| Category | Package | Started | Completed | Duration | Options | Logs | ||||
|---|---|---|---|---|---|---|---|---|---|---|
| URL | edge | 2026-05-28 16:19:36 | 2026-05-28 16:23:17 | 221s |
|
|||||
| Reports | JSON | |||||||||
interactive=1
nohuman=yes
2026-05-28 16:13:39,457 [root] INFO: Date set to: 20260528T16:19:39, timeout set to: 200
2026-05-28 16:19:39,008 [root] DEBUG: Starting analyzer from: C:\584fooce
2026-05-28 16:19:39,008 [root] DEBUG: Storing results at: C:\fmJyiQT
2026-05-28 16:19:39,009 [root] DEBUG: Pipe server name: \\.\PIPE\IBFaEiSE
2026-05-28 16:19:39,009 [root] DEBUG: Python path: C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64
2026-05-28 16:19:39,009 [root] INFO: analysis running as an admin
2026-05-28 16:19:39,009 [root] INFO: analysis package specified: "edge"
2026-05-28 16:19:39,009 [root] DEBUG: importing analysis package module: "modules.packages.edge"...
2026-05-28 16:19:39,011 [root] DEBUG: imported analysis package "edge"
2026-05-28 16:19:39,011 [root] DEBUG: initializing analysis package "edge"...
2026-05-28 16:19:39,011 [root] DEBUG: New location of moved file: https://badoomovies.com/download/BadooMovies.exe
2026-05-28 16:19:39,011 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option
2026-05-28 16:19:39,011 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option
2026-05-28 16:19:39,011 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option
2026-05-28 16:19:39,011 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option
2026-05-28 16:19:39,018 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-05-28 16:19:39,025 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-05-28 16:19:39,031 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-05-28 16:19:39,036 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-05-28 16:19:39,039 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-05-28 16:19:39,039 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-05-28 16:19:39,039 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-05-28 16:19:39,041 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-05-28 16:19:39,041 [root] DEBUG: Initialized auxiliary module "Browser"
2026-05-28 16:19:39,041 [root] DEBUG: attempting to configure 'Browser' from data
2026-05-28 16:19:39,042 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-05-28 16:19:39,042 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-05-28 16:19:39,042 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-05-28 16:19:39,043 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-05-28 16:19:39,043 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-05-28 16:19:39,043 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-05-28 16:19:39,043 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-05-28 16:19:39,044 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file
2026-05-28 16:19:39,044 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-05-28 16:19:39,044 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-05-28 16:19:39,044 [root] DEBUG: attempting to configure 'Disguise' from data
2026-05-28 16:19:39,044 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-05-28 16:19:39,045 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-05-28 16:19:39,047 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 6748)
2026-05-28 16:19:39,047 [modules.auxiliary.disguise] INFO: Disguising GUID to d16a8a89-b36a-4995-87f1-7819cb74bc9c
2026-05-28 16:19:39,047 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-05-28 16:19:39,048 [root] DEBUG: Initialized auxiliary module "Human"
2026-05-28 16:19:39,048 [root] DEBUG: attempting to configure 'Human' from data
2026-05-28 16:19:39,048 [root] DEBUG: module Human does not support data configuration, ignoring
2026-05-28 16:19:39,048 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-05-28 16:19:39,049 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-05-28 16:19:39,049 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-05-28 16:19:39,050 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-05-28 16:19:39,050 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-05-28 16:19:39,050 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-05-28 16:19:39,051 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2026-05-28 16:19:39,051 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-05-28 16:19:39,051 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-05-28 16:19:39,051 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-05-28 16:19:39,051 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-05-28 16:19:39,052 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-05-28 16:19:39,053 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-05-28 16:19:39,053 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-05-28 16:19:39,053 [root] INFO: Interactive mode enabled - injecting into explorer shell
2026-05-28 16:19:39,088 [lib.api.process] INFO: Monitor config for process 4280: C:\584fooce\dll\4280.ini
2026-05-28 16:19:39,089 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:39,091 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:39,135 [root] DEBUG: Loader: Injecting process 4280 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:39,147 [root] DEBUG: 4280: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:19:39,147 [root] DEBUG: 4280: Disabling sleep skipping.
2026-05-28 16:19:39,148 [root] DEBUG: 4280: Interactive desktop enabled.
2026-05-28 16:19:39,148 [root] DEBUG: 4280: Dropped file limit defaulting to 100.
2026-05-28 16:19:39,149 [root] DEBUG: 4280: Interactive desktop - injecting Explorer Shell
2026-05-28 16:19:39,154 [root] DEBUG: 4280: YaraInit: Compiled 44 rule files
2026-05-28 16:19:39,156 [root] DEBUG: 4280: YaraInit: Compiled rules saved to file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:19:39,172 [root] DEBUG: 4280: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:19:39,172 [root] DEBUG: 4280: YaraScan: Scanning 0x00007FF668AB0000, size 0x545316
2026-05-28 16:19:39,212 [root] DEBUG: 4280: Monitor initialised: 64-bit capemon loaded in process 4280 at 0x00007FFCDE520000, thread 6960, image base 0x00007FF668AB0000, stack from 0x0000000002F01000-0x0000000002F10000
2026-05-28 16:19:39,213 [root] DEBUG: 4280: Commandline: C:\Windows\Explorer.EXE
2026-05-28 16:19:39,222 [root] DEBUG: 4280: Hooked 69 out of 69 functions
2026-05-28 16:19:39,251 [root] DEBUG: 4280: Syscall hook installed, syscall logging level 1
2026-05-28 16:19:39,257 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 16:19:39,257 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:39,259 [lib.api.process] INFO: Injected into 64-bit <Process 4280 explorer.exe>
2026-05-28 16:19:46,154 [root] DEBUG: 4280: caller_dispatch: Added region at 0x00007FF668AB0000 to tracked regions list (ntdll::NtCreateFile returns to 0x00007FF668ACC161, thread 4284).
2026-05-28 16:19:46,156 [root] DEBUG: 4280: YaraScan: Scanning 0x00007FF668AB0000, size 0x545316
2026-05-28 16:19:46,188 [root] DEBUG: 4280: ProcessImageBase: Main module image at 0x00007FF668AB0000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:19:46,417 [root] INFO: Restarting WMI Service
2026-05-28 16:19:48,454 [root] DEBUG: package modules.packages.edge does not support configure, ignoring
2026-05-28 16:19:48,456 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'
2026-05-28 16:19:48,458 [lib.core.compound] INFO: C:\Users\admin\AppData\Local\Temp already exists, skipping creation
2026-05-28 16:19:48,463 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" with arguments ""https://badoomovies.com/download/BadooMovies.exe"" with pid 344
2026-05-28 16:19:48,465 [lib.api.process] INFO: Monitor config for process 344: C:\584fooce\dll\344.ini
2026-05-28 16:19:48,466 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:48,469 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:48,474 [root] DEBUG: Loader: Injecting process 344 (thread 3048) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:48,475 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:19:48,475 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:48,477 [lib.api.process] INFO: Injected into 64-bit <Process 344 msedge.exe>
2026-05-28 16:19:49,060 [lib.api.process] INFO: Monitor config for process 768: C:\584fooce\dll\768.ini
2026-05-28 16:19:49,065 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:49,068 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:49,079 [root] DEBUG: Loader: Injecting process 768 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:49,081 [root] DEBUG: 768: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:19:49,082 [root] DEBUG: 768: Disabling sleep skipping.
2026-05-28 16:19:49,083 [root] DEBUG: 768: Interactive desktop enabled.
2026-05-28 16:19:49,084 [root] DEBUG: 768: Dropped file limit defaulting to 100.
2026-05-28 16:19:49,100 [root] DEBUG: 768: Services hook set enabled
2026-05-28 16:19:49,104 [root] DEBUG: 768: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:19:49,117 [root] DEBUG: 768: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:19:49,118 [root] DEBUG: 768: Monitor initialised: 64-bit capemon loaded in process 768 at 0x00007FFCDE520000, thread 1284, image base 0x00007FF7C1CE0000, stack from 0x000000E7AAE74000-0x000000E7AAE80000
2026-05-28 16:19:49,118 [root] DEBUG: 768: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-05-28 16:19:49,126 [root] DEBUG: 768: Hooked 69 out of 69 functions
2026-05-28 16:19:49,127 [root] INFO: Loaded monitor into process with pid 768
2026-05-28 16:19:49,127 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 16:19:49,128 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:49,130 [lib.api.process] INFO: Injected into 64-bit <Process 768 svchost.exe>
2026-05-28 16:19:50,488 [lib.api.process] INFO: Successfully resumed process with pid 344
2026-05-28 16:19:50,599 [root] DEBUG: 344: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:19:50,600 [root] DEBUG: 344: Disabling sleep skipping.
2026-05-28 16:19:50,600 [root] DEBUG: 344: Interactive desktop enabled.
2026-05-28 16:19:50,601 [root] DEBUG: 344: Dropped file limit defaulting to 100.
2026-05-28 16:19:50,610 [root] DEBUG: 344: Edge-specific hook-set enabled.
2026-05-28 16:19:50,612 [root] DEBUG: 344: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:19:50,623 [root] DEBUG: 344: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:19:50,624 [root] DEBUG: 344: Monitor initialised: 64-bit capemon loaded in process 344 at 0x00007FFCDE520000, thread 3048, image base 0x00007FF7555E0000, stack from 0x0000000E883F4000-0x0000000E88400000
2026-05-28 16:19:50,624 [root] DEBUG: 344: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://badoomovies.com/download/BadooMovies.exe"
2026-05-28 16:19:50,631 [root] DEBUG: 344: Hooked 2 out of 2 functions
2026-05-28 16:19:50,790 [root] DEBUG: 344: Syscall hook installed, syscall logging level 1
2026-05-28 16:19:50,795 [root] DEBUG: 344: RestoreHeaders: Restored original import table.
2026-05-28 16:19:50,795 [root] INFO: Loaded monitor into process with pid 344
2026-05-28 16:19:50,796 [root] DEBUG: 344: DLL loaded at 0x00007FFD04CB0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 16:19:50,798 [root] DEBUG: 344: DLL loaded at 0x00007FFCF82F0000: C:\Windows\SYSTEM32\version (0xa000 bytes).
2026-05-28 16:19:50,799 [root] DEBUG: 344: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:19:50,800 [root] DEBUG: 344: DLL loaded at 0x00007FFD040A0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 16:19:50,801 [root] DEBUG: 344: DLL loaded at 0x00007FFD02810000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 16:19:50,802 [root] DEBUG: 344: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-28 16:19:50,803 [root] DEBUG: 344: DLL loaded at 0x00007FFD03870000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 16:19:50,964 [root] DEBUG: 344: DLL loaded at 0x00007FFCEFA20000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 16:19:50,968 [root] DEBUG: 344: DLL loaded at 0x00007FFCC9090000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-28 16:19:50,971 [root] DEBUG: 344: DLL loaded at 0x00007FFCEFB30000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 16:19:50,973 [root] DEBUG: 344: DLL loaded at 0x00007FFD020F0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 16:19:51,020 [root] DEBUG: 344: DLL loaded at 0x00007FFD02610000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 16:19:51,021 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 4080: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:51,023 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 4080
2026-05-28 16:19:51,024 [root] DEBUG: 344: DLL loaded at 0x00007FFD06E70000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 16:19:51,024 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 4080
2026-05-28 16:19:51,025 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAB70000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-28 16:19:51,026 [root] DEBUG: 344: DLL loaded at 0x00007FFD037C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 16:19:51,027 [root] DEBUG: 344: DLL loaded at 0x00007FFCFE8D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 16:19:51,033 [root] DEBUG: 344: DLL loaded at 0x00007FFD045E0000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 16:19:51,034 [root] DEBUG: 344: DLL loaded at 0x00007FFD02FC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 16:19:51,037 [root] DEBUG: 344: DLL loaded at 0x00007FFD03850000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 16:19:51,039 [root] DEBUG: 344: DLL loaded at 0x00007FFD03C50000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 16:19:51,041 [root] DEBUG: 344: DLL loaded at 0x00007FFD037C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 16:19:51,042 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAB00000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 16:19:51,045 [root] DEBUG: 344: DLL loaded at 0x00007FFD04590000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 16:19:51,046 [root] DEBUG: 344: DLL loaded at 0x00007FFD04000000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 16:19:51,046 [root] DEBUG: 344: DLL loaded at 0x00007FFD04110000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 16:19:51,047 [root] DEBUG: 344: DLL loaded at 0x00007FFD06560000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 16:19:51,047 [root] DEBUG: 344: DLL loaded at 0x00007FFCFD230000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 16:19:51,048 [root] DEBUG: 344: DLL loaded at 0x00007FFCEB1C0000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 16:19:51,049 [root] DEBUG: 344: DLL loaded at 0x00007FFCF5DA0000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 16:19:51,049 [root] DEBUG: 344: DLL loaded at 0x00007FFD04570000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 16:19:51,050 [root] DEBUG: 344: DLL loaded at 0x00007FFD040D0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 16:19:51,055 [root] DEBUG: 344: DLL loaded at 0x00007FFCF8320000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 16:19:51,056 [root] DEBUG: 344: DLL loaded at 0x00007FFD037C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 16:19:51,056 [root] DEBUG: 344: DLL loaded at 0x00007FFD04000000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 16:19:51,057 [root] DEBUG: 344: DLL loaded at 0x00007FFD01790000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 16:19:51,058 [root] DEBUG: 344: DLL loaded at 0x00007FFD04660000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 16:19:51,068 [root] DEBUG: 344: DLL loaded at 0x00007FFD06400000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 16:19:51,069 [root] DEBUG: 344: DLL loaded at 0x00007FFD04590000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 16:19:51,070 [root] DEBUG: 344: DLL loaded at 0x00007FFD04570000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 16:19:51,071 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAB50000: C:\Windows\System32\AssignedAccessRuntime (0x14000 bytes).
