x00007DF46D410000.
2026-05-28 20:19:58,278 [root] DEBUG: 9652: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:19:58,753 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 7468: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF7BBA60000
2026-05-28 20:19:58,754 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7468
2026-05-28 20:19:58,754 [lib.api.process] INFO: Monitor config for process 7468: C:\6lreqs2g\dll\7468.ini
2026-05-28 20:19:58,755 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:58,756 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:58,759 [root] DEBUG: Loader: Injecting process 7468 (thread 7464) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,760 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:19:58,761 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,762 [lib.api.process] INFO: Injected into 64-bit <Process 7468 backgroundTaskHost.exe>
2026-05-28 20:19:58,763 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7468
2026-05-28 20:19:58,763 [lib.api.process] INFO: Monitor config for process 7468: C:\6lreqs2g\dll\7468.ini
2026-05-28 20:19:58,763 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:58,764 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:58,768 [root] DEBUG: Loader: Injecting process 7468 (thread 7464) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,768 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:19:58,769 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,770 [lib.api.process] INFO: Injected into 64-bit <Process 7468 backgroundTaskHost.exe>
2026-05-28 20:19:58,771 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7468
2026-05-28 20:19:58,771 [lib.api.process] INFO: Monitor config for process 7468: C:\6lreqs2g\dll\7468.ini
2026-05-28 20:19:58,771 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:19:58,772 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:19:58,776 [root] DEBUG: Loader: Injecting process 7468 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:19:58,777 [root] DEBUG: GetProcessInitialThreadId: ReadProcessMemory failed (0x000000BDF67FE048).
2026-05-28 20:19:58,778 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2026-05-28 20:19:58,779 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:05,168 [root] DEBUG: 1144: DLL loaded at 0x00007FFED9900000: C:\Windows\System32\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).
2026-05-28 20:20:05,262 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 9704: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:05,263 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9704
2026-05-28 20:20:05,263 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9704
2026-05-28 20:20:11,407 [root] DEBUG: 1144: DLL loaded at 0x00007FFED8650000: C:\Windows\system32\explorerframe (0x244000 bytes).
2026-05-28 20:20:12,004 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 9708: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:12,005 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 3480: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:12,007 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9708
2026-05-28 20:20:12,007 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 3480
2026-05-28 20:20:12,010 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9708
2026-05-28 20:20:12,010 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 3480
2026-05-28 20:20:12,013 [root] DEBUG: 1144: DLL loaded at 0x00007FFED02B0000: C:\Windows\System32\Windows.FileExplorer.Common (0x61000 bytes).
2026-05-28 20:20:12,032 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE9310000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-05-28 20:20:12,036 [root] DEBUG: 1144: DLL loaded at 0x00007FFEF06C0000: C:\Windows\System32\coml2 (0x79000 bytes).
2026-05-28 20:20:12,040 [root] DEBUG: 1144: DLL loaded at 0x00007FFED81B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 20:20:12,045 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 9280: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:12,047 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9280
2026-05-28 20:20:12,047 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9280
2026-05-28 20:20:12,049 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:20:12,050 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:20:12,068 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 9172: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:12,071 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9172
2026-05-28 20:20:12,072 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 9172
2026-05-28 20:20:14,593 [root] DEBUG: 1144: DLL loaded at 0x00007FFED98B0000: C:\Windows\System32\Windows.UI.AppDefaults (0x4c000 bytes).
2026-05-28 20:20:14,603 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE61A0000: C:\Windows\SYSTEM32\srvcli (0x28000 bytes).
2026-05-28 20:20:14,604 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE5430000: C:\Windows\SYSTEM32\urlmon (0x1ed000 bytes).
2026-05-28 20:20:14,607 [root] DEBUG: 1144: DLL loaded at 0x00007FFEDE9E0000: C:\Windows\SYSTEM32\FLTLIB (0xb000 bytes).
2026-05-28 20:20:14,607 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEC8E0000: C:\Windows\SYSTEM32\virtdisk (0x13000 bytes).
2026-05-28 20:20:14,608 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE40A0000: C:\Windows\System32\smartscreenps (0x52000 bytes).
2026-05-28 20:20:14,609 [root] DEBUG: 1144: DLL loaded at 0x00007FFED0380000: C:\Windows\SYSTEM32\shdocvw (0x41000 bytes).
2026-05-28 20:20:14,612 [root] DEBUG: 1144: DLL loaded at 0x00007FFEECF30000: C:\Windows\SYSTEM32\apphelp (0x90000 bytes).
2026-05-28 20:20:14,624 [root] DEBUG: 1144: DLL loaded at 0x00007FFEE88C0000: C:\Windows\System32\ActXPrxy (0xa2000 bytes).
2026-05-28 20:20:14,630 [lib.api.process] INFO: Monitor config for process 4372: C:\6lreqs2g\dll\4372.ini
2026-05-28 20:20:14,630 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:14,631 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:14,635 [root] DEBUG: Loader: Injecting process 4372 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:14,636 [root] DEBUG: 4372: caller_dispatch: Added region at 0x00000000027C0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00000000027C0042, thread 7108).
2026-05-28 20:20:14,636 [root] DEBUG: 4372: DumpPEsInRange: Scanning range 0x00000000027C0000 - 0x00000000027C0133.
2026-05-28 20:20:14,637 [root] DEBUG: 4372: ScanForDisguisedPE: Size too small: 0x133 bytes
2026-05-28 20:20:14,638 [lib.common.results] INFO: Uploading file C:\wqmrdiqI\CAPE\4372_260351420029552026 to CAPE\f4846e749e24183e9976bf71bd404da62a10f44032e0ec2bea863439d3704b65; Size is 307; Max size: 100000000
2026-05-28 20:20:14,640 [root] DEBUG: 4372: DumpMemory: Payload successfully created: C:\wqmrdiqI\CAPE\4372_260351420029552026 (size 307 bytes)
2026-05-28 20:20:14,640 [root] DEBUG: 4372: DumpRegion: Dumped entire allocation from 0x00000000027C0000, size 4096 bytes.
2026-05-28 20:20:14,640 [root] DEBUG: 4372: ProcessTrackedRegion: Dumped region at 0x00000000027C0000.
2026-05-28 20:20:14,641 [root] DEBUG: 4372: YaraScan: Scanning 0x00000000027C0000, size 0x133
2026-05-28 20:20:14,642 [root] DEBUG: 4372: Monitor config - unrecognised key host-ip.
2026-05-28 20:20:14,642 [root] DEBUG: 4372: Monitor config - unrecognised key host-port.
2026-05-28 20:20:14,642 [root] DEBUG: 4372: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:20:14,643 [root] DEBUG: 4372: Dropped file limit defaulting to 100.
2026-05-28 20:20:14,662 [root] DEBUG: 4372: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:20:14,700 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:20:14,701 [root] DEBUG: 4372: set_hooks: Unable to hook LockResource
2026-05-28 20:20:14,720 [root] DEBUG: 4372: Hooked 627 out of 628 functions
2026-05-28 20:20:14,748 [root] INFO: Loaded monitor into process with pid 4372
2026-05-28 20:20:14,751 [root] DEBUG: Error 317 (0x13d) - InjectDllViaThread: RtlCreateUserThread injection failed: The system cannot find message text for message number 0x%1 in the message file for %2.
2026-05-28 20:20:14,752 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:16,759 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 20:20:16,760 [root] DEBUG: 4372: OpenProcessHandler: Injection info created for process 6220, handle 0x10b8: Error obtaining target process name
2026-05-28 20:20:16,761 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 20:20:16,761 [root] DEBUG: 4372: OpenProcessHandler: Injection info created for process 8780, handle 0x1e6c: Error obtaining target process name
2026-05-28 20:20:16,763 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 20:20:16,763 [root] DEBUG: 4372: OpenProcessHandler: Injection info created for process 6028, handle 0x2480: Error obtaining target process name
2026-05-28 20:20:16,764 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 20:20:16,765 [root] DEBUG: 4372: OpenProcessHandler: Injection info created for process 6632, handle 0xfc4: Error obtaining target process name
2026-05-28 20:20:16,765 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 20:20:16,766 [root] DEBUG: 4372: OpenProcessHandler: Injection info created for process 1144, handle 0x249c: Error obtaining target process name
2026-05-28 20:20:16,767 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 20:20:16,767 [root] DEBUG: 4372: OpenProcessHandler: Injection info created for process 7448, handle 0x1184: Error obtaining target process name
2026-05-28 20:20:16,791 [root] DEBUG: 4372: DLL loaded at 0x00007FFED9700000: C:\Windows\system32\zipfldr (0x4a000 bytes).
2026-05-28 20:20:16,792 [root] DEBUG: 4372: DLL loaded at 0x00007FFED9700000: C:\Windows\system32\zipfldr (0x4a000 bytes).
2026-05-28 20:20:16,816 [root] DEBUG: 4372: DLL loaded at 0x00007FFE97050000: C:\Windows\system32\DUI70 (0x1ae000 bytes).
2026-05-28 20:20:16,817 [root] DEBUG: 4372: DLL loaded at 0x00007FFE97050000: C:\Windows\system32\DUI70 (0x1ae000 bytes).
2026-05-28 20:20:16,822 [root] DEBUG: 4372: DLL loaded at 0x00007FFED95B0000: C:\Windows\system32\DUser (0x95000 bytes).
2026-05-28 20:20:16,823 [root] DEBUG: 4372: DLL loaded at 0x00007FFED95B0000: C:\Windows\system32\DUser (0x95000 bytes).
2026-05-28 20:20:16,847 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
2026-05-28 20:20:16,901 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDFF70000: C:\Windows\SYSTEM32\MsftEdit (0x34d000 bytes).
2026-05-28 20:20:16,902 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDFF70000: C:\Windows\SYSTEM32\MsftEdit (0x34d000 bytes).
2026-05-28 20:20:16,915 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE41B0000: C:\Windows\SYSTEM32\globinputhost (0x25000 bytes).
2026-05-28 20:20:16,918 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE41B0000: C:\Windows\SYSTEM32\globinputhost (0x25000 bytes).
2026-05-28 20:20:16,932 [root] DEBUG: 4372: DLL loaded at 0x00007FFE96FA0000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0xa9000 bytes).
2026-05-28 20:20:16,933 [root] DEBUG: 4372: DLL loaded at 0x00007FFE96FA0000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0xa9000 bytes).
2026-05-28 20:20:16,990 [root] DEBUG: 4372: DLL loaded at 0x00007FFED5DC0000: C:\Windows\System32\Windows.Internal.System.UserProfile (0x43000 bytes).
2026-05-28 20:20:16,990 [root] DEBUG: 4372: DLL loaded at 0x00007FFED5DC0000: C:\Windows\System32\Windows.Internal.System.UserProfile (0x43000 bytes).
2026-05-28 20:20:16,997 [root] DEBUG: 4372: DLL loaded at 0x000000000FD10000: C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_91a19322cc8a92a3\gdiplus (0x1a5000 bytes).
2026-05-28 20:20:16,998 [root] DEBUG: 4372: DLL loaded at 0x000000000FD10000: C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_91a19322cc8a92a3\gdiplus (0x1a5000 bytes).
2026-05-28 20:20:16,998 [root] DEBUG: 4372: DLL loaded at 0x00007FFE967B0000: C:\Windows\system32\UIRibbon (0x3ec000 bytes).
2026-05-28 20:20:16,999 [root] DEBUG: 4372: DLL loaded at 0x00007FFE967B0000: C:\Windows\system32\UIRibbon (0x3ec000 bytes).
2026-05-28 20:20:17,416 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDCD80000: C:\Windows\System32\Windows.System.Launcher (0xbd000 bytes).
2026-05-28 20:20:17,418 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDCD80000: C:\Windows\System32\Windows.System.Launcher (0xbd000 bytes).
2026-05-28 20:20:17,447 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Artemis.lnk
2026-05-28 20:20:17,479 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
2026-05-28 20:20:17,499 [root] DEBUG: 4372: DLL loaded at 0x00007FFED8180000: C:\Windows\system32\WINMM (0x27000 bytes).
2026-05-28 20:20:17,500 [root] DEBUG: 4372: DLL loaded at 0x00007FFED8180000: C:\Windows\system32\WINMM (0x27000 bytes).
2026-05-28 20:20:17,505 [root] DEBUG: 4372: api-rate-cap: IsDebuggerPresent hook disabled due to rate
2026-05-28 20:20:17,541 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4610000: C:\Windows\System32\Windows.Services.TargetedContent (0x123000 bytes).
2026-05-28 20:20:17,542 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4610000: C:\Windows\System32\Windows.Services.TargetedContent (0x123000 bytes).
2026-05-28 20:20:17,561 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 10564: C:\Windows\System32\rundll32.exe, ImageBase: 0x00007FF6C5DC0000
2026-05-28 20:20:17,562 [root] INFO: Announced 64-bit process name: rundll32.exe pid: 10564
2026-05-28 20:20:17,562 [lib.api.process] INFO: Monitor config for process 10564: C:\6lreqs2g\dll\10564.ini
2026-05-28 20:20:17,563 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:17,565 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:17,569 [root] DEBUG: Loader: Injecting process 10564 (thread 10568) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:17,570 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:20:17,571 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:17,573 [lib.api.process] INFO: Injected into 64-bit <Process 10564 rundll32.exe>
2026-05-28 20:20:17,577 [root] INFO: Announced 64-bit process name: rundll32.exe pid: 10564
2026-05-28 20:20:17,579 [lib.api.process] INFO: Monitor config for process 10564: C:\6lreqs2g\dll\10564.ini
2026-05-28 20:20:17,584 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:17,593 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:17,600 [root] DEBUG: Loader: Injecting process 10564 (thread 10568) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:17,600 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:20:17,601 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:17,602 [lib.api.process] INFO: Injected into 64-bit <Process 10564 rundll32.exe>
2026-05-28 20:20:17,609 [root] DEBUG: 10564: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:20:17,610 [root] DEBUG: 10564: Interactive desktop enabled.
2026-05-28 20:20:17,610 [root] DEBUG: 10564: Dropped file limit defaulting to 100.
2026-05-28 20:20:17,612 [root] DEBUG: 10564: Disabling sleep skipping.
2026-05-28 20:20:17,612 [root] DEBUG: 10564: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:20:17,625 [root] DEBUG: 10564: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:20:17,625 [root] DEBUG: 10564: YaraScan: Scanning 0x00007FF6C5DC0000, size 0x16100
2026-05-28 20:20:17,627 [root] DEBUG: 10564: Monitor initialised: 64-bit capemon loaded in process 10564 at 0x00007FFEAF1A0000, thread 10568, image base 0x00007FF6C5DC0000, stack from 0x0000004530AC4000-0x0000004530AD0000
2026-05-28 20:20:17,627 [root] DEBUG: 10564: Commandline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
2026-05-28 20:20:17,639 [root] DEBUG: 10564: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:20:17,663 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:20:17,664 [root] DEBUG: 10564: set_hooks: Unable to hook LockResource
2026-05-28 20:20:17,671 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
2026-05-28 20:20:17,671 [root] DEBUG: 10564: Hooked 627 out of 628 functions
2026-05-28 20:20:17,673 [root] DEBUG: 10564: Syscall hook installed, syscall logging level 1
2026-05-28 20:20:17,678 [root] DEBUG: 10564: RestoreHeaders: Restored original import table.
2026-05-28 20:20:17,679 [root] INFO: Loaded monitor into process with pid 10564
2026-05-28 20:20:17,679 [root] DEBUG: 10564: caller_dispatch: Added region at 0x00007FF6C5DC0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6C5DC6D01, thread 10568).
2026-05-28 20:20:17,680 [root] DEBUG: 10564: YaraScan: Scanning 0x00007FF6C5DC0000, size 0x16100
2026-05-28 20:20:17,683 [root] DEBUG: 10564: ProcessImageBase: Main module image at 0x00007FF6C5DC0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:20:17,690 [root] DEBUG: 10564: DLL loaded at 0x00007FFEED0B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 20:20:17,692 [root] DEBUG: 10564: DLL loaded at 0x00007FFEF0BA0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 20:20:17,702 [root] DEBUG: 4372: DLL loaded at 0x00007FFED9890000: C:\Windows\system32\NetworkExplorer (0x17000 bytes).
2026-05-28 20:20:17,703 [root] DEBUG: 4372: DLL loaded at 0x00007FFED9890000: C:\Windows\system32\NetworkExplorer (0x17000 bytes).
2026-05-28 20:20:17,704 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE8990000: C:\Windows\System32\WorkFoldersShell (0x3d000 bytes).
2026-05-28 20:20:17,704 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE8990000: C:\Windows\System32\WorkFoldersShell (0x3d000 bytes).
2026-05-28 20:20:17,707 [root] DEBUG: 4372: api-rate-cap: LdrpCallInitRoutine hook disabled due to rate
2026-05-28 20:20:17,715 [root] DEBUG: 10564: NtTerminateProcess hook: Attempting to dump process 10564
2026-05-28 20:20:17,718 [root] DEBUG: 10564: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:20:17,728 [root] INFO: Process with pid 10564 has terminated
2026-05-28 20:20:17,807 [root] DEBUG: 4372: api-rate-cap: NtClose hook disabled due to rate
2026-05-28 20:20:23,985 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 11156: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6868D0000
2026-05-28 20:20:23,987 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 11156
2026-05-28 20:20:23,988 [lib.api.process] INFO: Monitor config for process 11156: C:\6lreqs2g\dll\11156.ini
2026-05-28 20:20:23,994 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:23,998 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:24,003 [root] DEBUG: Loader: Injecting process 11156 (thread 11160) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:24,005 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:20:24,005 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:24,006 [lib.api.process] INFO: Injected into 64-bit <Process 11156 dllhost.exe>
2026-05-28 20:20:24,007 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 11156
2026-05-28 20:20:24,008 [lib.api.process] INFO: Monitor config for process 11156: C:\6lreqs2g\dll\11156.ini
2026-05-28 20:20:24,009 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:24,010 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:24,016 [root] DEBUG: Loader: Injecting process 11156 (thread 11160) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:24,016 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:20:24,017 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:24,024 [lib.api.process] INFO: Injected into 64-bit <Process 11156 dllhost.exe>
2026-05-28 20:20:24,031 [root] DEBUG: 11156: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:20:24,032 [root] DEBUG: 11156: Interactive desktop enabled.
2026-05-28 20:20:24,033 [root] DEBUG: 11156: Dropped file limit defaulting to 100.
2026-05-28 20:20:24,043 [root] DEBUG: 11156: Disabling sleep skipping.
2026-05-28 20:20:24,044 [root] DEBUG: 11156: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:20:24,056 [root] DEBUG: 11156: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:20:24,057 [root] DEBUG: 11156: YaraScan: Scanning 0x00007FF6868D0000, size 0x8026
2026-05-28 20:20:24,058 [root] DEBUG: 11156: Monitor initialised: 64-bit capemon loaded in process 11156 at 0x00007FFEAF1A0000, thread 11160, image base 0x00007FF6868D0000, stack from 0x000000DD0A744000-0x000000DD0A750000
2026-05-28 20:20:24,059 [root] DEBUG: 11156: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 20:20:24,068 [root] DEBUG: 11156: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:20:24,090 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:20:24,091 [root] DEBUG: 11156: set_hooks: Unable to hook LockResource
2026-05-28 20:20:24,096 [root] DEBUG: 11156: Hooked 627 out of 628 functions
2026-05-28 20:20:24,097 [root] DEBUG: 11156: Syscall hook installed, syscall logging level 1
2026-05-28 20:20:24,102 [root] DEBUG: 11156: RestoreHeaders: Restored original import table.
2026-05-28 20:20:24,103 [root] INFO: Loaded monitor into process with pid 11156
2026-05-28 20:20:24,104 [root] DEBUG: 11156: caller_dispatch: Added region at 0x00007FF6868D0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6868D12F2, thread 11160).
2026-05-28 20:20:24,105 [root] DEBUG: 11156: YaraScan: Scanning 0x00007FF6868D0000, size 0x8026
2026-05-28 20:20:24,106 [root] DEBUG: 11156: ProcessImageBase: Main module image at 0x00007FF6868D0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:20:24,108 [root] DEBUG: 11156: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:20:24,109 [root] DEBUG: 11156: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:20:24,112 [root] DEBUG: 11156: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:20:24,125 [root] DEBUG: 11156: DLL loaded at 0x00007FFEED0B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 20:20:24,138 [root] DEBUG: 11156: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:20:24,140 [root] DEBUG: 11156: DLL loaded at 0x00007FFED81B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 20:20:24,145 [root] DEBUG: 11156: DLL loaded at 0x00007FFEEB280000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 20:20:27,915 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 11436: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6868D0000
2026-05-28 20:20:27,917 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 11436
2026-05-28 20:20:27,917 [lib.api.process] INFO: Monitor config for process 11436: C:\6lreqs2g\dll\11436.ini
2026-05-28 20:20:27,919 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:27,923 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:27,928 [root] DEBUG: Loader: Injecting process 11436 (thread 11440) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:27,929 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:20:27,929 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:27,931 [lib.api.process] INFO: Injected into 64-bit <Process 11436 dllhost.exe>
2026-05-28 20:20:27,934 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 11436
2026-05-28 20:20:27,935 [lib.api.process] INFO: Monitor config for process 11436: C:\6lreqs2g\dll\11436.ini
2026-05-28 20:20:27,935 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:27,937 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:27,941 [root] DEBUG: Loader: Injecting process 11436 (thread 11440) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:27,942 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:20:27,943 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:27,944 [lib.api.process] INFO: Injected into 64-bit <Process 11436 dllhost.exe>
2026-05-28 20:20:27,951 [root] DEBUG: 11436: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:20:27,952 [root] DEBUG: 11436: Interactive desktop enabled.
2026-05-28 20:20:27,952 [root] DEBUG: 11436: Dropped file limit defaulting to 100.
2026-05-28 20:20:27,955 [root] DEBUG: 11436: Disabling sleep skipping.
2026-05-28 20:20:27,956 [root] DEBUG: 11436: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:20:27,960 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 11696: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x00007FF7D5630000
2026-05-28 20:20:27,961 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 11696
2026-05-28 20:20:27,962 [lib.api.process] INFO: Monitor config for process 11696: C:\6lreqs2g\dll\11696.ini
2026-05-28 20:20:27,964 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:27,968 [root] DEBUG: 11436: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:20:27,969 [root] DEBUG: 11436: YaraScan: Scanning 0x00007FF6868D0000, size 0x8026
2026-05-28 20:20:27,970 [root] DEBUG: 11436: Monitor initialised: 64-bit capemon loaded in process 11436 at 0x00007FFEAF1A0000, thread 11440, image base 0x00007FF6868D0000, stack from 0x00000001000F4000-0x0000000100100000
2026-05-28 20:20:27,970 [root] DEBUG: 11436: Commandline: C:\Windows\system32\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}
2026-05-28 20:20:27,981 [root] DEBUG: 11436: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:20:28,003 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:20:28,004 [root] DEBUG: 11436: set_hooks: Unable to hook LockResource
2026-05-28 20:20:28,008 [root] DEBUG: 11436: Hooked 627 out of 628 functions
2026-05-28 20:20:28,009 [root] DEBUG: 11436: Syscall hook installed, syscall logging level 1
2026-05-28 20:20:28,013 [root] DEBUG: 11436: RestoreHeaders: Restored original import table.
2026-05-28 20:20:28,014 [root] INFO: Loaded monitor into process with pid 11436
2026-05-28 20:20:28,014 [root] DEBUG: 11436: caller_dispatch: Added region at 0x00007FF6868D0000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x00007FF6868D1153, thread 11440).
2026-05-28 20:20:28,015 [root] DEBUG: 11436: YaraScan: Scanning 0x00007FF6868D0000, size 0x8026
2026-05-28 20:20:28,016 [root] DEBUG: 11436: ProcessImageBase: Main module image at 0x00007FF6868D0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:20:28,018 [root] DEBUG: 11436: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:20:28,019 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:20:28,021 [root] DEBUG: 11436: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:20:28,035 [root] DEBUG: 11436: DLL loaded at 0x00007FFEED0B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 20:20:28,051 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-28 20:20:28,051 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-28 20:20:28,052 [root] DEBUG: 11436: DLL loaded at 0x00007FFEE8D30000: C:\Windows\system32\dhcpcsvc (0x1d000 bytes).
2026-05-28 20:20:28,054 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-28 20:20:28,055 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:20:28,055 [root] DEBUG: 11436: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:20:28,056 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEEAD0000: C:\Windows\system32\IPHLPAPI (0x3b000 bytes).
2026-05-28 20:20:28,057 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEF5C0000: C:\Windows\system32\USERENV (0x2e000 bytes).
2026-05-28 20:20:28,058 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEF640000: C:\Windows\system32\profapi (0x25000 bytes).
2026-05-28 20:20:28,059 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEB240000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-28 20:20:28,060 [root] DEBUG: 11436: DLL loaded at 0x00007FFEEEB10000: C:\Windows\system32\DNSAPI (0xca000 bytes).
2026-05-28 20:20:28,060 [root] DEBUG: 11436: DLL loaded at 0x00007FFE95D90000: C:\Windows\system32\domgmt (0x86000 bytes).
2026-05-28 20:20:28,063 [root] DEBUG: 11436: DLL loaded at 0x00007FFEF0990000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 20:20:28,069 [root] DEBUG: 11436: DLL loaded at 0x00007FFEE0FD0000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 20:20:29,182 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:29,187 [root] DEBUG: Loader: Injecting process 11696 (thread 11700) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:29,188 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:20:29,189 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:29,190 [lib.api.process] INFO: Injected into 64-bit <Process 11696 WmiPrvSE.exe>
2026-05-28 20:20:29,191 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 11696
2026-05-28 20:20:29,191 [lib.api.process] INFO: Monitor config for process 11696: C:\6lreqs2g\dll\11696.ini
2026-05-28 20:20:29,192 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:29,308 [root] INFO: Process with pid 11156 has terminated
2026-05-28 20:20:29,309 [root] DEBUG: 11156: NtTerminateProcess hook: Attempting to dump process 11156
2026-05-28 20:20:29,310 [root] DEBUG: 11156: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:20:29,522 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:29,527 [root] DEBUG: Loader: Injecting process 11696 (thread 11700) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:29,528 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:20:29,529 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:29,530 [lib.api.process] INFO: Injected into 64-bit <Process 11696 WmiPrvSE.exe>
2026-05-28 20:20:29,538 [root] DEBUG: 11696: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:20:29,538 [root] DEBUG: 11696: Interactive desktop enabled.
