Options

interactive=1
nohuman=yes
vnc_port=5910

Analysis Log

2026-05-28 20:55:31,042 [root] INFO: Date set to: 20260529T05:23:56, timeout set to: 200
2026-05-29 05:23:56,011 [root] DEBUG: Starting analyzer from: C:\lpw_albt
2026-05-29 05:23:56,012 [root] DEBUG: Storing results at: C:\EsskdWmsyS
2026-05-29 05:23:56,012 [root] DEBUG: Pipe server name: \\.\PIPE\HICbhmaojK
2026-05-29 05:23:56,012 [root] DEBUG: Python path: C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64
2026-05-29 05:23:56,012 [root] INFO: analysis running as an admin
2026-05-29 05:23:56,012 [root] INFO: analysis package specified: "edge"
2026-05-29 05:23:56,012 [root] DEBUG: importing analysis package module: "modules.packages.edge"...
2026-05-29 05:23:56,018 [root] DEBUG: imported analysis package "edge"
2026-05-29 05:23:56,019 [root] DEBUG: initializing analysis package "edge"...
2026-05-29 05:23:56,019 [root] DEBUG: New location of moved file: g
2026-05-29 05:23:56,019 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option
2026-05-29 05:23:56,020 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option
2026-05-29 05:23:56,020 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option
2026-05-29 05:23:56,020 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option
2026-05-29 05:23:56,101 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-05-29 05:23:56,173 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-05-29 05:23:56,195 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-05-29 05:23:56,214 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-05-29 05:23:56,218 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-05-29 05:23:56,220 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-05-29 05:23:56,221 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-05-29 05:23:56,223 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-05-29 05:23:56,223 [root] DEBUG: Initialized auxiliary module "Browser"
2026-05-29 05:23:56,224 [root] DEBUG: attempting to configure 'Browser' from data
2026-05-29 05:23:56,224 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-05-29 05:23:56,224 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-05-29 05:23:56,225 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-05-29 05:23:56,225 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-05-29 05:23:56,225 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-05-29 05:23:56,226 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-05-29 05:23:56,226 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-05-29 05:23:56,226 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file
2026-05-29 05:23:56,226 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-05-29 05:23:56,227 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-05-29 05:23:56,227 [root] DEBUG: attempting to configure 'Disguise' from data
2026-05-29 05:23:56,227 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-05-29 05:23:56,228 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-05-29 05:23:56,241 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 844)
2026-05-29 05:23:56,242 [modules.auxiliary.disguise] INFO: Disguising GUID to 80438ff8-63a5-4e06-b69a-a7d9e7479144
2026-05-29 05:23:56,242 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-05-29 05:23:56,243 [root] DEBUG: Initialized auxiliary module "Human"
2026-05-29 05:23:56,244 [root] DEBUG: attempting to configure 'Human' from data
2026-05-29 05:23:56,245 [root] DEBUG: module Human does not support data configuration, ignoring
2026-05-29 05:23:56,245 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-05-29 05:23:56,246 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-05-29 05:23:56,247 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-05-29 05:23:56,247 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-05-29 05:23:56,247 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-05-29 05:23:56,247 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-05-29 05:23:56,248 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2026-05-29 05:23:56,248 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-05-29 05:23:56,248 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-05-29 05:23:56,248 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-05-29 05:23:56,248 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-05-29 05:23:56,248 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-05-29 05:23:56,252 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-05-29 05:23:56,253 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-05-29 05:23:56,253 [root] INFO: Interactive mode enabled - injecting into explorer shell
2026-05-29 05:23:56,387 [lib.api.process] INFO: Monitor config for process 4484: C:\lpw_albt\dll\4484.ini
2026-05-29 05:23:56,389 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 05:23:56,393 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-29 05:23:56,439 [root] DEBUG: Loader: Injecting process 4484 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-29 05:23:56,610 [root] DEBUG: 4484: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 05:23:56,613 [root] DEBUG: 4484: Disabling sleep skipping.
2026-05-29 05:23:56,615 [root] DEBUG: 4484: Interactive desktop enabled.
2026-05-29 05:23:56,616 [root] DEBUG: 4484: Dropped file limit defaulting to 100.