2026-05-28 16:19:51,072 [root] DEBUG: 344: DLL loaded at 0x00007FFCFBAF0000: C:\Windows\System32\SystemSettings.DataModel (0x74000 bytes).
2026-05-28 16:19:51,074 [root] DEBUG: 344: DLL loaded at 0x00007FFCF7F30000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 16:19:51,077 [root] DEBUG: 344: DLL loaded at 0x00007FFCEE830000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 16:19:51,078 [root] DEBUG: 344: DLL loaded at 0x00007FFCFEA00000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 16:19:51,079 [root] DEBUG: 344: DLL loaded at 0x00007FFD04290000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 16:19:51,081 [root] DEBUG: 344: DLL loaded at 0x00007FFD03AF0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 16:19:51,084 [root] DEBUG: 344: DLL loaded at 0x00007FFD00090000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 16:19:51,086 [root] DEBUG: 344: DLL loaded at 0x00007FFD06F20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 16:19:51,087 [root] DEBUG: 344: DLL loaded at 0x00007FFCFB160000: C:\Windows\System32\StructuredQuery (0xa6000 bytes).
2026-05-28 16:19:51,088 [root] DEBUG: 344: DLL loaded at 0x00007FFCFDB70000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 16:19:51,089 [root] DEBUG: 344: DLL loaded at 0x00007FFD01420000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-05-28 16:19:51,090 [root] DEBUG: 344: DLL loaded at 0x00007FFCFDB50000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 16:19:51,091 [root] DEBUG: 344: DLL loaded at 0x00007FFD04960000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-28 16:19:51,092 [root] DEBUG: 344: DLL loaded at 0x00007FFD03B30000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 16:19:51,094 [root] DEBUG: 344: DLL loaded at 0x00007FFCF5FE0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 16:19:51,100 [root] DEBUG: 344: DLL loaded at 0x00007FFD018E0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 16:19:51,101 [root] DEBUG: 344: DLL loaded at 0x00007FFD00F40000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 16:19:51,101 [root] DEBUG: 344: DLL loaded at 0x00007FFD019E0000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 16:19:51,102 [root] DEBUG: 344: DLL loaded at 0x00007FFCF9620000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 16:19:51,103 [root] DEBUG: 344: DLL loaded at 0x00007FFCF5F10000: C:\Windows\system32\Windows.Storage.Search (0xc6000 bytes).
2026-05-28 16:19:51,106 [root] DEBUG: 344: DLL loaded at 0x00007FFCFF510000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 16:19:51,107 [root] DEBUG: 344: DLL loaded at 0x00007FFCF53D0000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-28 16:19:51,108 [root] DEBUG: 344: DLL loaded at 0x00007FFCEEBF0000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 16:19:51,112 [root] DEBUG: 344: DLL loaded at 0x00007FFCFE990000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 16:19:51,115 [root] DEBUG: 344: DLL loaded at 0x00007FFCF5080000: C:\Windows\SYSTEM32\edputil (0x24000 bytes).
2026-05-28 16:19:51,118 [root] DEBUG: 344: DLL loaded at 0x00007FFCFF720000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 16:19:51,119 [root] DEBUG: 344: DLL loaded at 0x00007FFCF9720000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 16:19:51,119 [root] DEBUG: 344: DLL loaded at 0x00007FFCF9880000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 16:19:51,131 [root] DEBUG: 344: DLL loaded at 0x00007FFCFA640000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 16:19:51,134 [root] DEBUG: 344: DLL loaded at 0x00007FFCF4FA0000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-28 16:19:51,141 [root] DEBUG: 344: DLL loaded at 0x00007FFCDDA90000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneauth (0x5c4000 bytes).
2026-05-28 16:19:51,152 [root] DEBUG: 344: DLL loaded at 0x00007FFCFF380000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 16:19:51,153 [root] DEBUG: 344: DLL loaded at 0x00007FFCFF3A0000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 16:19:51,157 [root] DEBUG: 344: DLL loaded at 0x00007FFCFCDF0000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 16:19:51,160 [root] INFO: Announced starting service "b'MicrosoftEdgeElevationService'"
2026-05-28 16:19:51,160 [root] DEBUG: 344: DLL loaded at 0x00007FFD01740000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 16:19:51,161 [lib.api.process] INFO: Monitor config for process 620: C:\584fooce\dll\620.ini
2026-05-28 16:19:51,162 [root] DEBUG: 344: DLL loaded at 0x00007FFCF6D70000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 16:19:51,163 [root] DEBUG: 344: DLL loaded at 0x00007FFD04460000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 16:19:51,163 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:51,165 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:51,175 [root] DEBUG: Loader: Injecting process 620 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,182 [root] DEBUG: Loader: Copied config file C:\584fooce\dll\620.ini to system path C:\620.ini
2026-05-28 16:19:51,198 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 620 C:\584fooce\dll\ysbwLP.dll
2026-05-28 16:19:51,201 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 6036: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:51,202 [root] DEBUG: 344: DLL loaded at 0x00007FFCF81B0000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 16:19:51,203 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,205 [root] DEBUG: 344: caller_dispatch: Added region at 0x00007FF7555E0000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7556D7D66, thread 3112).
2026-05-28 16:19:51,252 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 6036
2026-05-28 16:19:51,261 [root] DEBUG: 344: DLL loaded at 0x00007FFCED410000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 16:19:51,262 [lib.api.process] INFO: Injected into 64-bit <Process 620 services.exe>
2026-05-28 16:19:51,265 [root] DEBUG: 344: ProcessImageBase: Main module image at 0x00007FF7555E0000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:19:51,265 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 6036
2026-05-28 16:19:51,267 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 5992: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:51,331 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 5992
2026-05-28 16:19:51,335 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 5656: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:51,336 [root] DEBUG: 344: DLL loaded at 0x00007FFD02FF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 16:19:51,337 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 5656
2026-05-28 16:19:51,338 [root] DEBUG: 344: DLL loaded at 0x00007FFD00710000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 16:19:51,340 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 5992
2026-05-28 16:19:51,342 [root] DEBUG: 344: DLL loaded at 0x00007FFD01520000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 16:19:51,344 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 5656
2026-05-28 16:19:51,356 [root] DEBUG: 344: DLL loaded at 0x00007FFCEE060000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 16:19:51,456 [root] DEBUG: 344: DLL loaded at 0x00007FFCF64E0000: C:\Windows\System32\Windows.System.Profile.RetailInfo (0x28000 bytes).
2026-05-28 16:19:51,461 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 2976: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:51,462 [root] DEBUG: 344: DLL loaded at 0x00007FFCEE180000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 16:19:51,464 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 6220: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:51,465 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 2976
2026-05-28 16:19:51,465 [root] DEBUG: 344: DLL loaded at 0x00007FFCF6F80000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 16:19:51,466 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 6220
2026-05-28 16:19:51,466 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 2976
2026-05-28 16:19:51,485 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 6220
2026-05-28 16:19:51,530 [root] DEBUG: 344: DLL loaded at 0x00007FFCF2AE0000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xf4000 bytes).
2026-05-28 16:19:51,592 [root] DEBUG: 344: DLL loaded at 0x00007FFD02220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 16:19:51,702 [root] DEBUG: 344: DLL loaded at 0x00007FFCF8320000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 16:19:51,707 [root] DEBUG: 344: DLL loaded at 0x00007FFCF3390000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains (0x9e000 bytes).
2026-05-28 16:19:51,712 [root] DEBUG: 344: DLL loaded at 0x00007FFD04270000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 16:19:51,714 [root] DEBUG: 344: DLL loaded at 0x00007FFCF1610000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0x11d000 bytes).
2026-05-28 16:19:51,716 [root] DEBUG: 344: DLL loaded at 0x00007FFD04000000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 16:19:51,719 [root] DEBUG: 344: DLL loaded at 0x00007FFD03730000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 16:19:51,719 [root] DEBUG: 344: DLL loaded at 0x00007FFCF6410000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 16:19:51,727 [root] DEBUG: 344: DLL loaded at 0x00007FFCEE7D0000: C:\Windows\System32\vaultcli (0x51000 bytes).
2026-05-28 16:19:51,742 [root] DEBUG: 344: DLL loaded at 0x00007FFCF5DA0000: C:\Windows\System32\aadWamExtension (0x36000 bytes).
2026-05-28 16:19:51,750 [root] DEBUG: 344: DLL loaded at 0x00007FFCEBD80000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x8c000 bytes).
2026-05-28 16:19:51,792 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 6868: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF7DC380000
2026-05-28 16:19:51,793 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6868
2026-05-28 16:19:51,794 [lib.api.process] INFO: Monitor config for process 6868: C:\584fooce\dll\6868.ini
2026-05-28 16:19:51,794 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:51,795 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:51,803 [root] DEBUG: Loader: Injecting process 6868 (thread 6864) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,803 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:19:51,804 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,805 [lib.api.process] INFO: Injected into 64-bit <Process 6868 backgroundTaskHost.exe>
2026-05-28 16:19:51,806 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6868
2026-05-28 16:19:51,806 [lib.api.process] INFO: Monitor config for process 6868: C:\584fooce\dll\6868.ini
2026-05-28 16:19:51,807 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:51,808 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:51,812 [root] DEBUG: Loader: Injecting process 6868 (thread 6864) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,812 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:19:51,813 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,814 [lib.api.process] INFO: Injected into 64-bit <Process 6868 backgroundTaskHost.exe>
2026-05-28 16:19:51,815 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6868
2026-05-28 16:19:51,816 [lib.api.process] INFO: Monitor config for process 6868: C:\584fooce\dll\6868.ini
2026-05-28 16:19:51,816 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:51,818 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:51,824 [root] DEBUG: Loader: Injecting process 6868 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,824 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 6864, handle 0x120
2026-05-28 16:19:51,825 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:19:51,825 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,826 [lib.api.process] INFO: Injected into 64-bit <Process 6868 backgroundTaskHost.exe>
2026-05-28 16:19:51,850 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 5348: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF7DC380000
2026-05-28 16:19:51,851 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5348
2026-05-28 16:19:51,852 [lib.api.process] INFO: Monitor config for process 5348: C:\584fooce\dll\5348.ini
2026-05-28 16:19:51,853 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:51,854 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:51,859 [root] DEBUG: Loader: Injecting process 5348 (thread 2100) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,860 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:19:51,861 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,862 [lib.api.process] INFO: Injected into 64-bit <Process 5348 backgroundTaskHost.exe>
2026-05-28 16:19:51,866 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5348
2026-05-28 16:19:51,866 [lib.api.process] INFO: Monitor config for process 5348: C:\584fooce\dll\5348.ini
2026-05-28 16:19:51,866 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:51,867 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:51,872 [root] DEBUG: Loader: Injecting process 5348 (thread 2100) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,873 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:19:51,873 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:51,874 [lib.api.process] INFO: Injected into 64-bit <Process 5348 backgroundTaskHost.exe>
2026-05-28 16:19:51,876 [root] INFO: Process with pid 5348 has terminated
2026-05-28 16:19:53,043 [root] DEBUG: 344: DLL loaded at 0x00007FFD037C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 16:19:53,045 [root] DEBUG: 344: DLL loaded at 0x00007FFCFE8D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 16:19:54,310 [root] DEBUG: 344: DLL loaded at 0x00007FFD044C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 16:19:54,322 [root] DEBUG: 344: DLL loaded at 0x00007FFCFFF60000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 16:19:54,323 [root] DEBUG: 344: DLL loaded at 0x00007FFCECC10000: C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).
2026-05-28 16:19:55,400 [root] DEBUG: 344: DLL loaded at 0x00007FFCEDE10000: C:\Windows\system32\explorerframe (0x244000 bytes).
2026-05-28 16:19:55,419 [root] DEBUG: 344: DLL loaded at 0x00007FFD05E20000: C:\Windows\System32\SETUPAPI (0x46e000 bytes).
2026-05-28 16:19:55,420 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 5344: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:55,421 [root] DEBUG: 344: DLL loaded at 0x00007FFD04230000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 16:19:55,423 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 5344
2026-05-28 16:19:55,426 [root] DEBUG: 344: DLL loaded at 0x00007FFD04D40000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 16:19:55,429 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 5344
2026-05-28 16:19:55,432 [root] DEBUG: 344: DLL loaded at 0x00007FFD00050000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-05-28 16:19:55,436 [root] DEBUG: 344: DLL loaded at 0x00007FFCFC6D0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-28 16:19:55,444 [root] DEBUG: 344: DLL loaded at 0x00007FFCC4E50000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\telclient (0x3ed000 bytes).
2026-05-28 16:19:55,453 [root] DEBUG: 344: DLL loaded at 0x00007FFCC4B10000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneds (0x33f000 bytes).
2026-05-28 16:19:55,457 [root] DEBUG: 344: DLL loaded at 0x00007FFD03350000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-28 16:19:55,458 [root] DEBUG: 344: DLL loaded at 0x00007FFD03310000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-28 16:19:55,460 [root] DEBUG: 344: DLL loaded at 0x00007FFCC7890000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\ffmpeg (0x467000 bytes).
2026-05-28 16:19:55,463 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAAE0000: C:\Windows\system32\TenantRestrictionsPlugin (0x1b000 bytes).
2026-05-28 16:19:55,464 [root] DEBUG: 344: DLL loaded at 0x00007FFCF37B0000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\microsoft_shell_integration (0x78000 bytes).
2026-05-28 16:19:55,469 [root] DEBUG: 344: DLL loaded at 0x00007FFCF49A0000: C:\Windows\System32\Windows.Networking.Connectivity (0xb9000 bytes).