2026-05-28 20:20:29,539 [root] DEBUG: 11696: Dropped file limit defaulting to 100.
2026-05-28 20:20:29,540 [root] DEBUG: 11696: Disabling sleep skipping.
2026-05-28 20:20:29,541 [root] DEBUG: 11696: Services hook set enabled
2026-05-28 20:20:29,543 [root] DEBUG: 11696: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:20:29,555 [root] DEBUG: 11696: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:20:29,555 [root] DEBUG: 11696: Monitor initialised: 64-bit capemon loaded in process 11696 at 0x00007FFEAF1A0000, thread 11700, image base 0x00007FF7D5630000, stack from 0x000000629C170000-0x000000629C180000
2026-05-28 20:20:29,556 [root] DEBUG: 11696: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2026-05-28 20:20:29,568 [root] DEBUG: 11696: Hooked 69 out of 69 functions
2026-05-28 20:20:29,571 [root] DEBUG: 11696: RestoreHeaders: Restored original import table.
2026-05-28 20:20:29,572 [root] INFO: Loaded monitor into process with pid 11696
2026-05-28 20:20:29,576 [root] DEBUG: 11696: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:20:29,576 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:20:29,578 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:20:29,580 [lib.api.process] INFO: Monitor config for process 4080: C:\6lreqs2g\dll\4080.ini
2026-05-28 20:20:29,581 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:20:29,583 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:20:29,586 [root] DEBUG: Loader: Injecting process 4080 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:29,588 [root] DEBUG: 4080: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:20:29,589 [root] DEBUG: 4080: Disabling sleep skipping.
2026-05-28 20:20:29,590 [root] DEBUG: 4080: Interactive desktop enabled.
2026-05-28 20:20:29,590 [root] DEBUG: 4080: Dropped file limit defaulting to 100.
2026-05-28 20:20:29,591 [root] DEBUG: 4080: Services hook set enabled
2026-05-28 20:20:29,592 [root] DEBUG: 4080: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:20:29,604 [root] DEBUG: 4080: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:20:29,605 [root] DEBUG: 4080: Monitor initialised: 64-bit capemon loaded in process 4080 at 0x00007FFEAF1A0000, thread 12240, image base 0x00007FF6A8D80000, stack from 0x0000008A92FF5000-0x0000008A93000000
2026-05-28 20:20:29,606 [root] DEBUG: 4080: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2026-05-28 20:20:29,618 [root] DEBUG: 4080: Hooked 69 out of 69 functions
2026-05-28 20:20:29,620 [root] INFO: Loaded monitor into process with pid 4080
2026-05-28 20:20:29,621 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 20:20:29,621 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:20:29,623 [lib.api.process] INFO: Injected into 64-bit <Process 4080 svchost.exe>
2026-05-28 20:20:31,635 [root] DEBUG: 11696: DLL loaded at 0x00007FFEDD9B0000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-05-28 20:20:31,638 [root] DEBUG: 11696: DLL loaded at 0x00007FFED9650000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-05-28 20:20:31,647 [root] DEBUG: 11696: DLL loaded at 0x00007FFED5D90000: C:\Windows\system32\wbem\wmiutils (0x28000 bytes).
2026-05-28 20:20:31,656 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:20:31,657 [root] DEBUG: 11696: DLL loaded at 0x00007FFE95030000: C:\Windows\SYSTEM32\framedynos (0x52000 bytes).
2026-05-28 20:20:31,657 [root] DEBUG: 11696: DLL loaded at 0x00007FFE95090000: C:\Windows\system32\wbem\cimwin32 (0x20c000 bytes).
2026-05-28 20:20:31,658 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF550000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 20:20:31,666 [root] DEBUG: 11696: DLL loaded at 0x0000025AB9180000: C:\Windows\SYSTEM32\WMI (0x3000 bytes).
2026-05-28 20:20:31,667 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEA840000: C:\Windows\SYSTEM32\wmiclnt (0x11000 bytes).
2026-05-28 20:20:31,669 [root] DEBUG: 11696: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-28 20:20:33,076 [root] INFO: Process with pid 11436 has terminated
2026-05-28 20:20:33,077 [root] DEBUG: 11436: NtTerminateProcess hook: Attempting to dump process 11436
2026-05-28 20:20:33,077 [root] DEBUG: 11436: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:20:34,232 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95DE0000: C:\Windows\System32\wscinterop (0x3d000 bytes).
2026-05-28 20:20:34,233 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95DE0000: C:\Windows\System32\wscinterop (0x3d000 bytes).
2026-05-28 20:20:34,235 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE1490000: C:\Windows\System32\WSCAPI (0x4d000 bytes).
2026-05-28 20:20:34,236 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE1490000: C:\Windows\System32\WSCAPI (0x4d000 bytes).
2026-05-28 20:20:34,243 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95DC0000: C:\Windows\System32\wscui.cpl (0x19000 bytes).
2026-05-28 20:20:34,243 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95DC0000: C:\Windows\System32\wscui.cpl (0x19000 bytes).
2026-05-28 20:20:34,253 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95030000: C:\Windows\System32\framedynos (0x52000 bytes).
2026-05-28 20:20:34,254 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95030000: C:\Windows\System32\framedynos (0x52000 bytes).
2026-05-28 20:20:34,255 [root] DEBUG: 4372: DLL loaded at 0x00007FFEED410000: C:\Windows\System32\wer (0xde000 bytes).
2026-05-28 20:20:34,255 [root] DEBUG: 4372: DLL loaded at 0x00007FFEED410000: C:\Windows\System32\wer (0xde000 bytes).
2026-05-28 20:20:34,256 [root] DEBUG: 4372: DLL loaded at 0x00007FFE94F50000: C:\Windows\System32\werconcpl (0xde000 bytes).
2026-05-28 20:20:34,257 [root] DEBUG: 4372: DLL loaded at 0x00007FFE94F50000: C:\Windows\System32\werconcpl (0xde000 bytes).
2026-05-28 20:20:34,263 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95DA0000: C:\Windows\System32\hcproviders (0x14000 bytes).
2026-05-28 20:20:34,263 [root] DEBUG: 4372: DLL loaded at 0x00007FFE95DA0000: C:\Windows\System32\hcproviders (0x14000 bytes).
2026-05-28 20:20:34,271 [root] DEBUG: 4372: DLL loaded at 0x00007FFE94E60000: C:\Windows\System32\ieproxy (0xee000 bytes).
2026-05-28 20:20:34,272 [root] DEBUG: 4372: DLL loaded at 0x00007FFE94E60000: C:\Windows\System32\ieproxy (0xee000 bytes).
2026-05-28 20:20:35,230 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE220000: C:\Windows\SYSTEM32\sppc (0x25000 bytes).
2026-05-28 20:20:35,231 [root] DEBUG: 1144: DLL loaded at 0x00007FFEEE250000: C:\Windows\system32\slc (0x29000 bytes).
2026-05-28 20:20:35,232 [root] DEBUG: 1144: DLL loaded at 0x00007FFE94E40000: C:\Windows\system32\slwga (0x19000 bytes).
2026-05-28 20:20:35,262 [root] DEBUG: 1144: DLL loaded at 0x00007FFE94E20000: C:\Windows\System32\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient (0x12000 bytes).
2026-05-28 20:20:35,326 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 12520: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:35,327 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 12520
2026-05-28 20:20:35,328 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 12520
2026-05-28 20:20:35,390 [root] DEBUG: 1144: DLL loaded at 0x00007FFE94CF0000: C:\Windows\System32\CloudExperienceHostCommon (0x128000 bytes).
2026-05-28 20:20:36,050 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 12704: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:20:36,051 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 12704
2026-05-28 20:20:36,051 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 12704
2026-05-28 20:20:48,140 [root] DEBUG: 4372: api-cap: RegQueryValueExW hook disabled due to count: 5001
2026-05-28 20:20:48,141 [root] DEBUG: 4372: api-cap: RegQueryValueExW hook disabled due to count: 5000
2026-05-28 20:20:48,141 [root] DEBUG: 4372: api-cap: RegQueryValueExW hook disabled due to count: 5002
2026-05-28 20:20:51,329 [root] DEBUG: 4372: api-cap: NtQueryInformationToken hook disabled due to count: 5000
2026-05-28 20:20:51,453 [root] DEBUG: 4372: api-cap: RegOpenKeyExW hook disabled due to count: 5000
2026-05-28 20:20:51,996 [root] DEBUG: 4372: api-cap: GetSystemMetrics hook disabled due to count: 5000
2026-05-28 20:20:52,182 [root] DEBUG: 4372: DLL loaded at 0x00007FFEB5DE0000: C:\Windows\SYSTEM32\CHARTV (0x25000 bytes).
2026-05-28 20:20:52,183 [root] DEBUG: 4372: DLL loaded at 0x00007FFEB5DE0000: C:\Windows\SYSTEM32\CHARTV (0x25000 bytes).
2026-05-28 20:20:52,271 [root] DEBUG: 4372: DLL loaded at 0x00007FFEF0A50000: C:\Windows\System32\comdlg32 (0xda000 bytes).
2026-05-28 20:20:52,272 [root] DEBUG: 4372: DLL loaded at 0x00007FFEF0A50000: C:\Windows\System32\comdlg32 (0xda000 bytes).
2026-05-28 20:21:09,204 [root] DEBUG: 4372: api-cap: NtQueryKey hook disabled due to count: 5000
2026-05-28 20:21:09,524 [root] DEBUG: 4372: DLL loaded at 0x00007FFED9050000: C:\Program Files\Windows Defender\MpOav (0x44000 bytes).
2026-05-28 20:21:09,525 [root] DEBUG: 4372: DLL loaded at 0x00007FFED9050000: C:\Program Files\Windows Defender\MpOav (0x44000 bytes).
2026-05-28 20:21:09,527 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE3EC0000: C:\Program Files\Windows Defender\MPCLIENT (0xe9000 bytes).
2026-05-28 20:21:09,528 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE3EC0000: C:\Program Files\Windows Defender\MPCLIENT (0xe9000 bytes).
2026-05-28 20:21:09,534 [root] DEBUG: 4372: DLL loaded at 0x00007FFEEDFA0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 20:21:09,534 [root] DEBUG: 4372: DLL loaded at 0x00007FFEEDFA0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 20:21:09,537 [root] DEBUG: 4372: api-rate-cap: NtOpenKeyEx hook disabled due to rate
2026-05-28 20:21:09,554 [root] DEBUG: 4372: api-cap: RegCloseKey hook disabled due to count: 5000
2026-05-28 20:21:09,697 [root] DEBUG: 4372: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5000
2026-05-28 20:21:09,699 [root] DEBUG: 4372: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5001
2026-05-28 20:21:10,018 [root] DEBUG: 4372: api-cap: RegEnumKeyExW hook disabled due to count: 5000
2026-05-28 20:21:12,448 [root] DEBUG: 4372: api-rate-cap: SystemParametersInfoW hook disabled due to rate
2026-05-28 20:21:12,700 [lib.common.results] INFO: Uploading file C:\Users\admin\Downloads\InstallBC201401.exe:Zone.Identifier to files\813a1c026993a71a1d691d71cdcff9a40aa74f20cea19b0d4cc94469585c3fa3; Size is 76; Max size: 100000000
2026-05-28 20:21:12,746 [root] DEBUG: 4372: CreateProcessHandler: Injection info set for new process 5944: C:\Users\admin\Downloads\InstallBC201401.exe, ImageBase: 0x00000000008C0000
2026-05-28 20:21:12,747 [root] INFO: Announced 32-bit process name: InstallBC201401.exe pid: 5944
2026-05-28 20:21:12,748 [lib.api.process] INFO: Monitor config for process 5944: C:\6lreqs2g\dll\5944.ini
2026-05-28 20:21:12,749 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:12,753 [lib.api.process] INFO: 32-bit DLL to inject is C:\6lreqs2g\dll\EDOZcREV.dll, loader C:\6lreqs2g\bin\gtAsima.exe
2026-05-28 20:21:12,761 [root] DEBUG: Loader: Injecting process 5944 (thread 5940) with C:\6lreqs2g\dll\EDOZcREV.dll.
2026-05-28 20:21:12,762 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:21:12,764 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\EDOZcREV.dll.
2026-05-28 20:21:12,766 [lib.api.process] INFO: Injected into 32-bit <Process 5944 InstallBC201401.exe>
2026-05-28 20:21:12,769 [root] INFO: Announced 32-bit process name: InstallBC201401.exe pid: 5944
2026-05-28 20:21:12,770 [lib.api.process] INFO: Monitor config for process 5944: C:\6lreqs2g\dll\5944.ini
2026-05-28 20:21:12,770 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:12,774 [lib.api.process] INFO: 32-bit DLL to inject is C:\6lreqs2g\dll\EDOZcREV.dll, loader C:\6lreqs2g\bin\gtAsima.exe
2026-05-28 20:21:12,780 [root] DEBUG: Loader: Injecting process 5944 (thread 5940) with C:\6lreqs2g\dll\EDOZcREV.dll.
2026-05-28 20:21:12,781 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:21:12,782 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\EDOZcREV.dll.
2026-05-28 20:21:12,784 [lib.api.process] INFO: Injected into 32-bit <Process 5944 InstallBC201401.exe>
2026-05-28 20:21:12,790 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE8A00000: C:\Windows\SYSTEM32\MPR (0x1d000 bytes).
2026-05-28 20:21:12,792 [root] DEBUG: 4372: DLL loaded at 0x00007FFEE8A00000: C:\Windows\SYSTEM32\MPR (0x1d000 bytes).
2026-05-28 20:21:12,793 [root] DEBUG: 4372: DLL loaded at 0x00007FFED0AA0000: C:\Windows\SYSTEM32\pcacli (0x16000 bytes).
2026-05-28 20:21:12,794 [root] DEBUG: 4372: DLL loaded at 0x00007FFED0AA0000: C:\Windows\SYSTEM32\pcacli (0x16000 bytes).
2026-05-28 20:21:12,797 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDD4B0000: C:\Windows\System32\sfc_os (0x12000 bytes).
2026-05-28 20:21:12,797 [root] DEBUG: 4372: DLL loaded at 0x00007FFEDD4B0000: C:\Windows\System32\sfc_os (0x12000 bytes).
2026-05-28 20:21:12,812 [root] INFO: Announced 32-bit process name: InstallBC201401.exe pid: 5944
2026-05-28 20:21:12,813 [lib.api.process] INFO: Monitor config for process 5944: C:\6lreqs2g\dll\5944.ini
2026-05-28 20:21:12,813 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:12,816 [lib.api.process] INFO: 32-bit DLL to inject is C:\6lreqs2g\dll\EDOZcREV.dll, loader C:\6lreqs2g\bin\gtAsima.exe
2026-05-28 20:21:12,822 [root] DEBUG: Loader: Injecting process 5944 with C:\6lreqs2g\dll\EDOZcREV.dll.
2026-05-28 20:21:12,822 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2026-05-28 20:21:12,823 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\EDOZcREV.dll.
2026-05-28 20:21:12,835 [root] DEBUG: 5944: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:21:12,836 [root] DEBUG: 5944: Interactive desktop enabled.
2026-05-28 20:21:12,836 [root] DEBUG: 5944: Dropped file limit defaulting to 100.
2026-05-28 20:21:12,838 [root] DEBUG: 5944: Disabling sleep skipping.
2026-05-28 20:21:12,840 [root] DEBUG: 5944: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:21:12,841 [root] DEBUG: 5944: YaraScan: Scanning 0x008C0000, size 0xcc5123
2026-05-28 20:21:12,916 [root] DEBUG: 5944: Monitor initialised: 32-bit capemon loaded in process 5944 at 0x6c5b0000, thread 5940, image base 0x8c0000, stack from 0x18f4000-0x1900000
2026-05-28 20:21:12,917 [root] DEBUG: 5944: Commandline: "C:\Users\admin\Downloads\InstallBC201401.exe"
2026-05-28 20:21:12,944 [root] DEBUG: 5944: hook_api: LdrpCallInitRoutine export address 0x776C2B50 obtained via GetFunctionAddress
2026-05-28 20:21:12,956 [root] DEBUG: 5944: hook_api: combase::CoCreateInstance export address 0x75EB94C0 differs from GetProcAddress -> 0x6ACC1770
2026-05-28 20:21:12,957 [root] DEBUG: 5944: hook_api: Warning - NtCreateFile export address 0x776C30F0 differs from GetProcAddress -> 0x6ACC1850 (apphelp.dll::0xf3671850)
2026-05-28 20:21:12,958 [root] DEBUG: 5944: hook_api: Warning - NtSetInformationFile export address 0x776C2E10 differs from GetProcAddress -> 0x6ACC19B0 (apphelp.dll::0xf36719b0)
2026-05-28 20:21:12,960 [root] DEBUG: 5944: hook_api: Warning - NtSetValueKey export address 0x776C31A0 differs from GetProcAddress -> 0x6ACC1A20 (apphelp.dll::0xf3671a20)
2026-05-28 20:21:12,961 [root] DEBUG: 5944: hook_api: Warning - SetWindowLongW export address 0x761259F0 differs from GetProcAddress -> 0x6AC85A40 (apphelp.dll::0xf4b95a40)
2026-05-28 20:21:12,961 [root] DEBUG: 5944: hook_api: Warning - EnumDisplayDevicesA export address 0x76119AF0 differs from GetProcAddress -> 0x6AC867E0 (apphelp.dll::0xf4b967e0)
2026-05-28 20:21:12,962 [root] DEBUG: 5944: hook_api: Warning - EnumDisplayDevicesW export address 0x76130150 differs from GetProcAddress -> 0x6ACAE560 (apphelp.dll::0xf4bbe560)
2026-05-28 20:21:12,964 [root] DEBUG: 5944: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 20:21:12,964 [root] DEBUG: 5944: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 20:21:12,965 [root] DEBUG: 5944: hook_api: Warning - SetWindowsHookExW export address 0x761309D0 differs from GetProcAddress -> 0x6ACC1A90 (apphelp.dll::0xf4bd1a90)
2026-05-28 20:21:12,969 [root] DEBUG: 5944: Hooked 632 out of 632 functions
2026-05-28 20:21:13,032 [root] DEBUG: 5944: Syscall hook installed, syscall logging level 1
2026-05-28 20:21:13,036 [root] DEBUG: 5944: RestoreHeaders: Restored original import table.
2026-05-28 20:21:13,037 [root] INFO: Loaded monitor into process with pid 5944
2026-05-28 20:21:13,044 [root] DEBUG: 5944: caller_dispatch: Added region at 0x008C0000 to tracked regions list (kernel32::GetSystemTimeAsFileTime returns to 0x008C14C2, thread 5940).
2026-05-28 20:21:13,046 [root] DEBUG: 5944: YaraScan: Scanning 0x008C0000, size 0xcc5123
2026-05-28 20:21:13,115 [root] DEBUG: 5944: ProcessImageBase: Main module image at 0x008C0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:21:13,129 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\TsuF0596FC9.dll
2026-05-28 20:21:13,152 [root] DEBUG: 5944: DLL loaded at 0x750B0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\COMCTL32 (0x210000 bytes).
2026-05-28 20:21:13,153 [root] DEBUG: 5944: DLL loaded at 0x77250000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 20:21:13,153 [root] DEBUG: 5944: DLL loaded at 0x75760000: C:\Windows\System32\comdlg32 (0xaf000 bytes).
2026-05-28 20:21:13,155 [root] DEBUG: 5944: DLL loaded at 0x742E0000: C:\Windows\SYSTEM32\WININET (0x455000 bytes).
2026-05-28 20:21:13,156 [root] DEBUG: 5944: DLL loaded at 0x752C0000: C:\Windows\SYSTEM32\USERENV (0x25000 bytes).
2026-05-28 20:21:13,157 [root] DEBUG: 5944: DLL loaded at 0x74840000: C:\Users\admin\AppData\Local\Temp\TsuF0596FC9 (0x49000 bytes).
2026-05-28 20:21:13,161 [root] DEBUG: 5944: InstrumentationCallback: Added region at 0x7569274C (base 0x75670000) to tracked regions list (thread 5940).
2026-05-28 20:21:13,162 [root] DEBUG: 5944: ProcessTrackedRegion: Region at 0x75670000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 20:21:13,172 [root] DEBUG: 5944: DLL loaded at 0x015F0000: C:\Windows\SYSTEM32\sfc (0x3000 bytes).
2026-05-28 20:21:13,174 [root] DEBUG: 5944: DLL loaded at 0x74830000: C:\Windows\SYSTEM32\sfc_os (0x10000 bytes).
2026-05-28 20:21:13,177 [root] DEBUG: 5944: DLL loaded at 0x74800000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 20:21:13,179 [root] DEBUG: 5944: DLL loaded at 0x76970000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-05-28 20:21:13,180 [root] DEBUG: 5944: DLL loaded at 0x74F60000: C:\Windows\system32\uxtheme (0x74000 bytes).
2026-05-28 20:21:13,194 [root] DEBUG: 5944: DLL loaded at 0x74770000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-05-28 20:21:13,197 [root] DEBUG: 5944: DLL loaded at 0x6C550000: C:\Windows\SYSTEM32\mscoree (0x52000 bytes).
2026-05-28 20:21:13,203 [root] DEBUG: 5944: DLL loaded at 0x6C4C0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x8d000 bytes).
2026-05-28 20:21:13,208 [root] DEBUG: 5944: DLL loaded at 0x74810000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion (0x13000 bytes).
2026-05-28 20:21:13,212 [root] DEBUG: 5944: DLL loaded at 0x6B1B0000: C:\Windows\SYSTEM32\ucrtbase_clr0400 (0xab000 bytes).
2026-05-28 20:21:13,213 [root] DEBUG: 5944: DLL loaded at 0x6C4A0000: C:\Windows\SYSTEM32\VCRUNTIME140_CLR0400 (0x14000 bytes).
2026-05-28 20:21:13,214 [root] DEBUG: 5944: DLL loaded at 0x6A1A0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr (0x848000 bytes).
2026-05-28 20:21:13,221 [root] DEBUG: 5944: DLL loaded at 0x70B90000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-28 20:21:13,221 [root] DEBUG: 5944: DLL loaded at 0x6B180000: C:\Windows\SYSTEM32\rstrtmgr (0x30000 bytes).
2026-05-28 20:21:13,223 [root] DEBUG: 5944: DLL loaded at 0x700B0000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-28 20:21:13,231 [root] DEBUG: 5944: ProtectionHandler: Adding region at 0x774D4000 to tracked regions.
2026-05-28 20:21:13,234 [root] DEBUG: 5944: DLL loaded at 0x77410000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-05-28 20:21:13,243 [root] DEBUG: 5944: ProtectionHandler: Adding region at 0x748D3000 to tracked regions.
2026-05-28 20:21:13,245 [root] DEBUG: 5944: ProtectionHandler: Processing previous tracked region at: 0x77410000.
2026-05-28 20:21:13,246 [root] DEBUG: 5944: ProcessTrackedRegion: Updated entropy for tracked region at 0x77410000: 6.651596e+00 (from 6.649760e+00)
2026-05-28 20:21:13,247 [root] DEBUG: 5944: ProcessTrackedRegion: Region at 0x77410000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\msctf.dll is in known range, skipping
2026-05-28 20:21:13,248 [root] DEBUG: 5944: DLL loaded at 0x748B0000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 20:21:13,249 [root] DEBUG: 5944: DLL loaded at 0x6F550000: C:\Windows\System32\CoreMessaging (0x9b000 bytes).
2026-05-28 20:21:13,250 [root] DEBUG: 5944: DLL loaded at 0x6F470000: C:\Windows\SYSTEM32\wintypes (0xdc000 bytes).
2026-05-28 20:21:13,251 [root] DEBUG: 5944: ProtectionHandler: Adding region at 0x6F84E000 to tracked regions.
2026-05-28 20:21:13,266 [root] DEBUG: 5944: ProtectionHandler: Processing previous tracked region at: 0x748B0000.
2026-05-28 20:21:13,268 [root] DEBUG: 5944: ProcessTrackedRegion: Updated entropy for tracked region at 0x748B0000: 5.913606e+00 (from 5.913624e+00)
2026-05-28 20:21:13,271 [root] DEBUG: 5944: ProcessTrackedRegion: Region at 0x748B0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\ntmarta.dll is in known range, skipping
2026-05-28 20:21:13,273 [root] DEBUG: 5944: DLL loaded at 0x6F6E0000: C:\Windows\System32\CoreUIComponents (0x27f000 bytes).
2026-05-28 20:21:13,275 [root] DEBUG: 5944: DLL loaded at 0x6F9E0000: C:\Windows\SYSTEM32\textinputframework (0xb9000 bytes).
2026-05-28 20:21:13,291 [root] DEBUG: 5944: DLL loaded at 0x6B0E0000: C:\Windows\SYSTEM32\TextShaping (0x95000 bytes).
2026-05-28 20:21:13,317 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,318 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,319 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,320 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,320 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,321 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,322 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,323 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,324 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,325 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,328 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,329 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,329 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,330 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,331 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,332 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,332 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,333 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,335 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,336 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,337 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,337 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,338 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,339 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,340 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,340 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,341 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,342 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,344 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,345 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,345 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,346 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,347 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,347 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,348 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,349 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,349 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,350 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,351 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,351 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,352 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,353 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,354 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,355 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,355 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,356 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,357 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,360 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,362 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,363 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,363 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,364 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,365 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,367 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,368 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,369 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,370 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,371 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,372 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,373 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,373 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,375 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,376 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,377 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,377 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,379 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,380 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,380 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,381 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,382 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,382 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,383 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,384 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,385 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,385 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,387 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,387 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,388 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,389 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,393 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,394 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,402 [root] DEBUG: 5944: caller_dispatch: Added region at 0x060E0000 to tracked regions list (user32::SetWindowLongW returns to 0x0684653A, thread 5940).
2026-05-28 20:21:13,406 [root] DEBUG: 5944: DumpPEsInRange: Nothing to dump at 0x060E0000!
2026-05-28 20:21:13,407 [root] DEBUG: 5944: DumpMemory: Nothing to dump at 0x06846000!