2026-05-29 05:23:56,617 [root] DEBUG: 4484: Interactive desktop - injecting Explorer Shell
2026-05-29 05:23:56,626 [root] DEBUG: 4484: YaraInit: Compiled 44 rule files
2026-05-29 05:23:56,629 [root] DEBUG: 4484: YaraInit: Compiled rules saved to file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 05:23:56,684 [root] DEBUG: 4484: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 05:23:56,687 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316
2026-05-29 05:23:56,765 [root] DEBUG: 4484: Monitor initialised: 64-bit capemon loaded in process 4484 at 0x00007FFF17B10000, thread 6608, image base 0x00007FF79BC10000, stack from 0x0000000009051000-0x0000000009060000
2026-05-29 05:23:56,767 [root] DEBUG: 4484: Commandline: C:\Windows\Explorer.EXE
2026-05-29 05:23:56,781 [root] DEBUG: 4484: Hooked 69 out of 69 functions
2026-05-29 05:23:56,815 [root] DEBUG: 4484: Syscall hook installed, syscall logging level 1
2026-05-29 05:23:56,825 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-29 05:23:56,827 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-29 05:23:56,828 [lib.api.process] INFO: Injected into 64-bit <Process 4484 explorer.exe>
2026-05-29 05:23:57,245 [root] DEBUG: 4484: caller_dispatch: Added region at 0x00007FF79BC10000 to tracked regions list (ntdll::NtCreateFile returns to 0x00007FF79BD27BE7, thread 4696).
2026-05-29 05:23:57,246 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316
2026-05-29 05:23:57,285 [root] DEBUG: 4484: ProcessImageBase: Main module image at 0x00007FF79BC10000 unmodified (entropy change 0.000000e+00)
2026-05-29 05:24:03,973 [root] INFO: Restarting WMI Service
2026-05-29 05:24:03,981 [root] DEBUG: package modules.packages.edge does not support configure, ignoring
2026-05-29 05:24:03,982 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'
2026-05-29 05:24:03,982 [lib.core.compound] INFO: C:\Users\admin\AppData\Local\Temp already exists, skipping creation
2026-05-29 05:24:03,983 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" with arguments ""g"" with pid 8412
2026-05-29 05:24:03,983 [lib.api.process] INFO: Monitor config for process 8412: C:\lpw_albt\dll\8412.ini
2026-05-29 05:24:03,984 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 05:24:03,986 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-29 05:24:03,990 [root] DEBUG: Loader: Injecting process 8412 (thread 8244) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-29 05:24:03,990 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 05:24:03,991 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-29 05:24:03,992 [lib.api.process] INFO: Injected into 64-bit <Process 8412 msedge.exe>
2026-05-29 05:24:06,008 [lib.api.process] INFO: Successfully resumed process with pid 8412
2026-05-29 05:24:06,053 [root] DEBUG: 8412: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 05:24:06,054 [root] DEBUG: 8412: Interactive desktop enabled.
2026-05-29 05:24:06,054 [root] DEBUG: 8412: Dropped file limit defaulting to 100.
2026-05-29 05:24:06,065 [root] DEBUG: 8412: Edge-specific hook-set enabled.
2026-05-29 05:24:06,067 [root] DEBUG: 8412: Disabling sleep skipping.
2026-05-29 05:24:06,068 [root] DEBUG: 8412: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 05:24:06,080 [root] DEBUG: 8412: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 05:24:06,081 [root] DEBUG: 8412: Monitor initialised: 64-bit capemon loaded in process 8412 at 0x00007FFF17B10000, thread 8244, image base 0x00007FF7F5380000, stack from 0x000000548D3F4000-0x000000548D400000
2026-05-29 05:24:06,081 [root] DEBUG: 8412: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "g"
2026-05-29 05:24:06,092 [root] DEBUG: 8412: Hooked 2 out of 2 functions
2026-05-29 05:24:06,146 [root] DEBUG: 8412: Syscall hook installed, syscall logging level 1
2026-05-29 05:24:06,151 [root] DEBUG: 8412: RestoreHeaders: Restored original import table.
2026-05-29 05:24:06,152 [root] INFO: Loaded monitor into process with pid 8412
2026-05-29 05:24:06,160 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-29 05:24:06,168 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43500000: C:\Windows\SYSTEM32\version (0xa000 bytes).
