Analysis Log

2026-03-05 20:34:37,304 [root] INFO: Date set to: 20260329T10:56:30, timeout set to: 600
2026-03-29 10:56:30,111 [root] DEBUG: Starting analyzer from: C:\ltb6yatm
2026-03-29 10:56:30,174 [root] DEBUG: Storing results at: C:\atsPQMC
2026-03-29 10:56:30,221 [root] DEBUG: Pipe server name: \\.\PIPE\HAyCBZRUua
2026-03-29 10:56:30,315 [root] DEBUG: Python path: C:\Python310
2026-03-29 10:56:30,377 [root] INFO: analysis running as an admin
2026-03-29 10:56:30,408 [root] INFO: analysis package specified: "vbs"
2026-03-29 10:56:30,518 [root] DEBUG: importing analysis package module: "modules.packages.vbs"...
2026-03-29 10:56:30,611 [root] DEBUG: imported analysis package "vbs"
2026-03-29 10:56:30,658 [root] DEBUG: initializing analysis package "vbs"...
2026-03-29 10:56:30,721 [lib.common.common] INFO: wrapping
2026-03-29 10:56:30,737 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation
2026-03-29 10:56:30,752 [root] DEBUG: New location of moved file: C:\Users\cape\AppData\Local\Temp\rknrl_1_.vbs
2026-03-29 10:56:30,752 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a DLL option
2026-03-29 10:56:30,768 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a DLL_64 option
2026-03-29 10:56:30,783 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a loader option
2026-03-29 10:56:30,783 [root] INFO: Analyzer: Package modules.packages.vbs does not specify a loader_64 option
2026-03-29 10:56:30,924 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-03-29 10:56:30,971 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-03-29 10:56:31,018 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-03-29 10:56:31,096 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-03-29 10:56:31,221 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-03-29 10:56:31,221 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2026-03-29 10:56:31,237 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2026-03-29 10:56:31,284 [lib.api.screenshot] INFO: Please upgrade Pillow to >= 5.4.1 for best performance
2026-03-29 10:56:31,299 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-03-29 10:56:31,299 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-03-29 10:56:31,299 [root] DEBUG: Initialized auxiliary module "Browser"
2026-03-29 10:56:31,299 [root] DEBUG: attempting to configure 'Browser' from data
2026-03-29 10:56:31,315 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-03-29 10:56:31,330 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-03-29 10:56:31,330 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-03-29 10:56:31,346 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-03-29 10:56:31,346 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-03-29 10:56:31,346 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-03-29 10:56:31,361 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-03-29 10:56:31,361 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature
2026-03-29 10:56:32,533 [modules.auxiliary.digisig] DEBUG: File is not signed
2026-03-29 10:56:32,533 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2026-03-29 10:56:32,565 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-03-29 10:56:32,565 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-03-29 10:56:32,565 [root] DEBUG: attempting to configure 'Disguise' from data
2026-03-29 10:56:32,565 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-03-29 10:56:32,565 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-03-29 10:56:32,596 [modules.auxiliary.disguise] INFO: Disguising GUID to 3aa9b531-8df5-4c32-b2ca-1777ff41603b
2026-03-29 10:56:32,658 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-03-29 10:56:32,658 [root] DEBUG: Initialized auxiliary module "Human"
2026-03-29 10:56:32,674 [root] DEBUG: attempting to configure 'Human' from data
2026-03-29 10:56:32,674 [root] DEBUG: module Human does not support data configuration, ignoring
2026-03-29 10:56:32,674 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-03-29 10:56:32,690 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-03-29 10:56:32,690 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-03-29 10:56:32,690 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-03-29 10:56:32,690 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-03-29 10:56:32,690 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-03-29 10:56:32,705 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-03-29 10:56:32,721 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-03-29 10:56:32,721 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-03-29 10:56:32,721 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-03-29 10:56:32,736 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-03-29 10:56:32,736 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 644
2026-03-29 10:56:32,987 [lib.api.process] INFO: Monitor config for <Process 644 lsass.exe>: C:\ltb6yatm\dll\644.ini
2026-03-29 10:56:33,002 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2026-03-29 10:56:33,080 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:56:33,190 [root] DEBUG: Loader: Injecting process 644 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:56:33,549 [root] DEBUG: 644: Python path set to 'C:\Python310'.
2026-03-29 10:56:33,565 [root] DEBUG: 644: Disabling sleep skipping.
2026-03-29 10:56:33,565 [root] DEBUG: 644: TLS secret dump mode enabled.
2026-03-29 10:56:33,877 [root] DEBUG: 644: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:56:33,893 [root] DEBUG: 644: Monitor initialised: 64-bit capemon loaded in process 644 at 0x00007FFEABE00000, thread 2888, image base 0x00007FF7C23E0000, stack from 0x0000008E4CA71000-0x0000008E4CA80000
2026-03-29 10:56:33,893 [root] DEBUG: 644: Commandline: C:\Windows\system32\lsass.exe
2026-03-29 10:56:33,940 [root] DEBUG: 644: Hooked 5 out of 5 functions
2026-03-29 10:56:33,940 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-03-29 10:56:33,940 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:56:34,612 [root] DEBUG: 644: TLS 1.2 secrets logged to: C:\atsPQMC\tlsdump\tlsdump.log
2026-03-29 10:56:35,033 [lib.api.process] INFO: Injected into 64-bit <Process 644 lsass.exe>
2026-03-29 10:56:35,033 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-03-29 10:57:09,487 [root] INFO: Restarting WMI Service
2026-03-29 10:57:09,565 [root] DEBUG: package modules.packages.vbs does not support configure, ignoring
2026-03-29 10:57:09,565 [root] WARNING: configuration error for package modules.packages.vbs: error importing data.packages.vbs: No module named 'data.packages'
2026-03-29 10:57:09,565 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation
2026-03-29 10:57:09,658 [lib.api.process] INFO: Successfully executed process from path "C:\Windows\system32\wscript.exe" with arguments ""C:\Users\cape\AppData\Local\Temp\rknrl_1_.vbs"" with pid 4364
2026-03-29 10:57:09,658 [lib.api.process] INFO: Monitor config for <Process 4364 wscript.exe>: C:\ltb6yatm\dll\4364.ini
2026-03-29 10:57:09,674 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:57:09,799 [root] DEBUG: Loader: Injecting process 4364 (thread 5996) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:09,908 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:09,908 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:09,924 [lib.api.process] INFO: Injected into 32-bit <Process 4364 wscript.exe>
2026-03-29 10:57:11,940 [lib.api.process] INFO: Successfully resumed <Process 4364 wscript.exe>
2026-03-29 10:57:12,330 [root] DEBUG: 4364: Python path set to 'C:\Python310'.
2026-03-29 10:57:12,346 [root] DEBUG: 4364: Disabling sleep skipping.
2026-03-29 10:57:12,346 [root] DEBUG: 4364: Dropped file limit defaulting to 100.
2026-03-29 10:57:12,346 [root] DEBUG: 4364: wscript hook set enabled
2026-03-29 10:57:12,409 [root] DEBUG: 4364: YaraInit: Compiled 44 rule files
2026-03-29 10:57:12,424 [root] DEBUG: 4364: YaraInit: Compiled rules saved to file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:12,424 [root] DEBUG: 4364: YaraScan: Scanning 0x00130000, size 0x26996
2026-03-29 10:57:12,440 [root] DEBUG: 4364: Monitor initialised: 32-bit capemon loaded in process 4364 at 0x73f00000, thread 5996, image base 0x130000, stack from 0x24f2000-0x2500000
2026-03-29 10:57:12,455 [root] DEBUG: 4364: Commandline: "C:\Windows\system32\wscript.exe" "C:\Users\cape\AppData\Local\Temp\rknrl_1_.vbs"
2026-03-29 10:57:12,533 [root] DEBUG: 4364: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:57:12,736 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:57:12,736 [root] DEBUG: 4364: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:57:12,752 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:57:12,752 [root] DEBUG: 4364: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:57:12,783 [root] DEBUG: 4364: Hooked 630 out of 632 functions
2026-03-29 10:57:12,799 [root] DEBUG: 4364: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:12,830 [root] DEBUG: 4364: RestoreHeaders: Restored original import table.
2026-03-29 10:57:12,846 [root] INFO: Loaded monitor into process with pid 4364
2026-03-29 10:57:12,862 [root] DEBUG: 4364: caller_dispatch: Added region at 0x00130000 to tracked regions list (ntdll::NtQueryLicenseValue returns to 0x0014539F, thread 5996).
2026-03-29 10:57:12,862 [root] DEBUG: 4364: YaraScan: Scanning 0x00130000, size 0x26996
2026-03-29 10:57:12,862 [root] DEBUG: 4364: ProcessImageBase: Main module image at 0x00130000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:57:13,065 [root] DEBUG: 4364: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 5996).
2026-03-29 10:57:13,065 [root] DEBUG: 4364: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:13,080 [root] DEBUG: 4364: set_hooks_by_export_directory: Hooked 0 out of 632 functions
2026-03-29 10:57:13,080 [root] DEBUG: 4364: DLL loaded at 0x75250000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-03-29 10:57:13,096 [root] DEBUG: 4364: DLL loaded at 0x76D80000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-03-29 10:57:13,096 [root] DEBUG: 4364: DLL loaded at 0x745D0000: C:\Windows\system32\uxtheme (0x74000 bytes).
2026-03-29 10:57:13,221 [root] DEBUG: 4364: DLL loaded at 0x73E70000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-03-29 10:57:13,237 [root] DEBUG: 4364: DLL loaded at 0x76BA0000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-03-29 10:57:13,252 [root] DEBUG: 4364: DLL loaded at 0x77400000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-03-29 10:57:13,518 [root] DEBUG: 4364: DLL loaded at 0x73DE0000: C:\Windows\System32\vbscript (0x86000 bytes).
2026-03-29 10:57:13,533 [root] DEBUG: 4364: DLL loaded at 0x73DC0000: C:\Windows\SYSTEM32\amsi (0x19000 bytes).
2026-03-29 10:57:13,533 [root] DEBUG: 4364: DEBUG:Initialized 9 com hooks
2026-03-29 10:57:13,549 [root] DEBUG: 4364: DLL loaded at 0x756D0000: C:\Windows\SYSTEM32\WLDP (0x27000 bytes).
2026-03-29 10:57:13,549 [root] DEBUG: 4364: DLL loaded at 0x77DD0000: C:\Windows\System32\WINTRUST (0x4e000 bytes).
2026-03-29 10:57:13,549 [root] DEBUG: 4364: DLL loaded at 0x73DB0000: C:\Windows\System32\MSASN1 (0xe000 bytes).
2026-03-29 10:57:13,565 [root] DEBUG: 4364: DLL loaded at 0x75280000: C:\Windows\System32\CRYPTSP (0x13000 bytes).
2026-03-29 10:57:13,565 [root] DEBUG: 4364: DLL loaded at 0x74C10000: C:\Windows\system32\rsaenh (0x2f000 bytes).
2026-03-29 10:57:13,580 [root] DEBUG: 4364: DLL loaded at 0x73DA0000: C:\Windows\System32\MSISIP (0x10000 bytes).
2026-03-29 10:57:13,596 [root] DEBUG: 4364: DLL loaded at 0x77590000: C:\Windows\System32\SHELL32 (0x5b5000 bytes).
2026-03-29 10:57:13,596 [root] DEBUG: 4364: DLL loaded at 0x73D80000: C:\Windows\System32\wshext (0x18000 bytes).
2026-03-29 10:57:13,612 [root] DEBUG: 4364: DLL loaded at 0x73D40000: C:\Windows\System32\scrobj (0x36000 bytes).
2026-03-29 10:57:13,861 [root] DEBUG: 4364: DLL loaded at 0x73BF0000: C:\Windows\System32\msxml3 (0x14f000 bytes).
2026-03-29 10:57:18,752 [root] DEBUG: 4364: api-cap: VbsMid hook disabled due to count: 5000
2026-03-29 10:57:18,783 [root] DEBUG: 4364: api-rate-cap: VbsInStr hook disabled due to rate
2026-03-29 10:57:19,518 [root] DEBUG: 4364: api-cap: VbsChr hook disabled due to count: 5000
2026-03-29 10:57:19,533 [root] DEBUG: 4364: api-cap: VbsMidB hook disabled due to count: 5000
2026-03-29 10:57:19,549 [root] DEBUG: 4364: api-cap: VbsAscB hook disabled due to count: 5000
2026-03-29 10:57:20,721 [root] DEBUG: 4364: DLL loaded at 0x73BA0000: C:\Windows\System32\MPR (0x19000 bytes).
2026-03-29 10:57:20,721 [root] DEBUG: 4364: DLL loaded at 0x73B70000: C:\Windows\System32\ScrRun (0x30000 bytes).
2026-03-29 10:57:20,736 [root] DEBUG: 4364: DLL loaded at 0x73BC0000: C:\Windows\System32\wshom.ocx (0x23000 bytes).