2026-05-28 20:21:13,407 [root] DEBUG: 5944: DumpRegion: Failed to dump region at 0x06846000 size 536576 bytes.
2026-05-28 20:21:13,409 [root] DEBUG: 5944: ProcessTrackedRegion: Failed to dump region at 0x06846000.
2026-05-28 20:21:13,409 [root] DEBUG: 5944: YaraScan: Nothing to scan at 0x06846000!
2026-05-28 20:21:13,411 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,412 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,413 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,413 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,414 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,415 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,417 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,419 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,424 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,424 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,425 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,426 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,428 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 101.
2026-05-28 20:21:13,431 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,431 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 102.
2026-05-28 20:21:13,432 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,433 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 103.
2026-05-28 20:21:13,434 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,435 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 104.
2026-05-28 20:21:13,435 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,436 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 105.
2026-05-28 20:21:13,438 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,439 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 106.
2026-05-28 20:21:13,440 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,442 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 107.
2026-05-28 20:21:13,443 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,444 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 108.
2026-05-28 20:21:13,445 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,446 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 109.
2026-05-28 20:21:13,447 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,448 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 110.
2026-05-28 20:21:13,449 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,450 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 111.
2026-05-28 20:21:13,450 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,451 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 112.
2026-05-28 20:21:13,453 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,456 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 113.
2026-05-28 20:21:13,458 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,458 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 114.
2026-05-28 20:21:13,462 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,463 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 115.
2026-05-28 20:21:13,464 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,465 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 116.
2026-05-28 20:21:13,465 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,466 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 117.
2026-05-28 20:21:13,467 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,469 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 118.
2026-05-28 20:21:13,470 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,472 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 119.
2026-05-28 20:21:13,473 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,474 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 120.
2026-05-28 20:21:13,474 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,475 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 121.
2026-05-28 20:21:13,476 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,476 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 122.
2026-05-28 20:21:13,477 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,478 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 123.
2026-05-28 20:21:13,478 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,479 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 124.
2026-05-28 20:21:13,480 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,481 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 125.
2026-05-28 20:21:13,482 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,482 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 126.
2026-05-28 20:21:13,484 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,486 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 127.
2026-05-28 20:21:13,486 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,487 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 128.
2026-05-28 20:21:13,487 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,488 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 129.
2026-05-28 20:21:13,489 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,489 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 130.
2026-05-28 20:21:13,490 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,491 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 131.
2026-05-28 20:21:13,493 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,494 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 132.
2026-05-28 20:21:13,495 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,496 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 133.
2026-05-28 20:21:13,496 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,497 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 134.
2026-05-28 20:21:13,498 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,498 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 135.
2026-05-28 20:21:13,500 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,501 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 136.
2026-05-28 20:21:13,501 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,502 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 137.
2026-05-28 20:21:13,503 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,503 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 138.
2026-05-28 20:21:13,504 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,505 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 139.
2026-05-28 20:21:13,507 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,507 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 140.
2026-05-28 20:21:13,509 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,510 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 141.
2026-05-28 20:21:13,511 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,511 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 142.
2026-05-28 20:21:13,512 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,513 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 143.
2026-05-28 20:21:13,514 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,515 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 144.
2026-05-28 20:21:13,515 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,516 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 145.
2026-05-28 20:21:13,517 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,517 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 146.
2026-05-28 20:21:13,518 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,518 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 147.
2026-05-28 20:21:13,519 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,519 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 148.
2026-05-28 20:21:13,520 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,521 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 149.
2026-05-28 20:21:13,522 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,524 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 150.
2026-05-28 20:21:13,525 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,526 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 151.
2026-05-28 20:21:13,526 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,528 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 152.
2026-05-28 20:21:13,528 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,529 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 153.
2026-05-28 20:21:13,531 [root] DEBUG: 5944: caller_dispatch: Added region at 0x058E0000 to tracked regions list (user32::SetWindowLongW returns to 0x05C70E80, thread 5940).
2026-05-28 20:21:13,532 [root] DEBUG: 5944: DumpPEsInRange: Scanning range 0x058E0000 - 0x058E068D.
2026-05-28 20:21:13,532 [root] DEBUG: 5944: ScanForDisguisedPE: Size too small: 0x68d bytes
2026-05-28 20:21:13,539 [lib.common.results] INFO: Uploading file C:\wqmrdiqI\CAPE\5944_35596411321029552026 to CAPE\9e8b301c3b994f390f23763748458df72721d5cdd740dfe22208eb55c50c261f; Size is 1677; Max size: 100000000
2026-05-28 20:21:13,550 [root] DEBUG: 5944: DumpMemory: Payload successfully created: C:\wqmrdiqI\CAPE\5944_35596411321029552026 (size 1677 bytes)
2026-05-28 20:21:13,551 [root] DEBUG: 5944: DumpRegion: Dumped entire allocation from 0x058E0000, size 4096 bytes.
2026-05-28 20:21:13,552 [root] DEBUG: 5944: ProcessTrackedRegion: Dumped region at 0x058E0000.
2026-05-28 20:21:13,552 [root] DEBUG: 5944: YaraScan: Scanning 0x058E0000, size 0x68d
2026-05-28 20:21:13,556 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 154.
2026-05-28 20:21:13,557 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,557 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 155.
2026-05-28 20:21:13,558 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,559 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 156.
2026-05-28 20:21:13,559 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,560 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 157.
2026-05-28 20:21:13,560 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,562 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 158.
2026-05-28 20:21:13,562 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,563 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 159.
2026-05-28 20:21:13,564 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,565 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 160.
2026-05-28 20:21:13,566 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,566 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 161.
2026-05-28 20:21:13,567 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,568 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 162.
2026-05-28 20:21:13,569 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,570 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 163.
2026-05-28 20:21:13,571 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,573 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 164.
2026-05-28 20:21:13,574 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,574 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 165.
2026-05-28 20:21:13,575 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,576 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 166.
2026-05-28 20:21:13,576 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,578 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 167.
2026-05-28 20:21:13,579 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,580 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 168.
2026-05-28 20:21:13,581 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,581 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 169.
2026-05-28 20:21:13,582 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,584 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 170.
2026-05-28 20:21:13,584 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,587 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 171.
2026-05-28 20:21:13,588 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,589 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 172.
2026-05-28 20:21:13,590 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,591 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 173.
2026-05-28 20:21:13,591 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,593 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 174.
2026-05-28 20:21:13,594 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,595 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 175.
2026-05-28 20:21:13,595 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,596 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 176.
2026-05-28 20:21:13,597 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,598 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 177.
2026-05-28 20:21:13,598 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,600 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 178.
2026-05-28 20:21:13,601 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,602 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 179.
2026-05-28 20:21:13,603 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,606 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 180.
2026-05-28 20:21:13,607 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,607 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 181.
2026-05-28 20:21:13,609 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,610 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 182.
2026-05-28 20:21:13,612 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,612 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 183.
2026-05-28 20:21:13,613 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,614 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 184.
2026-05-28 20:21:13,614 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,615 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 185.
2026-05-28 20:21:13,616 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,618 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 186.
2026-05-28 20:21:13,619 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,620 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 187.
2026-05-28 20:21:13,620 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,622 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 188.
2026-05-28 20:21:13,623 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,625 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 189.
2026-05-28 20:21:13,625 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,627 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 190.
2026-05-28 20:21:13,627 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,628 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 191.
2026-05-28 20:21:13,629 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,630 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 192.
2026-05-28 20:21:13,631 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,632 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 193.
2026-05-28 20:21:13,633 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,634 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 194.
2026-05-28 20:21:13,634 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,636 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 195.
2026-05-28 20:21:13,636 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,637 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 196.
2026-05-28 20:21:13,638 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,638 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 197.
2026-05-28 20:21:13,640 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,641 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 198.
2026-05-28 20:21:13,642 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,643 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 199.
2026-05-28 20:21:13,643 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,644 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 200.
2026-05-28 20:21:13,645 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,645 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 201.
2026-05-28 20:21:13,646 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,647 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 202.
2026-05-28 20:21:13,648 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,648 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 203.
2026-05-28 20:21:13,649 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,650 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 204.
2026-05-28 20:21:13,650 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,651 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 205.
2026-05-28 20:21:13,651 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,653 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 206.
2026-05-28 20:21:13,653 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,654 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 207.
2026-05-28 20:21:13,654 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,656 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 208.
2026-05-28 20:21:13,656 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,657 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 209.
2026-05-28 20:21:13,657 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,658 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 210.
2026-05-28 20:21:13,659 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,659 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 211.
2026-05-28 20:21:13,660 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,661 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 212.
2026-05-28 20:21:13,662 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,662 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 213.
2026-05-28 20:21:13,663 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,664 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 214.
2026-05-28 20:21:13,665 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,665 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 215.
2026-05-28 20:21:13,666 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,667 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 216.
2026-05-28 20:21:13,667 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,667 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 217.
2026-05-28 20:21:13,668 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,669 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 218.
2026-05-28 20:21:13,670 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,670 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 219.
2026-05-28 20:21:13,672 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,673 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 220.
2026-05-28 20:21:13,674 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,674 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 221.
2026-05-28 20:21:13,675 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,675 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 222.
2026-05-28 20:21:13,676 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,677 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 223.
2026-05-28 20:21:13,677 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,678 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 224.
2026-05-28 20:21:13,679 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,680 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 225.
2026-05-28 20:21:13,680 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,681 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 226.
2026-05-28 20:21:13,682 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,683 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 227.
2026-05-28 20:21:13,683 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,684 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 228.
2026-05-28 20:21:13,684 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,685 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 229.
2026-05-28 20:21:13,686 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,687 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 230.
2026-05-28 20:21:13,688 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,688 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 231.
2026-05-28 20:21:13,689 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,691 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 232.
2026-05-28 20:21:13,691 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,692 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 233.
2026-05-28 20:21:13,693 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,695 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 234.
2026-05-28 20:21:13,696 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,696 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 235.
2026-05-28 20:21:13,697 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,698 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 236.
2026-05-28 20:21:13,698 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,699 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 237.
2026-05-28 20:21:13,700 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,701 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 238.
2026-05-28 20:21:13,701 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,703 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 239.
2026-05-28 20:21:13,704 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,705 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 240.
2026-05-28 20:21:13,705 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,706 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 241.
2026-05-28 20:21:13,707 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,708 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 242.
2026-05-28 20:21:13,708 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,709 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 243.
2026-05-28 20:21:13,709 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,710 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 244.
2026-05-28 20:21:13,711 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,711 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 245.
2026-05-28 20:21:13,712 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,713 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 246.
2026-05-28 20:21:13,714 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,714 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 247.
2026-05-28 20:21:13,715 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,717 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 248.
2026-05-28 20:21:13,717 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,719 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 249.
2026-05-28 20:21:13,719 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,720 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 250.
2026-05-28 20:21:13,721 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,722 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 251.
2026-05-28 20:21:13,722 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,723 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 252.
2026-05-28 20:21:13,724 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,724 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 253.
2026-05-28 20:21:13,725 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,726 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 254.
2026-05-28 20:21:13,726 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,727 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 255.
2026-05-28 20:21:13,728 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,729 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 256.
2026-05-28 20:21:13,730 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,730 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 257.
2026-05-28 20:21:13,731 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,731 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 258.
2026-05-28 20:21:13,732 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,733 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 259.
2026-05-28 20:21:13,735 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,735 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 260.
2026-05-28 20:21:13,736 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,737 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 261.
2026-05-28 20:21:13,738 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,738 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 262.
2026-05-28 20:21:13,739 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,739 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 263.
2026-05-28 20:21:13,740 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,741 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 264.
2026-05-28 20:21:13,741 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,742 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 265.
2026-05-28 20:21:13,743 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,744 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 266.
2026-05-28 20:21:13,744 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,745 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 267.
2026-05-28 20:21:13,745 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,746 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 268.
2026-05-28 20:21:13,746 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,747 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 269.
2026-05-28 20:21:13,748 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,750 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 270.
2026-05-28 20:21:13,750 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,751 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 271.
2026-05-28 20:21:13,752 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,753 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 272.
2026-05-28 20:21:13,754 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,755 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 273.
2026-05-28 20:21:13,755 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,756 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 274.
2026-05-28 20:21:13,757 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,757 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 275.
2026-05-28 20:21:13,758 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,759 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 276.
2026-05-28 20:21:13,759 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,760 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 277.
2026-05-28 20:21:13,761 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,762 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 278.
2026-05-28 20:21:13,763 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,763 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 279.
2026-05-28 20:21:13,764 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,765 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 280.
2026-05-28 20:21:13,766 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,766 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 281.
2026-05-28 20:21:13,767 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,768 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 282.
2026-05-28 20:21:13,769 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,769 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 283.
2026-05-28 20:21:13,770 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,771 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 284.
2026-05-28 20:21:13,771 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,772 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 285.
2026-05-28 20:21:13,773 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,773 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 286.
2026-05-28 20:21:13,775 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,775 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 287.
2026-05-28 20:21:13,776 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,778 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 288.
2026-05-28 20:21:13,779 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,780 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 289.
2026-05-28 20:21:13,781 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,782 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 290.
2026-05-28 20:21:13,783 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,783 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 291.
2026-05-28 20:21:13,784 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:13,785 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 292.
2026-05-28 20:21:13,874 [root] DEBUG: 5944: caller_dispatch: Added region at 0x068D0000 to tracked regions list (user32::SetWindowLongW returns to 0x07798550, thread 5940).
2026-05-28 20:21:13,892 [root] DEBUG: 5944: ProcessTrackedRegion: Interesting region at 0x068D0000 mapped as \Device\HarddiskVolume2\Windows\Fonts\StaticCache.dat, dumping
2026-05-28 20:21:13,893 [root] DEBUG: 5944: DumpPEsInRange: Scanning range 0x068D0000 - 0x07C70000.
2026-05-28 20:21:13,898 [root] DEBUG: 5944: ScanForDisguisedPE: PE image located at: 0x0691845F
2026-05-28 20:21:13,921 [root] DEBUG: 5944: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x0691845F
2026-05-28 20:21:13,922 [root] DEBUG: 5944: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-05-28 20:21:13,922 [root] DEBUG: 5944: DumpProcess: Instantiating PeParser with address: 0x0691845F.
2026-05-28 20:21:13,923 [root] DEBUG: 5944: DumpProcess: Module entry point VA is 0x07088860.
2026-05-28 20:21:13,924 [root] DEBUG: 5944: PeParser: End of section 2 RVA 0x90200d7 is beyond allocated size 0x1260000
2026-05-28 20:21:13,925 [root] DEBUG: 5944: PeParser: End of section 3 RVA 0x40100d7 is beyond allocated size 0x1260000
2026-05-28 20:21:13,925 [root] DEBUG: 5944: PeParser: End of section 5 RVA 0xa5c0089 is beyond allocated size 0x1260000
2026-05-28 20:21:13,926 [root] DEBUG: 5944: PeParser: End of section 6 RVA 0x55b0089 is beyond allocated size 0x1260000
2026-05-28 20:21:13,927 [root] DEBUG: 5944: PeParser: End of section 31 RVA 0xd390534 is beyond allocated size 0x1260000
2026-05-28 20:21:13,928 [root] DEBUG: 5944: PeParser: End of section 33 RVA 0x1ff0b1e is beyond allocated size 0x1260000
2026-05-28 20:21:13,929 [root] DEBUG: 5944: PeParser: End of section 34 RVA 0x7000b1e is beyond allocated size 0x1260000
2026-05-28 20:21:13,929 [root] DEBUG: 5944: PeParser: End of section 36 RVA 0x4b50caa is beyond allocated size 0x1260000
2026-05-28 20:21:13,930 [root] DEBUG: 5944: PeParser: End of section 37 RVA 0x9b60caa is beyond allocated size 0x1260000
2026-05-28 20:21:13,930 [root] DEBUG: 5944: PeParser: End of section 39 RVA 0x66f12c9 is beyond allocated size 0x1260000
2026-05-28 20:21:13,931 [root] DEBUG: 5944: PeParser: End of section 40 RVA 0x107112c9 is beyond allocated size 0x1260000
2026-05-28 20:21:13,932 [root] DEBUG: 5944: PeParser: End of section 42 RVA 0x3af148b is beyond allocated size 0x1260000
2026-05-28 20:21:13,932 [root] DEBUG: 5944: PeParser: End of section 44 RVA 0x6691000 is beyond allocated size 0x1260000
2026-05-28 20:21:13,933 [root] DEBUG: 5944: reBasePEImage: Error, invalid image base 0x0691845F.
2026-05-28 20:21:13,933 [root] DEBUG: 5944: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x00ED0401.
2026-05-28 20:21:13,942 [root] DEBUG: 5944: DumpProcess: Failed to dump image at 0x0691845F.
2026-05-28 20:21:13,943 [root] DEBUG: 5944: DumpImageInCurrentProcess: Failed to dump virtual PE image from 0x0691845F, dumping memory region.
2026-05-28 20:21:14,218 [lib.common.results] INFO: Uploading file C:\wqmrdiqI\CAPE\5944_177821281321029552026 to CAPE\969adf4cfe75ec28023674ccb4962883823be397a94c7e1a7f246def288c38ab; Size is 20578304; Max size: 100000000
2026-05-28 20:21:14,239 [root] DEBUG: 5944: DumpMemory: Payload successfully created: C:\wqmrdiqI\CAPE\5944_177821281321029552026 (size 20578304 bytes)
2026-05-28 20:21:14,240 [root] DEBUG: 5944: DumpRegion: Dumped entire allocation from 0x068D0000, size 20578304 bytes.
2026-05-28 20:21:14,241 [root] DEBUG: 5944: ProcessTrackedRegion: Dumped region at 0x068D0000.
2026-05-28 20:21:14,242 [root] DEBUG: 5944: YaraScan: Scanning 0x068D0000, size 0x13a0000
2026-05-28 20:21:14,313 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 293.
2026-05-28 20:21:14,313 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,314 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 294.
2026-05-28 20:21:14,315 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,316 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 295.
2026-05-28 20:21:14,316 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,317 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 296.
2026-05-28 20:21:14,318 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,319 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 297.
2026-05-28 20:21:14,320 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,322 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 298.
2026-05-28 20:21:14,326 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,328 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 299.
2026-05-28 20:21:14,331 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,336 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 300.
2026-05-28 20:21:14,337 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,337 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 301.
2026-05-28 20:21:14,338 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,339 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 302.
2026-05-28 20:21:14,340 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,341 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 303.
2026-05-28 20:21:14,343 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,344 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 304.
2026-05-28 20:21:14,345 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,346 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 305.
2026-05-28 20:21:14,346 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,347 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 306.
2026-05-28 20:21:14,348 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,352 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 307.
2026-05-28 20:21:14,353 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,354 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 308.
2026-05-28 20:21:14,355 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,356 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 309.
2026-05-28 20:21:14,356 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,357 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 310.
2026-05-28 20:21:14,357 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,359 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 311.
2026-05-28 20:21:14,360 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,360 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 312.
2026-05-28 20:21:14,360 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,362 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 313.
2026-05-28 20:21:14,362 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,363 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 314.
2026-05-28 20:21:14,364 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,365 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 315.
2026-05-28 20:21:14,366 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,366 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 316.
2026-05-28 20:21:14,367 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,370 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 317.
2026-05-28 20:21:14,370 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,371 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 318.
2026-05-28 20:21:14,371 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,372 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 319.
2026-05-28 20:21:14,373 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,374 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 320.
2026-05-28 20:21:14,375 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,377 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 321.
2026-05-28 20:21:14,378 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,378 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 322.
2026-05-28 20:21:14,379 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,382 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 323.
2026-05-28 20:21:14,383 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,384 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 324.
2026-05-28 20:21:14,385 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,386 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 325.
2026-05-28 20:21:14,387 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,388 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 326.
2026-05-28 20:21:14,388 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,391 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 327.
2026-05-28 20:21:14,391 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,392 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 328.
2026-05-28 20:21:14,393 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,394 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 329.
2026-05-28 20:21:14,395 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,396 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 330.
2026-05-28 20:21:14,397 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,397 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 331.
2026-05-28 20:21:14,398 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,399 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 332.
2026-05-28 20:21:14,399 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,400 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 333.
2026-05-28 20:21:14,401 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,402 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 334.
2026-05-28 20:21:14,402 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,403 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 335.
2026-05-28 20:21:14,404 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,404 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 336.
2026-05-28 20:21:14,406 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,407 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 337.
2026-05-28 20:21:14,408 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,408 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 338.
2026-05-28 20:21:14,409 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,410 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 339.
2026-05-28 20:21:14,411 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,411 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 340.
2026-05-28 20:21:14,412 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,413 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 341.
2026-05-28 20:21:14,414 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,414 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 342.
2026-05-28 20:21:14,415 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,416 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 343.
2026-05-28 20:21:14,416 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,417 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 344.
2026-05-28 20:21:14,417 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,418 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 345.
2026-05-28 20:21:14,418 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,419 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 346.
2026-05-28 20:21:14,420 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,421 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 347.
2026-05-28 20:21:14,422 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,423 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 348.
2026-05-28 20:21:14,423 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,425 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 349.
2026-05-28 20:21:14,425 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,426 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 350.
2026-05-28 20:21:14,426 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,427 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 351.
2026-05-28 20:21:14,428 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,429 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 352.
2026-05-28 20:21:14,429 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,430 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 353.
2026-05-28 20:21:14,431 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,431 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 354.
2026-05-28 20:21:14,432 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,433 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 355.
2026-05-28 20:21:14,433 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,434 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 356.
2026-05-28 20:21:14,435 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,436 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 357.
2026-05-28 20:21:14,437 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,438 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 358.
2026-05-28 20:21:14,438 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,440 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 359.
2026-05-28 20:21:14,440 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,441 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 360.
2026-05-28 20:21:14,442 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,443 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 361.
2026-05-28 20:21:14,444 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,445 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 362.
2026-05-28 20:21:14,445 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,447 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 363.
2026-05-28 20:21:14,447 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,448 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 364.
2026-05-28 20:21:14,449 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,450 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 365.
2026-05-28 20:21:14,450 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,451 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 366.
2026-05-28 20:21:14,453 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,454 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 367.
2026-05-28 20:21:14,455 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,455 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 368.
2026-05-28 20:21:14,456 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,457 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 369.
2026-05-28 20:21:14,457 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,458 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 370.
2026-05-28 20:21:14,459 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,461 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 371.
2026-05-28 20:21:14,461 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,462 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 372.
2026-05-28 20:21:14,462 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,463 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 373.
2026-05-28 20:21:14,464 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,465 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 374.
2026-05-28 20:21:14,465 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,466 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 375.
2026-05-28 20:21:14,467 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,468 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 376.
2026-05-28 20:21:14,469 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,470 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 377.
2026-05-28 20:21:14,470 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,471 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 378.
2026-05-28 20:21:14,471 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,473 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 379.
2026-05-28 20:21:14,473 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,474 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 380.
2026-05-28 20:21:14,474 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,475 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 381.
2026-05-28 20:21:14,475 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,476 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 382.
2026-05-28 20:21:14,476 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,477 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 383.
2026-05-28 20:21:14,478 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,479 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 384.
2026-05-28 20:21:14,480 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,481 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 385.
2026-05-28 20:21:14,482 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,483 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 386.
2026-05-28 20:21:14,485 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,486 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 387.
2026-05-28 20:21:14,486 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,487 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 388.
2026-05-28 20:21:14,488 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,489 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 389.
2026-05-28 20:21:14,489 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,490 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 390.
2026-05-28 20:21:14,491 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,493 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 391.
2026-05-28 20:21:14,494 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,495 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 392.
2026-05-28 20:21:14,495 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,497 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 393.
2026-05-28 20:21:14,497 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,497 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 394.
2026-05-28 20:21:14,498 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,500 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 395.
2026-05-28 20:21:14,500 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,501 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 396.
2026-05-28 20:21:14,502 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,503 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 397.
2026-05-28 20:21:14,504 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,505 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 398.
2026-05-28 20:21:14,505 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,506 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 399.
2026-05-28 20:21:14,507 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,508 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 400.
2026-05-28 20:21:14,508 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,509 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 401.
2026-05-28 20:21:14,509 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,510 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 402.
2026-05-28 20:21:14,511 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,511 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 403.
2026-05-28 20:21:14,512 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,513 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 404.
2026-05-28 20:21:14,513 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,516 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 405.
2026-05-28 20:21:14,516 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,518 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 406.
2026-05-28 20:21:14,518 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,519 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 407.
2026-05-28 20:21:14,520 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,521 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 408.
2026-05-28 20:21:14,522 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,523 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 409.
2026-05-28 20:21:14,523 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,524 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 410.
2026-05-28 20:21:14,525 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,526 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 411.
2026-05-28 20:21:14,527 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,527 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 412.
2026-05-28 20:21:14,528 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,529 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 413.
2026-05-28 20:21:14,529 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,531 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 414.
2026-05-28 20:21:14,532 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,533 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 415.
2026-05-28 20:21:14,534 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,534 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 416.
2026-05-28 20:21:14,535 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,536 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 417.
2026-05-28 20:21:14,537 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,537 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 418.
2026-05-28 20:21:14,538 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,538 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 419.
2026-05-28 20:21:14,539 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,540 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 420.
2026-05-28 20:21:14,540 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,542 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 421.
2026-05-28 20:21:14,542 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,543 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 422.
2026-05-28 20:21:14,543 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,544 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 423.
2026-05-28 20:21:14,545 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,545 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 424.
2026-05-28 20:21:14,547 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,548 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 425.
2026-05-28 20:21:14,549 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,550 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 426.
2026-05-28 20:21:14,550 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,551 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 427.
2026-05-28 20:21:14,552 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,552 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 428.
2026-05-28 20:21:14,553 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,554 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 429.
2026-05-28 20:21:14,555 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,556 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 430.
2026-05-28 20:21:14,556 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,558 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 431.
2026-05-28 20:21:14,558 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,559 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 432.
2026-05-28 20:21:14,559 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,560 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 433.
2026-05-28 20:21:14,561 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,562 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 434.
2026-05-28 20:21:14,563 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,564 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 435.
2026-05-28 20:21:14,565 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,566 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 436.
2026-05-28 20:21:14,566 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,568 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 437.
2026-05-28 20:21:14,568 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,569 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 438.