2026-05-28 16:19:55,475 [root] DEBUG: 344: DLL loaded at 0x00007FFD02430000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 16:19:55,476 [root] DEBUG: 344: DLL loaded at 0x00007FFD00270000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 16:19:55,476 [root] DEBUG: 344: DLL loaded at 0x00007FFCEF500000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 16:19:55,492 [root] DEBUG: 344: DLL loaded at 0x00007FFCEF950000: C:\Windows\System32\dusmapi (0x11000 bytes).
2026-05-28 16:19:55,528 [root] DEBUG: 344: DLL loaded at 0x00007FFCE6B50000: C:\Windows\System32\Windows.FileExplorer.Common (0x61000 bytes).
2026-05-28 16:19:55,544 [root] DEBUG: 344: DLL loaded at 0x00007FFD06640000: C:\Windows\System32\coml2 (0x79000 bytes).
2026-05-28 16:19:55,598 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 3684: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:55,600 [root] DEBUG: 344: DLL loaded at 0x00007FFCECA30000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-28 16:19:55,603 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 3992: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:19:55,608 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 3684
2026-05-28 16:19:55,635 [root] DEBUG: 344: DLL loaded at 0x00007FFCFF9D0000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-05-28 16:19:55,656 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 3992
2026-05-28 16:19:55,673 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 3684
2026-05-28 16:19:55,679 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 3992
2026-05-28 16:19:55,686 [root] DEBUG: 344: DLL loaded at 0x00007FFCEDDA0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 16:19:55,713 [root] DEBUG: 344: DLL loaded at 0x00007FFD037C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 16:19:55,714 [root] DEBUG: 344: DLL loaded at 0x00007FFCFE8D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 16:19:55,759 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 7244: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe, ImageBase: 0x00007FF667020000
2026-05-28 16:19:55,760 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 7244
2026-05-28 16:19:55,761 [lib.api.process] INFO: Monitor config for process 7244: C:\584fooce\dll\7244.ini
2026-05-28 16:19:55,762 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:56,129 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 16:19:56,130 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-28 16:19:56,133 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:56,138 [root] DEBUG: Loader: Injecting process 7244 (thread 7248) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:56,139 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:19:56,139 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:56,141 [lib.api.process] INFO: Injected into 64-bit <Process 7244 identity_helper.exe>
2026-05-28 16:19:56,146 [root] DEBUG: 344: DLL loaded at 0x00007FFCFD250000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2026-05-28 16:19:56,147 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAA90000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-05-28 16:19:56,149 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 7412: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe, ImageBase: 0x00007FF667020000
2026-05-28 16:19:56,149 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 7412
2026-05-28 16:19:56,150 [lib.api.process] INFO: Monitor config for process 7412: C:\584fooce\dll\7412.ini
2026-05-28 16:19:56,151 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:56,152 [root] DEBUG: 344: DLL loaded at 0x00007FFCF2850000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 16:19:56,154 [root] DEBUG: 344: DLL loaded at 0x00007FFCFDA10000: C:\Windows\System32\AppXDeploymentClient (0x102000 bytes).
2026-05-28 16:19:56,157 [root] DEBUG: 344: DLL loaded at 0x00007FFCFD020000: C:\Windows\system32\wlanapi (0x74000 bytes).
2026-05-28 16:19:56,222 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 16:19:56,222 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-28 16:19:56,229 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:56,234 [root] DEBUG: Loader: Injecting process 7412 (thread 7416) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:56,235 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:19:56,236 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:56,237 [lib.api.process] INFO: Injected into 64-bit <Process 7412 identity_helper.exe>
2026-05-28 16:19:56,239 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 7412
2026-05-28 16:19:56,239 [lib.api.process] INFO: Monitor config for process 7412: C:\584fooce\dll\7412.ini
2026-05-28 16:19:56,240 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:19:56,308 [root] DEBUG: 344: DLL loaded at 0x00007FFD04110000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 16:19:56,310 [root] DEBUG: 344: DLL loaded at 0x00007FFD040D0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 16:19:56,311 [root] DEBUG: 344: DLL loaded at 0x00007FFCFD2B0000: C:\Windows\system32\PCPKsp (0x118000 bytes).
2026-05-28 16:19:56,312 [root] DEBUG: 344: DLL loaded at 0x00007FFD06560000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 16:19:56,313 [root] DEBUG: 344: DLL loaded at 0x00007FFCFD230000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 16:19:56,314 [root] DEBUG: 344: DLL loaded at 0x00007FFD03E00000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-05-28 16:19:56,316 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 16:19:56,317 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-28 16:19:56,318 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:19:56,319 [root] DEBUG: 344: DLL loaded at 0x00007FFCF3030000: C:\Windows\system32\ncryptprov (0x5a000 bytes).
2026-05-28 16:19:56,324 [root] DEBUG: Loader: Injecting process 7412 (thread 7416) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:56,324 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:19:56,325 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:19:56,326 [lib.api.process] INFO: Injected into 64-bit <Process 7412 identity_helper.exe>
2026-05-28 16:19:56,344 [root] DEBUG: 7412: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:19:56,345 [root] DEBUG: 7412: Interactive desktop enabled.
2026-05-28 16:19:56,345 [root] DEBUG: 7412: Dropped file limit defaulting to 100.
2026-05-28 16:19:56,355 [root] DEBUG: 7412: Disabling sleep skipping.
2026-05-28 16:19:56,356 [root] DEBUG: 7412: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:19:56,368 [root] DEBUG: 7412: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:19:56,369 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,402 [root] DEBUG: 7412: Monitor initialised: 64-bit capemon loaded in process 7412 at 0x00007FFCDE520000, thread 7416, image base 0x00007FF667020000, stack from 0x0000006118364000-0x0000006118370000
2026-05-28 16:19:56,404 [root] DEBUG: 7412: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6572,i,9181420350410975254,3269219776404264675,524288 --field-trial-handle=2352,i,2850132919868798213,14254908397885616522,262144 --variations-seed-version --pseudonymization-salt-handle=2356,i,4095303410144716949,162981210135311403
2026-05-28 16:19:56,404 [root] DEBUG: 7412: add_all_dlls_to_dll_ranges: skipping C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_elf.dll
2026-05-28 16:19:56,414 [root] DEBUG: 7412: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:19:56,438 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:19:56,438 [root] DEBUG: 7412: set_hooks: Unable to hook LockResource
2026-05-28 16:19:56,445 [root] DEBUG: 7412: Hooked 627 out of 628 functions
2026-05-28 16:19:56,463 [root] DEBUG: 7412: Syscall hook installed, syscall logging level 1
2026-05-28 16:19:56,468 [root] DEBUG: 7412: RestoreHeaders: Restored original import table.
2026-05-28 16:19:56,468 [root] INFO: Loaded monitor into process with pid 7412
2026-05-28 16:19:56,469 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,542 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,568 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,593 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,619 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,643 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,667 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FFCDE060000, size 0x4b9994
2026-05-28 16:19:56,693 [root] DEBUG: 7412: caller_dispatch: Added region at 0x00007FFCDE060000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFCDE25F156, thread 7416).
2026-05-28 16:19:56,694 [root] DEBUG: 7412: caller_dispatch: Scanning calling region at 0x00007FFCDE060000...
2026-05-28 16:19:56,697 [root] DEBUG: 7412: ProcessTrackedRegion: Region at 0x00007FFCDE060000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_elf.dll appears unmodified, skipping
2026-05-28 16:19:56,699 [root] DEBUG: 7412: DLL loaded at 0x00007FFD04CB0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 16:19:56,722 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,738 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,752 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,770 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,786 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,807 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,827 [root] DEBUG: 7412: caller_dispatch: Added region at 0x00007FF667020000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF667114096, thread 7416).
2026-05-28 16:19:56,827 [root] DEBUG: 7412: YaraScan: Scanning 0x00007FF667020000, size 0x28b4d8
2026-05-28 16:19:56,844 [root] DEBUG: 7412: ProcessImageBase: Main module image at 0x00007FF667020000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:19:56,848 [root] DEBUG: 7412: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:19:56,869 [root] DEBUG: 7412: DLL loaded at 0x00007FFCC9090000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-28 16:19:56,873 [root] DEBUG: 7412: DLL loaded at 0x00007FFD020F0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 16:19:56,877 [root] DEBUG: 7412: DLL loaded at 0x00007FFD06400000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 16:19:56,916 [root] DEBUG: 7412: DLL loaded at 0x00007FFD02610000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 16:19:56,922 [root] DEBUG: 7412: DLL loaded at 0x00007FFD06E70000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 16:19:56,927 [root] DEBUG: 7412: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:19:56,927 [root] DEBUG: 7412: DLL loaded at 0x00007FFD01420000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 16:19:56,928 [root] DEBUG: 7412: DLL loaded at 0x00007FFD018E0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 16:19:56,928 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF1210000: C:\Windows\System32\execmodelclient (0x63000 bytes).
2026-05-28 16:19:56,936 [root] DEBUG: 7412: DLL loaded at 0x00007FFCFF510000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 16:19:56,938 [root] DEBUG: 7412: DLL loaded at 0x00007FFD00F40000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 16:19:56,939 [root] DEBUG: 7412: DLL loaded at 0x00007FFD02430000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 16:19:56,943 [root] DEBUG: 7412: DLL loaded at 0x00007FFD00270000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 16:19:56,944 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEF500000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 16:19:56,952 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF6410000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 16:19:56,962 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEFB40000: C:\Windows\system32\execmodelproxy (0x18000 bytes).
2026-05-28 16:19:56,969 [root] DEBUG: 7412: DLL loaded at 0x00007FFD037C0000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-05-28 16:19:56,970 [root] DEBUG: 7412: DLL loaded at 0x00007FFCFE8D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 16:19:56,975 [root] DEBUG: 7412: DLL loaded at 0x00007FFCFFF60000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 16:19:56,983 [root] DEBUG: 7412: DLL loaded at 0x00007FFCFEA00000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 16:19:56,985 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF5FE0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 16:19:57,000 [root] DEBUG: 7412: DLL loaded at 0x00007FFD04D40000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 16:19:57,001 [root] DEBUG: 7412: DLL loaded at 0x00007FFCFD250000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2026-05-28 16:19:57,006 [root] DEBUG: 7412: DLL loaded at 0x00007FFD04270000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-05-28 16:19:57,012 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF2850000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 16:19:57,025 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEC7E0000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-28 16:19:57,039 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF9EA0000: C:\Windows\System32\StateRepository.Core (0xb1000 bytes).
2026-05-28 16:19:57,039 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF9F60000: C:\Windows\System32\Windows.StateRepository (0x58e000 bytes).
2026-05-28 16:19:57,040 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEF7A0000: C:\Windows\System32\TileDataRepository (0x99000 bytes).
2026-05-28 16:19:57,041 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEB240000: C:\Windows\System32\biwinrt (0x53000 bytes).
2026-05-28 16:19:57,053 [root] DEBUG: 7412: DLL loaded at 0x00007FFCFD9B0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-28 16:19:57,076 [root] DEBUG: 7412: DLL loaded at 0x00007FFD02FF0000: C:\Windows\System32\dxgi (0xf3000 bytes).
2026-05-28 16:19:57,078 [root] DEBUG: 7412: DLL loaded at 0x00007FFD00710000: C:\Windows\System32\d3d11 (0x263000 bytes).
2026-05-28 16:19:57,084 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF3EC0000: C:\Windows\System32\WININET (0x4d6000 bytes).
2026-05-28 16:19:57,085 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEB0B0000: C:\Windows\System32\windows.internal.shell.broker (0xdd000 bytes).
2026-05-28 16:19:57,100 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF1480000: C:\Windows\System32\PCShellCommonProxyStub (0x13000 bytes).
2026-05-28 16:19:57,120 [root] DEBUG: 7412: DLL loaded at 0x00007FFD045E0000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-28 16:19:57,121 [root] DEBUG: 7412: DLL loaded at 0x00007FFD040A0000: C:\Windows\System32\Wldp (0x2d000 bytes).
2026-05-28 16:19:57,121 [root] DEBUG: 7412: DLL loaded at 0x00007FFD02810000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 16:19:57,122 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF9AD0000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-05-28 16:19:57,122 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEE240000: C:\Windows\System32\StartTileData (0x58a000 bytes).
2026-05-28 16:19:57,146 [root] DEBUG: 7412: DLL loaded at 0x00007FFCEB430000: C:\Windows\System32\Windows.Storage.ApplicationData (0x66000 bytes).