2026-03-29 10:57:21,362 [root] DEBUG: 4364: DLL loaded at 0x75700000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes).
2026-03-29 10:57:21,377 [root] DEBUG: 4364: DLL loaded at 0x76F70000: C:\Windows\System32\SHCORE (0x87000 bytes).
2026-03-29 10:57:21,690 [root] DEBUG: 4364: DLL loaded at 0x73AA0000: C:\Windows\system32\propsys (0xc2000 bytes).
2026-03-29 10:57:22,049 [root] DEBUG: 4364: DLL loaded at 0x77480000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes).
2026-03-29 10:57:22,580 [root] DEBUG: 4364: DLL loaded at 0x75260000: C:\Windows\System32\profapi (0x18000 bytes).
2026-03-29 10:57:29,315 [root] DEBUG: 4364: DLL loaded at 0x73A80000: C:\Windows\System32\edputil (0x1b000 bytes).
2026-03-29 10:57:29,346 [lib.api.process] INFO: Monitor config for <Process 752 svchost.exe>: C:\ltb6yatm\dll\752.ini
2026-03-29 10:57:29,346 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:29,393 [root] DEBUG: Loader: Injecting process 752 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:29,393 [root] DEBUG: 752: Python path set to 'C:\Python310'.
2026-03-29 10:57:29,408 [root] DEBUG: 752: Disabling sleep skipping.
2026-03-29 10:57:29,408 [root] DEBUG: 752: Dropped file limit defaulting to 100.
2026-03-29 10:57:29,408 [root] DEBUG: 752: Services hook set enabled
2026-03-29 10:57:29,425 [root] DEBUG: 752: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:29,455 [root] DEBUG: 752: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:57:29,455 [root] DEBUG: 752: Monitor initialised: 64-bit capemon loaded in process 752 at 0x00007FFEABE00000, thread 1820, image base 0x00007FF7AB6E0000, stack from 0x000000AE373F4000-0x000000AE37400000
2026-03-29 10:57:29,455 [root] DEBUG: 752: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-03-29 10:57:29,502 [root] DEBUG: 752: Hooked 69 out of 69 functions
2026-03-29 10:57:29,611 [root] INFO: Loaded monitor into process with pid 752
2026-03-29 10:57:29,627 [root] INFO: Announced 64-bit process name: GameBarFTServer.exe pid: 7372
2026-03-29 10:57:29,627 [lib.api.process] INFO: Monitor config for <Process 7372 GameBarFTServer.exe>: C:\ltb6yatm\dll\7372.ini
2026-03-29 10:57:29,627 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-03-29 10:57:29,643 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:29,643 [lib.api.process] INFO: Injected into 64-bit <Process 752 svchost.exe>
2026-03-29 10:57:30,768 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4632: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x00007FF6402C0000
2026-03-29 10:57:30,768 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 4632
2026-03-29 10:57:30,783 [lib.api.process] INFO: Monitor config for <Process 4632 WmiPrvSE.exe>: C:\ltb6yatm\dll\4632.ini
2026-03-29 10:57:30,924 [root] INFO: Announced starting service "b'BcastDVRUserService_4343c'"
2026-03-29 10:57:30,940 [lib.api.process] INFO: Monitor config for <Process 632 services.exe>: C:\ltb6yatm\dll\632.ini
2026-03-29 10:57:31,377 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5548: C:\Windows\System32\RuntimeBroker.exe, ImageBase: 0x00007FF621170000
2026-03-29 10:57:31,393 [root] INFO: Announced 64-bit process name: RuntimeBroker.exe pid: 5548
2026-03-29 10:57:31,393 [lib.api.process] INFO: Monitor config for <Process 5548 RuntimeBroker.exe>: C:\ltb6yatm\dll\5548.ini
2026-03-29 10:57:31,893 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:31,924 [root] DEBUG: Loader: Injecting process 632 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,080 [root] DEBUG: Loader: Copied config file C:\ltb6yatm\dll\632.ini to system path C:\632.ini
2026-03-29 10:57:32,096 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 632 C:\ltb6yatm\dll\xzHEKGQ.dll
2026-03-29 10:57:32,096 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,112 [lib.api.process] INFO: Injected into 64-bit <Process 632 services.exe>
2026-03-29 10:57:32,127 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:32,162 [root] DEBUG: 4364: DLL loaded at 0x739E0000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2026-03-29 10:57:32,162 [root] DEBUG: Loader: Injecting process 5548 (thread 1636) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,174 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:32,174 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,174 [lib.api.process] INFO: Injected into 64-bit <Process 5548 RuntimeBroker.exe>
2026-03-29 10:57:32,174 [root] INFO: Announced 64-bit process name: RuntimeBroker.exe pid: 5548
2026-03-29 10:57:32,174 [lib.api.process] INFO: Monitor config for <Process 5548 RuntimeBroker.exe>: C:\ltb6yatm\dll\5548.ini
2026-03-29 10:57:32,471 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:32,487 [root] DEBUG: Loader: Injecting process 5548 (thread 1636) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,502 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:32,502 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,502 [lib.api.process] INFO: Injected into 64-bit <Process 5548 RuntimeBroker.exe>
2026-03-29 10:57:32,502 [root] INFO: Announced 64-bit process name: RuntimeBroker.exe pid: 5548
2026-03-29 10:57:32,518 [lib.api.process] INFO: Monitor config for <Process 5548 RuntimeBroker.exe>: C:\ltb6yatm\dll\5548.ini
2026-03-29 10:57:32,830 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:32,846 [root] DEBUG: Loader: Injecting process 5548 (thread 1636) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,862 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:32,862 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:32,862 [lib.api.process] INFO: Injected into 64-bit <Process 5548 RuntimeBroker.exe>
2026-03-29 10:57:33,190 [root] DEBUG: 5548: Python path set to 'C:\Python310'.
2026-03-29 10:57:33,190 [root] DEBUG: 5548: Dropped file limit defaulting to 100.
2026-03-29 10:57:33,361 [root] DEBUG: 5548: Disabling sleep skipping.
2026-03-29 10:57:33,361 [root] DEBUG: 5548: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:33,393 [root] DEBUG: 5548: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:57:33,408 [root] DEBUG: 5548: YaraScan: Scanning 0x00007FF621170000, size 0x1b158
2026-03-29 10:57:33,408 [root] DEBUG: 5548: Monitor initialised: 64-bit capemon loaded in process 5548 at 0x00007FFEABE00000, thread 1636, image base 0x00007FF621170000, stack from 0x0000008B547D4000-0x0000008B547E0000
2026-03-29 10:57:33,408 [root] DEBUG: 5548: Commandline: C:\Windows\System32\RuntimeBroker.exe -Embedding
2026-03-29 10:57:33,440 [root] DEBUG: 5548: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:57:33,705 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:57:33,705 [root] DEBUG: 5548: set_hooks: Unable to hook LockResource
2026-03-29 10:57:33,799 [root] DEBUG: 5548: Hooked 627 out of 628 functions
2026-03-29 10:57:33,799 [root] DEBUG: 5548: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:33,830 [root] DEBUG: 5548: RestoreHeaders: Restored original import table.
2026-03-29 10:57:33,830 [root] INFO: Loaded monitor into process with pid 5548
2026-03-29 10:57:33,846 [root] DEBUG: 4364: DLL loaded at 0x73600000: C:\Windows\System32\iertutil (0x22d000 bytes).
2026-03-29 10:57:33,846 [root] DEBUG: 4364: DLL loaded at 0x735E0000: C:\Windows\System32\srvcli (0x1d000 bytes).
2026-03-29 10:57:33,862 [root] DEBUG: 4364: DLL loaded at 0x75440000: C:\Windows\System32\netutils (0xb000 bytes).
2026-03-29 10:57:33,925 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFBDC0000: C:\Windows\System32\UMPDC (0x12000 bytes).
2026-03-29 10:57:34,143 [root] DEBUG: 5548: caller_dispatch: Added region at 0x00007FF621170000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6211765A9, thread 1636).
2026-03-29 10:57:34,143 [root] DEBUG: 5548: YaraScan: Scanning 0x00007FF621170000, size 0x1b158
2026-03-29 10:57:34,143 [root] DEBUG: 5548: ProcessImageBase: Main module image at 0x00007FF621170000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:57:34,252 [root] DEBUG: 4364: DLL loaded at 0x73830000: C:\Windows\System32\urlmon (0x1a8000 bytes).
2026-03-29 10:57:34,268 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:57:34,268 [root] DEBUG: 5548: DEBUG:Initialized 9 com hooks
2026-03-29 10:57:34,268 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:57:35,658 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFB900000: C:\Windows\system32\Wldp (0x30000 bytes).
2026-03-29 10:57:35,674 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFA080000: C:\Windows\system32\windows.storage (0x795000 bytes).
2026-03-29 10:57:36,174 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:57:36,174 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 10:57:36,658 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF09F0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7c9000 bytes).
2026-03-29 10:57:36,940 [root] DEBUG: 4364: DLL loaded at 0x73500000: C:\Windows\System32\wintypes (0xdb000 bytes).
2026-03-29 10:57:37,783 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\PROPSYS (0xf6000 bytes).
2026-03-29 10:57:39,252 [root] DEBUG: 5548: DLL loaded at 0x00007FFEDF9D0000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-03-29 10:57:39,502 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE6060000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-03-29 10:57:39,736 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFBFA0000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-03-29 10:57:39,736 [root] DEBUG: 4364: DLL loaded at 0x73430000: C:\Windows\System32\Bcp47Langs (0x48000 bytes).
2026-03-29 10:57:39,752 [root] DEBUG: 4364: DLL loaded at 0x733C0000: C:\Windows\System32\sppc (0x1c000 bytes).
2026-03-29 10:57:39,752 [root] DEBUG: 4364: DLL loaded at 0x73410000: C:\Windows\System32\SLC (0x1f000 bytes).
2026-03-29 10:57:39,752 [root] DEBUG: 4364: DLL loaded at 0x733E0000: C:\Windows\System32\USERENV (0x25000 bytes).
2026-03-29 10:57:39,752 [root] DEBUG: 4364: DLL loaded at 0x73480000: C:\Windows\System32\appresolver (0x71000 bytes).
2026-03-29 10:57:40,190 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE3640000: C:\Windows\system32\edputil (0x24000 bytes).
2026-03-29 10:57:40,330 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF8C40000: C:\Windows\System32\WinTypes (0x154000 bytes).
2026-03-29 10:57:40,408 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFDBE0000: C:\Windows\System32\shell32 (0x743000 bytes).
2026-03-29 10:57:40,721 [root] DEBUG: 5548: DLL loaded at 0x00007FFEDC540000: C:\Windows\System32\Windows.FileExplorer.Common (0x61000 bytes).
2026-03-29 10:57:40,862 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ￎ￲￪￠￧￠￭￮ ￢ ￤￮￱￲￳￯￥.
2026-03-29 10:57:40,862 [root] DEBUG: 5548: OpenProcessHandler: Injection info created for process 5000, handle 0x420: Error obtaining target process name
2026-03-29 10:57:40,877 [root] INFO: Announced 64-bit process name: explorer.exe pid: 5000
2026-03-29 10:57:40,877 [lib.api.process] INFO: Monitor config for <Process 5000 explorer.exe>: C:\ltb6yatm\dll\5000.ini
2026-03-29 10:57:40,971 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:41,002 [root] DEBUG: Loader: Injecting process 5000 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:41,002 [root] DEBUG: 5000: Python path set to 'C:\Python310'.
2026-03-29 10:57:41,018 [root] DEBUG: 5000: Dropped file limit defaulting to 100.
2026-03-29 10:57:41,018 [root] DEBUG: 5000: Disabling sleep skipping.
2026-03-29 10:57:41,033 [root] DEBUG: 5000: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:41,065 [root] DEBUG: 5000: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:57:41,065 [root] DEBUG: 5000: YaraScan: Scanning 0x00007FF768FF0000, size 0x4e1114
2026-03-29 10:57:41,549 [root] DEBUG: 4364: DLL loaded at 0x73380000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2026-03-29 10:57:41,908 [root] DEBUG: 4364: DLL loaded at 0x72FC0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes).