2026-05-28 20:21:14,570 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,571 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 439.
2026-05-28 20:21:14,571 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,572 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 440.
2026-05-28 20:21:14,572 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,573 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 441.
2026-05-28 20:21:14,574 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,574 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 442.
2026-05-28 20:21:14,575 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,576 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 443.
2026-05-28 20:21:14,576 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,578 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 444.
2026-05-28 20:21:14,579 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,580 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 445.
2026-05-28 20:21:14,581 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,582 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 446.
2026-05-28 20:21:14,583 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,584 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 447.
2026-05-28 20:21:14,585 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,585 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 448.
2026-05-28 20:21:14,586 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,587 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 449.
2026-05-28 20:21:14,588 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,588 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 450.
2026-05-28 20:21:14,589 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,590 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 451.
2026-05-28 20:21:14,591 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,591 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 452.
2026-05-28 20:21:14,593 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,594 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 453.
2026-05-28 20:21:14,595 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,596 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 454.
2026-05-28 20:21:14,596 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,597 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 455.
2026-05-28 20:21:14,598 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,598 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 456.
2026-05-28 20:21:14,599 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,600 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 457.
2026-05-28 20:21:14,602 [root] DEBUG: 5944: caller_dispatch: Added region at 0x050A0000 to tracked regions list (user32::SetWindowLongW returns to 0x0511E677, thread 5940).
2026-05-28 20:21:14,603 [root] DEBUG: 5944: DumpPEsInRange: Scanning range 0x050A0000 - 0x050EAFFB.
2026-05-28 20:21:14,604 [root] DEBUG: 5944: ScanForDisguisedPE: No PE image located in range 0x050A0000-0x050EAFFB.
2026-05-28 20:21:14,607 [lib.common.results] INFO: Uploading file C:\wqmrdiqI\CAPE\5944_28262081421029552026 to CAPE\37e6bdeabe237e2de4de126eff639e75a042e451a8065f9baf25fcb960f91978; Size is 307195; Max size: 100000000
2026-05-28 20:21:14,610 [root] DEBUG: 5944: DumpMemory: Payload successfully created: C:\wqmrdiqI\CAPE\5944_28262081421029552026 (size 307195 bytes)
2026-05-28 20:21:14,611 [root] DEBUG: 5944: DumpRegion: Dumped entire allocation from 0x050A0000, size 307200 bytes.
2026-05-28 20:21:14,612 [root] DEBUG: 5944: ProcessTrackedRegion: Dumped region at 0x050A0000.
2026-05-28 20:21:14,612 [root] DEBUG: 5944: YaraScan: Scanning 0x050A0000, size 0x4affb
2026-05-28 20:21:14,614 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 458.
2026-05-28 20:21:14,615 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,616 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 459.
2026-05-28 20:21:14,616 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,617 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 460.
2026-05-28 20:21:14,618 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,619 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 461.
2026-05-28 20:21:14,620 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,622 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 462.
2026-05-28 20:21:14,622 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,623 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 463.
2026-05-28 20:21:14,624 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,626 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 464.
2026-05-28 20:21:14,626 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,627 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 465.
2026-05-28 20:21:14,628 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,629 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 466.
2026-05-28 20:21:14,629 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,630 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 467.
2026-05-28 20:21:14,631 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,631 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 468.
2026-05-28 20:21:14,632 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,632 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 469.
2026-05-28 20:21:14,633 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,634 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 470.
2026-05-28 20:21:14,635 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,636 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 471.
2026-05-28 20:21:14,636 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,637 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 472.
2026-05-28 20:21:14,638 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,638 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 473.
2026-05-28 20:21:14,639 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,640 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 474.
2026-05-28 20:21:14,641 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,641 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 475.
2026-05-28 20:21:14,642 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,645 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 476.
2026-05-28 20:21:14,660 [root] DEBUG: 5944: caller_dispatch: Added region at 0x051A0000 to tracked regions list (user32::SetWindowLongW returns to 0x053F9B82, thread 5940).
2026-05-28 20:21:14,663 [root] DEBUG: 5944: ProcessTrackedRegion: Interesting region at 0x051A0000 mapped as \Device\HarddiskVolume2\Windows\Globalization\Sorting\SortDefault.nls, dumping
2026-05-28 20:21:14,664 [root] DEBUG: 5944: DumpPEsInRange: Scanning range 0x051A0000 - 0x054D7189.
2026-05-28 20:21:14,674 [root] DEBUG: 5944: ScanForDisguisedPE: No PE image located in range 0x051A0000-0x054D7189.
2026-05-28 20:21:14,680 [lib.common.results] INFO: Uploading file C:\wqmrdiqI\CAPE\5944_81036501421029552026 to CAPE\c7ec4e07f93801c4402cdaa548dd90374a5784c5fe62ad4eb37fb5c438750aa0; Size is 3371401; Max size: 100000000
2026-05-28 20:21:14,687 [root] DEBUG: 5944: DumpMemory: Payload successfully created: C:\wqmrdiqI\CAPE\5944_81036501421029552026 (size 3371401 bytes)
2026-05-28 20:21:14,688 [root] DEBUG: 5944: DumpRegion: Dumped entire allocation from 0x051A0000, size 3375104 bytes.
2026-05-28 20:21:14,688 [root] DEBUG: 5944: ProcessTrackedRegion: Dumped region at 0x051A0000.
2026-05-28 20:21:14,689 [root] DEBUG: 5944: YaraScan: Scanning 0x051A0000, size 0x337189
2026-05-28 20:21:14,700 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 477.
2026-05-28 20:21:14,700 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,701 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 478.
2026-05-28 20:21:14,701 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,703 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 479.
2026-05-28 20:21:14,704 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,704 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 480.
2026-05-28 20:21:14,705 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,706 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 481.
2026-05-28 20:21:14,706 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,707 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 482.
2026-05-28 20:21:14,707 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,708 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 483.
2026-05-28 20:21:14,709 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,709 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 484.
2026-05-28 20:21:14,710 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,711 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 485.
2026-05-28 20:21:14,711 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,712 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 486.
2026-05-28 20:21:14,712 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,713 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 487.
2026-05-28 20:21:14,714 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,714 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 488.
2026-05-28 20:21:14,715 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,716 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 489.
2026-05-28 20:21:14,716 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,717 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 490.
2026-05-28 20:21:14,718 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,719 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 491.
2026-05-28 20:21:14,720 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,721 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 492.
2026-05-28 20:21:14,722 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,722 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 493.
2026-05-28 20:21:14,723 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,724 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 494.
2026-05-28 20:21:14,724 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,725 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 495.
2026-05-28 20:21:14,725 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,726 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 496.
2026-05-28 20:21:14,727 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,728 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 497.
2026-05-28 20:21:14,728 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,729 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 498.
2026-05-28 20:21:14,729 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,731 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 499.
2026-05-28 20:21:14,731 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,732 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 500.
2026-05-28 20:21:14,734 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,735 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 501.
2026-05-28 20:21:14,735 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,736 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 502.
2026-05-28 20:21:14,737 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,738 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 503.
2026-05-28 20:21:14,738 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,739 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 504.
2026-05-28 20:21:14,740 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,741 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 505.
2026-05-28 20:21:14,742 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,743 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 506.
2026-05-28 20:21:14,743 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,745 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 507.
2026-05-28 20:21:14,745 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,746 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 508.
2026-05-28 20:21:14,746 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,748 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 509.
2026-05-28 20:21:14,750 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,750 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 510.
2026-05-28 20:21:14,751 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,752 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 511.
2026-05-28 20:21:14,753 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,753 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 512.
2026-05-28 20:21:14,754 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,755 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 513.
2026-05-28 20:21:14,756 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,756 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 514.
2026-05-28 20:21:14,757 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,758 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 515.
2026-05-28 20:21:14,759 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,759 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 516.
2026-05-28 20:21:14,760 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,761 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 517.
2026-05-28 20:21:14,762 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,763 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 518.
2026-05-28 20:21:14,763 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,764 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 519.
2026-05-28 20:21:14,765 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,766 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 520.
2026-05-28 20:21:14,766 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,767 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 521.
2026-05-28 20:21:14,768 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,769 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 522.
2026-05-28 20:21:14,770 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,771 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 523.
2026-05-28 20:21:14,771 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,772 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 524.
2026-05-28 20:21:14,773 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,774 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 525.
2026-05-28 20:21:14,774 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,775 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 526.
2026-05-28 20:21:14,775 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,776 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 527.
2026-05-28 20:21:14,777 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,778 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 528.
2026-05-28 20:21:14,779 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,779 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 529.
2026-05-28 20:21:14,781 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,782 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 530.
2026-05-28 20:21:14,783 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,783 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 531.
2026-05-28 20:21:14,784 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,785 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 532.
2026-05-28 20:21:14,785 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,787 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 533.
2026-05-28 20:21:14,788 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,788 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 534.
2026-05-28 20:21:14,789 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,790 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 535.
2026-05-28 20:21:14,791 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,791 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 536.
2026-05-28 20:21:14,792 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,792 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 537.
2026-05-28 20:21:14,793 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,794 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 538.
2026-05-28 20:21:14,795 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,796 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 539.
2026-05-28 20:21:14,797 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,798 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 540.
2026-05-28 20:21:14,799 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,800 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 541.
2026-05-28 20:21:14,800 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,801 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 542.
2026-05-28 20:21:14,801 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,802 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 543.
2026-05-28 20:21:14,803 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,803 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 544.
2026-05-28 20:21:14,804 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,805 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 545.
2026-05-28 20:21:14,805 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,806 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 546.
2026-05-28 20:21:14,807 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,807 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 547.
2026-05-28 20:21:14,808 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,809 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 548.
2026-05-28 20:21:14,809 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,810 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 549.
2026-05-28 20:21:14,811 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,813 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 550.
2026-05-28 20:21:14,813 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,814 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 551.
2026-05-28 20:21:14,815 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,815 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 552.
2026-05-28 20:21:14,816 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,817 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 553.
2026-05-28 20:21:14,818 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,818 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 554.
2026-05-28 20:21:14,819 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,820 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 555.
2026-05-28 20:21:14,821 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,822 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 556.
2026-05-28 20:21:14,823 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,824 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 557.
2026-05-28 20:21:14,824 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,825 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 558.
2026-05-28 20:21:14,826 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,826 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 559.
2026-05-28 20:21:14,828 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,829 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 560.
2026-05-28 20:21:14,830 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,831 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 561.
2026-05-28 20:21:14,831 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,832 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 562.
2026-05-28 20:21:14,832 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,833 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 563.
2026-05-28 20:21:14,834 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,834 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 564.
2026-05-28 20:21:14,835 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,838 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 565.
2026-05-28 20:21:14,838 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,839 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 566.
2026-05-28 20:21:14,839 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,840 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 567.
2026-05-28 20:21:14,840 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,841 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 568.
2026-05-28 20:21:14,842 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,844 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 569.
2026-05-28 20:21:14,844 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,845 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 570.
2026-05-28 20:21:14,846 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,847 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 571.
2026-05-28 20:21:14,847 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,848 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 572.
2026-05-28 20:21:14,849 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,850 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 573.
2026-05-28 20:21:14,851 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,852 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 574.
2026-05-28 20:21:14,852 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,854 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 575.
2026-05-28 20:21:14,855 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,855 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 576.
2026-05-28 20:21:14,856 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,857 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 577.
2026-05-28 20:21:14,857 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,860 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 578.
2026-05-28 20:21:14,860 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,862 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 579.
2026-05-28 20:21:14,862 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,863 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 580.
2026-05-28 20:21:14,863 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,864 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 581.
2026-05-28 20:21:14,865 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,865 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 582.
2026-05-28 20:21:14,866 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,867 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 583.
2026-05-28 20:21:14,867 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,868 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 584.
2026-05-28 20:21:14,868 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,869 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 585.
2026-05-28 20:21:14,870 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,871 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 586.
2026-05-28 20:21:14,871 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,872 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 587.
2026-05-28 20:21:14,872 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,874 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,875 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 589.
2026-05-28 20:21:14,876 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,876 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 590.
2026-05-28 20:21:14,878 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,878 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 591.
2026-05-28 20:21:14,879 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,880 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 592.
2026-05-28 20:21:14,881 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,883 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 593.
2026-05-28 20:21:14,883 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,884 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 594.
2026-05-28 20:21:14,885 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,886 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 595.
2026-05-28 20:21:14,886 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,887 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 596.
2026-05-28 20:21:14,888 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,890 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 597.
2026-05-28 20:21:14,891 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,892 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 598.
2026-05-28 20:21:14,892 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,893 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 599.
2026-05-28 20:21:14,894 [root] DEBUG: 5944: caller_dispatch: Added region at 0x022B0000 to tracked regions list (user32::SetWindowLongW returns to 0x0252BF66, thread 5940).
2026-05-28 20:21:14,896 [root] DEBUG: 5944: ProcessTrackedRegion: Updated entropy for tracked region at 0x022B0000: 2.452991e+00 (from 2.452989e+00)
2026-05-28 20:21:14,897 [root] DEBUG: 5944: DumpPEsInRange: Scanning range 0x022B0000 - 0x0230ACEB.
2026-05-28 20:21:14,898 [root] DEBUG: 5944: ScanForDisguisedPE: No PE image located in range 0x022B0000-0x0230ACEB.
2026-05-28 20:21:14,902 [lib.common.results] INFO: Uploading file C:\wqmrdiqI\CAPE\5944_239194341421029552026 to CAPE\404ff45c161012f73a39d635e4fa03502241c43ec4bdc36cea810a9bbca2efb0; Size is 371947; Max size: 100000000
2026-05-28 20:21:14,905 [root] DEBUG: 5944: DumpMemory: Payload successfully created: C:\wqmrdiqI\CAPE\5944_239194341421029552026 (size 371947 bytes)
2026-05-28 20:21:14,906 [root] DEBUG: 5944: DumpRegion: Dumped entire allocation from 0x022B0000, size 372736 bytes.
2026-05-28 20:21:14,906 [root] DEBUG: 5944: ProcessTrackedRegion: Dumped region at 0x022B0000.
2026-05-28 20:21:14,907 [root] DEBUG: 5944: YaraScan: Scanning 0x022B0000, size 0x5aceb
2026-05-28 20:21:14,910 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 600.
2026-05-28 20:21:14,910 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,911 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 601.
2026-05-28 20:21:14,911 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,912 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 602.
2026-05-28 20:21:14,913 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,913 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 603.
2026-05-28 20:21:14,914 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,915 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 604.
2026-05-28 20:21:14,915 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,916 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 605.
2026-05-28 20:21:14,917 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,917 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 606.
2026-05-28 20:21:14,918 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,919 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 607.
2026-05-28 20:21:14,920 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,922 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 608.
2026-05-28 20:21:14,922 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,923 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 609.
2026-05-28 20:21:14,923 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,925 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 610.
2026-05-28 20:21:14,925 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,926 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 611.
2026-05-28 20:21:14,926 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,927 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 612.
2026-05-28 20:21:14,928 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,929 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 613.
2026-05-28 20:21:14,930 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,931 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 614.
2026-05-28 20:21:14,932 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,932 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 615.
2026-05-28 20:21:14,933 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,934 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 616.
2026-05-28 20:21:14,934 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,935 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 617.
2026-05-28 20:21:14,936 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,938 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 618.
2026-05-28 20:21:14,939 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,940 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 619.
2026-05-28 20:21:14,940 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,941 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 620.
2026-05-28 20:21:14,942 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,942 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 621.
2026-05-28 20:21:14,943 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,944 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 622.
2026-05-28 20:21:14,944 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,945 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 623.
2026-05-28 20:21:14,945 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,946 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 624.
2026-05-28 20:21:14,946 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,947 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 625.
2026-05-28 20:21:14,948 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,949 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 626.
2026-05-28 20:21:14,950 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,951 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 627.
2026-05-28 20:21:14,953 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,954 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 628.
2026-05-28 20:21:14,955 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,955 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 629.
2026-05-28 20:21:14,956 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,957 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 630.
2026-05-28 20:21:14,957 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,958 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 631.
2026-05-28 20:21:14,959 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,959 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 632.
2026-05-28 20:21:14,960 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,960 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 633.
2026-05-28 20:21:14,961 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,962 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 634.
2026-05-28 20:21:14,962 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,963 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 635.
2026-05-28 20:21:14,963 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,964 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 636.
2026-05-28 20:21:14,965 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,965 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 637.
2026-05-28 20:21:14,966 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,967 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 638.
2026-05-28 20:21:14,969 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,969 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 639.
2026-05-28 20:21:14,970 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,972 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 640.
2026-05-28 20:21:14,972 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,973 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 641.
2026-05-28 20:21:14,974 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,975 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 642.
2026-05-28 20:21:14,975 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,976 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 643.
2026-05-28 20:21:14,977 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,978 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 644.
2026-05-28 20:21:14,979 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,980 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 645.
2026-05-28 20:21:14,980 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,982 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 646.
2026-05-28 20:21:14,984 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,985 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 647.
2026-05-28 20:21:14,985 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,986 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 648.
2026-05-28 20:21:14,987 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,988 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 649.
2026-05-28 20:21:14,988 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,990 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 650.
2026-05-28 20:21:14,990 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,991 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 651.
2026-05-28 20:21:14,992 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,993 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 652.
2026-05-28 20:21:14,994 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,995 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 653.
2026-05-28 20:21:14,995 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,996 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 654.
2026-05-28 20:21:14,997 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:14,997 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 655.
2026-05-28 20:21:14,998 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,000 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 656.
2026-05-28 20:21:15,000 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,001 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 657.
2026-05-28 20:21:15,001 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,003 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 658.
2026-05-28 20:21:15,004 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,004 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 659.
2026-05-28 20:21:15,005 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,007 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 660.
2026-05-28 20:21:15,008 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,009 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 661.
2026-05-28 20:21:15,010 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,011 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 662.
2026-05-28 20:21:15,011 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,012 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 663.
2026-05-28 20:21:15,012 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,013 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 664.
2026-05-28 20:21:15,014 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,015 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 665.
2026-05-28 20:21:15,016 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,018 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 666.
2026-05-28 20:21:15,018 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,019 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 667.
2026-05-28 20:21:15,019 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,020 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 668.
2026-05-28 20:21:15,021 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,022 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 669.
2026-05-28 20:21:15,022 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,023 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 670.
2026-05-28 20:21:15,024 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,025 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 671.
2026-05-28 20:21:15,025 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,026 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 672.
2026-05-28 20:21:15,026 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,027 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 673.
2026-05-28 20:21:15,028 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,029 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 674.
2026-05-28 20:21:15,029 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,030 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 675.
2026-05-28 20:21:15,032 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,033 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 676.
2026-05-28 20:21:15,034 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,034 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 677.
2026-05-28 20:21:15,035 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,037 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 678.
2026-05-28 20:21:15,037 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,038 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 679.
2026-05-28 20:21:15,039 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,040 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 680.
2026-05-28 20:21:15,041 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,042 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 681.
2026-05-28 20:21:15,042 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,043 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 682.
2026-05-28 20:21:15,044 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,044 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 683.
2026-05-28 20:21:15,045 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,046 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 684.
2026-05-28 20:21:15,047 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,048 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 685.
2026-05-28 20:21:15,048 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,049 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 686.
2026-05-28 20:21:15,050 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,051 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 687.
2026-05-28 20:21:15,052 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,053 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 688.
2026-05-28 20:21:15,054 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,055 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 689.
2026-05-28 20:21:15,058 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,059 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 690.
2026-05-28 20:21:15,060 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,062 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 691.
2026-05-28 20:21:15,063 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,064 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 692.
2026-05-28 20:21:15,065 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,066 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 693.
2026-05-28 20:21:15,067 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,068 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 694.
2026-05-28 20:21:15,068 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,069 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 695.
2026-05-28 20:21:15,069 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,071 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 696.
2026-05-28 20:21:15,071 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,072 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 697.
2026-05-28 20:21:15,072 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,074 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 698.
2026-05-28 20:21:15,074 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,075 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 699.
2026-05-28 20:21:15,076 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,078 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 700.
2026-05-28 20:21:15,078 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,079 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 701.
2026-05-28 20:21:15,079 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,080 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 702.
2026-05-28 20:21:15,081 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,081 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 703.
2026-05-28 20:21:15,083 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,084 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 704.
2026-05-28 20:21:15,084 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,085 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 705.
2026-05-28 20:21:15,086 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,087 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 706.
2026-05-28 20:21:15,087 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,088 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 707.
2026-05-28 20:21:15,089 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,090 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 708.
2026-05-28 20:21:15,090 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,091 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 709.
2026-05-28 20:21:15,091 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,092 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 710.
2026-05-28 20:21:15,094 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,094 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 711.
2026-05-28 20:21:15,095 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,096 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 712.
2026-05-28 20:21:15,096 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,097 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 713.
2026-05-28 20:21:15,098 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,098 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 714.
2026-05-28 20:21:15,099 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,100 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 715.
2026-05-28 20:21:15,101 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,102 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 716.
2026-05-28 20:21:15,102 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,103 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 717.
2026-05-28 20:21:15,104 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,105 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 718.
2026-05-28 20:21:15,105 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,106 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 719.
2026-05-28 20:21:15,107 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,109 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 720.
2026-05-28 20:21:15,109 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,110 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 721.
2026-05-28 20:21:15,110 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,111 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 722.
2026-05-28 20:21:15,112 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,113 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 723.
2026-05-28 20:21:15,113 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,114 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 724.
2026-05-28 20:21:15,115 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,115 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 725.
2026-05-28 20:21:15,116 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,117 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 726.
2026-05-28 20:21:15,118 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,118 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 727.
2026-05-28 20:21:15,119 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,120 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 728.
2026-05-28 20:21:15,121 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,122 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 729.
2026-05-28 20:21:15,122 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,123 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 730.
2026-05-28 20:21:15,125 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,125 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 731.
2026-05-28 20:21:15,126 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,126 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 732.
2026-05-28 20:21:15,127 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,128 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 733.
2026-05-28 20:21:15,128 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,129 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 734.
2026-05-28 20:21:15,130 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,130 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 735.
2026-05-28 20:21:15,131 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,132 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 736.
2026-05-28 20:21:15,133 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,133 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 737.
2026-05-28 20:21:15,134 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,135 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 738.
2026-05-28 20:21:15,135 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,136 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 739.
2026-05-28 20:21:15,137 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,137 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 740.
2026-05-28 20:21:15,138 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,139 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 741.
2026-05-28 20:21:15,141 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,142 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 742.
2026-05-28 20:21:15,143 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,144 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 743.
2026-05-28 20:21:15,145 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,146 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 744.
2026-05-28 20:21:15,147 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,148 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 745.
2026-05-28 20:21:15,149 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,149 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 746.
2026-05-28 20:21:15,150 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,151 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 747.
2026-05-28 20:21:15,152 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,153 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 748.
2026-05-28 20:21:15,154 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,156 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 749.
2026-05-28 20:21:15,157 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,159 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 750.
2026-05-28 20:21:15,160 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,161 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 751.
2026-05-28 20:21:15,161 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,163 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 752.
2026-05-28 20:21:15,165 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,165 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 753.
2026-05-28 20:21:15,166 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,167 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 754.
2026-05-28 20:21:15,167 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,168 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 755.
2026-05-28 20:21:15,169 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,172 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 756.
2026-05-28 20:21:15,172 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,173 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 757.
2026-05-28 20:21:15,173 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,175 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 758.
2026-05-28 20:21:15,175 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,176 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 759.
2026-05-28 20:21:15,177 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,178 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 760.
2026-05-28 20:21:15,179 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,179 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 761.
2026-05-28 20:21:15,180 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,181 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 762.
2026-05-28 20:21:15,181 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,182 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 763.
2026-05-28 20:21:15,183 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,184 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 764.
2026-05-28 20:21:15,184 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,185 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 765.
2026-05-28 20:21:15,186 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,187 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 766.
2026-05-28 20:21:15,188 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,189 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 767.
2026-05-28 20:21:15,189 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,191 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 768.
2026-05-28 20:21:15,192 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,192 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 769.
2026-05-28 20:21:15,193 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,194 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 770.
2026-05-28 20:21:15,195 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,196 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 771.
2026-05-28 20:21:15,196 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,199 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 772.
2026-05-28 20:21:15,199 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,200 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 773.
2026-05-28 20:21:15,200 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,203 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 774.
2026-05-28 20:21:15,204 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,205 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 775.
2026-05-28 20:21:15,205 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,206 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 776.
2026-05-28 20:21:15,207 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,207 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 777.
2026-05-28 20:21:15,208 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,209 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 778.
2026-05-28 20:21:15,210 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,211 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 779.
2026-05-28 20:21:15,212 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,215 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 780.
2026-05-28 20:21:15,216 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,217 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 781.
2026-05-28 20:21:15,219 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,220 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 782.
2026-05-28 20:21:15,221 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,222 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 783.
2026-05-28 20:21:15,222 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,223 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 784.
2026-05-28 20:21:15,224 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,225 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 785.
2026-05-28 20:21:15,226 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,228 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 786.
2026-05-28 20:21:15,228 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,229 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 787.
2026-05-28 20:21:15,230 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,231 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 788.
2026-05-28 20:21:15,231 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,232 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 789.
2026-05-28 20:21:15,233 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,234 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 790.
2026-05-28 20:21:15,234 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,235 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 791.
2026-05-28 20:21:15,235 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,236 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 792.
2026-05-28 20:21:15,237 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,237 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 793.
2026-05-28 20:21:15,238 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,239 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 794.
2026-05-28 20:21:15,239 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,240 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 795.
2026-05-28 20:21:15,240 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,241 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 796.
2026-05-28 20:21:15,242 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,243 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 797.
2026-05-28 20:21:15,244 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,245 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 798.
2026-05-28 20:21:15,246 [root] DEBUG: 5944: GetEntropy: Error - Supplied address inaccessible: 0x7FBF0000
2026-05-28 20:21:15,246 [root] DEBUG: 5944: caller_dispatch: Added region at 0x7FBF0000 to tracked regions list (user32::SetWindowLongW returns to 0x7FBF5F2B, thread 5940).
2026-05-28 20:21:15,247 [root] DEBUG: 5944: ReverseScanForNonZero: Error - Supplied size zero.
2026-05-28 20:21:15,248 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 799.
2026-05-28 20:21:15,249 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,250 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 800.