2026-05-28 16:19:57,164 [root] DEBUG: 7412: DLL loaded at 0x00007FFCF53D0000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-28 16:19:57,195 [root] DEBUG: 7412: DLL loaded at 0x00007FFD04960000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-28 16:20:07,275 [root] INFO: Process with pid 7412 has terminated
2026-05-28 16:20:07,277 [root] DEBUG: 7412: NtTerminateProcess hook: Attempting to dump process 7412
2026-05-28 16:20:07,283 [root] DEBUG: 7412: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:20:16,036 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 8108: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF7DC380000
2026-05-28 16:20:16,038 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8108
2026-05-28 16:20:16,038 [lib.api.process] INFO: Monitor config for process 8108: C:\584fooce\dll\8108.ini
2026-05-28 16:20:16,039 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:16,040 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:16,045 [root] DEBUG: Loader: Injecting process 8108 (thread 8112) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,046 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:16,047 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,048 [lib.api.process] INFO: Injected into 64-bit <Process 8108 backgroundTaskHost.exe>
2026-05-28 16:20:16,050 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8108
2026-05-28 16:20:16,051 [lib.api.process] INFO: Monitor config for process 8108: C:\584fooce\dll\8108.ini
2026-05-28 16:20:16,051 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:16,052 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:16,057 [root] DEBUG: Loader: Injecting process 8108 (thread 8112) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,058 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:16,058 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,060 [lib.api.process] INFO: Injected into 64-bit <Process 8108 backgroundTaskHost.exe>
2026-05-28 16:20:16,061 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8108
2026-05-28 16:20:16,061 [lib.api.process] INFO: Monitor config for process 8108: C:\584fooce\dll\8108.ini
2026-05-28 16:20:16,062 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:16,063 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:16,069 [root] DEBUG: Loader: Injecting process 8108 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,069 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 8112, handle 0x120
2026-05-28 16:20:16,071 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:16,072 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,073 [lib.api.process] INFO: Injected into 64-bit <Process 8108 backgroundTaskHost.exe>
2026-05-28 16:20:16,083 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 7516: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF7DC380000
2026-05-28 16:20:16,084 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7516
2026-05-28 16:20:16,084 [lib.api.process] INFO: Monitor config for process 7516: C:\584fooce\dll\7516.ini
2026-05-28 16:20:16,085 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:16,086 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:16,091 [root] DEBUG: Loader: Injecting process 7516 (thread 7512) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,091 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:16,092 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,094 [lib.api.process] INFO: Injected into 64-bit <Process 7516 backgroundTaskHost.exe>
2026-05-28 16:20:16,095 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7516
2026-05-28 16:20:16,095 [lib.api.process] INFO: Monitor config for process 7516: C:\584fooce\dll\7516.ini
2026-05-28 16:20:16,098 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:16,100 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:16,106 [root] DEBUG: Loader: Injecting process 7516 (thread 7512) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,107 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:16,108 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:16,110 [lib.api.process] INFO: Injected into 64-bit <Process 7516 backgroundTaskHost.exe>
2026-05-28 16:20:16,111 [root] INFO: Process with pid 7516 has terminated
2026-05-28 16:20:16,194 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 4884: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:20:16,195 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 4884
2026-05-28 16:20:16,196 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 4884
2026-05-28 16:20:20,256 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 7568: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:20:20,257 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 7568
2026-05-28 16:20:20,258 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 7568
2026-05-28 16:20:20,987 [root] DEBUG: 344: DLL loaded at 0x00007FFCF6290000: C:\Windows\System32\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).
2026-05-28 16:20:21,127 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 7140: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:20:21,129 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 7140
2026-05-28 16:20:21,129 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 7140
2026-05-28 16:20:28,470 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 3124: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:20:28,473 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 3124
2026-05-28 16:20:28,474 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 3124
2026-05-28 16:20:30,277 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAA30000: C:\Windows\SYSTEM32\srvcli (0x28000 bytes).
2026-05-28 16:20:30,278 [root] DEBUG: 344: DLL loaded at 0x00007FFCFAC20000: C:\Windows\SYSTEM32\urlmon (0x1ed000 bytes).
2026-05-28 16:20:30,281 [root] DEBUG: 344: DLL loaded at 0x00007FFCF0540000: C:\Windows\SYSTEM32\FLTLIB (0xb000 bytes).
2026-05-28 16:20:30,282 [root] DEBUG: 344: DLL loaded at 0x00007FFD01D90000: C:\Windows\SYSTEM32\virtdisk (0x13000 bytes).
2026-05-28 16:20:30,283 [root] DEBUG: 344: DLL loaded at 0x00007FFCF9E40000: C:\Windows\System32\smartscreenps (0x52000 bytes).
2026-05-28 16:20:30,284 [root] DEBUG: 344: DLL loaded at 0x00007FFCE6C40000: C:\Windows\SYSTEM32\shdocvw (0x41000 bytes).
2026-05-28 16:20:30,601 [root] DEBUG: 4280: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4D0AE1000, size: 0x1000.
2026-05-28 16:20:30,608 [root] DEBUG: 4280: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4D0AD1000, size: 0x1000.
2026-05-28 16:20:30,610 [root] DEBUG: 4280: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4D0AC1000, size: 0x1000.
2026-05-28 16:20:30,611 [root] DEBUG: 4280: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4D0AB1000, size: 0x1000.
2026-05-28 16:20:30,617 [root] DEBUG: 4280: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4D0AA1000, size: 0x1000.
2026-05-28 16:20:30,624 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF5D60000: C:\Windows\system32\activationclient (0x12000 bytes).
2026-05-28 16:20:30,642 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 3524: C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe, ImageBase: 0x00007FF75F4D0000
2026-05-28 16:20:30,646 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 3524
2026-05-28 16:20:30,646 [lib.api.process] INFO: Monitor config for process 3524: C:\584fooce\dll\3524.ini
2026-05-28 16:20:30,647 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:30,648 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:30,653 [root] DEBUG: Loader: Injecting process 3524 (thread 3228) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:30,653 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:30,654 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:30,656 [lib.api.process] INFO: Injected into 64-bit <Process 3524 CHXSmartScreen.exe>
2026-05-28 16:20:30,657 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 3524
2026-05-28 16:20:30,657 [lib.api.process] INFO: Monitor config for process 3524: C:\584fooce\dll\3524.ini
2026-05-28 16:20:30,657 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:30,660 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:30,664 [root] DEBUG: Loader: Injecting process 3524 (thread 3228) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:30,665 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:30,665 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:30,667 [lib.api.process] INFO: Injected into 64-bit <Process 3524 CHXSmartScreen.exe>
2026-05-28 16:20:30,668 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 3524
2026-05-28 16:20:30,668 [lib.api.process] INFO: Monitor config for process 3524: C:\584fooce\dll\3524.ini
2026-05-28 16:20:30,669 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:30,670 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:30,674 [root] DEBUG: Loader: Injecting process 3524 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:30,675 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 3228, handle 0x124
2026-05-28 16:20:30,676 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:30,676 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:30,678 [lib.api.process] INFO: Injected into 64-bit <Process 3524 CHXSmartScreen.exe>
2026-05-28 16:20:33,698 [root] DEBUG: 344: DLL loaded at 0x00007FFCF36E0000: C:\Windows\System32\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient (0x12000 bytes).
2026-05-28 16:20:33,868 [root] DEBUG: 344: CreateProcessHandler: Injection info set for new process 6864: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7555E0000
2026-05-28 16:20:33,870 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 6864
2026-05-28 16:20:33,871 [root] DEBUG: 344: ProcessMessage: Skipping monitoring process 6864
2026-05-28 16:20:34,046 [root] INFO: Process with pid 344 appears to have terminated
2026-05-28 16:20:34,174 [root] INFO: Announced starting service "b'MicrosoftEdgeElevationService'"
2026-05-28 16:20:34,226 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 6816: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF7DC380000
2026-05-28 16:20:34,229 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6816
2026-05-28 16:20:34,232 [lib.api.process] INFO: Monitor config for process 6816: C:\584fooce\dll\6816.ini
2026-05-28 16:20:34,234 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:34,235 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:34,240 [root] DEBUG: Loader: Injecting process 6816 (thread 3468) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,240 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:34,241 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,242 [lib.api.process] INFO: Injected into 64-bit <Process 6816 backgroundTaskHost.exe>
2026-05-28 16:20:34,244 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6816
2026-05-28 16:20:34,244 [lib.api.process] INFO: Monitor config for process 6816: C:\584fooce\dll\6816.ini
2026-05-28 16:20:34,245 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:34,246 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:34,252 [root] DEBUG: Loader: Injecting process 6816 (thread 3468) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,252 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:34,253 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,254 [lib.api.process] INFO: Injected into 64-bit <Process 6816 backgroundTaskHost.exe>
2026-05-28 16:20:34,255 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 6816
2026-05-28 16:20:34,256 [lib.api.process] INFO: Monitor config for process 6816: C:\584fooce\dll\6816.ini
2026-05-28 16:20:34,256 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:34,257 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:34,263 [root] DEBUG: Loader: Injecting process 6816 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,264 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 3468, handle 0x120
2026-05-28 16:20:34,265 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:34,265 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,267 [lib.api.process] INFO: Injected into 64-bit <Process 6816 backgroundTaskHost.exe>
2026-05-28 16:20:34,275 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 3128: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF7DC380000
2026-05-28 16:20:34,277 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 3128
2026-05-28 16:20:34,279 [lib.api.process] INFO: Monitor config for process 3128: C:\584fooce\dll\3128.ini
2026-05-28 16:20:34,282 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:34,283 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:34,287 [root] DEBUG: Loader: Injecting process 3128 (thread 912) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,288 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:34,288 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,290 [lib.api.process] INFO: Injected into 64-bit <Process 3128 backgroundTaskHost.exe>
2026-05-28 16:20:34,294 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 3128
2026-05-28 16:20:34,295 [lib.api.process] INFO: Monitor config for process 3128: C:\584fooce\dll\3128.ini
2026-05-28 16:20:34,295 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:34,296 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:34,301 [root] DEBUG: Loader: Injecting process 3128 (thread 912) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,302 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:34,303 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:34,305 [lib.api.process] INFO: Injected into 64-bit <Process 3128 backgroundTaskHost.exe>
2026-05-28 16:20:34,306 [root] INFO: Process with pid 3128 has terminated
2026-05-28 16:20:37,626 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEC3D0000: C:\Windows\system32\twext (0x33000 bytes).
2026-05-28 16:20:37,858 [lib.api.process] INFO: Monitor config for process 4280: C:\584fooce\dll\4280.ini
2026-05-28 16:20:37,869 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:37,884 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:37,922 [root] DEBUG: Loader: Injecting process 4280 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:37,940 [root] DEBUG: 4280: caller_dispatch: Added region at 0x0000000002EB0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x0000000002EB0042, thread 7144).
2026-05-28 16:20:37,948 [root] DEBUG: 4280: DumpPEsInRange: Scanning range 0x0000000002EB0000 - 0x0000000002EB0133.
2026-05-28 16:20:37,973 [root] DEBUG: 4280: ScanForDisguisedPE: Size too small: 0x133 bytes
2026-05-28 16:20:38,003 [lib.common.results] INFO: Uploading file C:\fmJyiQT\CAPE\4280_3956537202328452026 to CAPE\222fce517cb7f452cd41cbb7ff44f370b232165dd1c45c35074fa3404e8ee7de; Size is 307; Max size: 100000000
2026-05-28 16:20:38,040 [root] DEBUG: 4280: DumpMemory: Payload successfully created: C:\fmJyiQT\CAPE\4280_3956537202328452026 (size 307 bytes)
2026-05-28 16:20:38,060 [root] DEBUG: 4280: DumpRegion: Dumped entire allocation from 0x0000000002EB0000, size 4096 bytes.
2026-05-28 16:20:38,074 [root] DEBUG: 4280: ProcessTrackedRegion: Dumped region at 0x0000000002EB0000.
2026-05-28 16:20:38,108 [root] DEBUG: 4280: YaraScan: Scanning 0x0000000002EB0000, size 0x133
2026-05-28 16:20:38,126 [root] DEBUG: 4280: Monitor config - unrecognised key host-ip.
2026-05-28 16:20:38,147 [root] DEBUG: 4280: Monitor config - unrecognised key host-port.
2026-05-28 16:20:38,174 [root] DEBUG: 4280: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:20:38,198 [root] DEBUG: 4280: Dropped file limit defaulting to 100.
2026-05-28 16:20:38,237 [root] DEBUG: 4280: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:20:38,309 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:20:38,334 [root] DEBUG: 4280: set_hooks: Unable to hook LockResource
2026-05-28 16:20:38,384 [root] DEBUG: 4280: Hooked 627 out of 628 functions
2026-05-28 16:20:38,424 [root] INFO: Loaded monitor into process with pid 4280
2026-05-28 16:20:38,466 [root] DEBUG: Error 317 (0x13d) - InjectDllViaThread: RtlCreateUserThread injection failed: The system cannot find message text for message number 0x%1 in the message file for %2.
2026-05-28 16:20:38,495 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:39,670 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 3184, handle 0x2380: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe
2026-05-28 16:20:40,585 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDEDC0000: C:\Windows\system32\DUI70 (0x1ae000 bytes).
2026-05-28 16:20:40,606 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDEDC0000: C:\Windows\system32\DUI70 (0x1ae000 bytes).
2026-05-28 16:20:40,635 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDED20000: C:\Windows\system32\DUser (0x95000 bytes).
2026-05-28 16:20:40,654 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDED20000: C:\Windows\system32\DUser (0x95000 bytes).
2026-05-28 16:20:40,767 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF3B50000: C:\Windows\SYSTEM32\MsftEdit (0x34d000 bytes).
2026-05-28 16:20:40,776 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF3B50000: C:\Windows\SYSTEM32\MsftEdit (0x34d000 bytes).
2026-05-28 16:20:40,839 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF4DE0000: C:\Windows\SYSTEM32\globinputhost (0x25000 bytes).
2026-05-28 16:20:40,856 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF4DE0000: C:\Windows\SYSTEM32\globinputhost (0x25000 bytes).
2026-05-28 16:20:40,904 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDFED0000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0xa9000 bytes).
2026-05-28 16:20:40,951 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDFED0000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0xa9000 bytes).
2026-05-28 16:20:41,034 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEC3C0000: C:\Windows\System32\Windows.Internal.System.UserProfile (0x43000 bytes).
2026-05-28 16:20:41,060 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEC3C0000: C:\Windows\System32\Windows.Internal.System.UserProfile (0x43000 bytes).
2026-05-28 16:20:41,102 [root] DEBUG: 4280: DLL loaded at 0x0000000013FA0000: C:\Windows\system32\UIRibbon (0x3ec000 bytes).
2026-05-28 16:20:41,128 [root] DEBUG: 4280: DLL loaded at 0x0000000013FA0000: C:\Windows\system32\UIRibbon (0x3ec000 bytes).
2026-05-28 16:20:41,825 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEACC0000: C:\Windows\System32\Windows.Services.TargetedContent (0x123000 bytes).