2026-03-29 10:57:42,096 [root] DEBUG: 5000: Yara error: Scanning timed out
2026-03-29 10:57:42,096 [root] DEBUG: 5000: Monitor initialised: 64-bit capemon loaded in process 5000 at 0x00007FFEABE00000, thread 5564, image base 0x00007FF768FF0000, stack from 0x0000000008E22000-0x0000000008E30000
2026-03-29 10:57:42,096 [root] DEBUG: 5000: Commandline: C:\Windows\Explorer.EXE
2026-03-29 10:57:42,127 [root] DEBUG: 4364: CreateProcessHandler: Injection info set for new process 7932: C:\Windows\System32\cmd.exe, ImageBase: 0x00AE0000
2026-03-29 10:57:42,143 [root] INFO: Announced 32-bit process name: cmd.exe pid: 7932
2026-03-29 10:57:42,143 [lib.api.process] INFO: Monitor config for <Process 7932 cmd.exe>: C:\ltb6yatm\dll\7932.ini
2026-03-29 10:57:42,158 [root] DEBUG: 5000: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:57:42,408 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:57:42,440 [root] DEBUG: Loader: Injecting process 7932 (thread 6384) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:42,440 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:57:42,455 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:42,455 [root] DEBUG: 5000: set_hooks: Unable to hook LockResource
2026-03-29 10:57:42,455 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:42,471 [lib.api.process] INFO: Injected into 32-bit <Process 7932 cmd.exe>
2026-03-29 10:57:42,487 [root] DEBUG: 4364: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:42,502 [root] INFO: Announced 32-bit process name: cmd.exe pid: 7932
2026-03-29 10:57:42,502 [lib.api.process] INFO: Monitor config for <Process 7932 cmd.exe>: C:\ltb6yatm\dll\7932.ini
2026-03-29 10:57:42,580 [root] DEBUG: 5000: Hooked 627 out of 628 functions
2026-03-29 10:57:42,612 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:57:42,643 [root] DEBUG: Loader: Injecting process 7932 (thread 6384) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:42,643 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:42,643 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:42,658 [lib.api.process] INFO: Injected into 32-bit <Process 7932 cmd.exe>
2026-03-29 10:57:42,799 [root] DEBUG: 7932: Python path set to 'C:\Python310'.
2026-03-29 10:57:42,799 [root] DEBUG: 7932: Dropped file limit defaulting to 100.
2026-03-29 10:57:42,971 [root] DEBUG: 7932: Disabling sleep skipping.
2026-03-29 10:57:42,971 [root] DEBUG: 7932: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:42,971 [root] DEBUG: 7932: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:57:42,987 [root] DEBUG: 7932: YaraScan hit: FindFixAndRun
2026-03-29 10:57:42,987 [root] DEBUG: 7932: Monitor initialised: 32-bit capemon loaded in process 7932 at 0x73f00000, thread 6384, image base 0xae0000, stack from 0x2b43000-0x2c40000
2026-03-29 10:57:42,987 [root] DEBUG: 7932: Commandline: "C:\Windows\System32\cmd.exe" /c regedit /s /q C:\Users\cape\AppData\Local\Temp\rknrl.reg
2026-03-29 10:57:43,065 [root] DEBUG: 7932: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:57:43,096 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:57:43,096 [root] DEBUG: 7932: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:57:43,096 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:57:43,112 [root] DEBUG: 7932: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:57:43,127 [root] DEBUG: 7932: Hooked 630 out of 632 functions
2026-03-29 10:57:43,143 [root] DEBUG: 7932: set_hooks_exe: Hooked FindFixAndRun at 0x00AEAD60
2026-03-29 10:57:43,143 [root] DEBUG: 7932: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:43,158 [root] DEBUG: 7932: RestoreHeaders: Restored original import table.
2026-03-29 10:57:43,158 [root] INFO: Loaded monitor into process with pid 7932
2026-03-29 10:57:43,158 [root] DEBUG: 7932: caller_dispatch: Added region at 0x00AE0000 to tracked regions list (ntdll::NtOpenThread returns to 0x00AF09DE, thread 6384).
2026-03-29 10:57:43,158 [root] DEBUG: 7932: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:57:43,174 [root] DEBUG: 7932: ProcessImageBase: Main module image at 0x00AE0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:57:43,221 [root] DEBUG: 7932: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 6384).
2026-03-29 10:57:43,236 [root] DEBUG: 7932: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:43,627 [root] DEBUG: 5000: Yara error: Scanning timed out
2026-03-29 10:57:43,627 [root] DEBUG: 5000: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:43,643 [root] INFO: Loaded monitor into process with pid 5000
2026-03-29 10:57:43,643 [root] DEBUG: 5000: api-rate-cap: LdrpCallInitRoutine hook disabled due to rate
2026-03-29 10:57:43,659 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-03-29 10:57:43,659 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:43,659 [lib.api.process] INFO: Injected into 64-bit <Process 5000 explorer.exe>
2026-03-29 10:57:43,877 [root] DEBUG: 7932: CreateProcessHandler: Injection info set for new process 5008: C:\Windows\system32\regedit.exe, ImageBase: 0x00AE0000
2026-03-29 10:57:43,893 [root] INFO: Announced 32-bit process name: regedit.exe pid: 5008
2026-03-29 10:57:43,893 [lib.api.process] INFO: Monitor config for <Process 5008 regedit.exe>: C:\ltb6yatm\dll\5008.ini
2026-03-29 10:57:44,330 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 1016, handle 0x21a0: C:\Windows\System32\conhost.exe
2026-03-29 10:57:44,346 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 7932, handle 0xe14: C:\Windows\SysWOW64\cmd.exe
2026-03-29 10:57:44,486 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:57:44,486 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:57:44,518 [root] DEBUG: Loader: Injecting process 5008 (thread 4596) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:44,533 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:44,549 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:44,549 [lib.api.process] INFO: Injected into 32-bit <Process 5008 regedit.exe>
2026-03-29 10:57:44,596 [root] DEBUG: 7932: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:44,690 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFC970000: C:\Windows\System32\coml2 (0x79000 bytes).
2026-03-29 10:57:45,096 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFBEB0000: C:\Windows\system32\profapi (0x1f000 bytes).
2026-03-29 10:57:45,190 [root] INFO: Added new file to list with pid 5548 and path C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
2026-03-29 10:57:45,236 [root] INFO: Added new file to list with pid 5548 and path C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
2026-03-29 10:57:45,971 [root] DEBUG: 5000: DEBUG:Initialized 9 com hooks
2026-03-29 10:57:46,565 [root] DEBUG: 5000: caller_dispatch: Added region at 0x00007FF768FF0000 to tracked regions list (user32::MsgWaitForMultipleObjectsEx returns to 0x00007FF76906A819, thread 5444).
2026-03-29 10:57:46,565 [root] DEBUG: 5000: YaraScan: Scanning 0x00007FF768FF0000, size 0x4e1114
2026-03-29 10:57:46,674 [root] DEBUG: 5000: ProcessImageBase: Main module image at 0x00007FF768FF0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:57:46,737 [root] DEBUG: 5008: Python path set to 'C:\Python310'.
2026-03-29 10:57:46,753 [root] DEBUG: 5008: Dropped file limit defaulting to 100.
2026-03-29 10:57:46,987 [root] DEBUG: 5008: Disabling sleep skipping.
2026-03-29 10:57:47,002 [root] DEBUG: 5008: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:47,002 [root] DEBUG: 5008: YaraScan: Scanning 0x00AE0000, size 0x96302
2026-03-29 10:57:47,018 [root] DEBUG: 5008: Monitor initialised: 32-bit capemon loaded in process 5008 at 0x73f00000, thread 4596, image base 0xae0000, stack from 0x2e74000-0x2e80000
2026-03-29 10:57:47,018 [root] DEBUG: 5008: Commandline: regedit  /s /q C:\Users\cape\AppData\Local\Temp\rknrl.reg
2026-03-29 10:57:47,112 [root] DEBUG: 5008: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:57:47,174 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:57:47,174 [root] DEBUG: 5008: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:57:47,174 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:57:47,190 [root] DEBUG: 5008: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:57:47,205 [root] DEBUG: 5008: Hooked 630 out of 632 functions
2026-03-29 10:57:47,205 [root] DEBUG: 5008: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:47,221 [root] DEBUG: 5008: RestoreHeaders: Restored original import table.
2026-03-29 10:57:47,221 [root] INFO: Loaded monitor into process with pid 5008
2026-03-29 10:57:47,393 [root] DEBUG: 5008: InstrumentationCallback: Added region at 0x76AD24AC (base 0x76AB0000) to tracked regions list (thread 4596).
2026-03-29 10:57:47,408 [root] DEBUG: 5008: ProcessTrackedRegion: Region at 0x76AB0000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-03-29 10:57:47,893 [root] DEBUG: 5008: ProcessTrackedRegion: Region at 0x76AB0000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-03-29 10:57:47,971 [root] DEBUG: 5008: ProcessTrackedRegion: Region at 0x76AB0000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-03-29 10:57:48,002 [root] DEBUG: 4364: DLL loaded at 0x72C70000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-03-29 10:57:48,096 [root] DEBUG: 5008: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 4596).
2026-03-29 10:57:48,112 [root] DEBUG: 5008: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:48,112 [root] DEBUG: 5008: caller_dispatch: Added region at 0x00AE0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00AFCF9B, thread 4596).
2026-03-29 10:57:48,127 [root] DEBUG: 5008: YaraScan: Scanning 0x00AE0000, size 0x96302
2026-03-29 10:57:48,143 [root] DEBUG: 5008: ProcessImageBase: Main module image at 0x00AE0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:57:48,315 [root] DEBUG: 5008: NtTerminateProcess hook: Attempting to dump process 5008
2026-03-29 10:57:48,330 [root] DEBUG: 5008: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:57:48,408 [root] INFO: Process with pid 5008 has terminated
2026-03-29 10:57:48,533 [root] DEBUG: 7932: NtTerminateProcess hook: Attempting to dump process 7932
2026-03-29 10:57:48,565 [root] DEBUG: 7932: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:57:48,596 [root] DEBUG: 7932: DoProcessDump: Code modification detected, dumping Imagebase at 0x00AE0000.
2026-03-29 10:57:48,611 [root] DEBUG: 7932: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:57:48,611 [root] DEBUG: 7932: DumpProcess: Instantiating PeParser with address: 0x00AE0000.
2026-03-29 10:57:48,627 [root] DEBUG: 7932: DumpProcess: Module entry point VA is 0x00AF6B20.
2026-03-29 10:57:49,018 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\7932_247887874857729032026 to procdump\2160ea77be35a3fdf3c99796e0f01dfc989dae0aef3c57593b39e9428fc97f8a; Size is 346624; Max size: 100000000
2026-03-29 10:57:49,033 [root] DEBUG: 7932: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:57:49,049 [root] INFO: Process with pid 7932 has terminated
2026-03-29 10:57:49,252 [root] DEBUG: 4364: CreateProcessHandler: Injection info set for new process 3792: C:\Users\cape\AppData\Local\Temp\explorer.exe, ImageBase: 0x00520000
2026-03-29 10:57:49,252 [root] INFO: Announced 32-bit process name: explorer.exe pid: 3792
2026-03-29 10:57:49,252 [lib.api.process] INFO: Monitor config for <Process 3792 explorer.exe>: C:\ltb6yatm\dll\3792.ini
2026-03-29 10:57:49,362 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:57:49,455 [root] DEBUG: Loader: Injecting process 3792 (thread 5808) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:49,455 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:49,471 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:49,487 [lib.api.process] INFO: Injected into 32-bit <Process 3792 explorer.exe>
2026-03-29 10:57:49,596 [root] DEBUG: 4364: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:49,612 [root] INFO: Announced 32-bit process name: explorer.exe pid: 3792
2026-03-29 10:57:49,643 [lib.api.process] INFO: Monitor config for <Process 3792 explorer.exe>: C:\ltb6yatm\dll\3792.ini
2026-03-29 10:57:49,768 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:57:49,908 [root] DEBUG: Loader: Injecting process 3792 (thread 5808) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:49,924 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:49,924 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:57:49,971 [lib.api.process] INFO: Injected into 32-bit <Process 3792 explorer.exe>
2026-03-29 10:57:50,033 [root] DEBUG: 3792: Python path set to 'C:\Python310'.
2026-03-29 10:57:50,033 [root] DEBUG: 3792: Dropped file limit defaulting to 100.
2026-03-29 10:57:50,127 [root] DEBUG: 4364: NtTerminateProcess hook: Attempting to dump process 4364
2026-03-29 10:57:50,143 [root] DEBUG: 3792: Disabling sleep skipping.
2026-03-29 10:57:50,158 [root] DEBUG: 4364: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:57:50,174 [root] DEBUG: 3792: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:50,190 [root] DEBUG: 3792: YaraScan: Scanning 0x00520000, size 0x26996
2026-03-29 10:57:50,205 [root] DEBUG: 3792: Monitor initialised: 32-bit capemon loaded in process 3792 at 0x73f00000, thread 5808, image base 0x520000, stack from 0x2ef5000-0x2f00000
2026-03-29 10:57:50,205 [root] DEBUG: 3792: Commandline: "C:\Users\cape\AppData\Local\Temp\explorer.exe" //B "C:\Users\cape\AppData\Local\Temp\winstart.vbs"
2026-03-29 10:57:50,283 [root] DEBUG: 3792: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:57:50,362 [root] INFO: Process with pid 4364 has terminated
2026-03-29 10:57:50,408 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:57:50,408 [root] DEBUG: 3792: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:57:50,408 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:57:50,424 [root] DEBUG: 3792: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:57:50,440 [root] DEBUG: 3792: Hooked 630 out of 632 functions
2026-03-29 10:57:50,455 [root] DEBUG: 3792: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:50,518 [root] DEBUG: 3792: RestoreHeaders: Restored original import table.