2026-05-28 20:21:15,250 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,252 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 801.
2026-05-28 20:21:15,253 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,254 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 802.
2026-05-28 20:21:15,254 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,255 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 803.
2026-05-28 20:21:15,256 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,256 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 804.
2026-05-28 20:21:15,257 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,258 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 805.
2026-05-28 20:21:15,259 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,260 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 806.
2026-05-28 20:21:15,260 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,262 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 807.
2026-05-28 20:21:15,262 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,263 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 808.
2026-05-28 20:21:15,263 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,265 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 809.
2026-05-28 20:21:15,266 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,266 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 810.
2026-05-28 20:21:15,267 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,268 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 811.
2026-05-28 20:21:15,269 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,270 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 812.
2026-05-28 20:21:15,270 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,271 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 813.
2026-05-28 20:21:15,272 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,273 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 814.
2026-05-28 20:21:15,273 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,274 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 815.
2026-05-28 20:21:15,275 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,275 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 816.
2026-05-28 20:21:15,276 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,277 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 817.
2026-05-28 20:21:15,278 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,278 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 818.
2026-05-28 20:21:15,279 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,281 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 819.
2026-05-28 20:21:15,281 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,282 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 820.
2026-05-28 20:21:15,283 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,284 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 821.
2026-05-28 20:21:15,284 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,285 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 822.
2026-05-28 20:21:15,286 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,287 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 823.
2026-05-28 20:21:15,288 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,289 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 824.
2026-05-28 20:21:15,290 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,291 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 825.
2026-05-28 20:21:15,292 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,292 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 826.
2026-05-28 20:21:15,293 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,294 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 827.
2026-05-28 20:21:15,295 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,296 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 828.
2026-05-28 20:21:15,297 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,298 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 829.
2026-05-28 20:21:15,298 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,299 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 830.
2026-05-28 20:21:15,300 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,301 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 831.
2026-05-28 20:21:15,301 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,302 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 832.
2026-05-28 20:21:15,303 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,304 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 833.
2026-05-28 20:21:15,304 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,305 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 834.
2026-05-28 20:21:15,306 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,308 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 835.
2026-05-28 20:21:15,308 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,309 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 836.
2026-05-28 20:21:15,309 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,310 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 837.
2026-05-28 20:21:15,312 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,312 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 838.
2026-05-28 20:21:15,313 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,314 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 839.
2026-05-28 20:21:15,315 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,316 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 840.
2026-05-28 20:21:15,316 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,317 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 841.
2026-05-28 20:21:15,318 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,319 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 842.
2026-05-28 20:21:15,319 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,320 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 843.
2026-05-28 20:21:15,321 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,321 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 844.
2026-05-28 20:21:15,322 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,324 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 845.
2026-05-28 20:21:15,324 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,325 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 846.
2026-05-28 20:21:15,326 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,328 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 847.
2026-05-28 20:21:15,329 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,329 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 848.
2026-05-28 20:21:15,329 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,330 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 849.
2026-05-28 20:21:15,331 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,332 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 850.
2026-05-28 20:21:15,332 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,333 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 851.
2026-05-28 20:21:15,334 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,334 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 852.
2026-05-28 20:21:15,335 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,335 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 853.
2026-05-28 20:21:15,336 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,336 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 854.
2026-05-28 20:21:15,337 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,338 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 855.
2026-05-28 20:21:15,339 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,339 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 856.
2026-05-28 20:21:15,340 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,341 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 857.
2026-05-28 20:21:15,342 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,343 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 858.
2026-05-28 20:21:15,343 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,345 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 859.
2026-05-28 20:21:15,345 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,346 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 860.
2026-05-28 20:21:15,347 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,348 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 861.
2026-05-28 20:21:15,348 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,349 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 862.
2026-05-28 20:21:15,350 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,351 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 863.
2026-05-28 20:21:15,351 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,352 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 864.
2026-05-28 20:21:15,353 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,354 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 865.
2026-05-28 20:21:15,355 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,356 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 866.
2026-05-28 20:21:15,357 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,359 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 867.
2026-05-28 20:21:15,360 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,360 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 868.
2026-05-28 20:21:15,361 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,362 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 869.
2026-05-28 20:21:15,363 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,363 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 870.
2026-05-28 20:21:15,364 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,365 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 871.
2026-05-28 20:21:15,365 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,366 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 872.
2026-05-28 20:21:15,366 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,367 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 873.
2026-05-28 20:21:15,368 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,369 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 874.
2026-05-28 20:21:15,369 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,370 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 875.
2026-05-28 20:21:15,371 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,371 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 876.
2026-05-28 20:21:15,372 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,372 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 877.
2026-05-28 20:21:15,373 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,374 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 878.
2026-05-28 20:21:15,375 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,376 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 879.
2026-05-28 20:21:15,377 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,378 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 880.
2026-05-28 20:21:15,378 [root] DEBUG: Error 87 (0x57) - AddTrackedRegion: unable to query memory region 0x7FFF0000: The parameter is incorrect.
2026-05-28 20:21:15,395 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\10988831.dat
2026-05-28 20:21:15,400 [root] DEBUG: 5944: api-rate-cap: NtWriteFile hook disabled due to rate
2026-05-28 20:21:15,404 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\10988831.dat to files\77098fbeb11a37c5aaf858b4255be416fe0847cebd99331641faf01038d838c9; Size is 95172; Max size: 100000000
2026-05-28 20:21:15,410 [root] DEBUG: 5944: DLL loaded at 0x74030000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-05-28 20:21:15,416 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\10988831\_Setup.dll
2026-05-28 20:21:15,438 [root] DEBUG: 5944: DLL loaded at 0x6B0C0000: C:\Users\admin\AppData\Local\Temp\10988831\_Setup (0x19000 bytes).
2026-05-28 20:21:15,440 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\10988831\Setup.ico
2026-05-28 20:21:15,443 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\10988831\Readme.txt
2026-05-28 20:21:15,446 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\10988831\Setup.exe
2026-05-28 20:21:15,450 [root] DEBUG: 5944: DLL loaded at 0x69EF0000: C:\Windows\SYSTEM32\msftedit (0x2a6000 bytes).
2026-05-28 20:21:15,474 [root] DEBUG: 5944: DLL loaded at 0x748E0000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 20:21:15,475 [root] DEBUG: 5944: ProtectionHandler: Adding region at 0x74EB5000 to tracked regions.
2026-05-28 20:21:15,475 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 881.
2026-05-28 20:21:15,502 [root] DEBUG: 5944: ProtectionHandler: Processing previous tracked region at: 0x6F6E0000.
2026-05-28 20:21:15,504 [root] DEBUG: 5944: ProcessTrackedRegion: Updated entropy for tracked region at 0x6F6E0000: 6.276696e+00 (from 6.276133e+00)
2026-05-28 20:21:15,505 [root] DEBUG: 5944: ProcessTrackedRegion: Region at 0x6F6E0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\CoreUIComponents.dll is in known range, skipping
2026-05-28 20:21:15,505 [root] DEBUG: 5944: DLL loaded at 0x74910000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 20:21:27,529 [root] INFO: Announced starting service "b'InstallService'"
2026-05-28 20:21:27,530 [lib.api.process] INFO: Monitor config for process 708: C:\6lreqs2g\dll\708.ini
2026-05-28 20:21:27,532 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:27,536 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:21:27,542 [root] DEBUG: Loader: Injecting process 708 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:27,544 [root] DEBUG: Loader: Copied config file C:\6lreqs2g\dll\708.ini to system path C:\708.ini
2026-05-28 20:21:27,547 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 708 C:\6lreqs2g\dll\RafcrS.dll
2026-05-28 20:21:27,547 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:27,549 [lib.api.process] INFO: Injected into 64-bit <Process 708 services.exe>
2026-05-28 20:21:30,706 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\TsuF0596FC9.dll to files\f4b52618db95a41819d623d44995bb7a3f9acbcb406447ca8ecddee8859b94c1; Size is 286816; Max size: 100000000
2026-05-28 20:21:30,712 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\10988831\Setup.ico to files\0ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93; Size is 4846; Max size: 100000000
2026-05-28 20:21:30,717 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\10988831\Setup.exe to files\6c70d20e43651f4f40a39f0f5b9346157c17a9bbb0e2c738c713f545550fe58f; Size is 15968; Max size: 100000000
2026-05-28 20:21:30,721 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEB3E0000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes).
2026-05-28 20:21:30,723 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF440000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 20:21:30,726 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF710000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 20:21:30,726 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF3D0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 20:21:30,727 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\10988831\Readme.txt to files\7936796e1a2a732af971e7f137960eef4891981379d2ed103b377002e8c6c59d; Size is 2389; Max size: 100000000
2026-05-28 20:21:30,728 [root] DEBUG: 11696: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\SYSTEM32\NETAPI32 (0x19000 bytes).
2026-05-28 20:21:30,729 [root] DEBUG: 11696: DLL loaded at 0x00007FFEE6180000: C:\Windows\SYSTEM32\SAMCLI (0x19000 bytes).
2026-05-28 20:21:30,730 [root] DEBUG: 11696: DLL loaded at 0x00007FFEE61A0000: C:\Windows\SYSTEM32\SRVCLI (0x28000 bytes).
2026-05-28 20:21:30,732 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\SYSTEM32\NETUTILS (0xc000 bytes).
2026-05-28 20:21:30,733 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\SYSTEM32\LOGONCLI (0x43000 bytes).
2026-05-28 20:21:30,735 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\10988831\_Setup.dll to files\735a433ade90eaf829fd9c11c4bf6a33dcf712f5451bbab0b6b9435ede7b6259; Size is 93184; Max size: 100000000
2026-05-28 20:21:30,736 [root] DEBUG: 11696: DLL loaded at 0x00007FFEE8470000: C:\Windows\SYSTEM32\SCHEDCLI (0xc000 bytes).
2026-05-28 20:21:30,737 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEE870000: C:\Windows\SYSTEM32\WKSCLI (0x19000 bytes).
2026-05-28 20:21:30,739 [root] DEBUG: 11696: DLL loaded at 0x00007FFEED1A0000: C:\Windows\SYSTEM32\DSROLE (0xa000 bytes).
2026-05-28 20:21:30,740 [root] DEBUG: 5944: FreeHandler: Address: 0x060E0000.
2026-05-28 20:21:30,758 [root] DEBUG: 5944: ProtectionHandler: Adding region at 0x70B42000 to tracked regions.
2026-05-28 20:21:30,759 [root] DEBUG: 5944: AddTrackedRegion: DEBUG Warning - number of tracked regions 882.
2026-05-28 20:21:30,766 [root] DEBUG: 5944: ProtectionHandler: Processing previous tracked region at: 0x74910000.
2026-05-28 20:21:30,770 [root] DEBUG: 5944: ProcessTrackedRegion: Updated entropy for tracked region at 0x74910000: 6.760463e+00 (from 6.759745e+00)
2026-05-28 20:21:30,771 [root] DEBUG: 5944: ProcessTrackedRegion: Region at 0x74910000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\windows.storage.dll is in known range, skipping
2026-05-28 20:21:30,772 [root] DEBUG: 5944: DLL loaded at 0x70930000: C:\Windows\SYSTEM32\iertutil (0x236000 bytes).
2026-05-28 20:21:30,774 [root] INFO: Added new file to list with pid 5944 and path C:\Users\admin\AppData\Local\Temp\TsuF0596FC9.dll
2026-05-28 20:21:30,776 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\TsuF0596FC9.dll to files\f4b52618db95a41819d623d44995bb7a3f9acbcb406447ca8ecddee8859b94c1; Size is 286816; Max size: 100000000
2026-05-28 20:21:30,778 [root] DEBUG: 5944: NtTerminateProcess hook: Attempting to dump process 5944
2026-05-28 20:21:30,779 [root] DEBUG: 5944: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:21:30,787 [root] DEBUG: 5944: ReverseScanForNonZero: Error - Supplied size zero.
2026-05-28 20:21:30,788 [root] DEBUG: 5944: GetPageAddress: Error - Supplied address zero.
2026-05-28 20:21:30,796 [root] INFO: Process with pid 5944 has terminated
2026-05-28 20:21:32,015 [root] DEBUG: 4372: api-cap: NtQueryValueKey hook disabled due to count: 5000
2026-05-28 20:21:32,033 [root] DEBUG: 4372: DLL loaded at 0x00007FFED96D0000: C:\Windows\System32\drprov (0xb000 bytes).
2026-05-28 20:21:32,034 [root] DEBUG: 4372: DLL loaded at 0x00007FFED96D0000: C:\Windows\System32\drprov (0xb000 bytes).
2026-05-28 20:21:32,038 [root] DEBUG: 4372: DLL loaded at 0x00007FFED50E0000: C:\Windows\System32\ntlanman (0x1f000 bytes).
2026-05-28 20:21:32,039 [root] DEBUG: 4372: DLL loaded at 0x00007FFED50E0000: C:\Windows\System32\ntlanman (0x1f000 bytes).
2026-05-28 20:21:32,041 [root] DEBUG: 4372: DLL loaded at 0x00007FFED95A0000: C:\Windows\System32\DAVHLPR (0xd000 bytes).
2026-05-28 20:21:32,043 [root] DEBUG: 4372: DLL loaded at 0x00007FFED95A0000: C:\Windows\System32\DAVHLPR (0xd000 bytes).
2026-05-28 20:21:32,045 [root] DEBUG: 4372: DLL loaded at 0x00007FFED50C0000: C:\Windows\System32\davclnt (0x1e000 bytes).
2026-05-28 20:21:32,047 [root] DEBUG: 4372: DLL loaded at 0x00007FFED50C0000: C:\Windows\System32\davclnt (0x1e000 bytes).
2026-05-28 20:21:32,109 [root] DEBUG: 4372: DLL loaded at 0x00007FFED5060000: C:\Windows\System32\dlnashext (0x56000 bytes).
2026-05-28 20:21:32,111 [root] DEBUG: 4372: DLL loaded at 0x00007FFED5060000: C:\Windows\System32\dlnashext (0x56000 bytes).
2026-05-28 20:21:32,115 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4CD0000: C:\Windows\System32\PlayToDevice (0x64000 bytes).
2026-05-28 20:21:32,116 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4CD0000: C:\Windows\System32\PlayToDevice (0x64000 bytes).
2026-05-28 20:21:32,123 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4B40000: C:\Windows\system32\wpdshext (0xa1000 bytes).
2026-05-28 20:21:32,124 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4B40000: C:\Windows\system32\wpdshext (0xa1000 bytes).
2026-05-28 20:21:32,133 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4CA0000: C:\Windows\System32\EhStorAPI (0x26000 bytes).
2026-05-28 20:21:32,134 [root] DEBUG: 4372: DLL loaded at 0x00007FFED4CA0000: C:\Windows\System32\EhStorAPI (0x26000 bytes).
2026-05-28 20:21:32,366 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 21108: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6868D0000
2026-05-28 20:21:32,368 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 21108
2026-05-28 20:21:32,368 [lib.api.process] INFO: Monitor config for process 21108: C:\6lreqs2g\dll\21108.ini
2026-05-28 20:21:32,370 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:32,372 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:21:32,379 [root] DEBUG: Loader: Injecting process 21108 (thread 21112) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:32,381 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:21:32,382 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:32,383 [lib.api.process] INFO: Injected into 64-bit <Process 21108 dllhost.exe>
2026-05-28 20:21:32,384 [root] DEBUG: 4372: api-cap: NtOpenProcessToken hook disabled due to count: 5000
2026-05-28 20:21:32,384 [root] DEBUG: 4372: api-cap: NtOpenProcessToken hook disabled due to count: 5001
2026-05-28 20:21:32,385 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 21108
2026-05-28 20:21:32,386 [root] DEBUG: 4372: api-cap: NtWaitForSingleObject hook disabled due to count: 5000
2026-05-28 20:21:32,386 [lib.api.process] INFO: Monitor config for process 21108: C:\6lreqs2g\dll\21108.ini
2026-05-28 20:21:32,386 [root] DEBUG: 4372: api-cap: NtWaitForSingleObject hook disabled due to count: 5001
2026-05-28 20:21:32,387 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:32,389 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:21:32,394 [root] DEBUG: Loader: Injecting process 21108 (thread 21112) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:32,395 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:21:32,396 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:32,402 [lib.api.process] INFO: Injected into 64-bit <Process 21108 dllhost.exe>
2026-05-28 20:21:32,409 [root] DEBUG: 21108: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:21:32,410 [root] DEBUG: 21108: Interactive desktop enabled.
2026-05-28 20:21:32,411 [root] DEBUG: 21108: Dropped file limit defaulting to 100.
2026-05-28 20:21:32,413 [root] DEBUG: 21108: Disabling sleep skipping.
2026-05-28 20:21:32,414 [root] DEBUG: 21108: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:21:32,428 [root] DEBUG: 21108: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:21:32,428 [root] DEBUG: 21108: YaraScan: Scanning 0x00007FF6868D0000, size 0x8026
2026-05-28 20:21:32,430 [root] DEBUG: 21108: Monitor initialised: 64-bit capemon loaded in process 21108 at 0x00007FFEAF1A0000, thread 21112, image base 0x00007FF6868D0000, stack from 0x0000007D336F4000-0x0000007D33700000
2026-05-28 20:21:32,430 [root] DEBUG: 21108: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 20:21:32,441 [root] DEBUG: 21108: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:21:32,464 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:21:32,465 [root] DEBUG: 21108: set_hooks: Unable to hook LockResource
2026-05-28 20:21:32,470 [root] DEBUG: 21108: Hooked 627 out of 628 functions
2026-05-28 20:21:32,472 [root] DEBUG: 21108: Syscall hook installed, syscall logging level 1
2026-05-28 20:21:32,478 [root] DEBUG: 21108: RestoreHeaders: Restored original import table.
2026-05-28 20:21:32,479 [root] INFO: Loaded monitor into process with pid 21108
2026-05-28 20:21:32,480 [root] DEBUG: 21108: caller_dispatch: Added region at 0x00007FF6868D0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6868D12F2, thread 21112).
2026-05-28 20:21:32,481 [root] DEBUG: 21108: YaraScan: Scanning 0x00007FF6868D0000, size 0x8026
2026-05-28 20:21:32,483 [root] DEBUG: 21108: ProcessImageBase: Main module image at 0x00007FF6868D0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:21:32,486 [root] DEBUG: 21108: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:21:32,487 [root] DEBUG: 21108: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:21:32,490 [root] DEBUG: 21108: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:21:32,504 [root] DEBUG: 21108: DLL loaded at 0x00007FFEED0B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 20:21:32,518 [root] DEBUG: 21108: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:21:32,519 [root] DEBUG: 21108: DLL loaded at 0x00007FFED81B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 20:21:32,526 [root] DEBUG: 21108: DLL loaded at 0x00007FFEEB280000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 20:21:32,571 [root] DEBUG: 4372: api-cap: NtReleaseMutant hook disabled due to count: 5000
2026-05-28 20:21:32,783 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-05-28 20:21:32,785 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,786 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,787 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,788 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-05-28 20:21:32,789 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,790 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,791 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,792 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,793 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,794 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,806 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-05-28 20:21:32,807 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,808 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,809 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,809 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-05-28 20:21:32,810 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,812 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,813 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,814 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,815 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,816 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,826 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-05-28 20:21:32,827 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,829 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,830 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,831 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEDFD0000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-05-28 20:21:32,832 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,833 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,834 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:32,835 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:21:32,836 [root] DEBUG: 11696: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:21:32,837 [root] DEBUG: 11696: DLL loaded at 0x00007FFEEF210000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 20:21:35,251 [root] DEBUG: 1144: CreateProcessHandler: Injection info set for new process 22232: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF60A060000
2026-05-28 20:21:35,252 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 22232
2026-05-28 20:21:35,253 [root] DEBUG: 1144: ProcessMessage: Skipping monitoring process 22232
2026-05-28 20:21:37,594 [root] INFO: Process with pid 21108 has terminated
2026-05-28 20:21:37,596 [root] DEBUG: 21108: NtTerminateProcess hook: Attempting to dump process 21108
2026-05-28 20:21:37,597 [root] DEBUG: 21108: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:21:38,916 [root] DEBUG: 4372: CreateProcessHandler: Injection info set for new process 22404: C:\Windows\system32\taskmgr.exe, ImageBase: 0x00007FF6DDCE0000
2026-05-28 20:21:38,917 [root] INFO: Announced 64-bit process name: Taskmgr.exe pid: 22404
2026-05-28 20:21:38,918 [lib.api.process] INFO: Monitor config for process 22404: C:\6lreqs2g\dll\22404.ini
2026-05-28 20:21:38,919 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:38,923 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:21:38,927 [root] DEBUG: Loader: Injecting process 22404 (thread 22408) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:38,928 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:21:38,928 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:38,930 [lib.api.process] INFO: Injected into 64-bit <Process 22404 Taskmgr.exe>
2026-05-28 20:21:38,932 [root] INFO: Announced 64-bit process name: Taskmgr.exe pid: 22404
2026-05-28 20:21:38,933 [lib.api.process] INFO: Monitor config for process 22404: C:\6lreqs2g\dll\22404.ini
2026-05-28 20:21:38,933 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:38,936 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:21:38,941 [root] DEBUG: Loader: Injecting process 22404 (thread 22408) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:38,942 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:21:38,943 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:38,944 [lib.api.process] INFO: Injected into 64-bit <Process 22404 Taskmgr.exe>
2026-05-28 20:21:38,952 [root] INFO: Announced 64-bit process name: Taskmgr.exe pid: 22404
2026-05-28 20:21:38,953 [lib.api.process] INFO: Monitor config for process 22404: C:\6lreqs2g\dll\22404.ini
2026-05-28 20:21:38,953 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:21:38,957 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:21:38,961 [root] DEBUG: Loader: Injecting process 22404 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:38,962 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 22408, handle 0x120
2026-05-28 20:21:38,963 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:21:38,965 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:21:38,966 [lib.api.process] INFO: Injected into 64-bit <Process 22404 Taskmgr.exe>
2026-05-28 20:21:38,975 [root] DEBUG: 22404: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:21:38,976 [root] DEBUG: 22404: Interactive desktop enabled.
2026-05-28 20:21:38,977 [root] DEBUG: 22404: Dropped file limit defaulting to 100.
2026-05-28 20:21:38,981 [root] DEBUG: 22404: Disabling sleep skipping.
2026-05-28 20:21:38,982 [root] DEBUG: 22404: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:21:38,994 [root] DEBUG: 22404: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:21:38,995 [root] DEBUG: 22404: YaraScan: Scanning 0x00007FF6DDCE0000, size 0x12fcfe
2026-05-28 20:21:39,002 [root] DEBUG: 22404: Monitor initialised: 64-bit capemon loaded in process 22404 at 0x00007FFEAF1A0000, thread 22408, image base 0x00007FF6DDCE0000, stack from 0x000000750FAB4000-0x000000750FAC0000
2026-05-28 20:21:39,003 [root] DEBUG: 22404: Commandline: "C:\Windows\system32\taskmgr.exe" /4
2026-05-28 20:21:39,014 [root] DEBUG: 22404: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:21:39,035 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:21:39,036 [root] DEBUG: 22404: set_hooks: Unable to hook LockResource
2026-05-28 20:21:39,040 [root] DEBUG: 22404: Hooked 627 out of 628 functions
2026-05-28 20:21:39,048 [root] DEBUG: 22404: Syscall hook installed, syscall logging level 1
2026-05-28 20:21:39,053 [root] DEBUG: 22404: RestoreHeaders: Restored original import table.
2026-05-28 20:21:39,054 [root] INFO: Loaded monitor into process with pid 22404
2026-05-28 20:21:39,057 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEF550000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-28 20:21:39,079 [root] DEBUG: 22404: caller_dispatch: Added region at 0x00007FF6DDCE0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6DDD0FF02, thread 22408).
2026-05-28 20:21:39,080 [root] DEBUG: 22404: YaraScan: Scanning 0x00007FF6DDCE0000, size 0x12fcfe
2026-05-28 20:21:39,089 [root] DEBUG: 22404: ProcessImageBase: Main module image at 0x00007FF6DDCE0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:21:39,098 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:21:39,100 [root] DEBUG: 22404: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:21:39,106 [root] DEBUG: 22404: DLL loaded at 0x00007FFEF0BA0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 20:21:39,119 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE0BF0000: C:\Windows\system32\TextShaping (0xac000 bytes).
2026-05-28 20:21:39,134 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:21:39,135 [root] DEBUG: 22404: DLL loaded at 0x00007FFEECCF0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 20:21:39,136 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEB550000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 20:21:39,137 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEC530000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 20:21:39,138 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE3AB0000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 20:21:39,150 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\system32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:21:39,152 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:21:39,168 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE1520000: C:\Windows\System32\NetworkUXBroker (0x6d000 bytes).
2026-05-28 20:21:39,176 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE02E0000: C:\Windows\system32\srumapi (0x14000 bytes).
2026-05-28 20:21:39,183 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEB3E0000: C:\Windows\system32\WTSAPI32 (0x14000 bytes).
2026-05-28 20:21:39,188 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEF080000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-28 20:21:39,189 [root] DEBUG: 22404: DLL loaded at 0x00007FFEED7F0000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 20:21:39,192 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEB240000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-28 20:21:39,193 [root] DEBUG: 22404: DLL loaded at 0x00007FFEDF010000: C:\Windows\SYSTEM32\atlthunk (0xd000 bytes).
2026-05-28 20:21:39,200 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEF440000: C:\Windows\system32\WINSTA (0x5b000 bytes).
2026-05-28 20:21:39,210 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEF640000: C:\Windows\System32\profapi (0x25000 bytes).
2026-05-28 20:21:39,212 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE2620000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 20:21:39,221 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE6180000: C:\Windows\system32\samcli (0x19000 bytes).
2026-05-28 20:21:39,225 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEB380000: C:\Windows\system32\SAMLIB (0x28000 bytes).
2026-05-28 20:21:39,227 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE9310000: C:\Windows\system32\WindowsCodecs (0x1b4000 bytes).