2026-05-28 16:20:41,853 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEACC0000: C:\Windows\System32\Windows.Services.TargetedContent (0x123000 bytes).
2026-05-28 16:20:42,133 [root] DEBUG: 4280: api-rate-cap: IsDebuggerPresent hook disabled due to rate
2026-05-28 16:20:42,283 [root] INFO: Added new file to list with pid 4280 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
2026-05-28 16:20:42,318 [root] INFO: Added new file to list with pid 4280 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
2026-05-28 16:20:42,327 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF64F0000: C:\Windows\system32\NetworkExplorer (0x17000 bytes).
2026-05-28 16:20:42,416 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF64F0000: C:\Windows\system32\NetworkExplorer (0x17000 bytes).
2026-05-28 16:20:42,680 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEFA20000: C:\Windows\system32\WINMM (0x27000 bytes).
2026-05-28 16:20:42,818 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEFA20000: C:\Windows\system32\WINMM (0x27000 bytes).
2026-05-28 16:20:42,889 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:42,933 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 1416, handle 0x2554: Error obtaining target process name
2026-05-28 16:20:42,966 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:43,004 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 3056, handle 0x2548: Error obtaining target process name
2026-05-28 16:20:43,084 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:43,121 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 5684, handle 0x25f4: Error obtaining target process name
2026-05-28 16:20:43,158 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:43,273 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 536, handle 0x2628: Error obtaining target process name
2026-05-28 16:20:43,391 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:43,428 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 4824, handle 0x261c: Error obtaining target process name
2026-05-28 16:20:43,507 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:43,539 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 5744, handle 0x2638: Error obtaining target process name
2026-05-28 16:20:44,430 [root] DEBUG: 4280: api-cap: NtClose hook disabled due to count: 5001
2026-05-28 16:20:44,431 [root] DEBUG: 4280: api-cap: NtClose hook disabled due to count: 5002
2026-05-28 16:20:44,444 [root] DEBUG: 4280: api-cap: NtClose hook disabled due to count: 5000
2026-05-28 16:20:44,452 [root] DEBUG: 4280: api-cap: NtClose hook disabled due to count: 5003
2026-05-28 16:20:44,633 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 8356: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF70C120000
2026-05-28 16:20:44,742 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 8356
2026-05-28 16:20:44,762 [lib.api.process] INFO: Monitor config for process 8356: C:\584fooce\dll\8356.ini
2026-05-28 16:20:44,779 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:44,791 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:44,877 [root] DEBUG: Loader: Injecting process 8356 (thread 8360) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:44,896 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:44,954 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:45,023 [lib.api.process] INFO: Injected into 64-bit <Process 8356 dllhost.exe>
2026-05-28 16:20:45,058 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 8356
2026-05-28 16:20:45,064 [lib.api.process] INFO: Monitor config for process 8356: C:\584fooce\dll\8356.ini
2026-05-28 16:20:45,082 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:45,091 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:45,165 [root] DEBUG: Loader: Injecting process 8356 (thread 8360) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:45,242 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:45,293 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:45,368 [lib.api.process] INFO: Injected into 64-bit <Process 8356 dllhost.exe>
2026-05-28 16:20:45,484 [root] DEBUG: 8356: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:20:45,517 [root] DEBUG: 8356: Interactive desktop enabled.
2026-05-28 16:20:45,551 [root] DEBUG: 8356: Dropped file limit defaulting to 100.
2026-05-28 16:20:45,619 [root] DEBUG: 8356: Disabling sleep skipping.
2026-05-28 16:20:45,645 [root] DEBUG: 8356: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:20:45,684 [root] DEBUG: 8356: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:20:45,706 [root] DEBUG: 8356: YaraScan: Scanning 0x00007FF70C120000, size 0x8026
2026-05-28 16:20:45,761 [root] DEBUG: 8356: Monitor initialised: 64-bit capemon loaded in process 8356 at 0x00007FFCDE520000, thread 8360, image base 0x00007FF70C120000, stack from 0x00000016F36F4000-0x00000016F3700000
2026-05-28 16:20:45,777 [root] DEBUG: 8356: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 16:20:45,823 [root] DEBUG: 8356: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:20:45,916 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:20:45,932 [root] DEBUG: 8356: set_hooks: Unable to hook LockResource
2026-05-28 16:20:45,975 [root] DEBUG: 8356: Hooked 627 out of 628 functions
2026-05-28 16:20:46,012 [root] DEBUG: 8356: Syscall hook installed, syscall logging level 1
2026-05-28 16:20:46,125 [root] DEBUG: 8356: RestoreHeaders: Restored original import table.
2026-05-28 16:20:46,143 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 8744: C:\Windows\System32\rundll32.exe, ImageBase: 0x00007FF680550000
2026-05-28 16:20:46,216 [root] INFO: Announced 64-bit process name: rundll32.exe pid: 8744
2026-05-28 16:20:46,228 [lib.api.process] INFO: Monitor config for process 8744: C:\584fooce\dll\8744.ini
2026-05-28 16:20:46,233 [root] INFO: Loaded monitor into process with pid 8356
2026-05-28 16:20:46,253 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:46,259 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:46,281 [root] DEBUG: 8356: caller_dispatch: Added region at 0x00007FF70C120000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF70C1212F2, thread 8360).
2026-05-28 16:20:46,355 [root] DEBUG: 8356: YaraScan: Scanning 0x00007FF70C120000, size 0x8026
2026-05-28 16:20:46,375 [root] DEBUG: Loader: Injecting process 8744 (thread 8748) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:46,376 [root] DEBUG: 8356: ProcessImageBase: Main module image at 0x00007FF70C120000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:20:46,410 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:46,427 [root] DEBUG: 8356: DLL loaded at 0x00007FFD02610000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 16:20:46,427 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:46,503 [lib.api.process] INFO: Injected into 64-bit <Process 8744 rundll32.exe>
2026-05-28 16:20:46,503 [root] DEBUG: 8356: DLL loaded at 0x00007FFD04CB0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 16:20:46,551 [root] INFO: Announced 64-bit process name: rundll32.exe pid: 8744
2026-05-28 16:20:46,556 [lib.api.process] INFO: Monitor config for process 8744: C:\584fooce\dll\8744.ini
2026-05-28 16:20:46,565 [root] DEBUG: 8356: DLL loaded at 0x00007FFD06E70000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 16:20:46,568 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:46,594 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:46,734 [root] DEBUG: 8356: DLL loaded at 0x00007FFD020F0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 16:20:46,768 [root] DEBUG: Loader: Injecting process 8744 (thread 8748) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:46,884 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:20:46,899 [root] DEBUG: 8356: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:20:46,966 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:47,013 [root] DEBUG: 8356: DLL loaded at 0x00007FFCEDDA0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 16:20:47,013 [lib.api.process] INFO: Injected into 64-bit <Process 8744 rundll32.exe>
2026-05-28 16:20:47,081 [root] DEBUG: 8356: DLL loaded at 0x00007FFD01420000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 16:20:47,143 [root] DEBUG: 8744: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:20:47,235 [root] DEBUG: 8744: Interactive desktop enabled.
2026-05-28 16:20:47,246 [root] DEBUG: 8744: Dropped file limit defaulting to 100.
2026-05-28 16:20:47,321 [root] DEBUG: 8744: Disabling sleep skipping.
2026-05-28 16:20:47,351 [root] DEBUG: 8744: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:20:47,480 [root] DEBUG: 8744: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:20:47,576 [root] DEBUG: 8744: YaraScan: Scanning 0x00007FF680550000, size 0x16100
2026-05-28 16:20:47,621 [root] DEBUG: 8744: Monitor initialised: 64-bit capemon loaded in process 8744 at 0x00007FFCDE520000, thread 8748, image base 0x00007FF680550000, stack from 0x000000E405A74000-0x000000E405A80000
2026-05-28 16:20:47,676 [root] DEBUG: 8744: Commandline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
2026-05-28 16:20:47,732 [root] DEBUG: 8744: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:20:47,793 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:20:47,865 [root] DEBUG: 8744: set_hooks: Unable to hook LockResource
2026-05-28 16:20:47,924 [root] DEBUG: 8744: Hooked 627 out of 628 functions
2026-05-28 16:20:47,981 [root] DEBUG: 8744: Syscall hook installed, syscall logging level 1
2026-05-28 16:20:48,044 [root] DEBUG: 8744: RestoreHeaders: Restored original import table.
2026-05-28 16:20:48,056 [root] INFO: Loaded monitor into process with pid 8744
2026-05-28 16:20:48,099 [root] DEBUG: 8744: caller_dispatch: Added region at 0x00007FF680550000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF680556D01, thread 8748).
2026-05-28 16:20:48,148 [root] DEBUG: 8744: YaraScan: Scanning 0x00007FF680550000, size 0x16100
2026-05-28 16:20:48,223 [root] DEBUG: 8744: ProcessImageBase: Main module image at 0x00007FF680550000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:20:48,270 [root] DEBUG: 8744: DLL loaded at 0x00007FFD020F0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 16:20:48,305 [root] DEBUG: 8744: DLL loaded at 0x00007FFD06400000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 16:20:48,346 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 8744, handle 0x29bc: C:\Windows\System32\rundll32.exe
2026-05-28 16:20:48,346 [root] DEBUG: 4280: DLL loaded at 0x00007FFCE6D50000: C:\Windows\System32\WorkFoldersShell (0x3d000 bytes).
2026-05-28 16:20:48,383 [root] DEBUG: 4280: DLL loaded at 0x00007FFCE6D50000: C:\Windows\System32\WorkFoldersShell (0x3d000 bytes).
2026-05-28 16:20:48,474 [root] DEBUG: 8744: NtTerminateProcess hook: Attempting to dump process 8744
2026-05-28 16:20:48,559 [root] DEBUG: 8744: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:20:48,589 [root] INFO: Process with pid 8744 has terminated
2026-05-28 16:20:49,412 [root] DEBUG: 4280: api-cap: RegQueryValueExW hook disabled due to count: 5000
2026-05-28 16:20:49,465 [root] DEBUG: 4280: api-cap: RegQueryValueExW hook disabled due to count: 5001
2026-05-28 16:20:50,424 [root] DEBUG: 8356: DLL loaded at 0x00007FFCFF9D0000: C:\Windows\system32\WindowsCodecs (0x1b4000 bytes).
2026-05-28 16:20:50,474 [root] DEBUG: 8356: DLL loaded at 0x00007FFCF7220000: C:\Windows\system32\PhotoMetadataHandler (0x84000 bytes).
2026-05-28 16:20:50,545 [root] DEBUG: 8356: DLL loaded at 0x00007FFCFEA00000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 16:20:52,347 [root] DEBUG: 4280: api-rate-cap: SystemParametersInfoW hook disabled due to rate
2026-05-28 16:20:56,025 [root] INFO: Process with pid 8356 has terminated
2026-05-28 16:20:56,181 [root] DEBUG: 8356: NtTerminateProcess hook: Attempting to dump process 8356
2026-05-28 16:20:56,303 [root] DEBUG: 8356: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:20:56,770 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 9568: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF70C120000
2026-05-28 16:20:56,770 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 16:20:57,125 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 9568
2026-05-28 16:20:57,173 [lib.api.process] INFO: Monitor config for process 9568: C:\584fooce\dll\9568.ini
2026-05-28 16:20:57,202 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 6864, handle 0x22e4: Error obtaining target process name
2026-05-28 16:20:57,260 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:57,387 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:57,687 [root] DEBUG: 4280: api-cap: NtQueryInformationToken hook disabled due to count: 5000
2026-05-28 16:20:57,739 [root] DEBUG: Loader: Injecting process 9568 (thread 9572) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:57,940 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:58,092 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:58,336 [lib.api.process] INFO: Injected into 64-bit <Process 9568 dllhost.exe>
2026-05-28 16:20:58,581 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 9568
2026-05-28 16:20:58,637 [lib.api.process] INFO: Monitor config for process 9568: C:\584fooce\dll\9568.ini
2026-05-28 16:20:58,671 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:20:58,693 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:20:58,939 [root] DEBUG: Loader: Injecting process 9568 (thread 9572) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:58,961 [root] DEBUG: 4280: OpenProcessHandler: Image base for process 4112 (handle 0x2bbc): 0x00007FF6EF480000.
2026-05-28 16:20:59,006 [root] DEBUG: 4280: api-cap: GetSystemMetrics hook disabled due to count: 5001
2026-05-28 16:20:59,060 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:20:59,107 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 4112, handle 0x2bbc: C:\Windows\System32\conhost.exe
2026-05-28 16:20:59,141 [root] DEBUG: 4280: api-cap: GetSystemMetrics hook disabled due to count: 5000
2026-05-28 16:20:59,143 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:20:59,292 [lib.api.process] INFO: Injected into 64-bit <Process 9568 dllhost.exe>
2026-05-28 16:20:59,654 [root] DEBUG: 9568: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:20:59,767 [root] DEBUG: 4280: api-cap: RegOpenKeyExW hook disabled due to count: 5001
2026-05-28 16:20:59,797 [root] DEBUG: 4280: api-cap: RegOpenKeyExW hook disabled due to count: 5002
2026-05-28 16:20:59,800 [root] DEBUG: 9568: Interactive desktop enabled.
2026-05-28 16:20:59,840 [root] DEBUG: 4280: api-cap: RegOpenKeyExW hook disabled due to count: 5000
2026-05-28 16:20:59,880 [root] DEBUG: 4280: api-cap: RegOpenKeyExW hook disabled due to count: 5004
2026-05-28 16:20:59,938 [root] DEBUG: 4280: api-cap: RegOpenKeyExW hook disabled due to count: 5005
2026-05-28 16:20:59,963 [root] DEBUG: 4280: api-cap: RegOpenKeyExW hook disabled due to count: 5003
2026-05-28 16:21:00,035 [root] DEBUG: 9568: Dropped file limit defaulting to 100.