2026-03-29 10:57:50,518 [root] INFO: Loaded monitor into process with pid 3792
2026-03-29 10:57:50,549 [root] DEBUG: 3792: caller_dispatch: Added region at 0x00520000 to tracked regions list (ntdll::NtQueryLicenseValue returns to 0x0053539F, thread 5808).
2026-03-29 10:57:50,565 [root] DEBUG: 3792: YaraScan: Scanning 0x00520000, size 0x26996
2026-03-29 10:57:50,565 [root] DEBUG: 3792: ProcessImageBase: Main module image at 0x00520000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:57:50,596 [root] DEBUG: 3792: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 5808).
2026-03-29 10:57:50,612 [root] DEBUG: 3792: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:57:50,643 [root] DEBUG: 3792: set_hooks_by_export_directory: Hooked 0 out of 632 functions
2026-03-29 10:57:50,658 [root] DEBUG: 3792: DLL loaded at 0x75250000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-03-29 10:57:50,658 [root] DEBUG: 3792: DLL loaded at 0x76D80000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-03-29 10:57:50,674 [root] DEBUG: 3792: DLL loaded at 0x745D0000: C:\Windows\system32\uxtheme (0x74000 bytes).
2026-03-29 10:57:51,190 [root] DEBUG: 3792: DLL loaded at 0x73E70000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-03-29 10:57:51,205 [root] INFO: Announced starting service "b'edgeupdate'"
2026-03-29 10:57:51,205 [root] DEBUG: 3792: DLL loaded at 0x76BA0000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-03-29 10:57:51,221 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 3792, handle 0x19e8: C:\Users\cape\AppData\Local\Temp\explorer.exe
2026-03-29 10:57:51,221 [root] DEBUG: 3792: DLL loaded at 0x77400000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-03-29 10:57:51,315 [root] DEBUG: 3792: DLL loaded at 0x73DE0000: C:\Windows\System32\vbscript (0x86000 bytes).
2026-03-29 10:57:51,346 [root] DEBUG: 3792: DLL loaded at 0x73DC0000: C:\Windows\SYSTEM32\amsi (0x19000 bytes).
2026-03-29 10:57:51,361 [root] DEBUG: 3792: DEBUG:Initialized 9 com hooks
2026-03-29 10:57:51,377 [root] DEBUG: 3792: DLL loaded at 0x756D0000: C:\Windows\SYSTEM32\WLDP (0x27000 bytes).
2026-03-29 10:57:51,440 [root] DEBUG: 3792: DLL loaded at 0x77DD0000: C:\Windows\System32\WINTRUST (0x4e000 bytes).
2026-03-29 10:57:51,455 [root] DEBUG: 3792: DLL loaded at 0x73DB0000: C:\Windows\SYSTEM32\MSASN1 (0xe000 bytes).
2026-03-29 10:57:51,471 [root] DEBUG: 3792: DLL loaded at 0x75280000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-03-29 10:57:51,471 [root] DEBUG: 3792: DLL loaded at 0x74C10000: C:\Windows\system32\rsaenh (0x2f000 bytes).
2026-03-29 10:57:51,518 [root] DEBUG: 3792: DLL loaded at 0x73DA0000: C:\Windows\System32\MSISIP (0x10000 bytes).
2026-03-29 10:57:51,580 [root] DEBUG: 3792: DLL loaded at 0x77590000: C:\Windows\System32\SHELL32 (0x5b5000 bytes).
2026-03-29 10:57:51,596 [root] DEBUG: 3792: DLL loaded at 0x73D80000: C:\Windows\System32\wshext (0x18000 bytes).
2026-03-29 10:57:51,658 [root] DEBUG: 3792: DLL loaded at 0x73D40000: C:\Windows\System32\scrobj (0x36000 bytes).
2026-03-29 10:57:51,705 [root] DEBUG: 3792: DLL loaded at 0x73BF0000: C:\Windows\System32\msxml3 (0x14f000 bytes).
2026-03-29 10:57:52,471 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:52,549 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:52,893 [root] DEBUG: Loader: Injecting process 7372 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:53,002 [root] DEBUG: Loader: Injecting process 4632 (thread 6592) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:53,143 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 2748, handle 0x11c
2026-03-29 10:57:53,268 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:53,330 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:57:53,408 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:53,549 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:53,565 [lib.api.process] INFO: Injected into 64-bit <Process 4632 WmiPrvSE.exe>
2026-03-29 10:57:53,674 [lib.api.process] INFO: Injected into 64-bit <Process 7372 GameBarFTServer.exe>
2026-03-29 10:57:53,768 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 4632
2026-03-29 10:57:53,862 [lib.api.process] INFO: Monitor config for <Process 4632 WmiPrvSE.exe>: C:\ltb6yatm\dll\4632.ini
2026-03-29 10:57:53,877 [root] INFO: Announced 64-bit process name: GameBarFTServer.exe pid: 7372
2026-03-29 10:57:53,971 [lib.api.process] INFO: Monitor config for <Process 7372 GameBarFTServer.exe>: C:\ltb6yatm\dll\7372.ini
2026-03-29 10:57:54,221 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ￎ￲￪￠￧￠￭￮ ￢ ￤￮￱￲￳￯￥.
2026-03-29 10:57:54,471 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 452, handle 0xf70: Error obtaining target process name
2026-03-29 10:57:54,721 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ￎ￲￪￠￧￠￭￮ ￢ ￤￮￱￲￳￯￥.
2026-03-29 10:57:55,033 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 5904, handle 0xf74: Error obtaining target process name
2026-03-29 10:57:55,283 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ￎ￲￪￠￧￠￭￮ ￢ ￤￮￱￲￳￯￥.
2026-03-29 10:57:55,580 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 5728, handle 0xf38: Error obtaining target process name
2026-03-29 10:57:55,611 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:55,643 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:56,033 [root] DEBUG: Loader: Injecting process 7372 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:56,096 [root] DEBUG: Loader: Injecting process 4632 (thread 6592) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:56,205 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 2748, handle 0x118
2026-03-29 10:57:56,283 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:56,377 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:56,486 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:56,627 [lib.api.process] INFO: Injected into 64-bit <Process 4632 WmiPrvSE.exe>
2026-03-29 10:57:56,674 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:56,768 [lib.api.process] INFO: Injected into 64-bit <Process 7372 GameBarFTServer.exe>
2026-03-29 10:57:56,768 [root] DEBUG: 4632: Python path set to 'C:\Python310'.
2026-03-29 10:57:56,768 [root] INFO: Announced 64-bit process name: GameBarFTServer.exe pid: 7372
2026-03-29 10:57:56,768 [lib.api.process] INFO: Monitor config for <Process 7372 GameBarFTServer.exe>: C:\ltb6yatm\dll\7372.ini
2026-03-29 10:57:56,955 [root] DEBUG: 4632: Dropped file limit defaulting to 100.
2026-03-29 10:57:57,283 [root] DEBUG: 4632: Disabling sleep skipping.
2026-03-29 10:57:57,549 [root] DEBUG: 4632: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:57:57,752 [root] DEBUG: 4632: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:57:57,893 [root] DEBUG: 4632: YaraScan: Scanning 0x00007FF6402C0000, size 0x7dcfe
2026-03-29 10:57:58,205 [root] DEBUG: 4632: Monitor initialised: 64-bit capemon loaded in process 4632 at 0x00007FFEABE00000, thread 6592, image base 0x00007FF6402C0000, stack from 0x0000003222C70000-0x0000003222C80000
2026-03-29 10:57:58,361 [root] DEBUG: 4632: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2026-03-29 10:57:58,408 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:57:58,518 [root] DEBUG: 4632: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:57:58,830 [root] DEBUG: Loader: Injecting process 7372 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:59,018 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:57:59,018 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 2748, handle 0x118
2026-03-29 10:57:59,080 [root] DEBUG: 4632: set_hooks: Unable to hook LockResource
2026-03-29 10:57:59,174 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:57:59,330 [root] DEBUG: 4632: Hooked 627 out of 628 functions
2026-03-29 10:57:59,426 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:57:59,502 [root] DEBUG: 4632: Syscall hook installed, syscall logging level 1
2026-03-29 10:57:59,596 [lib.api.process] INFO: Injected into 64-bit <Process 7372 GameBarFTServer.exe>
2026-03-29 10:57:59,783 [root] DEBUG: 4632: RestoreHeaders: Restored original import table.
2026-03-29 10:57:59,893 [root] INFO: Announced 64-bit process name: GameBarFTServer.exe pid: 7372
2026-03-29 10:57:59,908 [lib.api.process] INFO: Monitor config for <Process 7372 GameBarFTServer.exe>: C:\ltb6yatm\dll\7372.ini
2026-03-29 10:57:59,924 [root] INFO: Loaded monitor into process with pid 4632
2026-03-29 10:58:00,190 [root] DEBUG: 4632: caller_dispatch: Added region at 0x00007FF6402C0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6402D2CD1, thread 6592).
2026-03-29 10:58:00,440 [root] DEBUG: 4632: YaraScan: Scanning 0x00007FF6402C0000, size 0x7dcfe
2026-03-29 10:58:00,596 [root] DEBUG: 5000: DLL loaded at 0x00007FFEECE40000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-03-29 10:58:00,612 [root] DEBUG: 4632: ProcessImageBase: Main module image at 0x00007FF6402C0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:00,658 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 176: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF63B3C0000
2026-03-29 10:58:00,690 [root] DEBUG: 4632: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:58:00,737 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:58:00,752 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 176
2026-03-29 10:58:00,752 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:58:00,752 [lib.api.process] INFO: Monitor config for <Process 176 SecurityHealthHost.exe>: C:\ltb6yatm\dll\176.ini
2026-03-29 10:58:00,799 [root] DEBUG: 3792: api-cap: VbsMid hook disabled due to count: 5000
2026-03-29 10:58:00,830 [root] DEBUG: 4632: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:00,830 [root] DEBUG: 3792: api-rate-cap: VbsInStr hook disabled due to rate
2026-03-29 10:58:00,848 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:00,924 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:58:01,158 [lib.api.process] INFO: Monitor config for <Process 5744 svchost.exe>: C:\ltb6yatm\dll\5744.ini
2026-03-29 10:58:01,190 [root] DEBUG: Loader: Injecting process 176 (thread 2708) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:01,283 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:01,424 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:01,565 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:01,580 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:01,658 [root] DEBUG: Loader: Injecting process 5744 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:01,783 [lib.api.process] INFO: Injected into 64-bit <Process 176 SecurityHealthHost.exe>
2026-03-29 10:58:01,814 [root] DEBUG: Loader: Injecting process 7372 with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:01,924 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 176
2026-03-29 10:58:01,987 [root] DEBUG: 5744: Python path set to 'C:\Python310'.
2026-03-29 10:58:02,002 [lib.api.process] INFO: Monitor config for <Process 176 SecurityHealthHost.exe>: C:\ltb6yatm\dll\176.ini
2026-03-29 10:58:02,033 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 2748, handle 0x12c
2026-03-29 10:58:02,065 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:02,127 [root] DEBUG: 5744: Disabling sleep skipping.
2026-03-29 10:58:02,268 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:02,440 [root] DEBUG: 5744: Dropped file limit defaulting to 100.
2026-03-29 10:58:02,455 [root] DEBUG: Loader: Injecting process 176 (thread 2708) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:02,455 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:02,471 [root] DEBUG: 3792: api-cap: VbsChr hook disabled due to count: 5000
2026-03-29 10:58:02,518 [lib.api.process] INFO: Injected into 64-bit <Process 7372 GameBarFTServer.exe>
2026-03-29 10:58:02,518 [root] DEBUG: 5744: Services hook set enabled
2026-03-29 10:58:02,533 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:02,627 [root] DEBUG: 3792: api-cap: VbsMidB hook disabled due to count: 5000
2026-03-29 10:58:02,658 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:02,674 [root] DEBUG: 3792: api-cap: VbsAscB hook disabled due to count: 5000
2026-03-29 10:58:02,830 [lib.api.process] INFO: Injected into 64-bit <Process 176 SecurityHealthHost.exe>
2026-03-29 10:58:02,846 [root] DEBUG: 5744: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:03,612 [root] DEBUG: 3792: DLL loaded at 0x73850000: C:\Windows\System32\MPR (0x19000 bytes).
2026-03-29 10:58:03,768 [root] DEBUG: 5744: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:58:03,799 [root] DEBUG: 3792: DLL loaded at 0x73820000: C:\Windows\System32\ScrRun (0x30000 bytes).
2026-03-29 10:58:03,815 [root] DEBUG: 176: Python path set to 'C:\Python310'.
2026-03-29 10:58:03,815 [root] DEBUG: 5744: Monitor initialised: 64-bit capemon loaded in process 5744 at 0x00007FFEABE00000, thread 2384, image base 0x00007FF7AB6E0000, stack from 0x0000000311EF4000-0x0000000311F00000
2026-03-29 10:58:03,830 [root] DEBUG: 176: Dropped file limit defaulting to 100.