2026-05-28 20:21:39,233 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-28 20:21:39,247 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 124, handle 0x5b4:
2026-05-28 20:21:39,255 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 488, handle 0x5d8: C:\Windows\System32\csrss.exe
2026-05-28 20:21:39,267 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 572, handle 0x5e0: C:\Windows\System32\csrss.exe
2026-05-28 20:21:39,270 [root] DEBUG: 22404: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2026-05-28 20:21:39,271 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 708, handle 0x5e0: C:\Windows\System32\services.exe
2026-05-28 20:21:39,279 [root] DEBUG: 22404: api-rate-cap: NtReleaseMutant hook disabled due to rate
2026-05-28 20:21:39,281 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 848, handle 0x5e0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,284 [root] DEBUG: 22404: DLL loaded at 0x00007FFED8910000: C:\Windows\system32\OLEACC (0x66000 bytes).
2026-05-28 20:21:39,288 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 848 (handle 0x5e0): 0x00007FF6A8D80000.
2026-05-28 20:21:39,289 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 884, handle 0x5e0: C:\Windows\System32\fontdrvhost.exe
2026-05-28 20:21:39,296 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 884 (handle 0x5e0): 0x00007FF768A90000.
2026-05-28 20:21:39,298 [root] DEBUG: 22404: DLL loaded at 0x00007FFED81B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 20:21:39,300 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1016, handle 0x5e0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,304 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE88C0000: C:\Windows\System32\ActXPrxy (0xa2000 bytes).
2026-05-28 20:21:39,307 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1016 (handle 0x61c): 0x00007FF6A8D80000.
2026-05-28 20:21:39,312 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1052, handle 0x61c: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,319 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1052 (handle 0x61c): 0x00007FF6A8D80000.
2026-05-28 20:21:39,320 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1088, handle 0x61c: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,328 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1280, handle 0x61c: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,332 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1280 (handle 0x61c): 0x00007FF6A8D80000.
2026-05-28 20:21:39,333 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1364, handle 0x61c: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,341 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1364 (handle 0x61c): 0x00007FF6A8D80000.
2026-05-28 20:21:39,343 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEB280000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 20:21:39,346 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1484, handle 0x61c: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,349 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1484 (handle 0x61c): 0x00007FF6A8D80000.
2026-05-28 20:21:39,351 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1572, handle 0x61c: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,359 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1572 (handle 0x654): 0x00007FF6A8D80000.
2026-05-28 20:21:39,361 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1588, handle 0x654: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,364 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1588 (handle 0x654): 0x00007FF6A8D80000.
2026-05-28 20:21:39,365 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1604, handle 0x654: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,368 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1604 (handle 0x654): 0x00007FF6A8D80000.
2026-05-28 20:21:39,372 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1796, handle 0x654: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,376 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1796 (handle 0x654): 0x00007FF6A8D80000.
2026-05-28 20:21:39,378 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1844, handle 0x654: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,381 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1844 (handle 0x654): 0x00007FF6A8D80000.
2026-05-28 20:21:39,382 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1968, handle 0x654: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,389 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1968 (handle 0x674): 0x00007FF6A8D80000.
2026-05-28 20:21:39,391 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1452, handle 0x674: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,393 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2076, handle 0x674: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,396 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2076 (handle 0x674): 0x00007FF6A8D80000.
2026-05-28 20:21:39,398 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2104, handle 0x674: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,401 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2104 (handle 0x674): 0x00007FF6A8D80000.
2026-05-28 20:21:39,403 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2268, handle 0x674: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,407 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2268 (handle 0x674): 0x00007FF6A8D80000.
2026-05-28 20:21:39,409 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2456, handle 0x674: C:\Windows\System32\spoolsv.exe
2026-05-28 20:21:39,413 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2456 (handle 0x644): 0x00007FF7E0D20000.
2026-05-28 20:21:39,414 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2644, handle 0x644: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,420 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2644 (handle 0x644): 0x00007FF6A8D80000.
2026-05-28 20:21:39,422 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2844, handle 0x644: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,425 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2844 (handle 0x644): 0x00007FF6A8D80000.
2026-05-28 20:21:39,426 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2976, handle 0x644: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,428 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2976 (handle 0x694): 0x00007FF6A8D80000.
2026-05-28 20:21:39,429 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3048, handle 0x694: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,435 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3048 (handle 0x6ac): 0x00007FF6A8D80000.
2026-05-28 20:21:39,436 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2476, handle 0x6ac: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,439 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2476 (handle 0x6ac): 0x00007FF6A8D80000.
2026-05-28 20:21:39,441 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3264, handle 0x6ac: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,444 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3264 (handle 0x6ac): 0x00007FF6A8D80000.
2026-05-28 20:21:39,445 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2956, handle 0x6ac: C:\Windows\System32\SearchIndexer.exe
2026-05-28 20:21:39,449 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2956 (handle 0x694): 0x00007FF718E70000.
2026-05-28 20:21:39,450 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4132, handle 0x694: C:\Windows\System32\SearchProtocolHost.exe
2026-05-28 20:21:39,453 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4132 (handle 0x694): 0x00007FF78AD10000.
2026-05-28 20:21:39,454 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4164, handle 0x694: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,456 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4164 (handle 0x694): 0x00007FF6A8D80000.
2026-05-28 20:21:39,457 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4440, handle 0x694: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,460 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4440 (handle 0x694): 0x00007FF6A8D80000.
2026-05-28 20:21:39,461 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4600, handle 0x694: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,465 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4600 (handle 0x694): 0x00007FF6A8D80000.
2026-05-28 20:21:39,466 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4884, handle 0x694: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,469 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5020, handle 0x694: C:\Windows\System32\taskhostw.exe
2026-05-28 20:21:39,472 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4372, handle 0x694: C:\Windows\explorer.exe
2026-05-28 20:21:39,476 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4372 (handle 0x694): 0x00007FF65F9E0000.
2026-05-28 20:21:39,478 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5652, handle 0x694: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,482 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 5652 (handle 0x694): 0x00007FF6A8D80000.
2026-05-28 20:21:39,484 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 6028, handle 0x694: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
2026-05-28 20:21:39,487 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE4250000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-05-28 20:21:39,488 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEE220000: C:\Windows\System32\sppc (0x25000 bytes).
2026-05-28 20:21:39,490 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEE250000: C:\Windows\System32\SLC (0x29000 bytes).
2026-05-28 20:21:39,492 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEF5C0000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-28 20:21:39,493 [root] DEBUG: 22404: DLL loaded at 0x00007FFEDDAE0000: C:\Windows\System32\appresolver (0x90000 bytes).
2026-05-28 20:21:39,502 [root] DEBUG: 22404: DLL loaded at 0x00007FFEECF30000: C:\Windows\SYSTEM32\apphelp (0x90000 bytes).
2026-05-28 20:21:39,511 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE5370000: C:\Windows\System32\StateRepository.Core (0xb1000 bytes).
2026-05-28 20:21:39,512 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE4650000: C:\Windows\System32\Windows.StateRepository (0x58e000 bytes).
2026-05-28 20:21:39,513 [root] DEBUG: 22404: DLL loaded at 0x00007FFEDAE80000: C:\Windows\System32\TileDataRepository (0x99000 bytes).
2026-05-28 20:21:39,520 [root] DEBUG: 22404: DLL loaded at 0x00007FFEDF8A0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 20:21:39,536 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE0440000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-05-28 20:21:39,546 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE3D00000: C:\Windows\System32\MrmCoreR (0xf4000 bytes).
2026-05-28 20:21:39,555 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE94D0000: C:\Windows\SYSTEM32\twinapi.appcore (0x203000 bytes).
2026-05-28 20:21:39,556 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE96E0000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 20:21:39,558 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE3950000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 20:21:39,559 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE3BB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 20:21:39,560 [root] DEBUG: 22404: DLL loaded at 0x00007FFEDFE80000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 20:21:39,562 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE3900000: C:\Windows\SYSTEM32\languageoverlayutil (0x41000 bytes).
2026-05-28 20:21:39,569 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE41E0000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-05-28 20:21:39,572 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE4BE0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 20:21:39,588 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 6028 (handle 0x7a8): 0x00007FF6174D0000.
2026-05-28 20:21:39,594 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5232, handle 0x7ac: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,597 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 5232 (handle 0x7ac): 0x00007FF6A8D80000.
2026-05-28 20:21:39,600 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 6432, handle 0x7ac: C:\Windows\System32\RuntimeBroker.exe
2026-05-28 20:21:39,607 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 6432 (handle 0x7b8): 0x00007FF6CD080000.
2026-05-28 20:21:39,608 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 6708, handle 0x7c4: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,611 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 6708 (handle 0x7c4): 0x00007FF6A8D80000.
2026-05-28 20:21:39,612 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4812, handle 0x7c4: C:\Windows\System32\smartscreen.exe
2026-05-28 20:21:39,614 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4812 (handle 0x7c4): 0x00007FF6BE4B0000.
2026-05-28 20:21:39,614 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3492, handle 0x7c4: C:\Windows\System32\SecurityHealthService.exe
2026-05-28 20:21:39,616 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3856, handle 0x7c4: C:\Windows\System32\conhost.exe
2026-05-28 20:21:39,618 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3856 (handle 0x7c4): 0x00007FF66D090000.
2026-05-28 20:21:39,619 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 6632, handle 0x7c4: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-28 20:21:39,620 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 6632 (handle 0x7c4): 0x00007FF6CE2A0000.
2026-05-28 20:21:39,622 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5432, handle 0x7c4: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-28 20:21:39,623 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 5432 (handle 0x7c4): 0x00007FF6CE2A0000.
2026-05-28 20:21:39,624 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3704, handle 0x7c4: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-28 20:21:39,626 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3704 (handle 0x7c4): 0x00007FF6CE2A0000.
2026-05-28 20:21:39,627 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7488, handle 0x7c4: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:39,629 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7488 (handle 0x7c4): 0x00007FF60C850000.
2026-05-28 20:21:39,630 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7636, handle 0x7c4: C:\Program Files (x86)\Common Files\Steam\steamservice.exe
2026-05-28 20:21:39,631 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7636 (handle 0x7c4): 0x0000000000340000.
2026-05-28 20:21:39,632 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7848, handle 0x7c4: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:39,633 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7848 (handle 0x7c4): 0x00007FF60C850000.
2026-05-28 20:21:39,636 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 8216, handle 0x7c4: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-28 20:21:39,638 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 8216 (handle 0x7c4): 0x00007FF6CE2A0000.
2026-05-28 20:21:39,639 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 8780, handle 0x7c4: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
2026-05-28 20:21:39,652 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 8780 (handle 0x7d0): 0x00007FF716380000.
2026-05-28 20:21:39,655 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7204, handle 0x734: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:39,657 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7204 (handle 0x734): 0x00007FF60C850000.
2026-05-28 20:21:39,658 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4080, handle 0x734: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,660 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4080 (handle 0x734): 0x00007FF6A8D80000.
2026-05-28 20:21:39,661 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 8052, handle 0x734: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:39,663 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 8052 (handle 0x734): 0x00007FF60A060000.
2026-05-28 20:21:39,663 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1908, handle 0x734: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:39,665 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1908 (handle 0x734): 0x00007FF60A060000.
2026-05-28 20:21:39,667 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 8276, handle 0x734: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:39,668 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 8276 (handle 0x734): 0x00007FF60A060000.
2026-05-28 20:21:39,669 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 9652, handle 0x734: C:\Windows\System32\ApplicationFrameHost.exe
2026-05-28 20:21:39,670 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 9652 (handle 0x734): 0x00007FF6477E0000.
2026-05-28 20:21:39,671 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 11300, handle 0x734: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,673 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 11300 (handle 0x734): 0x00007FF6A8D80000.
2026-05-28 20:21:39,674 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 11372, handle 0x734: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,676 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12000, handle 0x734: C:\Windows\System32\SgrmBroker.exe
2026-05-28 20:21:39,679 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12132, handle 0x734: C:\Windows\System32\svchost.exe
2026-05-28 20:21:39,681 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12520, handle 0x734: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:39,682 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 12520 (handle 0x734): 0x00007FF60A060000.
2026-05-28 20:21:39,684 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12652, handle 0x734: C:\Windows\System32\SearchFilterHost.exe
2026-05-28 20:21:39,685 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 12652 (handle 0x734): 0x00007FF690670000.
2026-05-28 20:21:39,686 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 20336, handle 0x734: C:\Windows\System32\sppsvc.exe
2026-05-28 20:21:39,930 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEEAD0000: C:\Windows\system32\IPHLPAPI (0x3b000 bytes).
2026-05-28 20:21:39,937 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE8E20000: C:\Windows\SYSTEM32\WINNSI (0xb000 bytes).
2026-05-28 20:21:39,957 [root] DEBUG: 22404: api-rate-cap: NtQueryValueKey hook disabled due to rate
2026-05-28 20:21:40,233 [root] DEBUG: 22404: DLL loaded at 0x00007FFEED220000: C:\Windows\system32\dwmapi (0x2f000 bytes).
2026-05-28 20:21:40,234 [root] DEBUG: 22404: DLL loaded at 0x00007FFEB2D50000: C:\Windows\system32\d3d9 (0x1cd000 bytes).
2026-05-28 20:21:40,241 [root] DEBUG: 22404: DLL loaded at 0x00007FFEED200000: C:\Windows\SYSTEM32\resourcepolicyclient (0x14000 bytes).
2026-05-28 20:21:40,246 [root] DEBUG: 22404: DLL loaded at 0x00007FFE94680000: C:\Windows\system32\D3D12Core (0x1cd000 bytes).
2026-05-28 20:21:40,255 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE6F40000: C:\Windows\system32\d3d10warp (0x6f6000 bytes).
2026-05-28 20:21:40,267 [root] DEBUG: 22404: DLL loaded at 0x00007FFE94540000: C:\Windows\system32\dxilconv (0x139000 bytes).
2026-05-28 20:21:40,269 [root] DEBUG: 22404: DLL loaded at 0x0000023B0ACA0000: C:\Windows\system32\D3DSCache (0x2a000 bytes).
2026-05-28 20:21:40,290 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE6F40000: C:\Windows\system32\d3d10warp (0x6f6000 bytes).
2026-05-28 20:21:40,292 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEF3D0000: C:\Windows\system32\DEVOBJ (0x33000 bytes).
2026-05-28 20:21:40,295 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE8E40000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 20:21:40,296 [root] DEBUG: 22404: DLL loaded at 0x00007FFEE8D30000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 20:21:40,298 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEEB10000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 20:21:40,299 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 392, handle 0xa8c: C:\Windows\System32\smss.exe
2026-05-28 20:21:40,303 [root] DEBUG: 22404: DLL loaded at 0x00007FFEEE870000: C:\Windows\system32\wkscli (0x19000 bytes).
2026-05-28 20:21:40,316 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 556, handle 0xa44: C:\Windows\System32\wininit.exe
2026-05-28 20:21:40,321 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 664, handle 0x7cc: C:\Windows\System32\winlogon.exe
2026-05-28 20:21:40,332 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 664 (handle 0x7c4): 0x00007FF682A90000.
2026-05-28 20:21:40,333 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 732, handle 0x7c4: C:\Windows\System32\lsass.exe
2026-05-28 20:21:40,338 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 732 (handle 0x724): 0x00007FF7371E0000.
2026-05-28 20:21:40,339 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 876, handle 0x724: C:\Windows\System32\fontdrvhost.exe
2026-05-28 20:21:40,340 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 960, handle 0x724: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,342 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 960 (handle 0x724): 0x00007FF6A8D80000.
2026-05-28 20:21:40,343 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 492, handle 0x724: C:\Windows\System32\dwm.exe
2026-05-28 20:21:40,347 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 492 (handle 0x604): 0x00007FF632AF0000.
2026-05-28 20:21:40,349 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1060, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,351 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1060 (handle 0x604): 0x00007FF6A8D80000.
2026-05-28 20:21:40,352 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1212, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,354 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1212 (handle 0x604): 0x00007FF6A8D80000.
2026-05-28 20:21:40,355 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1288, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,357 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1288 (handle 0x604): 0x00007FF6A8D80000.
2026-05-28 20:21:40,358 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1476, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,361 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1476 (handle 0x604): 0x00007FF6A8D80000.
2026-05-28 20:21:40,361 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1580, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,363 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1580 (handle 0x604): 0x00007FF6A8D80000.
2026-05-28 20:21:40,364 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1596, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,366 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1596 (handle 0x604): 0x00007FF6A8D80000.
2026-05-28 20:21:40,367 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1744, handle 0x604: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,369 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1744 (handle 0x724): 0x00007FF6A8D80000.
2026-05-28 20:21:40,371 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1836, handle 0x724: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,374 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1836 (handle 0x724): 0x00007FF6A8D80000.
2026-05-28 20:21:40,375 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1884, handle 0x724: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,377 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1884 (handle 0x724): 0x00007FF6A8D80000.
2026-05-28 20:21:40,378 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2020, handle 0x724: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,380 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2020 (handle 0x724): 0x00007FF6A8D80000.
2026-05-28 20:21:40,381 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1684, handle 0x724: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,383 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1684 (handle 0x724): 0x00007FF6A8D80000.
2026-05-28 20:21:40,383 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2084, handle 0x724: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,385 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2084 (handle 0x7a0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,387 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2256, handle 0x7a0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,389 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2256 (handle 0x7a0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,390 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2404, handle 0x7a0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,392 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2404 (handle 0x7a0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,393 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2580, handle 0x7a0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,395 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2580 (handle 0x7a0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,396 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2836, handle 0x7a0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,398 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2836 (handle 0x7a0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,399 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2968, handle 0x7a0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,401 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2968 (handle 0xab0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,403 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 2996, handle 0xab0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,405 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 2996 (handle 0xab0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,406 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3060, handle 0xab0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,408 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3060 (handle 0xab0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,409 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3104, handle 0xab0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,411 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3104 (handle 0xab0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,412 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3928, handle 0xab0: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,414 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3928 (handle 0xab0): 0x00007FF6A8D80000.
2026-05-28 20:21:40,415 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4100, handle 0xab0: C:\Windows\System32\sihost.exe
2026-05-28 20:21:40,420 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4100 (handle 0x814): 0x00007FF737480000.
2026-05-28 20:21:40,421 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4152, handle 0x814: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,423 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4152 (handle 0x814): 0x00007FF6A8D80000.
2026-05-28 20:21:40,424 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4228, handle 0x814: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,426 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4228 (handle 0x814): 0x00007FF6A8D80000.
2026-05-28 20:21:40,427 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4528, handle 0x814: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,430 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4528 (handle 0x814): 0x00007FF6A8D80000.
2026-05-28 20:21:40,431 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4688, handle 0x814: C:\Windows\System32\ctfmon.exe
2026-05-28 20:21:40,442 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4688 (handle 0xa04): 0x00007FF71F7E0000.
2026-05-28 20:21:40,443 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4976, handle 0xa04: C:\Windows\System32\taskhostw.exe
2026-05-28 20:21:40,445 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4976 (handle 0xa04): 0x00007FF753750000.
2026-05-28 20:21:40,446 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5048, handle 0xa04: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,449 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 5048 (handle 0xab4): 0x00007FF6A8D80000.
2026-05-28 20:21:40,450 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4608, handle 0xab4: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,452 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4608 (handle 0xab4): 0x00007FF6A8D80000.
2026-05-28 20:21:40,453 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5764, handle 0xab4: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,455 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 5764 (handle 0xab4): 0x00007FF6A8D80000.
2026-05-28 20:21:40,456 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4352, handle 0xab4: C:\Windows\System32\RuntimeBroker.exe
2026-05-28 20:21:40,462 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4352 (handle 0xa04): 0x00007FF6CD080000.
2026-05-28 20:21:40,464 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 6220, handle 0xa04: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
2026-05-28 20:21:40,491 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 6220 (handle 0xabc): 0x00007FF741AF0000.
2026-05-28 20:21:40,493 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 6636, handle 0x814: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,495 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 6636 (handle 0x814): 0x00007FF6A8D80000.
2026-05-28 20:21:40,496 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3816, handle 0x814: C:\Windows\System32\RuntimeBroker.exe
2026-05-28 20:21:40,497 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3816 (handle 0x814): 0x00007FF6CD080000.
2026-05-28 20:21:40,498 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 5324, handle 0x814: C:\Windows\System32\SecurityHealthSystray.exe
2026-05-28 20:21:40,501 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 5324 (handle 0x814): 0x00007FF796BE0000.
2026-05-28 20:21:40,501 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7084, handle 0x814: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,504 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7084 (handle 0x814): 0x00007FF6A8D80000.
2026-05-28 20:21:40,504 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3136, handle 0x814: C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
2026-05-28 20:21:40,506 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3136 (handle 0x814): 0x0000000000880000.
2026-05-28 20:21:40,508 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7160, handle 0x814: C:\Program Files (x86)\Steam\steam.exe
2026-05-28 20:21:40,509 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7160 (handle 0x814): 0x00007FF6D9060000.
2026-05-28 20:21:40,510 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3876, handle 0x814: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-28 20:21:40,511 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3876 (handle 0x814): 0x00007FF6CE2A0000.
2026-05-28 20:21:40,512 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7448, handle 0x814: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:40,513 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7448 (handle 0x814): 0x00007FF60C850000.
2026-05-28 20:21:40,515 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7540, handle 0x814: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-28 20:21:40,516 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7540 (handle 0x814): 0x00007FF6CE2A0000.
2026-05-28 20:21:40,517 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7732, handle 0x814: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:40,519 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7732 (handle 0x814): 0x00007FF60C850000.
2026-05-28 20:21:40,520 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7936, handle 0x814: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:40,521 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7936 (handle 0x814): 0x00007FF60C850000.
2026-05-28 20:21:40,522 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 8460, handle 0x814: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-28 20:21:40,524 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 8460 (handle 0x814): 0x00007FF60C850000.
2026-05-28 20:21:40,525 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 7340, handle 0x814: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,528 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 7340 (handle 0x814): 0x00007FF6A8D80000.
2026-05-28 20:21:40,529 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 788, handle 0x814: C:\Windows\System32\notepad.exe
2026-05-28 20:21:40,540 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 788 (handle 0xa04): 0x00007FF7ACB50000.
2026-05-28 20:21:40,543 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1144, handle 0xa04: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:40,545 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1144 (handle 0xa14): 0x00007FF60A060000.
2026-05-28 20:21:40,546 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 1624, handle 0xa14: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:40,548 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 1624 (handle 0xa14): 0x00007FF60A060000.
2026-05-28 20:21:40,549 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 4616, handle 0xa14: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:40,550 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 4616 (handle 0xa14): 0x00007FF60A060000.
2026-05-28 20:21:40,551 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 8224, handle 0xa14: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:40,552 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 8224 (handle 0xa14): 0x00007FF60A060000.
2026-05-28 20:21:40,553 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 3480, handle 0xa14: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-28 20:21:40,555 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 3480 (handle 0xa14): 0x00007FF60A060000.
2026-05-28 20:21:40,556 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 11340, handle 0xa14: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,559 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 11340 (handle 0xa14): 0x00007FF6A8D80000.
2026-05-28 20:21:40,560 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 11696, handle 0xa14: C:\Windows\System32\wbem\WmiPrvSE.exe
2026-05-28 20:21:40,570 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 11696 (handle 0xac4): 0x00007FF7D5630000.
2026-05-28 20:21:40,571 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12088, handle 0xac4: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,573 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 12088 (handle 0xac4): 0x00007FF6A8D80000.
2026-05-28 20:21:40,573 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12204, handle 0xac4: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,575 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 12204 (handle 0xac4): 0x00007FF6A8D80000.
2026-05-28 20:21:40,576 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 12600, handle 0xac4: C:\Windows\System32\SearchProtocolHost.exe
2026-05-28 20:21:40,578 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 12600 (handle 0xac4): 0x00007FF78AD10000.
2026-05-28 20:21:40,579 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 20072, handle 0xac4: C:\Windows\System32\taskhostw.exe
2026-05-28 20:21:40,581 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 20072 (handle 0xac4): 0x00007FF753750000.
2026-05-28 20:21:40,582 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 20404, handle 0xac4: C:\Windows\System32\svchost.exe
2026-05-28 20:21:40,584 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 20404 (handle 0xac4): 0x00007FF6A8D80000.
2026-05-28 20:21:40,607 [root] DEBUG: 22404: DLL loaded at 0x0000023B08460000: C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3636_none_91a19322cc8a92a3\gdiplus (0x1a5000 bytes).
2026-05-28 20:21:40,609 [root] DEBUG: 22404: DLL loaded at 0x00007FFEB5DE0000: C:\Windows\system32\CHARTV (0x25000 bytes).
2026-05-28 20:22:01,521 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 24800: C:\Windows\System32\mousocoreworker.exe, ImageBase: 0x00007FF6D0370000
2026-05-28 20:22:01,522 [root] INFO: Announced 64-bit process name: MoUsoCoreWorker.exe pid: 24800
2026-05-28 20:22:01,523 [lib.api.process] INFO: Monitor config for process 24800: C:\6lreqs2g\dll\24800.ini
2026-05-28 20:22:01,525 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:01,529 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:01,533 [root] DEBUG: Loader: Injecting process 24800 (thread 24804) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:01,534 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:01,535 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:01,536 [lib.api.process] INFO: Injected into 64-bit <Process 24800 MoUsoCoreWorker.exe>
2026-05-28 20:22:01,537 [root] INFO: Announced 64-bit process name: MoUsoCoreWorker.exe pid: 24800
2026-05-28 20:22:01,538 [lib.api.process] INFO: Monitor config for process 24800: C:\6lreqs2g\dll\24800.ini
2026-05-28 20:22:01,539 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:01,542 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:01,546 [root] DEBUG: Loader: Injecting process 24800 (thread 24804) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:01,547 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:01,548 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:01,550 [lib.api.process] INFO: Injected into 64-bit <Process 24800 MoUsoCoreWorker.exe>
2026-05-28 20:22:01,556 [root] DEBUG: 24800: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:22:01,557 [root] DEBUG: 24800: Interactive desktop enabled.
2026-05-28 20:22:01,559 [root] DEBUG: 24800: Dropped file limit defaulting to 100.
2026-05-28 20:22:01,562 [root] DEBUG: 24800: VerifyCodeSection: Exception rebasing image from 0x00007FF6D0370000 to 0x0000000140000000.
2026-05-28 20:22:01,564 [root] DEBUG: 24800: Disabling sleep skipping.