2026-05-28 16:21:00,221 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDFE10000: C:\Windows\System32\Windows.Energy (0x35000 bytes).
2026-05-28 16:21:00,644 [root] DEBUG: 9568: Disabling sleep skipping.
2026-05-28 16:21:00,695 [root] DEBUG: 4280: DLL loaded at 0x00007FFCDFE10000: C:\Windows\System32\Windows.Energy (0x35000 bytes).
2026-05-28 16:21:00,890 [root] DEBUG: 9568: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:21:01,104 [root] DEBUG: 9568: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:21:01,547 [root] DEBUG: 9568: YaraScan: Scanning 0x00007FF70C120000, size 0x8026
2026-05-28 16:21:01,964 [root] DEBUG: 9568: Monitor initialised: 64-bit capemon loaded in process 9568 at 0x00007FFCDE520000, thread 9572, image base 0x00007FF70C120000, stack from 0x0000004A0F144000-0x0000004A0F150000
2026-05-28 16:21:01,965 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 10000: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:21:02,328 [root] DEBUG: 9568: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 16:21:02,410 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 10000
2026-05-28 16:21:02,412 [lib.api.process] INFO: Monitor config for process 10000: C:\584fooce\dll\10000.ini
2026-05-28 16:21:02,437 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:02,705 [root] DEBUG: 9568: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:21:02,756 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:03,030 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:21:03,226 [root] DEBUG: Loader: Injecting process 10000 (thread 10004) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:03,419 [root] DEBUG: 9568: set_hooks: Unable to hook LockResource
2026-05-28 16:21:03,547 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:03,709 [root] DEBUG: 9568: Hooked 627 out of 628 functions
2026-05-28 16:21:03,906 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:04,086 [lib.api.process] INFO: Injected into 64-bit <Process 10000 SearchApp.exe>
2026-05-28 16:21:04,181 [root] DEBUG: 9568: Syscall hook installed, syscall logging level 1
2026-05-28 16:21:04,453 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 10000
2026-05-28 16:21:04,498 [lib.api.process] INFO: Monitor config for process 10000: C:\584fooce\dll\10000.ini
2026-05-28 16:21:04,509 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:04,712 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:04,966 [root] DEBUG: 9568: RestoreHeaders: Restored original import table.
2026-05-28 16:21:04,975 [root] DEBUG: Loader: Injecting process 10000 (thread 10004) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:05,041 [root] DEBUG: 4280: api-cap: NtQueryKey hook disabled due to count: 5001
2026-05-28 16:21:05,123 [root] DEBUG: 4280: api-cap: NtQueryKey hook disabled due to count: 5002
2026-05-28 16:21:05,135 [root] DEBUG: 4280: api-cap: NtQueryKey hook disabled due to count: 5000
2026-05-28 16:21:05,170 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:05,250 [root] DEBUG: 4280: api-cap: NtQueryKey hook disabled due to count: 5003
2026-05-28 16:21:05,451 [root] INFO: Loaded monitor into process with pid 9568
2026-05-28 16:21:05,751 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:05,936 [lib.api.process] INFO: Injected into 64-bit <Process 10000 SearchApp.exe>
2026-05-28 16:21:06,067 [root] DEBUG: 9568: caller_dispatch: Added region at 0x00007FF70C120000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF70C1212F2, thread 9572).
2026-05-28 16:21:06,347 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 10000
2026-05-28 16:21:06,419 [lib.api.process] INFO: Monitor config for process 10000: C:\584fooce\dll\10000.ini
2026-05-28 16:21:06,442 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:06,546 [root] DEBUG: 9568: YaraScan: Scanning 0x00007FF70C120000, size 0x8026
2026-05-28 16:21:06,716 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:06,941 [root] DEBUG: 9568: ProcessImageBase: Main module image at 0x00007FF70C120000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:21:07,241 [root] DEBUG: Loader: Injecting process 10000 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:07,315 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF9E40000: C:\Windows\System32\smartscreenps (0x52000 bytes).
2026-05-28 16:21:07,460 [root] DEBUG: 9568: DLL loaded at 0x00007FFD02610000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 16:21:07,614 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 10004, handle 0x120
2026-05-28 16:21:07,733 [root] DEBUG: 4280: DLL loaded at 0x00007FFCF9E40000: C:\Windows\System32\smartscreenps (0x52000 bytes).
2026-05-28 16:21:07,961 [root] DEBUG: 9568: DLL loaded at 0x00007FFD04CB0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 16:21:08,173 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:08,184 [root] DEBUG: 4280: api-cap: RegCloseKey hook disabled due to count: 5001
2026-05-28 16:21:08,256 [root] DEBUG: 4280: api-cap: RegCloseKey hook disabled due to count: 5000
2026-05-28 16:21:08,257 [root] DEBUG: 4280: api-cap: RegCloseKey hook disabled due to count: 5002
2026-05-28 16:21:08,441 [root] DEBUG: 4280: api-cap: RegCloseKey hook disabled due to count: 5003
2026-05-28 16:21:08,482 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:08,668 [root] DEBUG: 9568: DLL loaded at 0x00007FFD06E70000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 16:21:08,857 [lib.api.process] INFO: Injected into 64-bit <Process 10000 SearchApp.exe>
2026-05-28 16:21:08,859 [root] DEBUG: 4280: api-cap: RegCloseKey hook disabled due to count: 5004
2026-05-28 16:21:09,541 [root] DEBUG: 9568: DLL loaded at 0x00007FFD020F0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 16:21:10,005 [root] DEBUG: 4280: api-cap: NtOpenKeyEx hook disabled due to count: 5000
2026-05-28 16:21:10,214 [root] DEBUG: 4280: api-cap: NtOpenKeyEx hook disabled due to count: 5001
2026-05-28 16:21:10,362 [root] DEBUG: 9568: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:21:10,404 [root] DEBUG: 4280: api-cap: NtOpenKeyEx hook disabled due to count: 5002
2026-05-28 16:21:10,481 [root] DEBUG: 4280: api-cap: NtOpenKeyEx hook disabled due to count: 5003
2026-05-28 16:21:10,548 [root] DEBUG: 4280: api-cap: NtOpenKeyEx hook disabled due to count: 5004
2026-05-28 16:21:10,575 [root] DEBUG: 4280: api-cap: LdrpCallInitRoutine hook disabled due to count: 5000
2026-05-28 16:21:10,998 [root] DEBUG: 9568: DLL loaded at 0x00007FFCEDDA0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 16:21:11,001 [root] DEBUG: 4280: AllocationHandler: Allocation already in tracked region list: 0x00007DF4D0AE0000.
2026-05-28 16:21:11,314 [root] DEBUG: 4280: AllocationHandler: Allocation already in tracked region list: 0x00007DF4D0AD0000.
2026-05-28 16:21:11,327 [root] DEBUG: 9568: DLL loaded at 0x00007FFD01420000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 16:21:11,407 [root] DEBUG: 4280: AllocationHandler: Allocation already in tracked region list: 0x00007DF4D0AC0000.
2026-05-28 16:21:11,717 [root] DEBUG: 4280: AllocationHandler: Allocation already in tracked region list: 0x00007DF4D0AB0000.
2026-05-28 16:21:16,291 [root] DEBUG: 4280: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5000
2026-05-28 16:21:16,346 [root] DEBUG: 4280: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5001
2026-05-28 16:21:16,519 [root] DEBUG: 4280: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5004
2026-05-28 16:21:16,536 [root] DEBUG: 4280: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5003
2026-05-28 16:21:16,595 [root] DEBUG: 4280: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5002
2026-05-28 16:21:17,516 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 10312: C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe, ImageBase: 0x00007FF75F4D0000
2026-05-28 16:21:17,638 [root] INFO: Process with pid 9568 has terminated
2026-05-28 16:21:18,074 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 10312
2026-05-28 16:21:18,088 [lib.api.process] INFO: Monitor config for process 10312: C:\584fooce\dll\10312.ini
2026-05-28 16:21:18,108 [root] DEBUG: 9568: NtTerminateProcess hook: Attempting to dump process 9568
2026-05-28 16:21:18,202 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:18,232 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:18,528 [root] DEBUG: 9568: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:21:18,721 [root] DEBUG: Loader: Injecting process 10312 (thread 10316) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:19,228 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:19,745 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:20,073 [lib.api.process] INFO: Injected into 64-bit <Process 10312 CHXSmartScreen.exe>
2026-05-28 16:21:20,556 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 10312
2026-05-28 16:21:20,559 [lib.api.process] INFO: Monitor config for process 10312: C:\584fooce\dll\10312.ini
2026-05-28 16:21:20,561 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:20,569 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:21,082 [root] DEBUG: Loader: Injecting process 10312 (thread 10316) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:21,599 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:22,060 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:22,358 [lib.api.process] INFO: Injected into 64-bit <Process 10312 CHXSmartScreen.exe>
2026-05-28 16:21:22,958 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 10312
2026-05-28 16:21:22,960 [lib.api.process] INFO: Monitor config for process 10312: C:\584fooce\dll\10312.ini
2026-05-28 16:21:22,998 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:23,001 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:23,491 [root] DEBUG: Loader: Injecting process 10312 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:23,826 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 10316, handle 0x120
2026-05-28 16:21:24,111 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:24,607 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:24,850 [lib.api.process] INFO: Injected into 64-bit <Process 10312 CHXSmartScreen.exe>
2026-05-28 16:21:25,081 [root] DEBUG: 4280: OpenProcessHandler: Injection info created for process 11140, handle 0x2e54: C:\Windows\System32\rundll32.exe
2026-05-28 16:21:25,322 [root] DEBUG: 4280: DLL loaded at 0x00007FFD01770000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 16:21:25,450 [root] DEBUG: 4280: DLL loaded at 0x00007FFD01770000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 16:21:25,452 [root] INFO: Announced starting service "b'lfsvc'"
2026-05-28 16:21:26,177 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 11228: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF7F9C60000
2026-05-28 16:21:26,283 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 11228
2026-05-28 16:21:26,284 [lib.api.process] INFO: Monitor config for process 11228: C:\584fooce\dll\11228.ini
2026-05-28 16:21:26,435 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:26,438 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:26,643 [root] DEBUG: Loader: Injecting process 11228 (thread 11232) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:26,756 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:26,821 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:27,058 [lib.api.process] INFO: Injected into 64-bit <Process 11228 SecurityHealthHost.exe>
2026-05-28 16:21:27,232 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 11228
2026-05-28 16:21:27,234 [lib.api.process] INFO: Monitor config for process 11228: C:\584fooce\dll\11228.ini
2026-05-28 16:21:27,248 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:27,255 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:27,669 [lib.api.process] INFO: Injected into 64-bit <Process 11228 SecurityHealthHost.exe>
2026-05-28 16:21:27,920 [root] DEBUG: 11228: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:21:28,136 [root] DEBUG: 11228: Interactive desktop enabled.
2026-05-28 16:21:28,247 [root] DEBUG: 11228: Dropped file limit defaulting to 100.
2026-05-28 16:21:28,462 [root] DEBUG: 11228: Disabling sleep skipping.
2026-05-28 16:21:28,591 [root] DEBUG: 11228: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:21:28,734 [root] DEBUG: 11228: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:21:28,842 [root] DEBUG: 11228: YaraScan: Scanning 0x00007FF7F9C60000, size 0x19174
2026-05-28 16:21:28,953 [root] DEBUG: 11228: Monitor initialised: 64-bit capemon loaded in process 11228 at 0x00007FFCDE520000, thread 11232, image base 0x00007FF7F9C60000, stack from 0x000000C686574000-0x000000C686580000
2026-05-28 16:21:29,029 [root] DEBUG: 11228: Commandline: C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
2026-05-28 16:21:29,264 [root] DEBUG: 11228: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:21:29,341 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:21:29,404 [root] DEBUG: 11228: set_hooks: Unable to hook LockResource
2026-05-28 16:21:29,503 [root] DEBUG: 11228: Hooked 627 out of 628 functions
2026-05-28 16:21:29,606 [root] DEBUG: 11228: Syscall hook installed, syscall logging level 1
2026-05-28 16:21:29,733 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AA0000.
2026-05-28 16:21:29,838 [root] DEBUG: 11228: RestoreHeaders: Restored original import table.
2026-05-28 16:21:29,906 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:29,969 [root] INFO: Loaded monitor into process with pid 11228
2026-05-28 16:21:30,076 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AD0000.
2026-05-28 16:21:30,139 [root] DEBUG: 11228: caller_dispatch: Added region at 0x00007FF7F9C60000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF7F9C6D3B2, thread 11232).
2026-05-28 16:21:30,275 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:30,404 [root] DEBUG: 11228: YaraScan: Scanning 0x00007FF7F9C60000, size 0x19174
2026-05-28 16:21:30,457 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AB0000.
2026-05-28 16:21:30,521 [root] DEBUG: 11228: ProcessImageBase: Main module image at 0x00007FF7F9C60000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:21:30,664 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:30,952 [root] DEBUG: 11228: DLL loaded at 0x00007FFD02610000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 16:21:31,060 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AC0000.
2026-05-28 16:21:31,171 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:31,290 [root] DEBUG: 11228: DLL loaded at 0x00007FFD04CB0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 16:21:31,395 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AE0000.
2026-05-28 16:21:31,465 [root] DEBUG: 11228: DLL loaded at 0x00007FFD06E70000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 16:21:31,545 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:31,714 [root] DEBUG: 11228: DLL loaded at 0x00007FFD040A0000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-28 16:21:31,872 [root] DEBUG: 11228: DLL loaded at 0x00007FFD03870000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 16:21:32,014 [root] DEBUG: 11228: DLL loaded at 0x00007FFCF3220000: C:\Windows\system32\SecurityHealthAgent (0x6d000 bytes).