2026-03-29 10:58:03,846 [root] INFO: Announced 64-bit process name: GameBarFTServer.exe pid: 7372
2026-03-29 10:58:03,846 [root] DEBUG: 3792: DLL loaded at 0x73870000: C:\Windows\System32\wshom.ocx (0x23000 bytes).
2026-03-29 10:58:03,861 [root] DEBUG: 5744: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2026-03-29 10:58:03,924 [lib.api.process] INFO: Monitor config for <Process 7372 GameBarFTServer.exe>: C:\ltb6yatm\dll\7372.ini
2026-03-29 10:58:03,924 [root] DEBUG: 5744: Hooked 69 out of 69 functions
2026-03-29 10:58:03,941 [root] DEBUG: 3792: DLL loaded at 0x75700000: C:\Windows\SYSTEM32\windows.storage (0x60d000 bytes).
2026-03-29 10:58:03,955 [root] INFO: Loaded monitor into process with pid 5744
2026-03-29 10:58:03,973 [root] DEBUG: 3792: DLL loaded at 0x76F70000: C:\Windows\System32\SHCORE (0x87000 bytes).
2026-03-29 10:58:03,986 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-03-29 10:58:04,018 [root] DEBUG: 3792: DLL loaded at 0x73A90000: C:\Windows\system32\propsys (0xc2000 bytes).
2026-03-29 10:58:04,049 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:04,065 [root] DEBUG: 3792: DLL loaded at 0x75260000: C:\Windows\SYSTEM32\profapi (0x18000 bytes).
2026-03-29 10:58:04,174 [lib.api.process] INFO: Injected into 64-bit <Process 5744 svchost.exe>
2026-03-29 10:58:04,236 [root] DEBUG: 176: Disabling sleep skipping.
2026-03-29 10:58:04,268 [root] DEBUG: 3792: DLL loaded at 0x77480000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes).
2026-03-29 10:58:04,299 [root] DEBUG: 176: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:04,362 [root] DEBUG: 176: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:58:04,393 [root] DEBUG: 3792: DLL loaded at 0x73010000: C:\Windows\System32\WININET (0x454000 bytes).
2026-03-29 10:58:04,393 [root] DEBUG: 176: YaraScan: Scanning 0x00007FF63B3C0000, size 0x19174
2026-03-29 10:58:04,424 [root] DEBUG: 3792: DLL loaded at 0x72DD0000: C:\Windows\System32\iertutil (0x22d000 bytes).
2026-03-29 10:58:04,440 [root] DEBUG: 176: Monitor initialised: 64-bit capemon loaded in process 176 at 0x00007FFEABE00000, thread 2708, image base 0x00007FF63B3C0000, stack from 0x000000F162914000-0x000000F162920000
2026-03-29 10:58:04,486 [root] DEBUG: 3792: DLL loaded at 0x72D20000: C:\Windows\SYSTEM32\wbemcomn (0x70000 bytes).
2026-03-29 10:58:04,502 [root] DEBUG: 176: Commandline: C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
2026-03-29 10:58:04,582 [root] DEBUG: 3792: DLL loaded at 0x72D90000: C:\Windows\system32\wbem\wbemdisp (0x3f000 bytes).
2026-03-29 10:58:04,596 [root] DEBUG: 176: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:58:04,877 [root] DEBUG: 3792: DLL loaded at 0x72D10000: C:\Windows\system32\wbem\wbemprox (0xd000 bytes).
2026-03-29 10:58:04,908 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:58:05,018 [root] DEBUG: 3792: DLL loaded at 0x72CF0000: C:\Windows\system32\wbem\wmiutils (0x1d000 bytes).
2026-03-29 10:58:05,111 [root] DEBUG: 176: set_hooks: Unable to hook LockResource
2026-03-29 10:58:05,158 [root] DEBUG: 5744: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:05,174 [root] DEBUG: 176: Hooked 627 out of 628 functions
2026-03-29 10:58:05,190 [root] DEBUG: 5744: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:05,205 [root] DEBUG: 176: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:05,221 [root] DEBUG: 176: RestoreHeaders: Restored original import table.
2026-03-29 10:58:05,236 [root] INFO: Loaded monitor into process with pid 176
2026-03-29 10:58:05,268 [root] DEBUG: 176: caller_dispatch: Added region at 0x00007FF63B3C0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF63B3CD3B2, thread 2708).
2026-03-29 10:58:05,283 [root] DEBUG: 176: YaraScan: Scanning 0x00007FF63B3C0000, size 0x19174
2026-03-29 10:58:05,299 [root] DEBUG: 3792: DLL loaded at 0x72C50000: C:\Windows\system32\wbem\wbemsvc (0x10000 bytes).
2026-03-29 10:58:05,299 [root] DEBUG: 176: ProcessImageBase: Main module image at 0x00007FF63B3C0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:05,331 [root] DEBUG: 176: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:58:05,346 [root] DEBUG: 176: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:58:05,362 [root] DEBUG: 176: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:58:05,377 [root] DEBUG: 176: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:05,395 [root] DEBUG: 176: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:58:05,487 [root] DEBUG: 176: DLL loaded at 0x00007FFEFDBE0000: C:\Windows\System32\SHELL32 (0x743000 bytes).
2026-03-29 10:58:05,549 [root] DEBUG: 176: DLL loaded at 0x00007FFEFB900000: C:\Windows\system32\Wldp (0x30000 bytes).
2026-03-29 10:58:05,565 [root] DEBUG: 3792: DLL loaded at 0x72B80000: C:\Windows\system32\wbem\fastprox (0xc9000 bytes).
2026-03-29 10:58:05,565 [root] DEBUG: 176: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:58:05,580 [root] DEBUG: 176: DLL loaded at 0x00007FFEE79A0000: C:\Windows\system32\SecurityHealthAgent (0x6d000 bytes).
2026-03-29 10:58:05,815 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:05,986 [root] DEBUG: Loader: Injecting process 7372 (thread 2748) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:06,002 [root] DEBUG: 176: DLL loaded at 0x00007FFEECE40000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-03-29 10:58:06,033 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:06,080 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:06,096 [root] DEBUG: 176: DLL loaded at 0x00007FFEE7170000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2026-03-29 10:58:06,111 [lib.api.process] INFO: Injected into 64-bit <Process 7372 GameBarFTServer.exe>
2026-03-29 10:58:06,408 [root] DEBUG: 176: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:58:06,424 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF1EB0000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-03-29 10:58:06,471 [root] DEBUG: 7372: Python path set to 'C:\Python310'.
2026-03-29 10:58:06,502 [root] DEBUG: 176: DLL loaded at 0x00007FFEF8C40000: C:\Windows\SYSTEM32\wintypes (0x154000 bytes).
2026-03-29 10:58:06,518 [root] DEBUG: 7372: Dropped file limit defaulting to 100.
2026-03-29 10:58:06,518 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF2120000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-03-29 10:58:06,611 [root] DEBUG: 176: DLL loaded at 0x00007FFEF9CA0000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-03-29 10:58:06,643 [root] DEBUG: 7372: Disabling sleep skipping.
2026-03-29 10:58:06,658 [root] DEBUG: 176: DLL loaded at 0x00007FFEF60C0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-03-29 10:58:06,658 [root] DEBUG: 7372: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:06,705 [root] DEBUG: 176: DLL loaded at 0x00007FFEEF4B0000: C:\Windows\System32\twinapi.appcore (0x200000 bytes).
2026-03-29 10:58:06,721 [root] DEBUG: 7372: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:58:06,737 [root] DEBUG: 176: DLL loaded at 0x00007FFEE32A0000: C:\Windows\System32\wpnapps (0x156000 bytes).
2026-03-29 10:58:06,830 [root] DEBUG: 7372: YaraScan: Scanning 0x00007FF679BD0000, size 0x1795bc
2026-03-29 10:58:06,955 [root] DEBUG: 176: DLL loaded at 0x00007FFEF7A20000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-03-29 10:58:06,955 [root] DEBUG: 7372: Monitor initialised: 64-bit capemon loaded in process 7372 at 0x00007FFEABE00000, thread 2748, image base 0x00007FF679BD0000, stack from 0x0000003F6ADC4000-0x0000003F6ADD0000
2026-03-29 10:58:07,002 [root] DEBUG: 7372: Commandline: "C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_7.326.2102.0_x64__8wekyb3d8bbwe\GameBarFTServer.exe" -Embedding
2026-03-29 10:58:07,065 [root] DEBUG: 176: DLL loaded at 0x00007FFEF09F0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7c9000 bytes).
2026-03-29 10:58:07,080 [root] DEBUG: 7372: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:58:07,236 [root] DEBUG: 176: DLL loaded at 0x00007FFEE1060000: C:\Windows\System32\ShellCommonCommonProxyStub (0xd0000 bytes).
2026-03-29 10:58:07,252 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF4200000: C:\Windows\system32\wbem\wmiutils (0x28000 bytes).
2026-03-29 10:58:07,315 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:58:07,393 [root] DEBUG: 7372: set_hooks: Unable to hook LockResource
2026-03-29 10:58:07,533 [root] DEBUG: 7372: Hooked 627 out of 628 functions
2026-03-29 10:58:07,596 [root] DEBUG: 176: DLL loaded at 0x00007FFEFA080000: C:\Windows\SYSTEM32\windows.storage (0x795000 bytes).
2026-03-29 10:58:07,658 [root] DEBUG: 176: NtTerminateProcess hook: Attempting to dump process 176
2026-03-29 10:58:07,830 [root] DEBUG: 176: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:58:07,877 [root] DEBUG: 7372: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:08,190 [root] DEBUG: 7372: RestoreHeaders: Restored original import table.
2026-03-29 10:58:08,257 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E61000, size: 0x1000.
2026-03-29 10:58:08,268 [root] INFO: Process with pid 176 has terminated
2026-03-29 10:58:08,424 [root] INFO: Loaded monitor into process with pid 7372
2026-03-29 10:58:08,471 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E51000, size: 0x1000.
2026-03-29 10:58:08,518 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E41000, size: 0x1000.
2026-03-29 10:58:08,611 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E31000, size: 0x1000.
2026-03-29 10:58:08,768 [root] DEBUG: 7372: DLL loaded at 0x00007FFEFBDC0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-03-29 10:58:08,815 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E21000, size: 0x1000.
2026-03-29 10:58:08,862 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 7800: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF76BCF0000
2026-03-29 10:58:08,877 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E11000, size: 0x1000.
2026-03-29 10:58:08,940 [root] DEBUG: 7372: caller_dispatch: Added region at 0x00007FF679BD0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF679C45529, thread 2748).
2026-03-29 10:58:08,955 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E01000, size: 0x1000.
2026-03-29 10:58:08,987 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 7800
2026-03-29 10:58:08,987 [lib.api.process] INFO: Monitor config for <Process 7800 ShellExperienceHost.exe>: C:\ltb6yatm\dll\7800.ini
2026-03-29 10:58:08,987 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442DF1000, size: 0x1000.
2026-03-29 10:58:09,033 [root] DEBUG: 7372: YaraScan: Scanning 0x00007FF679BD0000, size 0x1795bc
2026-03-29 10:58:09,080 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442DE1000, size: 0x1000.
2026-03-29 10:58:09,112 [root] DEBUG: 7372: ProcessImageBase: Main module image at 0x00007FF679BD0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:09,127 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442DD1000, size: 0x1000.
2026-03-29 10:58:09,174 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442DC1000, size: 0x1000.
2026-03-29 10:58:09,174 [root] DEBUG: 7372: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:58:09,268 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442DB1000, size: 0x1000.
2026-03-29 10:58:09,330 [root] DEBUG: 7372: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:58:09,377 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442DA1000, size: 0x1000.
2026-03-29 10:58:09,393 [root] DEBUG: 7372: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-03-29 10:58:09,440 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442D91000, size: 0x1000.
2026-03-29 10:58:09,580 [root] DEBUG: 7372: DLL loaded at 0x00007FFEFBEB0000: C:\Windows\SYSTEM32\profapi (0x1f000 bytes).
2026-03-29 10:58:09,580 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442D81000, size: 0x1000.
2026-03-29 10:58:09,627 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:58:09,627 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442D71000, size: 0x1000.
2026-03-29 10:58:09,658 [root] DEBUG: 7372: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:09,691 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442D61000, size: 0x1000.
2026-03-29 10:58:09,723 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:58:09,830 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442D51000, size: 0x1000.
2026-03-29 10:58:09,893 [root] DEBUG: 7372: DLL loaded at 0x00007FFEEF4B0000: C:\Windows\SYSTEM32\twinapi.appcore (0x200000 bytes).
2026-03-29 10:58:09,924 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFB850000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-03-29 10:58:09,940 [root] DEBUG: 7372: DLL loaded at 0x00007FFEE07A0000: C:\Windows\System32\Windows.Storage.ApplicationData (0x68000 bytes).
2026-03-29 10:58:09,955 [root] DEBUG: 4632: DLL loaded at 0x00007FFEEFF90000: C:\Windows\System32\AEPIC (0x92000 bytes).