2026-05-28 20:22:01,566 [root] DEBUG: 24800: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:22:01,580 [root] DEBUG: 24800: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:22:01,582 [root] DEBUG: 24800: YaraScan: Scanning 0x00007FF6D0370000, size 0x1ad000
2026-05-28 20:22:01,595 [root] DEBUG: 24800: Monitor initialised: 64-bit capemon loaded in process 24800 at 0x00007FFEAF1A0000, thread 24804, image base 0x00007FF6D0370000, stack from 0x00000075090F4000-0x0000007509100000
2026-05-28 20:22:01,595 [root] DEBUG: 24800: Commandline: C:\Windows\System32\mousocoreworker.exe -Embedding
2026-05-28 20:22:01,607 [root] DEBUG: 24800: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:22:01,628 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:22:01,629 [root] DEBUG: 24800: set_hooks: Unable to hook LockResource
2026-05-28 20:22:01,635 [root] DEBUG: 24800: Hooked 627 out of 628 functions
2026-05-28 20:22:01,645 [root] DEBUG: 24800: Syscall hook installed, syscall logging level 1
2026-05-28 20:22:01,650 [root] DEBUG: 24800: RestoreHeaders: Restored original import table.
2026-05-28 20:22:01,650 [root] INFO: Loaded monitor into process with pid 24800
2026-05-28 20:22:01,657 [root] DEBUG: 24800: caller_dispatch: Added region at 0x00007FF6D0370000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x00007FF6D0491219, thread 24804).
2026-05-28 20:22:01,657 [root] DEBUG: 24800: YaraScan: Scanning 0x00007FF6D0370000, size 0x1ad000
2026-05-28 20:22:01,669 [root] DEBUG: 24800: ProcessImageBase: Main module image at 0x00007FF6D0370000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:22:01,671 [root] DEBUG: 24800: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:22:01,672 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:22:01,692 [root] DEBUG: 24800: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-28 20:22:01,710 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:22:01,727 [root] DEBUG: 24800: DLL loaded at 0x00007FFED0B00000: C:\Windows\System32\usocoreps (0xd000 bytes).
2026-05-28 20:22:01,948 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\System32\WINHTTP (0x10a000 bytes).
2026-05-28 20:22:01,949 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF430000: C:\Windows\System32\DPAPI (0xa000 bytes).
2026-05-28 20:22:01,950 [root] DEBUG: 24800: DLL loaded at 0x00007FFED48E0000: C:\Windows\System32\UPShared (0xb2000 bytes).
2026-05-28 20:22:01,956 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDDB70000: C:\Windows\System32\wuapi (0xf0000 bytes).
2026-05-28 20:22:01,961 [root] DEBUG: 24800: DLL loaded at 0x00007FFED0890000: C:\Windows\SYSTEM32\wups (0x1a000 bytes).
2026-05-28 20:22:01,963 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEB3E0000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes).
2026-05-28 20:22:01,964 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF440000: C:\Windows\System32\WINSTA (0x5b000 bytes).
2026-05-28 20:22:02,031 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 24800, handle 0xabc: C:\Windows\System32\MoUsoCoreWorker.exe
2026-05-28 20:22:02,037 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 24800 (handle 0xad4): 0x00007FF6D0370000.
2026-05-28 20:22:02,069 [root] DEBUG: 24800: DLL loaded at 0x00007FFED0890000: C:\Windows\System32\wups (0x1a000 bytes).
2026-05-28 20:22:03,630 [root] DEBUG: 24800: api-rate-cap: NtClose hook disabled due to rate
2026-05-28 20:22:05,719 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:22:05,720 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:22:05,725 [root] DEBUG: 24800: DLL loaded at 0x00007FFED47D0000: C:\Windows\System32\usoapi (0x26000 bytes).
2026-05-28 20:22:05,727 [root] DEBUG: 24800: DLL loaded at 0x00007FFED8B50000: C:\Windows\System32\FlightSettings (0xe6000 bytes).
2026-05-28 20:22:05,729 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDDEA0000: C:\Windows\System32\Windows.Networking.Connectivity (0xb9000 bytes).
2026-05-28 20:22:05,732 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE8E60000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-28 20:22:05,736 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEB550000: C:\Windows\System32\WinTypes (0x155000 bytes).
2026-05-28 20:22:05,741 [root] DEBUG: 24800: DLL loaded at 0x00007FFED71F0000: C:\Windows\SYSTEM32\productenumerator (0xe000 bytes).
2026-05-28 20:22:06,028 [root] INFO: Stopping Task Scheduler Service
2026-05-28 20:22:06,039 [root] INFO: Stopped Task Scheduler Service
2026-05-28 20:22:06,044 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 25236, handle 0xad8: C:\Windows\System32\sc.exe
2026-05-28 20:22:06,045 [root] INFO: Starting Task Scheduler Service
2026-05-28 20:22:06,054 [root] INFO: Started Task Scheduler Service
2026-05-28 20:22:06,056 [lib.api.process] INFO: Monitor config for process 1212: C:\6lreqs2g\dll\1212.ini
2026-05-28 20:22:06,058 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:06,061 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:06,066 [root] DEBUG: Loader: Injecting process 1212 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:06,068 [root] DEBUG: 1212: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:22:06,069 [root] DEBUG: 1212: Disabling sleep skipping.
2026-05-28 20:22:06,070 [root] DEBUG: 1212: Interactive desktop enabled.
2026-05-28 20:22:06,070 [root] DEBUG: 1212: Dropped file limit defaulting to 100.
2026-05-28 20:22:06,071 [root] DEBUG: 1212: Services hook set enabled
2026-05-28 20:22:06,074 [root] DEBUG: 1212: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:22:06,085 [root] DEBUG: 1212: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:22:06,086 [root] DEBUG: 1212: Monitor initialised: 64-bit capemon loaded in process 1212 at 0x00007FFEAF1A0000, thread 25324, image base 0x00007FF6A8D80000, stack from 0x0000004FD89F4000-0x0000004FD8A00000
2026-05-28 20:22:06,086 [root] DEBUG: 1212: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
2026-05-28 20:22:06,099 [root] DEBUG: 1212: Hooked 69 out of 69 functions
2026-05-28 20:22:06,100 [root] INFO: Loaded monitor into process with pid 1212
2026-05-28 20:22:06,101 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 20:22:06,102 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:06,103 [lib.api.process] INFO: Injected into 64-bit <Process 1212 svchost.exe>
2026-05-28 20:22:08,105 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEACF0000: C:\Windows\System32\taskschd (0xac000 bytes).
2026-05-28 20:22:08,136 [root] INFO: Announced starting service "b'WaaSMedicSvc'"
2026-05-28 20:22:09,167 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA3A0000: C:\Windows\system32\WaaSMedicPS (0xc000 bytes).
2026-05-28 20:22:09,254 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE4BE0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 20:22:09,254 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDEB40000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-28 20:22:09,259 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA3B0000: C:\Windows\System32\wosc (0x4e000 bytes).
2026-05-28 20:22:09,262 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0990000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 20:22:09,265 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDD9D0000: C:\Windows\System32\dusmapi (0x11000 bytes).
2026-05-28 20:22:09,288 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:09,289 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:09,289 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:09,290 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:09,293 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:09,322 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE220000: C:\Windows\SYSTEM32\sppc (0x25000 bytes).
2026-05-28 20:22:09,323 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE250000: C:\Windows\SYSTEM32\slc (0x29000 bytes).
2026-05-28 20:22:09,330 [root] DEBUG: 24800: api-rate-cap: ReadProcessMemory hook disabled due to rate
2026-05-28 20:22:09,336 [root] DEBUG: 24800: api-rate-cap: NtReadVirtualMemory hook disabled due to rate
2026-05-28 20:22:09,406 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 20:22:09,407 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEB400000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 20:22:09,421 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF3D0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 20:22:09,421 [root] DEBUG: 24800: DLL loaded at 0x00007FFE95AF0000: C:\Windows\SYSTEM32\dmEnrollEngine (0xdf000 bytes).
2026-05-28 20:22:09,423 [root] DEBUG: 24800: DLL loaded at 0x00007FFED5C00000: C:\Windows\SYSTEM32\enrollmentapi (0x11000 bytes).
2026-05-28 20:22:09,466 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:09,467 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:09,473 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:09,473 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:09,475 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:09,477 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:09,480 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE8480000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-28 20:22:09,484 [root] DEBUG: 24800: DLL loaded at 0x00007FFED5BD0000: C:\Windows\System32\fcon (0x45000 bytes).
2026-05-28 20:22:09,490 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE710000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 20:22:09,514 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:09,515 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:09,517 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:09,518 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:09,519 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:09,527 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\wldp (0x2d000 bytes).
2026-05-28 20:22:09,531 [root] DEBUG: 24800: DLL loaded at 0x0000017E90790000: C:\Windows\System32\WDSCORE (0x43000 bytes).
2026-05-28 20:22:09,532 [root] DEBUG: 24800: DLL loaded at 0x00007FFEB6C10000: C:\Windows\System32\MSI (0x337000 bytes).
2026-05-28 20:22:09,533 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\System32\NETAPI32 (0x19000 bytes).
2026-05-28 20:22:09,534 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9040000: C:\Windows\System32\VERSION (0xa000 bytes).
2026-05-28 20:22:09,535 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE0D0000: C:\Windows\System32\tdh (0x11b000 bytes).
2026-05-28 20:22:09,537 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:22:09,538 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE6180000: C:\Windows\System32\SAMCLI (0x19000 bytes).
2026-05-28 20:22:09,538 [root] DEBUG: 24800: DLL loaded at 0x00007FFE94460000: C:\Windows\System32\appraiser (0x212000 bytes).
2026-05-28 20:22:09,551 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA250000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xf4000 bytes).
2026-05-28 20:22:09,556 [root] DEBUG: 24800: DLL loaded at 0x00007FFED0400000: C:\Windows\System32\OneSettingsClient (0x32000 bytes).
2026-05-28 20:22:09,561 [root] DEBUG: 24800: DLL loaded at 0x00007FFED5E30000: C:\Windows\system32\OnDemandConnRouteHelper (0x17000 bytes).
2026-05-28 20:22:09,563 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEDE0000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-05-28 20:22:09,564 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE8E20000: C:\Windows\SYSTEM32\WINNSI (0xb000 bytes).
2026-05-28 20:22:09,566 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE8E40000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 20:22:09,567 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE8D30000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 20:22:09,570 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDB3D0000: C:\Windows\System32\webio (0x98000 bytes).
2026-05-28 20:22:09,578 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEB10000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 20:22:09,580 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE4F10000: C:\Windows\System32\rasadhlp (0xa000 bytes).
2026-05-28 20:22:09,582 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE6D00000: C:\Windows\System32\fwpuclnt (0x80000 bytes).
2026-05-28 20:22:09,790 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE620000: C:\Windows\system32\schannel (0x97000 bytes).
2026-05-28 20:22:10,060 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 25444, handle 0xaf4: C:\Windows\System32\svchost.exe
2026-05-28 20:22:10,211 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9520000: C:\Windows\SYSTEM32\mskeyprotect (0x15000 bytes).
2026-05-28 20:22:10,212 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9570000: C:\Windows\system32\ncryptsslp (0x26000 bytes).
2026-05-28 20:22:10,223 [root] DEBUG: 24800: DLL loaded at 0x00007FFED94B0000: C:\Windows\System32\cryptnet (0x31000 bytes).
2026-05-28 20:22:10,702 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,703 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,709 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,709 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,710 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,713 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:10,739 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,741 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,743 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,745 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,746 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,754 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\wldp (0x2d000 bytes).
2026-05-28 20:22:10,758 [root] DEBUG: 24800: DLL loaded at 0x0000017E90810000: C:\Windows\System32\WDSCORE (0x43000 bytes).
2026-05-28 20:22:10,759 [root] DEBUG: 24800: DLL loaded at 0x00007FFEB6C10000: C:\Windows\System32\MSI (0x337000 bytes).
2026-05-28 20:22:10,760 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\System32\NETAPI32 (0x19000 bytes).
2026-05-28 20:22:10,761 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9040000: C:\Windows\System32\VERSION (0xa000 bytes).
2026-05-28 20:22:10,762 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE0D0000: C:\Windows\System32\tdh (0x11b000 bytes).
2026-05-28 20:22:10,763 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:22:10,764 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE6180000: C:\Windows\System32\SAMCLI (0x19000 bytes).
2026-05-28 20:22:10,764 [root] DEBUG: 24800: DLL loaded at 0x00007FFE94460000: C:\Windows\System32\appraiser (0x212000 bytes).
2026-05-28 20:22:10,791 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,792 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,798 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,799 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,800 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,802 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:10,827 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,828 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,830 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,831 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,832 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,840 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\wldp (0x2d000 bytes).
2026-05-28 20:22:10,844 [root] DEBUG: 24800: DLL loaded at 0x0000017E90810000: C:\Windows\System32\WDSCORE (0x43000 bytes).
2026-05-28 20:22:10,844 [root] DEBUG: 24800: DLL loaded at 0x00007FFEB6C10000: C:\Windows\System32\MSI (0x337000 bytes).
2026-05-28 20:22:10,845 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\System32\NETAPI32 (0x19000 bytes).
2026-05-28 20:22:10,846 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9040000: C:\Windows\System32\VERSION (0xa000 bytes).
2026-05-28 20:22:10,846 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE0D0000: C:\Windows\System32\tdh (0x11b000 bytes).
2026-05-28 20:22:10,848 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:22:10,848 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE6180000: C:\Windows\System32\SAMCLI (0x19000 bytes).
2026-05-28 20:22:10,849 [root] DEBUG: 24800: DLL loaded at 0x00007FFE94460000: C:\Windows\System32\appraiser (0x212000 bytes).
2026-05-28 20:22:10,877 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,878 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,884 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,885 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,886 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,889 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:10,914 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,914 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,917 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,919 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,919 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,927 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\wldp (0x2d000 bytes).
2026-05-28 20:22:10,930 [root] DEBUG: 24800: DLL loaded at 0x0000017E90810000: C:\Windows\System32\WDSCORE (0x43000 bytes).
2026-05-28 20:22:10,931 [root] DEBUG: 24800: DLL loaded at 0x00007FFEB6C10000: C:\Windows\System32\MSI (0x337000 bytes).
2026-05-28 20:22:10,932 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\System32\NETAPI32 (0x19000 bytes).
2026-05-28 20:22:10,933 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9040000: C:\Windows\System32\VERSION (0xa000 bytes).
2026-05-28 20:22:10,934 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE0D0000: C:\Windows\System32\tdh (0x11b000 bytes).
2026-05-28 20:22:10,935 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:22:10,936 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE6180000: C:\Windows\System32\SAMCLI (0x19000 bytes).
2026-05-28 20:22:10,937 [root] DEBUG: 24800: DLL loaded at 0x00007FFE94460000: C:\Windows\System32\appraiser (0x212000 bytes).
2026-05-28 20:22:10,963 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:10,964 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:10,970 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:10,972 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:10,972 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:10,975 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:10,999 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\System32\logoncli (0x43000 bytes).
2026-05-28 20:22:11,000 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDA380000: C:\Windows\System32\utcutil (0x1f000 bytes).
2026-05-28 20:22:11,002 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 20:22:11,003 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:11,004 [root] DEBUG: 24800: DLL loaded at 0x00007FFE959C0000: C:\Windows\System32\dcntel (0xbf000 bytes).
2026-05-28 20:22:11,012 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEF080000: C:\Windows\SYSTEM32\wldp (0x2d000 bytes).
2026-05-28 20:22:11,015 [root] DEBUG: 24800: DLL loaded at 0x0000017E90810000: C:\Windows\System32\WDSCORE (0x43000 bytes).
2026-05-28 20:22:11,016 [root] DEBUG: 24800: DLL loaded at 0x00007FFEB6C10000: C:\Windows\System32\MSI (0x337000 bytes).
2026-05-28 20:22:11,017 [root] DEBUG: 24800: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\System32\NETAPI32 (0x19000 bytes).
2026-05-28 20:22:11,018 [root] DEBUG: 24800: DLL loaded at 0x00007FFED9040000: C:\Windows\System32\VERSION (0xa000 bytes).
2026-05-28 20:22:11,019 [root] DEBUG: 24800: DLL loaded at 0x00007FFEEE0D0000: C:\Windows\System32\tdh (0x11b000 bytes).
2026-05-28 20:22:11,019 [root] DEBUG: 24800: DLL loaded at 0x00007FFEF0250000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-28 20:22:11,020 [root] DEBUG: 24800: DLL loaded at 0x00007FFEE6180000: C:\Windows\System32\SAMCLI (0x19000 bytes).
2026-05-28 20:22:11,021 [root] DEBUG: 24800: DLL loaded at 0x00007FFE94460000: C:\Windows\System32\appraiser (0x212000 bytes).
2026-05-28 20:22:11,036 [root] DEBUG: 1212: CreateProcessHandler: Injection info set for new process 25408: C:\Windows\system32\taskhostw.exe, ImageBase: 0x00007FF753750000
2026-05-28 20:22:11,037 [root] INFO: Announced 64-bit process name: taskhostw.exe pid: 25408
2026-05-28 20:22:11,038 [lib.api.process] INFO: Monitor config for process 25408: C:\6lreqs2g\dll\25408.ini
2026-05-28 20:22:11,039 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:11,043 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:11,047 [root] DEBUG: Loader: Injecting process 25408 (thread 25424) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:11,048 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:11,049 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:11,051 [lib.api.process] INFO: Injected into 64-bit <Process 25408 taskhostw.exe>
2026-05-28 20:22:11,052 [root] INFO: Announced 64-bit process name: taskhostw.exe pid: 25408
2026-05-28 20:22:11,052 [lib.api.process] INFO: Monitor config for process 25408: C:\6lreqs2g\dll\25408.ini
2026-05-28 20:22:11,053 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:11,056 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:11,061 [root] DEBUG: Loader: Injecting process 25408 (thread 25424) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:11,062 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:11,063 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:11,064 [lib.api.process] INFO: Injected into 64-bit <Process 25408 taskhostw.exe>
2026-05-28 20:22:11,066 [root] INFO: Announced 64-bit process name: taskhostw.exe pid: 25408
2026-05-28 20:22:11,066 [lib.api.process] INFO: Monitor config for process 25408: C:\6lreqs2g\dll\25408.ini
2026-05-28 20:22:11,067 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:11,071 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:11,077 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 25408, handle 0xa14: C:\Windows\System32\taskhostw.exe
2026-05-28 20:22:11,080 [root] DEBUG: 22404: OpenProcessHandler: Image base for process 25408 (handle 0x794): 0x00007FF753750000.
2026-05-28 20:22:11,080 [root] DEBUG: Loader: Injecting process 25408 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:11,080 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 25628, handle 0x794: C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:11,082 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 25424, handle 0x120
2026-05-28 20:22:11,082 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:22:11,083 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:11,084 [lib.api.process] INFO: Injected into 64-bit <Process 25408 taskhostw.exe>
2026-05-28 20:22:11,093 [root] DEBUG: 25408: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:22:11,094 [root] DEBUG: 25408: Interactive desktop enabled.
2026-05-28 20:22:11,095 [root] DEBUG: 25408: Dropped file limit defaulting to 100.
2026-05-28 20:22:11,099 [root] DEBUG: 25408: Disabling sleep skipping.
2026-05-28 20:22:11,100 [root] DEBUG: 25408: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:22:11,110 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\1619d76e0f2788fa447cc2bbb24582ce82561fc482237ca16a50024e96ad899a; Size is 12824; Max size: 100000000
2026-05-28 20:22:11,113 [root] DEBUG: 25408: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:22:11,114 [root] DEBUG: 25408: YaraScan: Scanning 0x00007FF753750000, size 0x192fc
2026-05-28 20:22:11,117 [root] DEBUG: 25408: Monitor initialised: 64-bit capemon loaded in process 25408 at 0x00007FFEAF1A0000, thread 25424, image base 0x00007FF753750000, stack from 0x000000ABC9B34000-0x000000ABC9B40000
2026-05-28 20:22:11,118 [root] DEBUG: 25408: Commandline: taskhostw.exe
2026-05-28 20:22:11,130 [root] DEBUG: 25408: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:22:11,155 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:22:11,156 [root] DEBUG: 25408: set_hooks: Unable to hook LockResource
2026-05-28 20:22:11,161 [root] DEBUG: 25408: Hooked 627 out of 628 functions
2026-05-28 20:22:11,163 [root] DEBUG: 25408: Syscall hook installed, syscall logging level 1
2026-05-28 20:22:11,168 [root] DEBUG: 25408: RestoreHeaders: Restored original import table.
2026-05-28 20:22:11,169 [root] INFO: Loaded monitor into process with pid 25408
2026-05-28 20:22:11,171 [root] DEBUG: 25408: caller_dispatch: Added region at 0x00007FF753750000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF753755CA1, thread 25424).
2026-05-28 20:22:11,171 [root] DEBUG: 25408: YaraScan: Scanning 0x00007FF753750000, size 0x192fc
2026-05-28 20:22:11,173 [root] DEBUG: 25408: ProcessImageBase: Main module image at 0x00007FF753750000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:22:11,174 [root] DEBUG: 25408: DLL loaded at 0x00007FFEF1540000: C:\Windows\System32\imm32 (0x30000 bytes).
2026-05-28 20:22:11,177 [root] DEBUG: 25408: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:22:11,179 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:22:11,184 [root] DEBUG: 25408: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:22:11,188 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEFD0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 20:22:11,189 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDA3B0000: C:\Windows\System32\wosc (0x4e000 bytes).
2026-05-28 20:22:11,193 [root] DEBUG: 25408: DLL loaded at 0x00007FFED8B50000: C:\Windows\System32\FlightSettings (0xe6000 bytes).
2026-05-28 20:22:11,195 [root] DEBUG: 25408: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:22:11,196 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDDEA0000: C:\Windows\System32\Windows.Networking.Connectivity (0xb9000 bytes).
2026-05-28 20:22:11,204 [root] DEBUG: 25408: DLL loaded at 0x00007FFEE8E60000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-28 20:22:11,210 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEB550000: C:\Windows\System32\WinTypes (0x155000 bytes).
2026-05-28 20:22:11,213 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEAD0000: C:\Windows\System32\IPHLPAPI (0x3b000 bytes).
2026-05-28 20:22:11,214 [root] DEBUG: 25408: DLL loaded at 0x00007FFEF0990000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 20:22:11,217 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDD9D0000: C:\Windows\System32\dusmapi (0x11000 bytes).
2026-05-28 20:22:11,220 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF640000: C:\Windows\System32\profapi (0x25000 bytes).
2026-05-28 20:22:11,221 [root] DEBUG: 25408: DLL loaded at 0x00007FFEE4FE0000: C:\Windows\System32\Cabinet (0x29000 bytes).
2026-05-28 20:22:11,222 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF5C0000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-28 20:22:11,223 [root] DEBUG: 25408: DLL loaded at 0x00007FFEF0020000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 20:22:11,224 [root] DEBUG: 25408: DLL loaded at 0x00007FFED49C0000: C:\Windows\System32\UpdatePolicy (0x43000 bytes).
2026-05-28 20:22:11,225 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF210000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-05-28 20:22:11,230 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE7A0000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-05-28 20:22:11,230 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEA450000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 20:22:11,235 [root] DEBUG: 25408: DLL loaded at 0x00007FFEE4BE0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 20:22:11,236 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDEB40000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-28 20:22:11,268 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-28 20:22:11,269 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDA380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-28 20:22:11,279 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:22:11,280 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-28 20:22:11,282 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-28 20:22:11,283 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:11,284 [root] DEBUG: 25408: DLL loaded at 0x00007FFE959C0000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-28 20:22:11,285 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF550000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-28 20:22:11,288 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:11,290 [root] DEBUG: 25408: DLL loaded at 0x00007FFEE8480000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-28 20:22:11,296 [root] DEBUG: 25408: DLL loaded at 0x00007FFED5BD0000: C:\Windows\system32\fcon (0x45000 bytes).
2026-05-28 20:22:11,303 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE710000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 20:22:11,325 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-28 20:22:11,327 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDA380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-28 20:22:11,335 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:22:11,338 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-28 20:22:11,339 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-28 20:22:11,340 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:11,340 [root] DEBUG: 25408: DLL loaded at 0x00007FFE959C0000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-28 20:22:11,341 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF550000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-28 20:22:11,344 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDAF20000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-28 20:22:11,365 [root] DEBUG: 24800: api-cap: RegQueryValueExW hook disabled due to count: 5000
2026-05-28 20:22:11,393 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-28 20:22:11,395 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDA380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-28 20:22:11,454 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:22:11,455 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-28 20:22:11,456 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-28 20:22:11,457 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-28 20:22:11,458 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:11,458 [root] DEBUG: 25408: DLL loaded at 0x00007FFE959C0000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-28 20:22:11,460 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF550000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-28 20:22:11,462 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDA380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-28 20:22:11,494 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE220000: C:\Windows\SYSTEM32\sppc (0x25000 bytes).
2026-05-28 20:22:11,495 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE250000: C:\Windows\SYSTEM32\slc (0x29000 bytes).
2026-05-28 20:22:11,500 [root] DEBUG: 25408: api-rate-cap: ReadProcessMemory hook disabled due to rate
2026-05-28 20:22:11,504 [root] DEBUG: 25408: api-rate-cap: NtReadVirtualMemory hook disabled due to rate
2026-05-28 20:22:11,543 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\fc7449e6776a6fe105f5ceebe7fd345ee6311be07dfc4b0ac1b270fd49da7cd9; Size is 12824; Max size: 100000000
2026-05-28 20:22:11,563 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\2b88d558a3b8564f6147a2efaf398a3dbd2ee508b6151e54c388f3f3574daa59; Size is 12824; Max size: 100000000
2026-05-28 20:22:11,574 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDF9F0000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 20:22:11,575 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEB400000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 20:22:11,583 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF710000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 20:22:11,584 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF3D0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 20:22:11,584 [root] DEBUG: 25408: DLL loaded at 0x00007FFE95AF0000: C:\Windows\SYSTEM32\dmEnrollEngine (0xdf000 bytes).
2026-05-28 20:22:11,585 [root] DEBUG: 25408: DLL loaded at 0x00007FFED4C60000: C:\Windows\SYSTEM32\enrollmentapi (0x11000 bytes).