2026-05-29 05:24:06,169 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 05:24:06,170 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-29 05:24:06,171 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-29 05:24:06,172 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-29 05:24:06,173 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 05:24:06,320 [root] DEBUG: 8412: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-29 05:24:06,323 [root] DEBUG: 8412: DLL loaded at 0x00007FFEFE540000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-29 05:24:06,331 [root] DEBUG: 8412: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-29 05:24:06,340 [root] DEBUG: 8412: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-29 05:24:06,350 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-29 05:24:06,351 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 408: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:06,351 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-29 05:24:06,353 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 408
2026-05-29 05:24:06,353 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 408
2026-05-29 05:24:06,354 [root] DEBUG: 8412: DLL loaded at 0x00007FFF186F0000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-29 05:24:06,355 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 05:24:06,355 [root] DEBUG: 8412: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 05:24:06,360 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-29 05:24:06,361 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-29 05:24:06,362 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-29 05:24:06,363 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-29 05:24:06,363 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 05:24:06,364 [root] DEBUG: 8412: DLL loaded at 0x00007FFF16930000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-29 05:24:06,365 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 05:24:06,366 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-29 05:24:06,366 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-29 05:24:06,367 [root] DEBUG: 8412: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 05:24:06,369 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-29 05:24:06,370 [root] DEBUG: 8412: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-29 05:24:06,371 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3F6A0000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-29 05:24:06,371 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-29 05:24:06,372 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-29 05:24:06,374 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-29 05:24:06,375 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 05:24:06,375 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-29 05:24:06,376 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-29 05:24:06,378 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-29 05:24:06,406 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CFA0000: C:\Windows\System32\AssignedAccessRuntime (0x14000 bytes).
2026-05-29 05:24:06,408 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-29 05:24:06,409 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4D3D0000: C:\Windows\System32\SystemSettings.DataModel (0x74000 bytes).
2026-05-29 05:24:06,409 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 05:24:06,410 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-29 05:24:06,411 [root] DEBUG: 8412: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-29 05:24:06,414 [root] DEBUG: 8412: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-29 05:24:06,415 [root] DEBUG: 8412: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-29 05:24:06,416 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-29 05:24:06,419 [root] DEBUG: 8412: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-29 05:24:06,420 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-29 05:24:06,423 [root] DEBUG: 8412: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-29 05:24:06,424 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-29 05:24:06,426 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4B070000: C:\Windows\System32\StructuredQuery (0xa6000 bytes).
2026-05-29 05:24:06,429 [root] DEBUG: 8412: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-29 05:24:06,433 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52860000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-05-29 05:24:06,435 [root] DEBUG: 8412: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-29 05:24:06,437 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-29 05:24:06,439 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CBF0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-29 05:24:06,445 [root] DEBUG: 8412: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-29 05:24:06,447 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-29 05:24:06,447 [root] DEBUG: 8412: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-29 05:24:06,448 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-29 05:24:06,449 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CD70000: C:\Windows\system32\Windows.Storage.Search (0xc6000 bytes).
2026-05-29 05:24:06,452 [root] DEBUG: 8412: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-29 05:24:06,454 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4CD40000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-29 05:24:06,454 [root] DEBUG: 8412: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-29 05:24:06,458 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-29 05:24:06,461 [root] DEBUG: 8412: DLL loaded at 0x00007FFF47AB0000: C:\Windows\SYSTEM32\edputil (0x24000 bytes).
2026-05-29 05:24:06,463 [root] DEBUG: 8412: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-29 05:24:06,463 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-29 05:24:06,464 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-29 05:24:06,466 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-29 05:24:06,468 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-29 05:24:06,469 [root] DEBUG: 8412: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-29 05:24:06,470 [root] DEBUG: 8412: DLL loaded at 0x00007FFF47980000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-29 05:24:06,476 [root] DEBUG: 8412: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-29 05:24:06,479 [root] DEBUG: 8412: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-29 05:24:06,481 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-29 05:24:06,494 [root] DEBUG: 8412: DLL loaded at 0x00007FFF163D0000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneauth (0x5c4000 bytes).