2026-03-29 10:58:10,018 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFBFF0000: C:\Windows\System32\WINTRUST (0x69000 bytes).
2026-03-29 10:58:10,049 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E50000.
2026-03-29 10:58:10,066 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFDBE0000: C:\Windows\System32\SHELL32 (0x743000 bytes).
2026-03-29 10:58:10,112 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:10,162 [root] DEBUG: 7372: DLL loaded at 0x00007FFEF8C40000: C:\Windows\System32\WinTypes (0x154000 bytes).
2026-03-29 10:58:10,162 [root] DEBUG: 4632: DLL loaded at 0x00007FFEAD920000: C:\Windows\System32\msi (0x337000 bytes).
2026-03-29 10:58:10,205 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E50000 from tracked region list.
2026-03-29 10:58:10,221 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF60C0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-03-29 10:58:10,408 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E60000.
2026-03-29 10:58:10,486 [root] DEBUG: 4632: DLL loaded at 0x00007FFEDBCB0000: C:\Windows\System32\AEINV (0xd0000 bytes).
2026-03-29 10:58:10,518 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:10,533 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF9CD0000: C:\Windows\System32\wer (0xdb000 bytes).
2026-03-29 10:58:10,549 [root] DEBUG: 7372: DLL loaded at 0x00007FFEDF9D0000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-03-29 10:58:10,549 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E60000 from tracked region list.
2026-03-29 10:58:10,580 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF1F00000: C:\Windows\System32\dbghelp (0x1e4000 bytes).
2026-03-29 10:58:10,627 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF0620000: C:\Windows\System32\drvstore (0x148000 bytes).
2026-03-29 10:58:10,643 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442DD0000.
2026-03-29 10:58:10,658 [root] DEBUG: 7372: DLL loaded at 0x00007FFEF6F00000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-03-29 10:58:10,690 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFBFA0000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-03-29 10:58:10,690 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:10,893 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442DD0000 from tracked region list.
2026-03-29 10:58:10,986 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFBCB0000: C:\Windows\System32\DEVOBJ (0x2c000 bytes).
2026-03-29 10:58:11,111 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442DE0000.
2026-03-29 10:58:11,205 [root] DEBUG: 4632: DLL loaded at 0x00007FFEEA8A0000: C:\Windows\System32\FLTLIB (0xb000 bytes).
2026-03-29 10:58:11,252 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:11,361 [root] DEBUG: 4632: DLL loaded at 0x00007FFEE3760000: C:\Windows\System32\devinv (0xa5000 bytes).
2026-03-29 10:58:11,533 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442DE0000 from tracked region list.
2026-03-29 10:58:11,549 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF5C20000: C:\Windows\System32\WINHTTP (0x10a000 bytes).
2026-03-29 10:58:11,565 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:11,565 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E30000.
2026-03-29 10:58:11,580 [root] DEBUG: 7372: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 10:58:11,643 [root] DEBUG: 4632: DLL loaded at 0x00007FFEE6970000: C:\Windows\System32\invagent (0x8e000 bytes).
2026-03-29 10:58:11,705 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:11,721 [root] DEBUG: Loader: Injecting process 7800 (thread 1220) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:11,877 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E30000 from tracked region list.
2026-03-29 10:58:12,080 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFBA90000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-03-29 10:58:12,127 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:12,143 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E40000.
2026-03-29 10:58:12,143 [root] DEBUG: 7372: DLL loaded at 0x00007FFEF0350000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-03-29 10:58:12,143 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:12,361 [lib.api.process] INFO: Injected into 64-bit <Process 7800 ShellExperienceHost.exe>
2026-03-29 10:58:12,361 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:12,393 [root] DEBUG: 7372: DLL loaded at 0x00007FFEFE6C0000: C:\Windows\System32\MSCTF (0x115000 bytes).
2026-03-29 10:58:12,409 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E40000 from tracked region list.
2026-03-29 10:58:12,502 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 7800
2026-03-29 10:58:12,533 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 7372, handle 0x2248: C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_7.326.2102.0_x64__8wekyb3d8bbwe\GameBarFTServer.exe
2026-03-29 10:58:12,533 [lib.api.process] INFO: Monitor config for <Process 7800 ShellExperienceHost.exe>: C:\ltb6yatm\dll\7800.ini
2026-03-29 10:58:12,549 [root] DEBUG: 4632: DLL loaded at 0x00007FFEF1310000: C:\Windows\SYSTEM32\iertutil (0x2b1000 bytes).
2026-03-29 10:58:12,674 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442D50000.
2026-03-29 10:58:12,674 [root] DEBUG: 7372: DLL loaded at 0x00007FFEDCB40000: C:\Windows\SYSTEM32\rometadata (0x3b000 bytes).
2026-03-29 10:58:12,752 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:12,877 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442D50000 from the end of the tracked region list.
2026-03-29 10:58:12,877 [root] DEBUG: 7372: OpenProcessHandler: Injection info created for process 452, handle 0x4e8: C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_7.326.2102.0_x64__8wekyb3d8bbwe\GameBar.exe
2026-03-29 10:58:12,924 [root] DEBUG: 7372: DLL loaded at 0x00007FFEEA210000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-03-29 10:58:12,971 [root] DEBUG: 7372: DLL loaded at 0x00007FFEF1C10000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\VCRUNTIME140_APP (0x1d000 bytes).
2026-03-29 10:58:12,971 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442D90000.
2026-03-29 10:58:13,002 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,033 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442D90000 from tracked region list.
2026-03-29 10:58:13,033 [root] DEBUG: 7372: DLL loaded at 0x00007FFEF20F0000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\VCRUNTIME140_1_APP (0xc000 bytes).
2026-03-29 10:58:13,065 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442DF0000.
2026-03-29 10:58:13,065 [root] DEBUG: 7372: DLL loaded at 0x00007FFEEF0A0000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.33519.0_x64__8wekyb3d8bbwe\MSVCP140_APP (0x8c000 bytes).
2026-03-29 10:58:13,080 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,205 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442DF0000 from tracked region list.
2026-03-29 10:58:13,252 [root] DEBUG: 7372: DLL loaded at 0x00007FFEDBC40000: C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_7.326.2102.0_x64__8wekyb3d8bbwe\Microsoft.Gaming.OverlayDataModels (0x69000 bytes).
2026-03-29 10:58:13,299 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E10000.
2026-03-29 10:58:13,315 [root] DEBUG: 7372: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:58:13,330 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,361 [root] DEBUG: 7372: DLL loaded at 0x00007FFEEE110000: C:\Windows\System32\ActXPrxy (0xa1000 bytes).
2026-03-29 10:58:13,377 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E10000 from tracked region list.
2026-03-29 10:58:13,502 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E20000.
2026-03-29 10:58:13,518 [root] INFO: Announced starting service "b'BcastDVRUserService_4343c'"
2026-03-29 10:58:13,565 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,580 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E20000 from tracked region list.
2026-03-29 10:58:13,596 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442D60000.
2026-03-29 10:58:13,658 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,705 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442D60000 from the end of the tracked region list.
2026-03-29 10:58:13,783 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E00000.
2026-03-29 10:58:13,799 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,830 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E00000 from tracked region list.
2026-03-29 10:58:13,908 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442DB0000.
2026-03-29 10:58:13,924 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:13,955 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442DB0000 from tracked region list.
2026-03-29 10:58:14,096 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442DA0000.
2026-03-29 10:58:14,111 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:14,190 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442DA0000 from tracked region list.
2026-03-29 10:58:14,252 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442D70000.
2026-03-29 10:58:14,299 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:14,299 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442D70000 from the end of the tracked region list.
2026-03-29 10:58:14,315 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442D80000.
2026-03-29 10:58:14,424 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:14,502 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442D80000 from the end of the tracked region list.
2026-03-29 10:58:14,768 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442DC0000.
2026-03-29 10:58:14,783 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:14,879 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:14,893 [root] DEBUG: Loader: Injecting process 7800 (thread 1220) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:14,893 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442DC0000 from the end of the tracked region list.
2026-03-29 10:58:14,940 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E61000, size: 0x1000.
2026-03-29 10:58:14,955 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:14,971 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:15,004 [root] DEBUG: 5000: AllocationHandler: Adding allocation to tracked region list: 0x00007DF442E51000, size: 0x1000.
2026-03-29 10:58:15,004 [lib.api.process] INFO: Injected into 64-bit <Process 7800 ShellExperienceHost.exe>
2026-03-29 10:58:15,033 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 7800
2026-03-29 10:58:15,033 [lib.api.process] INFO: Monitor config for <Process 7800 ShellExperienceHost.exe>: C:\ltb6yatm\dll\7800.ini
2026-03-29 10:58:15,049 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E50000.
2026-03-29 10:58:15,049 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:15,096 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E50000 from the end of the tracked region list.
2026-03-29 10:58:15,111 [root] DEBUG: 5000: DLL loaded at 0x00007FFEE7DD0000: C:\Windows\System32\bcastdvr.proxy (0x43000 bytes).
2026-03-29 10:58:15,190 [root] DEBUG: 5000: FreeHandler: Address: 0x00007DF442E60000.
2026-03-29 10:58:15,361 [root] DEBUG: 5000: ScanForNonZero: Error - Supplied size zero.
2026-03-29 10:58:15,377 [root] DEBUG: 5000: DropTrackedRegion: removed region at 0x00007DF442E60000 from the end of the tracked region list.
2026-03-29 10:58:16,221 [root] DEBUG: 5000: OpenProcessHandler: Image base for process 3684 (handle 0x2530): 0x00007FF7AB6E0000.
2026-03-29 10:58:16,315 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 3684, handle 0x2530: C:\Windows\System32\svchost.exe
2026-03-29 10:58:16,627 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\dd7c3b1adb1c168b.automaticDestinations-ms
2026-03-29 10:58:16,658 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\dd7c3b1adb1c168b.automaticDestinations-ms
2026-03-29 10:58:16,815 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE9FF0000: C:\Windows\System32\Windows.Networking.Connectivity (0xb9000 bytes).
2026-03-29 10:58:16,846 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:17,033 [root] DEBUG: 3792: DLL loaded at 0x72B60000: C:\Windows\system32\napinsp (0x11000 bytes).
2026-03-29 10:58:17,033 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay---.lnk to files\52594ba17b85dd0b3fdd9aecef3b4c22ca5109d5074455edbbecabe3484316c5; Size is 156; Max size: 100000000
2026-03-29 10:58:17,065 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF09C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-03-29 10:58:17,158 [root] DEBUG: Loader: Injecting process 7800 (thread 1220) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:17,221 [root] DEBUG: 3792: DLL loaded at 0x72B40000: C:\Windows\system32\pnrpnsp (0x16000 bytes).
2026-03-29 10:58:17,283 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:17,330 [root] DEBUG: 3792: DLL loaded at 0x72B30000: C:\Windows\system32\wshbth (0x10000 bytes).
2026-03-29 10:58:17,377 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:17,393 [root] DEBUG: 3792: DLL loaded at 0x74BB0000: C:\Windows\SYSTEM32\IPHLPAPI (0x32000 bytes).
2026-03-29 10:58:17,440 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay---.lnk
2026-03-29 10:58:17,440 [lib.api.process] INFO: Injected into 64-bit <Process 7800 ShellExperienceHost.exe>
2026-03-29 10:58:17,502 [root] DEBUG: 3792: DLL loaded at 0x72B10000: C:\Windows\system32\NLAapi (0x16000 bytes).
2026-03-29 10:58:17,689 [root] DEBUG: 3792: DLL loaded at 0x747C0000: C:\Windows\System32\mswsock (0x52000 bytes).
2026-03-29 10:58:17,861 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\Интернет.lnk to files\b68e121586ef846dc2be14897087566ac72f6e6339f193609a5fc6f766e5c4aa; Size is 104; Max size: 100000000
2026-03-29 10:58:17,971 [root] DEBUG: 3792: DLL loaded at 0x735F0000: C:\Windows\SYSTEM32\DNSAPI (0x90000 bytes).
2026-03-29 10:58:18,065 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\Интернет.lnk
2026-03-29 10:58:18,080 [root] DEBUG: 3792: DLL loaded at 0x77E20000: C:\Windows\System32\NSI (0x7000 bytes).
2026-03-29 10:58:18,330 [root] DEBUG: 3792: DLL loaded at 0x72B00000: C:\Windows\System32\winrnr (0xe000 bytes).
2026-03-29 10:58:18,455 [root] DEBUG: 5548: DLL loaded at 0x00007FFEEA630000: C:\Windows\System32\LINKINFO (0xd000 bytes).
2026-03-29 10:58:18,502 [root] DEBUG: 3792: DLL loaded at 0x73580000: C:\Windows\System32\fwpuclnt (0x59000 bytes).
2026-03-29 10:58:18,502 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE1D20000: C:\Windows\System32\ntshrui (0x7d000 bytes).
2026-03-29 10:58:18,627 [root] DEBUG: 3792: DLL loaded at 0x735E0000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2026-03-29 10:58:18,643 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF15D0000: C:\Windows\System32\srvcli (0x28000 bytes).