2026-05-28 20:22:11,596 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\820fc84f7282332a7ccf01ec15604ba0395f9523661416e33244fb4e0b2ba5aa; Size is 12824; Max size: 100000000
2026-05-28 20:22:11,611 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF570000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 20:22:11,611 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBF0000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-28 20:22:11,612 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEEBE0000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-28 20:22:11,612 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEA8B0000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-28 20:22:11,613 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:11,614 [root] DEBUG: 25408: DLL loaded at 0x00007FFE959C0000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-28 20:22:11,615 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEF550000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-28 20:22:11,617 [root] DEBUG: 25408: DLL loaded at 0x00007FFEDA380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-28 20:22:11,623 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\3c1e5ac49499d29860892e41e700f523648e2eae2a8c9aa84bdcb0235a69475e; Size is 12824; Max size: 100000000
2026-05-28 20:22:11,641 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEACF0000: C:\Windows\System32\taskschd (0xac000 bytes).
2026-05-28 20:22:11,644 [root] DEBUG: 25408: DLL loaded at 0x00007FFEEB240000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 20:22:11,648 [root] DEBUG: 25408: DLL loaded at 0x00007FFED8C40000: C:\Windows\SYSTEM32\dmiso8601utils (0x9000 bytes).
2026-05-28 20:22:11,683 [root] DEBUG: 25408: NtTerminateProcess hook: Attempting to dump process 25408
2026-05-28 20:22:11,684 [root] DEBUG: 25408: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:11,692 [root] INFO: Process with pid 25408 has terminated
2026-05-28 20:22:11,696 [root] INFO: Process with pid 25408 has terminated
2026-05-28 20:22:11,821 [root] DEBUG: 24800: api-cap: RegOpenKeyExW hook disabled due to count: 5000
2026-05-28 20:22:11,927 [root] DEBUG: 24800: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5000
2026-05-28 20:22:11,997 [root] DEBUG: 9652: api-rate-cap: LdrpCallInitRoutine hook disabled due to rate
2026-05-28 20:22:12,081 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\a5afc739c6a6a7f1044be73dbd9ece8caf2dd793d466a273fcf5a1a285f8acac; Size is 8720; Max size: 100000000
2026-05-28 20:22:12,108 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\c1a86180b989f0fbc3aba4abf6ca56bc9574a831c275e9dcda6b0459e6cb3fb2; Size is 8720; Max size: 100000000
2026-05-28 20:22:12,175 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\302d37253af1f3136bc57c0fec59365911616fc2bd96e29e9e8312cc51896fb5; Size is 8720; Max size: 100000000
2026-05-28 20:22:12,202 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\91e12d691a621b32446def195c230053af5d86398ba97b247f8fe83ff2724e42; Size is 8720; Max size: 100000000
2026-05-28 20:22:12,238 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\1f515aeae0fce122ede1bdcf4d668723838d40953ab25a920e8281b84ff42c39; Size is 8720; Max size: 100000000
2026-05-28 20:22:12,288 [root] DEBUG: 24800: api-rate-cap: NtReadFile hook disabled due to rate
2026-05-28 20:22:12,308 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db-journal to files\ba04f5b5da4303d421f0db0f8e15089034663b98d686b552f1a2a54def9b51fd; Size is 12824; Max size: 100000000
2026-05-28 20:22:20,076 [root] DEBUG: 22404: api-cap: NtClose hook disabled due to count: 5000
2026-05-28 20:22:28,874 [root] DEBUG: 4372: DLL loaded at 0x00007FFEEC890000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 20:22:28,875 [root] DEBUG: 4372: DLL loaded at 0x00007FFEEC890000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 20:22:28,880 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 26336: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF623BE0000
2026-05-28 20:22:28,881 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 26336
2026-05-28 20:22:28,881 [lib.api.process] INFO: Monitor config for process 26336: C:\6lreqs2g\dll\26336.ini
2026-05-28 20:22:28,882 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:28,885 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:28,892 [root] DEBUG: Loader: Injecting process 26336 (thread 26340) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:28,893 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:28,893 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:28,895 [lib.api.process] INFO: Injected into 64-bit <Process 26336 SecurityHealthHost.exe>
2026-05-28 20:22:28,897 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 26336
2026-05-28 20:22:28,899 [lib.api.process] INFO: Monitor config for process 26336: C:\6lreqs2g\dll\26336.ini
2026-05-28 20:22:28,900 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:28,904 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:28,908 [root] DEBUG: Loader: Injecting process 26336 (thread 26340) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:28,909 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:22:28,910 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:28,911 [lib.api.process] INFO: Injected into 64-bit <Process 26336 SecurityHealthHost.exe>
2026-05-28 20:22:28,918 [root] DEBUG: 26336: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 20:22:28,919 [root] DEBUG: 26336: Interactive desktop enabled.
2026-05-28 20:22:28,920 [root] DEBUG: 26336: Dropped file limit defaulting to 100.
2026-05-28 20:22:28,922 [root] DEBUG: 26336: Disabling sleep skipping.
2026-05-28 20:22:28,924 [root] DEBUG: 26336: YaraInit: Compiled rules loaded from existing file C:\6lreqs2g\data\yara\capemon.yac
2026-05-28 20:22:28,936 [root] DEBUG: 26336: RtlInsertInvertedFunctionTable 0x00007FFEF204090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEF219D4F0
2026-05-28 20:22:28,937 [root] DEBUG: 26336: YaraScan: Scanning 0x00007FF623BE0000, size 0x19174
2026-05-28 20:22:28,938 [root] DEBUG: 26336: Monitor initialised: 64-bit capemon loaded in process 26336 at 0x00007FFEAF1A0000, thread 26340, image base 0x00007FF623BE0000, stack from 0x000000EAA6BC4000-0x000000EAA6BD0000
2026-05-28 20:22:28,939 [root] DEBUG: 26336: Commandline: C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
2026-05-28 20:22:28,949 [root] DEBUG: 26336: hook_api: LdrpCallInitRoutine export address 0x00007FFEF20499BC obtained via GetFunctionAddress
2026-05-28 20:22:28,971 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 20:22:28,972 [root] DEBUG: 26336: set_hooks: Unable to hook LockResource
2026-05-28 20:22:28,977 [root] DEBUG: 26336: Hooked 627 out of 628 functions
2026-05-28 20:22:28,979 [root] DEBUG: 26336: Syscall hook installed, syscall logging level 1
2026-05-28 20:22:28,983 [root] DEBUG: 26336: RestoreHeaders: Restored original import table.
2026-05-28 20:22:28,985 [root] INFO: Loaded monitor into process with pid 26336
2026-05-28 20:22:28,985 [root] DEBUG: 26336: caller_dispatch: Added region at 0x00007FF623BE0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF623BED3B2, thread 26340).
2026-05-28 20:22:28,986 [root] DEBUG: 26336: YaraScan: Scanning 0x00007FF623BE0000, size 0x19174
2026-05-28 20:22:28,988 [root] DEBUG: 26336: ProcessImageBase: Main module image at 0x00007FF623BE0000 unmodified (entropy change 0.000000e+00)
2026-05-28 20:22:28,991 [root] DEBUG: 26336: DLL loaded at 0x00007FFEED5F0000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 20:22:28,993 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEFEE0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 20:22:28,995 [root] DEBUG: 26336: DLL loaded at 0x00007FFEF0740000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 20:22:29,010 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEF080000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-28 20:22:29,011 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEE830000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 20:22:29,013 [root] DEBUG: 26336: DLL loaded at 0x000001EEA1DF0000: C:\Windows\system32\SecurityHealthAgent (0x6d000 bytes).
2026-05-28 20:22:29,026 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEC890000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 20:22:29,030 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEAA90000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2026-05-28 20:22:29,035 [root] DEBUG: 26336: DLL loaded at 0x00007FFEF0190000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 20:22:29,036 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEB550000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 20:22:29,037 [root] DEBUG: 26336: DLL loaded at 0x00007FFEED4F0000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 20:22:29,037 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEB240000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 20:22:29,039 [root] DEBUG: 26336: DLL loaded at 0x00007FFEE94D0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 20:22:29,040 [root] DEBUG: 26336: DLL loaded at 0x00007FFEDA690000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 20:22:29,043 [root] DEBUG: 26336: DLL loaded at 0x00007FFEEADA0000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 20:22:29,051 [root] DEBUG: 26336: DLL loaded at 0x00007FFEE7C90000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 20:22:29,059 [root] DEBUG: 26336: DLL loaded at 0x00007FFED5C90000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-28 20:22:29,074 [root] DEBUG: 4372: AllocationHandler: Adding allocation to tracked region list: 0x00007DF49C5C1000, size: 0x1000.
2026-05-28 20:22:29,077 [root] DEBUG: 4372: AllocationHandler: Adding allocation to tracked region list: 0x00007DF49C5B1000, size: 0x1000.
2026-05-28 20:22:29,079 [root] DEBUG: 4372: FreeHandler: Address: 0x00007DF49C5B0000.
2026-05-28 20:22:29,079 [root] DEBUG: 4372: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:22:29,082 [root] DEBUG: 4372: FreeHandler: Address: 0x00007DF49C5C0000.
2026-05-28 20:22:29,082 [root] DEBUG: 4372: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:22:29,093 [root] DEBUG: 4372: AllocationHandler: Allocation already in tracked region list: 0x00007DF49C5C0000.
2026-05-28 20:22:29,096 [root] DEBUG: 4372: FreeHandler: Address: 0x00007DF49C5B0000.
2026-05-28 20:22:29,097 [root] DEBUG: 4372: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:22:29,098 [root] DEBUG: 26336: NtTerminateProcess hook: Attempting to dump process 26336
2026-05-28 20:22:29,100 [root] DEBUG: 26336: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:29,100 [root] DEBUG: 4372: FreeHandler: Address: 0x00007DF49C5C0000.
2026-05-28 20:22:29,101 [root] DEBUG: 4372: ScanForNonZero: Error - Supplied size zero.
2026-05-28 20:22:29,108 [root] INFO: Process with pid 26336 has terminated
2026-05-28 20:22:29,115 [root] DEBUG: 848: CreateProcessHandler: Injection info set for new process 26244: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF648C80000
2026-05-28 20:22:29,116 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 26244
2026-05-28 20:22:29,117 [lib.api.process] INFO: Monitor config for process 26244: C:\6lreqs2g\dll\26244.ini
2026-05-28 20:22:29,117 [root] DEBUG: 4372: api-cap: NtSetInformationThread hook disabled due to count: 5000
2026-05-28 20:22:29,118 [root] DEBUG: 4372: api-cap: NtSetInformationThread hook disabled due to count: 5001
2026-05-28 20:22:29,120 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:29,122 [root] DEBUG: 22404: OpenProcessHandler: Injection info created for process 26244, handle 0xaf0: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
2026-05-28 20:22:30,298 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:30,303 [root] DEBUG: Loader: Injecting process 26244 (thread 26248) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:30,304 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:30,305 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:30,307 [lib.api.process] INFO: Injected into 64-bit <Process 26244 ShellExperienceHost.exe>
2026-05-28 20:22:30,308 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 26244
2026-05-28 20:22:30,308 [lib.api.process] INFO: Monitor config for process 26244: C:\6lreqs2g\dll\26244.ini
2026-05-28 20:22:30,309 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:31,400 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:31,405 [root] DEBUG: Loader: Injecting process 26244 (thread 26248) with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:31,406 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 20:22:31,407 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:31,408 [lib.api.process] INFO: Injected into 64-bit <Process 26244 ShellExperienceHost.exe>
2026-05-28 20:22:31,410 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 26244
2026-05-28 20:22:31,410 [lib.api.process] INFO: Monitor config for process 26244: C:\6lreqs2g\dll\26244.ini
2026-05-28 20:22:31,411 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 20:22:32,454 [lib.api.process] INFO: 64-bit DLL to inject is C:\6lreqs2g\dll\RafcrS.dll, loader C:\6lreqs2g\bin\DCBuQsig.exe
2026-05-28 20:22:32,460 [root] DEBUG: Loader: Injecting process 26244 with C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:32,461 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 26248, handle 0x120
2026-05-28 20:22:32,462 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 20:22:32,463 [root] DEBUG: Successfully injected DLL C:\6lreqs2g\dll\RafcrS.dll.
2026-05-28 20:22:32,465 [lib.api.process] INFO: Injected into 64-bit <Process 26244 ShellExperienceHost.exe>
2026-05-28 20:22:55,807 [root] INFO: Analysis timeout hit, terminating analysis
2026-05-28 20:22:55,808 [lib.api.process] INFO: Terminate event set for process 1144
2026-05-28 20:22:55,808 [root] DEBUG: 1144: Terminate Event: Attempting to dump process 1144
2026-05-28 20:22:55,811 [root] DEBUG: 1144: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:55,824 [lib.api.process] INFO: Termination confirmed for process 1144
2026-05-28 20:22:55,825 [root] INFO: Terminate event set for process 1144
2026-05-28 20:22:55,824 [root] DEBUG: 1144: Terminate Event: monitor shutdown complete for process 1144
2026-05-28 20:22:55,826 [lib.api.process] INFO: Terminate event set for process 848
2026-05-28 20:22:55,826 [root] DEBUG: 848: Terminate Event: Attempting to dump process 848
2026-05-28 20:22:55,827 [root] DEBUG: 848: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:55,832 [lib.api.process] INFO: Termination confirmed for process 848
2026-05-28 20:22:55,832 [root] DEBUG: 848: Terminate Event: monitor shutdown complete for process 848
2026-05-28 20:22:55,832 [root] INFO: Terminate event set for process 848
2026-05-28 20:22:55,833 [lib.api.process] INFO: Terminate event set for process 9652
2026-05-28 20:22:55,834 [root] DEBUG: 9652: Terminate Event: Attempting to dump process 9652
2026-05-28 20:22:55,835 [root] DEBUG: 9652: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:55,841 [root] DEBUG: 9652: ReverseScanForNonZero: Error - Supplied size zero.
2026-05-28 20:22:55,842 [root] DEBUG: 9652: GetPageAddress: Error - Supplied address zero.
2026-05-28 20:22:55,843 [lib.api.process] INFO: Termination confirmed for process 9652
2026-05-28 20:22:55,843 [root] DEBUG: 9652: Terminate Event: monitor shutdown complete for process 9652
2026-05-28 20:22:55,843 [root] INFO: Terminate event set for process 9652
2026-05-28 20:22:55,844 [lib.api.process] INFO: Terminate event set for process 4372
2026-05-28 20:22:55,844 [root] DEBUG: 4372: Terminate Event: Attempting to dump process 4372
2026-05-28 20:22:55,848 [root] DEBUG: 4372: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:55,864 [root] DEBUG: 4372: ReverseScanForNonZero: Error - Supplied size zero.
2026-05-28 20:22:55,864 [root] DEBUG: 4372: GetPageAddress: Error - Supplied address zero.
2026-05-28 20:22:55,865 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
2026-05-28 20:22:55,870 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
2026-05-28 20:22:55,873 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2026-05-28 20:22:55,875 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
2026-05-28 20:22:55,884 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
2026-05-28 20:22:55,887 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\Downloads\InstallBC201401.exe
2026-05-28 20:22:55,896 [root] INFO: Added new file to list with pid 4372 and path C:\Users\admin\AppData\Local\Discord\app.ico
2026-05-28 20:22:55,926 [root] DEBUG: 4372: Dropped file limit reached.
2026-05-28 20:22:55,927 [lib.api.process] INFO: Termination confirmed for process 4372
2026-05-28 20:22:55,927 [root] DEBUG: 4372: Terminate Event: monitor shutdown complete for process 4372
2026-05-28 20:22:55,927 [root] INFO: Terminate event set for process 4372
2026-05-28 20:22:55,928 [lib.api.process] INFO: Terminate event set for process 11696
2026-05-28 20:22:55,929 [root] DEBUG: 11696: Terminate Event: Attempting to dump process 11696
2026-05-28 20:22:55,930 [root] DEBUG: 11696: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:22:55,932 [root] DEBUG: 11696: Terminate Event: Shutdown complete for process 11696 but failed to inform analyzer.
2026-05-28 20:23:00,916 [lib.api.process] INFO: Termination confirmed for process 11696
2026-05-28 20:23:00,917 [root] INFO: Terminate event set for process 11696
2026-05-28 20:23:00,918 [root] DEBUG: 4080: Terminate Event: Attempting to dump process 4080
2026-05-28 20:23:00,918 [lib.api.process] INFO: Terminate event set for process 4080
2026-05-28 20:23:00,918 [root] DEBUG: 4080: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:23:00,920 [root] DEBUG: 4080: Terminate Event: monitor shutdown complete for process 4080
2026-05-28 20:23:00,920 [lib.api.process] INFO: Termination confirmed for process 4080
2026-05-28 20:23:00,921 [root] INFO: Terminate event set for process 4080
2026-05-28 20:23:00,921 [lib.api.process] INFO: Terminate event set for process 22404
2026-05-28 20:23:00,923 [root] DEBUG: 22404: Terminate Event: Attempting to dump process 22404
2026-05-28 20:23:00,925 [root] DEBUG: 22404: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:23:00,938 [lib.api.process] INFO: Termination confirmed for process 22404
2026-05-28 20:23:00,938 [root] INFO: Terminate event set for process 22404
2026-05-28 20:23:00,939 [root] DEBUG: 22404: Terminate Event: monitor shutdown complete for process 22404
2026-05-28 20:23:00,939 [lib.api.process] INFO: Terminate event set for process 24800
2026-05-28 20:23:00,940 [root] DEBUG: 24800: Terminate Event: Attempting to dump process 24800
2026-05-28 20:23:00,941 [root] DEBUG: 24800: VerifyCodeSection: Exception rebasing image from 0x00007FF6D0370000 to 0x0000000140000000.
2026-05-28 20:23:00,942 [root] DEBUG: 24800: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:23:00,953 [root] INFO: Added new file to list with pid 24800 and path C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.45b4e0ab-d3bf-4c02-be0a-c1a55cea80c3.2.etl
2026-05-28 20:23:00,954 [root] INFO: Added new file to list with pid 24800 and path C:\ProgramData\USOPrivate\UpdateStore\store.db
2026-05-28 20:23:00,955 [root] INFO: Added new file to list with pid 24800 and path C:\ProgramData\USOShared\Logs\System\WuProvider.43fc724e-bae1-4bc0-873c-485c9d9665b9.1.etl
2026-05-28 20:23:00,956 [root] INFO: Added new file to list with pid 24800 and path C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.45b4e0ab-d3bf-4c02-be0a-c1a55cea80c3.1.etl
2026-05-28 20:23:00,957 [lib.api.process] INFO: Termination confirmed for process 24800
2026-05-28 20:23:00,957 [root] INFO: Terminate event set for process 24800
2026-05-28 20:23:00,957 [root] DEBUG: 24800: Terminate Event: monitor shutdown complete for process 24800
2026-05-28 20:23:00,958 [lib.api.process] INFO: Terminate event set for process 1212
2026-05-28 20:23:00,958 [root] DEBUG: 1212: Terminate Event: Attempting to dump process 1212
2026-05-28 20:23:00,960 [root] DEBUG: 1212: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 20:23:00,962 [root] INFO: Added new file to list with pid 1212 and path C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask
2026-05-28 20:23:00,965 [root] INFO: Added new file to list with pid 1212 and path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan
2026-05-28 20:23:00,968 [root] INFO: Added new file to list with pid 1212 and path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
2026-05-28 20:23:00,972 [root] INFO: Added new file to list with pid 1212 and path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
2026-05-28 20:23:00,975 [root] INFO: Added new file to list with pid 1212 and path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
2026-05-28 20:23:00,982 [root] INFO: Added new file to list with pid 1212 and path C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache
2026-05-28 20:23:01,023 [lib.api.process] INFO: Termination confirmed for process 1212
2026-05-28 20:23:01,024 [root] INFO: Terminate event set for process 1212
2026-05-28 20:23:01,024 [root] INFO: Created shutdown mutex
2026-05-28 20:23:01,025 [root] DEBUG: 1212: Terminate Event: monitor shutdown complete for process 1212
2026-05-28 20:23:02,026 [root] INFO: Shutting down package
2026-05-28 20:23:02,027 [root] INFO: Stopping auxiliary modules
2026-05-28 20:23:02,027 [root] INFO: Stopping auxiliary module: Browser
2026-05-28 20:23:02,028 [root] INFO: Stopping auxiliary module: Human
2026-05-28 20:23:02,028 [root] INFO: Stopping auxiliary module: Screenshots
2026-05-28 20:23:02,029 [root] INFO: Finishing auxiliary modules
2026-05-28 20:23:02,029 [root] INFO: Shutting down pipe server and dumping dropped files
2026-05-28 20:23:02,031 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db to files\dfb29c5939881d30755fe81a53c05b434b69634ae87539cd92bf663f21abb4c6; Size is 58320; Max size: 100000000
2026-05-28 20:23:02,035 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Artemis.lnk to files\62ec6e92f672761eed20bbcf37e232f8fb4d21c3f637f0c090575d888a6f80a0; Size is 582; Max size: 100000000
2026-05-28 20:23:02,039 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms to files\309433cfa3511d845cbb219cc7bfaf11e2e002002d1080805f697868ec242fc3; Size is 4608; Max size: 100000000
2026-05-28 20:23:02,048 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db to files\f2a5da84c2e31e3e5e3095c051dbc55dbc1839467f5d01647d7ad794c8c9184f; Size is 1048576; Max size: 100000000
2026-05-28 20:23:02,055 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db to files\6ce93836fbbd9fce7e3259707133cc769c5832ce7d72c54a22ccea50248bb9ba; Size is 1048576; Max size: 100000000
2026-05-28 20:23:02,063 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db to files\b749a7ef60d7fee33f9f2676a005e79db40441224499494fc75558a89d1d1cea; Size is 1048576; Max size: 100000000
2026-05-28 20:23:02,069 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db to files\89a57fb3b10bf21cf067614713a4ba4166e3c41beb86729375152e0a6b399403; Size is 14688; Max size: 100000000
2026-05-28 20:23:02,075 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db to files\b02ec916d941aa9bd471d898682d7ecd34b7b4b2f22508a3942bbe02b43bf3c5; Size is 1048576; Max size: 100000000
2026-05-28 20:23:02,083 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db to files\5500253f04c2e50abc6c054122963ff9a2ee5318954d7d2dbb8c0d05b9b0b5a3; Size is 1048576; Max size: 100000000
2026-05-28 20:23:02,099 [lib.common.results] INFO: Uploading file C:\Users\admin\Downloads\InstallBC201401.exe to files\834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc; Size is 13370880; Max size: 100000000
2026-05-28 20:23:02,120 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Discord\app.ico to files\dfcea1bea8a924252d507d0316d8cf38efc61cf1314e47dca3eb723f47d5fe43; Size is 285478; Max size: 100000000
2026-05-28 20:23:02,124 [lib.common.results] INFO: Uploading file C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.45b4e0ab-d3bf-4c02-be0a-c1a55cea80c3.2.etl to files\14a51bd7c3ebfa6e0d6fbcab55266fdfc066b6aadb409368f5b8601eada69213; Size is 49152; Max size: 100000000
2026-05-28 20:23:02,153 [lib.common.results] INFO: Uploading file C:\ProgramData\USOPrivate\UpdateStore\store.db to files\fd2efb8d74e9f1d916db74a20a9b035ef15469f87f35faea23934a96c9a004dc; Size is 8138752; Max size: 100000000
2026-05-28 20:23:02,166 [lib.common.results] INFO: Uploading file C:\ProgramData\USOShared\Logs\System\WuProvider.43fc724e-bae1-4bc0-873c-485c9d9665b9.1.etl to files\191a210778f40eddd57f79d056049de3fe6be39e11d2f4ca657181f280200fa3; Size is 4096; Max size: 100000000
2026-05-28 20:23:02,172 [lib.common.results] INFO: Uploading file C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.45b4e0ab-d3bf-4c02-be0a-c1a55cea80c3.1.etl to files\5e0c934f9ad6b05dd626c00bdb11e60ec7d5a972695748f5550e4b94f855281f; Size is 77824; Max size: 100000000
2026-05-28 20:23:02,176 [lib.common.results] INFO: Uploading file C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask to files\1c6061db793514ab6706d0934841b2c15d91f0fbfe24b4d7ba60c0acc02d40c4; Size is 4680; Max size: 100000000
2026-05-28 20:23:02,182 [lib.common.results] INFO: Uploading file C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan to files\d187ca4c3758d723e7ffd57caca626b41015d0ab98c46d4551eb1281b03399f1; Size is 3990; Max size: 100000000
2026-05-28 20:23:02,186 [lib.common.results] INFO: Uploading file C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work to files\dff8902430dcae2fba05fc7f54157c4bc8a7445ed488c1d5727947a0c07075d6; Size is 3116; Max size: 100000000
2026-05-28 20:23:02,190 [lib.common.results] INFO: Uploading file C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work to files\acade97e8a1d30477d0dc3fdfea70c2c617c369b56115ec708ed8a2cfdbc3692; Size is 3086; Max size: 100000000
2026-05-28 20:23:02,196 [lib.common.results] INFO: Uploading file C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work to files\7eb93e43c5ef0fb8b073d6b11245e32c45c9e723e8da3fdcd9f49b6b5f475882; Size is 3358; Max size: 100000000
2026-05-28 20:23:02,200 [lib.common.results] INFO: Uploading file C:\Windows\System32\Tasks\Microsoft\Windows\Flighting\OneSettings\RefreshCache to files\975690194bff20642a0ba536ce1a99ad1cc8dc0ad2b2c4f824c7923204aee6cc; Size is 4482; Max size: 100000000
2026-05-28 20:23:02,203 [root] WARNING: Folder at path "C:\wqmrdiqI\debugger" does not exist, skipping
2026-05-28 20:23:02,203 [root] WARNING: Folder at path "C:\wqmrdiqI\tlsdump" does not exist, skipping
2026-05-28 20:23:02,894 [root] WARNING: Monitor injection attempted but failed for process 4516
2026-05-28 20:23:02,896 [root] WARNING: Monitor injection attempted but failed for process 9708
2026-05-28 20:23:02,896 [root] WARNING: Monitor injection attempted but failed for process 7468
2026-05-28 20:23:02,896 [root] WARNING: Monitor injection attempted but failed for process 26244
2026-05-28 20:23:02,897 [root] INFO: Analysis completed

Process Log

Pre-Script Log

During-Script Log