2026-05-29 05:24:06,499 [root] DEBUG: 8412: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-29 05:24:06,500 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 3544: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:06,501 [root] DEBUG: 8412: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-29 05:24:06,501 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3544
2026-05-29 05:24:06,502 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3544
2026-05-29 05:24:06,502 [root] DEBUG: 8412: caller_dispatch: Added region at 0x00007FF7F5380000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7F5477D66, thread 6084).
2026-05-29 05:24:06,506 [root] DEBUG: 8412: ProcessImageBase: Main module image at 0x00007FF7F5380000 unmodified (entropy change 0.000000e+00)
2026-05-29 05:24:06,509 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 6176: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:06,510 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6176
2026-05-29 05:24:06,511 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6176
2026-05-29 05:24:06,512 [root] DEBUG: 8412: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-29 05:24:06,533 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 3600: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:06,542 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-29 05:24:06,549 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3600
2026-05-29 05:24:06,550 [root] DEBUG: 8412: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-29 05:24:06,551 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 3600
2026-05-29 05:24:06,551 [root] DEBUG: 8412: DLL loaded at 0x00007FFF409A0000: C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).
2026-05-29 05:24:06,569 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-29 05:24:06,570 [root] DEBUG: 8412: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-29 05:24:06,571 [root] DEBUG: 8412: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-29 05:24:06,572 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-29 05:24:06,597 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3E230000: C:\Windows\System32\Windows.System.Profile.RetailInfo (0x28000 bytes).
2026-05-29 05:24:06,614 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-29 05:24:06,622 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-29 05:24:06,623 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 6488: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:06,623 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 1380: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:06,624 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6488
2026-05-29 05:24:06,625 [root] DEBUG: 8412: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-29 05:24:06,625 [root] DEBUG: 
2026-05-29 05:24:06,625 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 6488
2026-05-29 05:24:06,626 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 1380
2026-05-29 05:24:06,643 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3EA70000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xf4000 bytes).
2026-05-29 05:24:06,648 [root] DEBUG: 8412: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-29 05:24:06,688 [root] DEBUG: 8412: DLL loaded at 0x00007FFF456D0000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0x11d000 bytes).
2026-05-29 05:24:06,698 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3F8A0000: C:\Windows\SYSTEM32\VCRUNTIME140 (0x1e000 bytes).
2026-05-29 05:24:06,705 [root] DEBUG: 8412: DLL loaded at 0x00007FFF42BF0000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions (0x17000 bytes).
2026-05-29 05:24:06,730 [root] DEBUG: 8412: DLL loaded at 0x00007FFF162A0000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains (0x9e000 bytes).
2026-05-29 05:24:06,736 [root] DEBUG: 8412: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-29 05:24:06,738 [root] DEBUG: 8412: DLL loaded at 0x00007FFF57130000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-29 05:24:06,738 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3E730000: C:\Windows\System32\vaultcli (0x51000 bytes).
2026-05-29 05:24:06,746 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-29 05:24:06,751 [root] DEBUG: 8412: DLL loaded at 0x00007FFF56630000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-29 05:24:06,762 [root] DEBUG: 8412: DLL loaded at 0x00007FFF18730000: C:\Windows\System32\aadWamExtension (0x36000 bytes).
2026-05-29 05:24:06,788 [root] DEBUG: 8412: DLL loaded at 0x00007FFF15540000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x8c000 bytes).
2026-05-29 05:24:07,977 [root] DEBUG: 8412: DLL loaded at 0x00007FFF3FD40000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-29 05:24:08,370 [root] DEBUG: 8412: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 05:24:08,371 [root] DEBUG: 8412: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 05:24:08,974 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 9328: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:08,979 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9328
2026-05-29 05:24:08,982 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9328
2026-05-29 05:24:08,987 [root] DEBUG: 8412: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-29 05:24:08,989 [root] DEBUG: 8412: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-29 05:24:08,989 [root] DEBUG: 8412: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-29 05:24:09,320 [root] DEBUG: 8412: CreateProcessHandler: Injection info set for new process 9432: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 05:24:09,324 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9432
2026-05-29 05:24:09,325 [root] DEBUG: 8412: ProcessMessage: Skipping monitoring process 9432
2026-05-29 05:24:10,039 [root] INFO: Process with pid 8412 appears to have terminated

Process Log

Pre-Script Log

During-Script Log