2026-03-29 10:58:18,752 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE7F80000: C:\Windows\System32\cscapi (0x12000 bytes).
2026-03-29 10:58:18,847 [root] DEBUG: 5548: DLL loaded at 0x00007FFEFBE70000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-03-29 10:58:19,143 [root] DEBUG: 3792: DLL loaded at 0x72B40000: C:\Windows\system32\mlang (0x34000 bytes).
2026-03-29 10:58:19,471 [root] DEBUG: 3792: DLL loaded at 0x72970000: C:\Windows\System32\srvcli (0x1d000 bytes).
2026-03-29 10:58:19,736 [root] DEBUG: 3792: DLL loaded at 0x75440000: C:\Windows\System32\netutils (0xb000 bytes).
2026-03-29 10:58:19,940 [root] DEBUG: 3792: DLL loaded at 0x72990000: C:\Windows\System32\urlmon (0x1a8000 bytes).
2026-03-29 10:58:20,237 [root] DEBUG: 3792: DLL loaded at 0x72950000: C:\Windows\SYSTEM32\ondemandconnroutehelper (0x12000 bytes).
2026-03-29 10:58:20,627 [root] DEBUG: 3792: DLL loaded at 0x73750000: C:\Windows\SYSTEM32\winhttp (0xc9000 bytes).
2026-03-29 10:58:20,815 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 7524, handle 0xdc0: C:\Windows\System32\rundll32.exe
2026-03-29 10:58:20,986 [root] DEBUG: 3792: DLL loaded at 0x73680000: C:\Windows\SYSTEM32\WINNSI (0x8000 bytes).
2026-03-29 10:58:22,502 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF1310000: C:\Windows\System32\iertutil (0x2b1000 bytes).
2026-03-29 10:58:22,877 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3452: C:\Windows\system32\BackgroundTransferHost.exe, ImageBase: 0x00007FF7F1110000
2026-03-29 10:58:22,893 [root] INFO: Announced 64-bit process name: BackgroundTransferHost.exe pid: 3452
2026-03-29 10:58:22,893 [lib.api.process] INFO: Monitor config for <Process 3452 BackgroundTransferHost.exe>: C:\ltb6yatm\dll\3452.ini
2026-03-29 10:58:22,986 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:23,080 [root] DEBUG: Loader: Injecting process 3452 (thread 1328) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:23,096 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:23,158 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:23,174 [lib.api.process] INFO: Injected into 64-bit <Process 3452 BackgroundTransferHost.exe>
2026-03-29 10:58:23,236 [root] INFO: Announced 64-bit process name: BackgroundTransferHost.exe pid: 3452
2026-03-29 10:58:23,236 [lib.api.process] INFO: Monitor config for <Process 3452 BackgroundTransferHost.exe>: C:\ltb6yatm\dll\3452.ini
2026-03-29 10:58:23,315 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:23,596 [root] DEBUG: Loader: Injecting process 3452 (thread 1328) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:23,611 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:23,611 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:23,643 [lib.api.process] INFO: Injected into 64-bit <Process 3452 BackgroundTransferHost.exe>
2026-03-29 10:58:23,658 [root] INFO: Announced 64-bit process name: BackgroundTransferHost.exe pid: 3452
2026-03-29 10:58:23,674 [lib.api.process] INFO: Monitor config for <Process 3452 BackgroundTransferHost.exe>: C:\ltb6yatm\dll\3452.ini
2026-03-29 10:58:23,721 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:23,846 [root] DEBUG: Loader: Injecting process 3452 (thread 1328) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:23,846 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:23,940 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:24,096 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4488: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 10:58:24,205 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 4488
2026-03-29 10:58:24,205 [lib.api.process] INFO: Injected into 64-bit <Process 3452 BackgroundTransferHost.exe>
2026-03-29 10:58:24,205 [lib.api.process] INFO: Monitor config for <Process 4488 dllhost.exe>: C:\ltb6yatm\dll\4488.ini
2026-03-29 10:58:24,440 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:24,455 [root] DEBUG: 752: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:24,486 [root] DEBUG: Loader: Injecting process 4488 (thread 1788) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:24,565 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:24,596 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:24,612 [lib.api.process] INFO: Injected into 64-bit <Process 4488 dllhost.exe>
2026-03-29 10:58:24,690 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 4488
2026-03-29 10:58:24,707 [lib.api.process] INFO: Monitor config for <Process 4488 dllhost.exe>: C:\ltb6yatm\dll\4488.ini
2026-03-29 10:58:24,752 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:24,783 [root] DEBUG: Loader: Injecting process 4488 (thread 1788) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:24,799 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:24,815 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:24,846 [lib.api.process] INFO: Injected into 64-bit <Process 4488 dllhost.exe>
2026-03-29 10:58:25,174 [root] DEBUG: 4488: Python path set to 'C:\Python310'.
2026-03-29 10:58:25,190 [root] DEBUG: 4488: Dropped file limit defaulting to 100.
2026-03-29 10:58:25,236 [root] DEBUG: 3792: DLL loaded at 0x73D90000: C:\Windows\system32\napinsp (0x11000 bytes).
2026-03-29 10:58:25,299 [root] DEBUG: 3792: DLL loaded at 0x72930000: C:\Windows\system32\pnrpnsp (0x16000 bytes).
2026-03-29 10:58:25,315 [root] DEBUG: 3792: DLL loaded at 0x73D80000: C:\Windows\system32\wshbth (0x10000 bytes).
2026-03-29 10:58:25,330 [root] DEBUG: 3792: DLL loaded at 0x72910000: C:\Windows\system32\NLAapi (0x16000 bytes).
2026-03-29 10:58:25,346 [root] DEBUG: 3792: DLL loaded at 0x72900000: C:\Windows\System32\winrnr (0xe000 bytes).
2026-03-29 10:58:25,361 [root] DEBUG: 4488: Disabling sleep skipping.
2026-03-29 10:58:25,361 [root] DEBUG: 3792: DLL loaded at 0x73580000: C:\Windows\System32\fwpuclnt (0x59000 bytes).
2026-03-29 10:58:25,377 [root] DEBUG: 4488: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:25,428 [root] DEBUG: 4488: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:58:25,440 [root] DEBUG: 4488: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 10:58:25,471 [root] DEBUG: 4488: Monitor initialised: 64-bit capemon loaded in process 4488 at 0x00007FFEABE00000, thread 1788, image base 0x00007FF6F2810000, stack from 0x000000DE3FAF4000-0x000000DE3FB00000
2026-03-29 10:58:25,486 [root] DEBUG: 4488: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AA65DD7C-83AC-48C0-A6FD-9B61FEBF8800}
2026-03-29 10:58:25,533 [root] DEBUG: 4488: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:58:25,768 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:58:25,799 [root] DEBUG: 4488: set_hooks: Unable to hook LockResource
2026-03-29 10:58:25,846 [root] DEBUG: 4488: Hooked 627 out of 628 functions
2026-03-29 10:58:25,864 [root] DEBUG: 4488: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:25,877 [root] DEBUG: 4488: RestoreHeaders: Restored original import table.
2026-03-29 10:58:25,908 [root] INFO: Loaded monitor into process with pid 4488
2026-03-29 10:58:25,971 [root] DEBUG: 4488: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28112F2, thread 1788).
2026-03-29 10:58:25,987 [root] DEBUG: 4488: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 10:58:26,002 [root] DEBUG: 4488: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:26,018 [root] DEBUG: 4488: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:58:26,033 [root] DEBUG: 4488: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:58:26,033 [root] DEBUG: 3792: DLL loaded at 0x728D0000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-03-29 10:58:26,080 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:58:26,096 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:58:26,315 [root] DEBUG: 4488: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:26,361 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFB470000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-03-29 10:58:26,393 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFB390000: C:\Windows\system32\netutils (0xc000 bytes).
2026-03-29 10:58:26,408 [root] DEBUG: 4488: DLL loaded at 0x00007FFEF5F10000: C:\Windows\system32\dhcpcsvc (0x1d000 bytes).
2026-03-29 10:58:26,471 [root] DEBUG: 4488: DLL loaded at 0x00007FFEF5C20000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-03-29 10:58:26,549 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:58:26,565 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:58:26,611 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFB350000: C:\Windows\system32\IPHLPAPI (0x3b000 bytes).
2026-03-29 10:58:26,815 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFBE70000: C:\Windows\system32\USERENV (0x2e000 bytes).
2026-03-29 10:58:26,861 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFBEB0000: C:\Windows\system32\profapi (0x1f000 bytes).
2026-03-29 10:58:26,877 [root] DEBUG: 4488: DLL loaded at 0x00007FFEF60C0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-03-29 10:58:26,893 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFB3A0000: C:\Windows\system32\DNSAPI (0xca000 bytes).
2026-03-29 10:58:26,893 [root] DEBUG: 4488: DLL loaded at 0x00007FFED9E70000: C:\Windows\system32\domgmt (0x7e000 bytes).
2026-03-29 10:58:27,236 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFE580000: C:\Windows\System32\NSI (0x8000 bytes).
2026-03-29 10:58:27,502 [root] DEBUG: 4488: DLL loaded at 0x00007FFEEA210000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-03-29 10:58:28,846 [root] DEBUG: 4488: DLL loaded at 0x00007FFEFB070000: C:\Windows\system32\msvcp110_win (0x8a000 bytes).
2026-03-29 10:58:28,908 [root] DEBUG: 4488: DLL loaded at 0x00007FFEF6370000: C:\Windows\SYSTEM32\policymanager (0xa0000 bytes).
2026-03-29 10:58:30,393 [root] DEBUG: 3792: DLL loaded at 0x72890000: C:\Windows\SYSTEM32\edputil (0x1b000 bytes).
2026-03-29 10:58:30,471 [root] DEBUG: 3792: DLL loaded at 0x727F0000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2026-03-29 10:58:30,533 [root] DEBUG: 3792: DLL loaded at 0x72710000: C:\Windows\System32\wintypes (0xdb000 bytes).
2026-03-29 10:58:30,580 [root] DEBUG: 3792: DLL loaded at 0x72640000: C:\Windows\System32\Bcp47Langs (0x48000 bytes).
2026-03-29 10:58:30,580 [root] DEBUG: 3792: DLL loaded at 0x72600000: C:\Windows\System32\sppc (0x1c000 bytes).
2026-03-29 10:58:30,580 [root] DEBUG: 3792: DLL loaded at 0x72620000: C:\Windows\System32\SLC (0x1f000 bytes).
2026-03-29 10:58:30,596 [root] DEBUG: 3792: DLL loaded at 0x73B60000: C:\Windows\System32\USERENV (0x25000 bytes).
2026-03-29 10:58:30,611 [root] DEBUG: 3792: DLL loaded at 0x72690000: C:\Windows\System32\appresolver (0x71000 bytes).
2026-03-29 10:58:30,705 [root] DEBUG: 3792: DLL loaded at 0x72C60000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2026-03-29 10:58:30,736 [root] DEBUG: 3792: DLL loaded at 0x72240000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3b9000 bytes).
2026-03-29 10:58:30,799 [root] DEBUG: 3792: CreateProcessHandler: Injection info set for new process 1040: C:\Windows\System32\cmd.exe, ImageBase: 0x00AE0000
2026-03-29 10:58:30,846 [root] INFO: Announced 32-bit process name: cmd.exe pid: 1040
2026-03-29 10:58:30,861 [lib.api.process] INFO: Monitor config for <Process 1040 cmd.exe>: C:\ltb6yatm\dll\1040.ini
2026-03-29 10:58:30,877 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:30,924 [root] DEBUG: Loader: Injecting process 1040 (thread 3164) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:30,924 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:30,924 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:30,940 [lib.api.process] INFO: Injected into 32-bit <Process 1040 cmd.exe>
2026-03-29 10:58:30,987 [root] DEBUG: 3792: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:30,987 [root] INFO: Announced 32-bit process name: cmd.exe pid: 1040
2026-03-29 10:58:31,002 [lib.api.process] INFO: Monitor config for <Process 1040 cmd.exe>: C:\ltb6yatm\dll\1040.ini
2026-03-29 10:58:31,018 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:31,080 [root] DEBUG: Loader: Injecting process 1040 (thread 3164) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:31,096 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:31,096 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:31,127 [lib.api.process] INFO: Injected into 32-bit <Process 1040 cmd.exe>
2026-03-29 10:58:31,393 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 5020, handle 0x1744: C:\Windows\System32\conhost.exe
2026-03-29 10:58:31,424 [root] DEBUG: 3792: CreateProcessHandler: Injection info set for new process 2168: C:\Windows\System32\cmd.exe, ImageBase: 0x00AE0000
2026-03-29 10:58:31,440 [root] INFO: Announced 32-bit process name: cmd.exe pid: 2168
2026-03-29 10:58:31,440 [lib.api.process] INFO: Monitor config for <Process 2168 cmd.exe>: C:\ltb6yatm\dll\2168.ini
2026-03-29 10:58:31,486 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:31,486 [root] DEBUG: 1040: Python path set to 'C:\Python310'.