2026-05-28 16:21:32,220 [root] DEBUG: 11228: DLL loaded at 0x00007FFD01770000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 16:21:32,316 [root] DEBUG: 11228: DLL loaded at 0x00007FFCF2C30000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2026-05-28 16:21:32,419 [root] DEBUG: 11228: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:21:32,532 [root] DEBUG: 11228: DLL loaded at 0x00007FFD00F40000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 16:21:32,610 [root] DEBUG: 11228: DLL loaded at 0x00007FFD02430000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 16:21:32,732 [root] DEBUG: 768: DLL loaded at 0x00007FFCF5FE0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 16:21:32,858 [root] DEBUG: 11228: DLL loaded at 0x00007FFD00270000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 16:21:32,975 [root] DEBUG: 11228: DLL loaded at 0x00007FFCFF510000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 16:21:33,200 [root] DEBUG: 11228: DLL loaded at 0x00007FFCEF500000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 16:21:33,278 [root] DEBUG: 11228: DLL loaded at 0x00007FFCFFF60000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 16:21:33,347 [root] DEBUG: 11228: DLL loaded at 0x00007FFCFEA00000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 16:21:33,632 [root] DEBUG: 11228: DLL loaded at 0x00007FFCECA30000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-28 16:21:34,017 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 4512: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:21:34,108 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4512
2026-05-28 16:21:34,155 [lib.api.process] INFO: Monitor config for process 4512: C:\584fooce\dll\4512.ini
2026-05-28 16:21:34,337 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:34,596 [root] DEBUG: 4280: AllocationHandler: Allocation already in tracked region list: 0x00007DF4D0AE0000.
2026-05-28 16:21:34,685 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:34,781 [root] DEBUG: 4280: AllocationHandler: Allocation already in tracked region list: 0x00007DF4D0AD0000.
2026-05-28 16:21:34,853 [root] DEBUG: 11228: NtTerminateProcess hook: Attempting to dump process 11228
2026-05-28 16:21:35,045 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AD0000.
2026-05-28 16:21:35,161 [root] DEBUG: Loader: Injecting process 4512 (thread 4576) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:35,227 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:35,228 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:35,302 [root] DEBUG: 11228: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:21:35,406 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:35,407 [root] INFO: Process with pid 11228 appears to have terminated
2026-05-28 16:21:35,576 [root] INFO: Process with pid 11228 has terminated
2026-05-28 16:21:35,716 [root] DEBUG: 4280: FreeHandler: Address: 0x00007DF4D0AE0000.
2026-05-28 16:21:35,747 [lib.api.process] INFO: Injected into 64-bit <Process 4512 SearchApp.exe>
2026-05-28 16:21:35,780 [root] DEBUG: 4280: ScanForNonZero: Error - Supplied size zero.
2026-05-28 16:21:35,952 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4512
2026-05-28 16:21:35,956 [lib.api.process] INFO: Monitor config for process 4512: C:\584fooce\dll\4512.ini
2026-05-28 16:21:35,965 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:36,224 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:36,592 [root] DEBUG: Loader: Injecting process 4512 (thread 4576) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:36,697 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:36,790 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:37,106 [lib.api.process] INFO: Injected into 64-bit <Process 4512 SearchApp.exe>
2026-05-28 16:21:37,215 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4512
2026-05-28 16:21:37,262 [lib.api.process] INFO: Monitor config for process 4512: C:\584fooce\dll\4512.ini
2026-05-28 16:21:37,283 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:37,481 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:37,717 [root] DEBUG: Loader: Injecting process 4512 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:37,826 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 4576, handle 0x124
2026-05-28 16:21:37,990 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:38,115 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:38,354 [lib.api.process] INFO: Injected into 64-bit <Process 4512 SearchApp.exe>
2026-05-28 16:21:38,653 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 4168: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:21:38,826 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4168
2026-05-28 16:21:38,829 [lib.api.process] INFO: Monitor config for process 4168: C:\584fooce\dll\4168.ini
2026-05-28 16:21:38,921 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:39,163 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:39,733 [root] DEBUG: Loader: Injecting process 4168 (thread 3276) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:39,825 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:39,903 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:40,155 [lib.api.process] INFO: Injected into 64-bit <Process 4168 SearchApp.exe>
2026-05-28 16:21:40,371 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4168
2026-05-28 16:21:40,418 [lib.api.process] INFO: Monitor config for process 4168: C:\584fooce\dll\4168.ini
2026-05-28 16:21:40,442 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:40,778 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:41,156 [root] DEBUG: Loader: Injecting process 4168 (thread 3276) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:41,256 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:41,375 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:41,793 [lib.api.process] INFO: Injected into 64-bit <Process 4168 SearchApp.exe>
2026-05-28 16:21:41,966 [root] INFO: Process with pid 4168 has terminated
2026-05-28 16:21:46,624 [root] DEBUG: 4280: api-cap: NtQueryValueKey hook disabled due to count: 5002
2026-05-28 16:21:46,765 [root] DEBUG: 4280: api-cap: NtQueryValueKey hook disabled due to count: 5002
2026-05-28 16:21:46,825 [root] DEBUG: 4280: api-cap: NtQueryValueKey hook disabled due to count: 5002
2026-05-28 16:21:46,980 [root] DEBUG: 4280: api-cap: NtQueryValueKey hook disabled due to count: 5003
2026-05-28 16:21:48,312 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 1900: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:21:48,511 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1900
2026-05-28 16:21:48,513 [lib.api.process] INFO: Monitor config for process 1900: C:\584fooce\dll\1900.ini
2026-05-28 16:21:48,664 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:48,893 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:49,155 [root] DEBUG: Loader: Injecting process 1900 (thread 1856) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:49,219 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:49,362 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:49,498 [lib.api.process] INFO: Injected into 64-bit <Process 1900 SearchApp.exe>
2026-05-28 16:21:49,613 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1900
2026-05-28 16:21:49,660 [lib.api.process] INFO: Monitor config for process 1900: C:\584fooce\dll\1900.ini
2026-05-28 16:21:49,725 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:50,004 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:50,213 [root] DEBUG: Loader: Injecting process 1900 (thread 1856) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:50,288 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:50,385 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:50,579 [lib.api.process] INFO: Injected into 64-bit <Process 1900 SearchApp.exe>
2026-05-28 16:21:50,675 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1900
2026-05-28 16:21:50,684 [lib.api.process] INFO: Monitor config for process 1900: C:\584fooce\dll\1900.ini
2026-05-28 16:21:50,686 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:50,904 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:51,160 [root] DEBUG: Loader: Injecting process 1900 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:51,247 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 1856, handle 0x120
2026-05-28 16:21:51,286 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:51,384 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:51,579 [lib.api.process] INFO: Injected into 64-bit <Process 1900 SearchApp.exe>
2026-05-28 16:21:51,743 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 6320: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:21:51,874 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6320
2026-05-28 16:21:51,875 [lib.api.process] INFO: Monitor config for process 6320: C:\584fooce\dll\6320.ini
2026-05-28 16:21:51,968 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:52,206 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:52,597 [root] DEBUG: Loader: Injecting process 6320 (thread 4044) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:52,659 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:52,760 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:53,009 [lib.api.process] INFO: Injected into 64-bit <Process 6320 SearchApp.exe>
2026-05-28 16:21:53,070 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6320
2026-05-28 16:21:53,073 [lib.api.process] INFO: Monitor config for process 6320: C:\584fooce\dll\6320.ini
2026-05-28 16:21:53,075 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:53,280 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:53,549 [root] DEBUG: Loader: Injecting process 6320 (thread 4044) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:53,620 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:53,669 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:53,747 [lib.api.process] INFO: Injected into 64-bit <Process 6320 SearchApp.exe>
2026-05-28 16:21:53,807 [root] INFO: Process with pid 6320 has terminated
2026-05-28 16:21:57,170 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 1272: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:21:57,245 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1272
2026-05-28 16:21:57,248 [lib.api.process] INFO: Monitor config for process 1272: C:\584fooce\dll\1272.ini
2026-05-28 16:21:57,340 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:57,692 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:57,893 [root] DEBUG: Loader: Injecting process 1272 (thread 6824) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:58,032 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:21:58,064 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:58,348 [lib.api.process] INFO: Injected into 64-bit <Process 1272 SearchApp.exe>
2026-05-28 16:21:58,497 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1272
2026-05-28 16:21:58,500 [lib.api.process] INFO: Monitor config for process 1272: C:\584fooce\dll\1272.ini
2026-05-28 16:21:58,502 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:21:58,775 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:21:59,220 [root] DEBUG: Loader: Injecting process 1272 (thread 6824) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:59,362 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:21:59,508 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:21:59,736 [root] INFO: Announced starting service "b'BITS'"
2026-05-28 16:21:59,818 [lib.api.process] INFO: Injected into 64-bit <Process 1272 SearchApp.exe>
2026-05-28 16:21:59,915 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1272
2026-05-28 16:21:59,998 [lib.api.process] INFO: Monitor config for process 1272: C:\584fooce\dll\1272.ini
2026-05-28 16:22:00,000 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:00,229 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:00,797 [root] DEBUG: Loader: Injecting process 1272 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:00,875 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 6824, handle 0x120
2026-05-28 16:22:01,012 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:01,223 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:01,459 [lib.api.process] INFO: Injected into 64-bit <Process 1272 SearchApp.exe>
2026-05-28 16:22:01,705 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 11284: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:22:01,832 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11284
2026-05-28 16:22:01,837 [lib.api.process] INFO: Monitor config for process 11284: C:\584fooce\dll\11284.ini
2026-05-28 16:22:01,970 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:02,237 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:02,625 [root] DEBUG: Loader: Injecting process 11284 (thread 11288) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:02,722 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:02,876 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:03,313 [lib.api.process] INFO: Injected into 64-bit <Process 11284 SearchApp.exe>
2026-05-28 16:22:03,471 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11284
2026-05-28 16:22:03,483 [lib.api.process] INFO: Monitor config for process 11284: C:\584fooce\dll\11284.ini
2026-05-28 16:22:03,489 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:03,853 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:04,226 [root] DEBUG: Loader: Injecting process 11284 (thread 11288) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:04,307 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:04,377 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:04,735 [lib.api.process] INFO: Injected into 64-bit <Process 11284 SearchApp.exe>
2026-05-28 16:22:04,823 [root] INFO: Process with pid 11284 has terminated
2026-05-28 16:22:10,173 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 11500: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:22:10,345 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11500
2026-05-28 16:22:10,353 [lib.api.process] INFO: Monitor config for process 11500: C:\584fooce\dll\11500.ini
2026-05-28 16:22:10,465 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:10,840 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:11,104 [root] DEBUG: Loader: Injecting process 11500 (thread 11504) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:11,188 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:11,344 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:11,707 [lib.api.process] INFO: Injected into 64-bit <Process 11500 SearchApp.exe>
2026-05-28 16:22:11,787 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11500
2026-05-28 16:22:11,822 [lib.api.process] INFO: Monitor config for process 11500: C:\584fooce\dll\11500.ini
2026-05-28 16:22:11,827 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:12,150 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:12,440 [root] DEBUG: Loader: Injecting process 11500 (thread 11504) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:12,542 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:12,659 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:12,889 [lib.api.process] INFO: Injected into 64-bit <Process 11500 SearchApp.exe>
2026-05-28 16:22:12,973 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11500
2026-05-28 16:22:12,977 [lib.api.process] INFO: Monitor config for process 11500: C:\584fooce\dll\11500.ini
2026-05-28 16:22:13,043 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:13,295 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:13,707 [root] DEBUG: Loader: Injecting process 11500 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:13,848 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 11504, handle 0xec
2026-05-28 16:22:13,987 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:14,081 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:14,266 [lib.api.process] INFO: Injected into 64-bit <Process 11500 SearchApp.exe>
2026-05-28 16:22:14,564 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 11792: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:22:14,708 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11792
2026-05-28 16:22:14,714 [lib.api.process] INFO: Monitor config for process 11792: C:\584fooce\dll\11792.ini
2026-05-28 16:22:14,804 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:15,007 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:15,313 [root] DEBUG: Loader: Injecting process 11792 (thread 11796) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:15,446 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:15,529 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:15,721 [lib.api.process] INFO: Injected into 64-bit <Process 11792 SearchApp.exe>
2026-05-28 16:22:15,815 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11792
2026-05-28 16:22:15,817 [lib.api.process] INFO: Monitor config for process 11792: C:\584fooce\dll\11792.ini
2026-05-28 16:22:15,820 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:16,308 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:16,667 [root] DEBUG: Loader: Injecting process 11792 (thread 11796) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:16,766 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:16,836 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:17,055 [lib.api.process] INFO: Injected into 64-bit <Process 11792 SearchApp.exe>
2026-05-28 16:22:17,167 [root] INFO: Process with pid 11792 has terminated
2026-05-28 16:22:25,136 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEF660000: C:\Windows\System32\Windows.CloudStore.Schema.Shell (0xf4000 bytes).
2026-05-28 16:22:25,261 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 11980: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:22:25,388 [root] DEBUG: 4280: DLL loaded at 0x00007FFCEF660000: C:\Windows\System32\Windows.CloudStore.Schema.Shell (0xf4000 bytes).
2026-05-28 16:22:25,530 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11980
2026-05-28 16:22:25,535 [lib.api.process] INFO: Monitor config for process 11980: C:\584fooce\dll\11980.ini
2026-05-28 16:22:25,624 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:26,009 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:26,391 [root] DEBUG: Loader: Injecting process 11980 (thread 11984) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:26,465 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:26,554 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:26,792 [lib.api.process] INFO: Injected into 64-bit <Process 11980 SearchApp.exe>
2026-05-28 16:22:26,903 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11980
2026-05-28 16:22:26,981 [lib.api.process] INFO: Monitor config for process 11980: C:\584fooce\dll\11980.ini
2026-05-28 16:22:27,008 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:27,356 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:27,593 [root] DEBUG: Loader: Injecting process 11980 (thread 11984) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:27,703 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:27,766 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:28,073 [lib.api.process] INFO: Injected into 64-bit <Process 11980 SearchApp.exe>
2026-05-28 16:22:28,226 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 11980
2026-05-28 16:22:28,243 [lib.api.process] INFO: Monitor config for process 11980: C:\584fooce\dll\11980.ini
2026-05-28 16:22:28,274 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:28,652 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:29,012 [root] DEBUG: Loader: Injecting process 11980 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:29,144 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 11984, handle 0x120
2026-05-28 16:22:29,227 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:29,401 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:29,823 [lib.api.process] INFO: Injected into 64-bit <Process 11980 SearchApp.exe>
2026-05-28 16:22:30,104 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 12196: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:22:30,221 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 12196
2026-05-28 16:22:30,223 [lib.api.process] INFO: Monitor config for process 12196: C:\584fooce\dll\12196.ini
2026-05-28 16:22:30,293 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:30,561 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:30,751 [root] DEBUG: Loader: Injecting process 12196 (thread 12200) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:30,827 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:30,917 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:31,403 [lib.api.process] INFO: Injected into 64-bit <Process 12196 SearchApp.exe>
2026-05-28 16:22:31,498 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 12196
2026-05-28 16:22:31,501 [lib.api.process] INFO: Monitor config for process 12196: C:\584fooce\dll\12196.ini
2026-05-28 16:22:31,504 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:31,827 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:32,357 [root] DEBUG: Loader: Injecting process 12196 (thread 12200) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:32,453 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:32,594 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:32,696 [lib.api.process] INFO: Injected into 64-bit <Process 12196 SearchApp.exe>
2026-05-28 16:22:32,791 [root] INFO: Process with pid 12196 has terminated
2026-05-28 16:22:40,573 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 5896: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF7459E0000
2026-05-28 16:22:40,657 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 5896
2026-05-28 16:22:40,662 [lib.api.process] INFO: Monitor config for process 5896: C:\584fooce\dll\5896.ini
2026-05-28 16:22:40,748 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:40,972 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:41,259 [root] DEBUG: Loader: Injecting process 5896 (thread 11412) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:41,390 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:41,518 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:41,718 [lib.api.process] INFO: Injected into 64-bit <Process 5896 SearchApp.exe>
2026-05-28 16:22:41,796 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 5896
2026-05-28 16:22:41,803 [lib.api.process] INFO: Monitor config for process 5896: C:\584fooce\dll\5896.ini
2026-05-28 16:22:41,808 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:42,103 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:42,337 [root] DEBUG: Loader: Injecting process 5896 (thread 11412) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:42,439 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:42,493 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:42,794 [lib.api.process] INFO: Injected into 64-bit <Process 5896 SearchApp.exe>
2026-05-28 16:22:42,933 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 5896
2026-05-28 16:22:43,009 [lib.api.process] INFO: Monitor config for process 5896: C:\584fooce\dll\5896.ini
2026-05-28 16:22:43,056 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:43,390 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:43,733 [root] DEBUG: Loader: Injecting process 5896 with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:43,906 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 11412, handle 0xec
2026-05-28 16:22:50,141 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 16:22:50,200 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:50,430 [lib.api.process] INFO: Injected into 64-bit <Process 5896 SearchApp.exe>
2026-05-28 16:22:50,884 [root] DEBUG: 768: CreateProcessHandler: Injection info set for new process 11712: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF70C120000
2026-05-28 16:22:51,394 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 11712
2026-05-28 16:22:51,395 [lib.api.process] INFO: Monitor config for process 11712: C:\584fooce\dll\11712.ini
2026-05-28 16:22:51,610 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:51,614 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:51,657 [root] DEBUG: 4280: api-cap: NtWaitForSingleObject hook disabled due to count: 5001
2026-05-28 16:22:51,700 [root] DEBUG: 4280: api-cap: NtWaitForSingleObject hook disabled due to count: 5002
2026-05-28 16:22:51,793 [root] DEBUG: 4280: api-cap: NtWaitForSingleObject hook disabled due to count: 5001
2026-05-28 16:22:51,940 [root] DEBUG: Loader: Injecting process 11712 (thread 11660) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:52,036 [root] DEBUG: 4280: api-cap: NtWaitForSingleObject hook disabled due to count: 5003
2026-05-28 16:22:52,165 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:52,693 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:52,893 [lib.api.process] INFO: Injected into 64-bit <Process 11712 dllhost.exe>
2026-05-28 16:22:53,134 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 11712
2026-05-28 16:22:53,197 [lib.api.process] INFO: Monitor config for process 11712: C:\584fooce\dll\11712.ini
2026-05-28 16:22:53,295 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 16:22:53,300 [lib.api.process] INFO: 64-bit DLL to inject is C:\584fooce\dll\ysbwLP.dll, loader C:\584fooce\bin\audCHNzo.exe
2026-05-28 16:22:53,526 [root] DEBUG: Loader: Injecting process 11712 (thread 11660) with C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:53,665 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 16:22:53,791 [root] DEBUG: Successfully injected DLL C:\584fooce\dll\ysbwLP.dll.
2026-05-28 16:22:54,087 [lib.api.process] INFO: Injected into 64-bit <Process 11712 dllhost.exe>
2026-05-28 16:22:54,481 [root] DEBUG: 11712: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 16:22:54,682 [root] DEBUG: 11712: Interactive desktop enabled.
2026-05-28 16:22:54,729 [root] DEBUG: 11712: Dropped file limit defaulting to 100.
2026-05-28 16:22:54,969 [root] DEBUG: 11712: Disabling sleep skipping.
2026-05-28 16:22:55,015 [root] DEBUG: 11712: YaraInit: Compiled rules loaded from existing file C:\584fooce\data\yara\capemon.yac
2026-05-28 16:22:55,227 [root] DEBUG: 11712: RtlInsertInvertedFunctionTable 0x00007FFD0706090E, LdrpInvertedFunctionTableSRWLock 0x00007FFD071BD4F0
2026-05-28 16:22:55,385 [root] DEBUG: 11712: YaraScan: Scanning 0x00007FF70C120000, size 0x8026
2026-05-28 16:22:55,525 [root] DEBUG: 11712: Monitor initialised: 64-bit capemon loaded in process 11712 at 0x00007FFCDE520000, thread 11660, image base 0x00007FF70C120000, stack from 0x0000009A9A4F4000-0x0000009A9A500000
2026-05-28 16:22:55,666 [root] DEBUG: 11712: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 16:22:55,782 [root] DEBUG: 11712: hook_api: LdrpCallInitRoutine export address 0x00007FFD070699BC obtained via GetFunctionAddress
2026-05-28 16:22:55,930 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 16:22:56,103 [root] DEBUG: 11712: set_hooks: Unable to hook LockResource
2026-05-28 16:22:56,165 [root] DEBUG: 11712: Hooked 627 out of 628 functions
2026-05-28 16:22:56,322 [root] DEBUG: 11712: Syscall hook installed, syscall logging level 1
2026-05-28 16:22:56,477 [root] DEBUG: 11712: RestoreHeaders: Restored original import table.
2026-05-28 16:22:56,559 [root] INFO: Loaded monitor into process with pid 11712
2026-05-28 16:22:56,667 [root] DEBUG: 11712: caller_dispatch: Added region at 0x00007FF70C120000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF70C1212F2, thread 11660).
2026-05-28 16:22:56,744 [root] DEBUG: 11712: YaraScan: Scanning 0x00007FF70C120000, size 0x8026
2026-05-28 16:22:56,778 [root] DEBUG: 11712: ProcessImageBase: Main module image at 0x00007FF70C120000 unmodified (entropy change 0.000000e+00)
2026-05-28 16:22:56,930 [root] DEBUG: 11712: DLL loaded at 0x00007FFD02610000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 16:22:57,080 [root] DEBUG: 11712: DLL loaded at 0x00007FFD04CB0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 16:22:57,275 [root] DEBUG: 11712: DLL loaded at 0x00007FFD06E70000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 16:22:57,631 [root] DEBUG: 11712: DLL loaded at 0x00007FFD020F0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 16:22:58,123 [root] DEBUG: 11712: DLL loaded at 0x00007FFD050B0000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 16:22:58,180 [root] DEBUG: 11712: DLL loaded at 0x00007FFCEDDA0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 16:22:58,293 [root] DEBUG: 11712: DLL loaded at 0x00007FFD01420000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 16:22:59,902 [root] DEBUG: 4280: api-cap: NtOpenProcessToken hook disabled due to count: 5000
2026-05-28 16:23:04,754 [root] INFO: Process with pid 11712 has terminated
2026-05-28 16:23:04,840 [root] DEBUG: 11712: NtTerminateProcess hook: Attempting to dump process 11712
2026-05-28 16:23:04,948 [root] DEBUG: 11712: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:23:11,171 [root] INFO: Analysis timeout hit, terminating analysis
2026-05-28 16:23:11,184 [lib.api.process] INFO: Terminate event set for process 768
2026-05-28 16:23:11,246 [root] DEBUG: 768: Terminate Event: Attempting to dump process 768
2026-05-28 16:23:11,501 [root] DEBUG: 768: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 16:23:11,547 [lib.api.process] INFO: Termination confirmed for process 768
2026-05-28 16:23:11,549 [root] INFO: Terminate event set for process 768
2026-05-28 16:23:11,551 [lib.api.process] INFO: Terminate event set for process 4280
2026-05-28 16:23:11,603 [lib.api.process] INFO: Termination confirmed for process 4280
2026-05-28 16:23:11,604 [root] INFO: Terminate event set for process 4280
2026-05-28 16:23:11,623 [root] INFO: Created shutdown mutex
2026-05-28 16:23:11,660 [root] DEBUG: 768: Terminate Event: monitor shutdown complete for process 768
2026-05-28 16:23:12,697 [root] INFO: Shutting down package
2026-05-28 16:23:12,787 [root] INFO: Stopping auxiliary modules
2026-05-28 16:23:12,801 [root] INFO: Stopping auxiliary module: Browser
2026-05-28 16:23:12,808 [root] INFO: Stopping auxiliary module: Human
2026-05-28 16:23:12,812 [root] INFO: Stopping auxiliary module: Screenshots
2026-05-28 16:23:12,816 [root] INFO: Finishing auxiliary modules
2026-05-28 16:23:12,817 [root] INFO: Shutting down pipe server and dumping dropped files
2026-05-28 16:23:12,822 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db to files\a4ebc81a9c57198fb335eedda59cfe464688c8eb73823812da8b93f505b5c6b6; Size is 29232; Max size: 100000000
2026-05-28 16:23:12,845 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db to files\0abf58cef7555386b0d95e2b1cf4ba4fafbee6ce84d90ece6f5e02873f9cebca; Size is 1048576; Max size: 100000000
2026-05-28 16:23:12,851 [root] WARNING: Folder at path "C:\fmJyiQT\debugger" does not exist, skipping
2026-05-28 16:23:12,872 [root] WARNING: Folder at path "C:\fmJyiQT\tlsdump" does not exist, skipping
2026-05-28 16:23:12,908 [root] WARNING: Monitor injection attempted but failed for process 6868
2026-05-28 16:23:12,949 [root] WARNING: Monitor injection attempted but failed for process 5348
2026-05-28 16:23:13,040 [root] WARNING: Monitor injection attempted but failed for process 7244
2026-05-28 16:23:13,041 [root] WARNING: Monitor injection attempted but failed for process 8108
2026-05-28 16:23:13,075 [root] WARNING: Monitor injection attempted but failed for process 7516
2026-05-28 16:23:13,078 [root] WARNING: Monitor injection attempted but failed for process 3524
2026-05-28 16:23:13,084 [root] WARNING: Monitor injection attempted but failed for process 6816
2026-05-28 16:23:13,095 [root] WARNING: Monitor injection attempted but failed for process 3128
2026-05-28 16:23:13,100 [root] WARNING: Monitor injection attempted but failed for process 10000
2026-05-28 16:23:13,107 [root] WARNING: Monitor injection attempted but failed for process 10312
2026-05-28 16:23:13,120 [root] WARNING: Monitor injection attempted but failed for process 4512
2026-05-28 16:23:13,127 [root] WARNING: Monitor injection attempted but failed for process 4168
2026-05-28 16:23:13,131 [root] WARNING: Monitor injection attempted but failed for process 1900
2026-05-28 16:23:13,137 [root] WARNING: Monitor injection attempted but failed for process 6320
2026-05-28 16:23:13,142 [root] WARNING: Monitor injection attempted but failed for process 1272
2026-05-28 16:23:13,150 [root] WARNING: Monitor injection attempted but failed for process 11284
2026-05-28 16:23:13,152 [root] WARNING: Monitor injection attempted but failed for process 11500
2026-05-28 16:23:13,165 [root] WARNING: Monitor injection attempted but failed for process 11792
2026-05-28 16:23:13,225 [root] WARNING: Monitor injection attempted but failed for process 11980
2026-05-28 16:23:13,233 [root] WARNING: Monitor injection attempted but failed for process 12196
2026-05-28 16:23:13,243 [root] WARNING: Monitor injection attempted but failed for process 5896
2026-05-28 16:23:13,246 [root] INFO: Analysis completed
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| cuckoo1 | cuckoo1 | KVM | 2026-05-28 16:19:36 | 2026-05-28 16:23:16 | none |
Seek in progress...
No results found.
No behavioral analysis data available.
No dropped files found.
No CAPE payloads found.