2026-03-29 10:58:31,535 [root] DEBUG: 1040: Dropped file limit defaulting to 100.
2026-03-29 10:58:31,549 [root] DEBUG: Loader: Injecting process 2168 (thread 7968) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:31,549 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:31,549 [root] DEBUG: 1040: Disabling sleep skipping.
2026-03-29 10:58:31,596 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:31,596 [root] DEBUG: 1040: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:31,612 [lib.api.process] INFO: Injected into 32-bit <Process 2168 cmd.exe>
2026-03-29 10:58:31,643 [root] DEBUG: 1040: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:58:31,661 [root] DEBUG: 1040: YaraScan hit: FindFixAndRun
2026-03-29 10:58:31,674 [root] DEBUG: 3792: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:31,674 [root] DEBUG: 1040: Monitor initialised: 32-bit capemon loaded in process 1040 at 0x73f00000, thread 3164, image base 0xae0000, stack from 0x2e83000-0x2f80000
2026-03-29 10:58:31,674 [root] INFO: Announced 32-bit process name: cmd.exe pid: 2168
2026-03-29 10:58:31,674 [root] DEBUG: 1040: Commandline: "C:\Windows\System32\cmd.exe" /c sc stop RemoteAccess
2026-03-29 10:58:31,705 [lib.api.process] INFO: Monitor config for <Process 2168 cmd.exe>: C:\ltb6yatm\dll\2168.ini
2026-03-29 10:58:31,861 [root] DEBUG: 1040: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:58:31,924 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:32,002 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:58:32,033 [root] DEBUG: 1040: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:58:32,049 [root] DEBUG: Loader: Injecting process 2168 (thread 7968) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:32,049 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:58:32,049 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:32,049 [root] DEBUG: 1040: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:58:32,080 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:32,080 [root] DEBUG: 1040: Hooked 630 out of 632 functions
2026-03-29 10:58:32,143 [lib.api.process] INFO: Injected into 32-bit <Process 2168 cmd.exe>
2026-03-29 10:58:32,143 [root] DEBUG: 1040: set_hooks_exe: Hooked FindFixAndRun at 0x00AEAD60
2026-03-29 10:58:32,268 [root] DEBUG: 1040: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:32,455 [root] DEBUG: 1040: RestoreHeaders: Restored original import table.
2026-03-29 10:58:32,580 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 2956, handle 0x1744: C:\Windows\System32\conhost.exe
2026-03-29 10:58:32,643 [root] INFO: Loaded monitor into process with pid 1040
2026-03-29 10:58:32,674 [root] DEBUG: 3792: CreateProcessHandler: Injection info set for new process 3964: C:\Windows\System32\cmd.exe, ImageBase: 0x00AE0000
2026-03-29 10:58:32,690 [root] DEBUG: 2168: Python path set to 'C:\Python310'.
2026-03-29 10:58:32,690 [root] DEBUG: 1040: caller_dispatch: Added region at 0x00AE0000 to tracked regions list (ntdll::NtOpenThread returns to 0x00AF09DE, thread 3164).
2026-03-29 10:58:32,705 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 2168, handle 0x1744: C:\Windows\SysWOW64\cmd.exe
2026-03-29 10:58:32,705 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3964
2026-03-29 10:58:32,721 [root] DEBUG: 2168: Dropped file limit defaulting to 100.
2026-03-29 10:58:32,737 [lib.api.process] INFO: Monitor config for <Process 3964 cmd.exe>: C:\ltb6yatm\dll\3964.ini
2026-03-29 10:58:32,752 [root] DEBUG: 1040: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:58:32,816 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:32,955 [root] DEBUG: 2168: Disabling sleep skipping.
2026-03-29 10:58:33,002 [root] DEBUG: Loader: Injecting process 3964 (thread 6596) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:33,034 [root] DEBUG: 2168: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:33,049 [root] DEBUG: 1040: ProcessImageBase: Main module image at 0x00AE0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:33,158 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:33,190 [root] DEBUG: 1040: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 3164).
2026-03-29 10:58:33,221 [root] DEBUG: 2168: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:58:33,252 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:33,299 [lib.api.process] INFO: Injected into 32-bit <Process 3964 cmd.exe>
2026-03-29 10:58:33,299 [root] DEBUG: 2168: YaraScan hit: FindFixAndRun
2026-03-29 10:58:33,330 [root] DEBUG: 1040: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:33,393 [root] DEBUG: 3792: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:33,471 [root] DEBUG: 2168: Monitor initialised: 32-bit capemon loaded in process 2168 at 0x73f00000, thread 7968, image base 0xae0000, stack from 0x403000-0x500000
2026-03-29 10:58:33,518 [root] DEBUG: 2168: Commandline: "C:\Windows\System32\cmd.exe" /c sc config RemoteAccess binpath= "C:\Windows\system32\wscript.exe //B C:\autoexec.vbs" start= auto
2026-03-29 10:58:33,518 [root] INFO: Announced 32-bit process name: cmd.exe pid: 3964
2026-03-29 10:58:33,612 [lib.api.process] INFO: Monitor config for <Process 3964 cmd.exe>: C:\ltb6yatm\dll\3964.ini
2026-03-29 10:58:33,705 [root] DEBUG: 1040: CreateProcessHandler: Injection info set for new process 7728: C:\Windows\system32\sc.exe, ImageBase: 0x00B20000
2026-03-29 10:58:33,752 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:33,799 [root] DEBUG: 2168: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:58:33,893 [root] INFO: Announced 32-bit process name: sc.exe pid: 7728
2026-03-29 10:58:33,939 [root] DEBUG: Loader: Injecting process 3964 (thread 6596) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:33,939 [lib.api.process] INFO: Monitor config for <Process 7728 sc.exe>: C:\ltb6yatm\dll\7728.ini
2026-03-29 10:58:33,955 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:58:33,955 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:58:33,955 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:33,955 [root] DEBUG: 2168: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:58:34,049 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:34,049 [root] DEBUG: Loader: Injecting process 7728 (thread 1936) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:34,065 [lib.api.process] INFO: Injected into 32-bit <Process 3964 cmd.exe>
2026-03-29 10:58:34,065 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:58:34,112 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:34,143 [root] DEBUG: 2168: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:58:34,221 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:34,268 [root] DEBUG: 2168: Hooked 630 out of 632 functions
2026-03-29 10:58:34,299 [lib.api.process] INFO: Injected into 32-bit <Process 7728 sc.exe>
2026-03-29 10:58:34,377 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 1240, handle 0x1744: C:\Windows\System32\conhost.exe
2026-03-29 10:58:34,424 [root] DEBUG: 2168: set_hooks_exe: Hooked FindFixAndRun at 0x00AEAD60
2026-03-29 10:58:34,455 [root] DEBUG: 3964: Python path set to 'C:\Python310'.
2026-03-29 10:58:34,471 [root] DEBUG: 1040: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:34,486 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 3964, handle 0x1744: C:\Windows\SysWOW64\cmd.exe
2026-03-29 10:58:34,518 [root] DEBUG: 2168: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:34,596 [root] DEBUG: 3964: Dropped file limit defaulting to 100.
2026-03-29 10:58:34,612 [root] DEBUG: 2168: RestoreHeaders: Restored original import table.
2026-03-29 10:58:34,658 [root] DEBUG: 7728: Python path set to 'C:\Python310'.
2026-03-29 10:58:34,674 [root] INFO: Loaded monitor into process with pid 2168
2026-03-29 10:58:34,690 [root] DEBUG: 3964: Disabling sleep skipping.
2026-03-29 10:58:34,690 [root] DEBUG: 7728: Dropped file limit defaulting to 100.
2026-03-29 10:58:34,768 [root] DEBUG: 2168: caller_dispatch: Added region at 0x00AE0000 to tracked regions list (ntdll::NtOpenThread returns to 0x00AF09DE, thread 7968).
2026-03-29 10:58:34,783 [root] DEBUG: 3964: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:34,783 [root] DEBUG: 3964: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:58:34,799 [root] DEBUG: 2168: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:58:34,815 [root] DEBUG: 7728: Disabling sleep skipping.
2026-03-29 10:58:34,846 [root] DEBUG: 3964: YaraScan hit: FindFixAndRun
2026-03-29 10:58:34,846 [root] DEBUG: 7728: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:34,846 [root] DEBUG: 2168: ProcessImageBase: Main module image at 0x00AE0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:34,846 [root] DEBUG: 3964: Monitor initialised: 32-bit capemon loaded in process 3964 at 0x73f00000, thread 6596, image base 0xae0000, stack from 0x403000-0x500000
2026-03-29 10:58:34,893 [root] DEBUG: 7728: YaraScan: Scanning 0x00B20000, size 0x12a80
2026-03-29 10:58:34,908 [root] DEBUG: 3964: Commandline: "C:\Windows\System32\cmd.exe" /c sc start RemoteAccess
2026-03-29 10:58:35,111 [root] DEBUG: 2168: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 7968).
2026-03-29 10:58:35,111 [root] DEBUG: 7728: Monitor initialised: 32-bit capemon loaded in process 7728 at 0x73f00000, thread 1936, image base 0xb20000, stack from 0x3235000-0x3240000
2026-03-29 10:58:35,127 [root] DEBUG: 3964: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:58:35,174 [root] DEBUG: 2168: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:35,174 [root] DEBUG: 7728: Commandline: sc  stop RemoteAccess
2026-03-29 10:58:35,658 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:58:36,002 [root] DEBUG: 7728: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:58:36,018 [root] DEBUG: 2168: CreateProcessHandler: Injection info set for new process 1012: C:\Windows\system32\sc.exe, ImageBase: 0x00B20000
2026-03-29 10:58:36,127 [root] INFO: Process with pid 4488 has terminated
2026-03-29 10:58:36,143 [root] DEBUG: 3964: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:58:36,143 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:58:36,221 [root] DEBUG: 4488: NtTerminateProcess hook: Attempting to dump process 4488
2026-03-29 10:58:36,221 [root] INFO: Announced 32-bit process name: sc.exe pid: 1012
2026-03-29 10:58:36,236 [lib.api.process] INFO: Monitor config for <Process 1012 sc.exe>: C:\ltb6yatm\dll\1012.ini
2026-03-29 10:58:36,236 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:58:36,252 [root] DEBUG: 7728: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:58:36,268 [root] DEBUG: 4488: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:58:36,268 [root] DEBUG: 3964: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:58:36,283 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:58:36,330 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:36,361 [root] DEBUG: 3964: Hooked 630 out of 632 functions
2026-03-29 10:58:36,393 [root] DEBUG: 7728: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:58:36,424 [root] DEBUG: 3964: set_hooks_exe: Hooked FindFixAndRun at 0x00AEAD60
2026-03-29 10:58:36,440 [root] DEBUG: Loader: Injecting process 1012 (thread 3224) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:36,440 [root] DEBUG: 3964: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:36,471 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:36,471 [root] DEBUG: 7728: Hooked 630 out of 632 functions
2026-03-29 10:58:36,535 [root] DEBUG: 3964: RestoreHeaders: Restored original import table.
2026-03-29 10:58:36,549 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:36,549 [root] INFO: Loaded monitor into process with pid 3964
2026-03-29 10:58:36,549 [root] DEBUG: 7728: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:36,598 [lib.api.process] INFO: Injected into 32-bit <Process 1012 sc.exe>
2026-03-29 10:58:36,598 [root] DEBUG: 3964: caller_dispatch: Added region at 0x00AE0000 to tracked regions list (ntdll::NtOpenThread returns to 0x00AF09DE, thread 6596).
2026-03-29 10:58:36,598 [root] DEBUG: 7728: RestoreHeaders: Restored original import table.
2026-03-29 10:58:36,690 [root] DEBUG: 2168: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:36,721 [root] INFO: Loaded monitor into process with pid 7728
2026-03-29 10:58:36,752 [root] DEBUG: 3964: YaraScan: Scanning 0x00AE0000, size 0x595ee
2026-03-29 10:58:36,768 [root] DEBUG: 1012: Python path set to 'C:\Python310'.
2026-03-29 10:58:36,783 [root] DEBUG: 3964: ProcessImageBase: Main module image at 0x00AE0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:36,846 [root] DEBUG: 7728: caller_dispatch: Added region at 0x00B20000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00B25DEA, thread 1936).
2026-03-29 10:58:36,846 [root] DEBUG: 1012: Dropped file limit defaulting to 100.
2026-03-29 10:58:36,861 [root] DEBUG: 7728: YaraScan: Scanning 0x00B20000, size 0x12a80
2026-03-29 10:58:36,908 [root] DEBUG: 7728: ProcessImageBase: Main module image at 0x00B20000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:36,908 [root] DEBUG: 3964: InstrumentationCallback: Added region at 0x772833EC (base 0x77150000) to tracked regions list (thread 6596).
2026-03-29 10:58:36,986 [root] DEBUG: 1012: Disabling sleep skipping.
2026-03-29 10:58:37,002 [root] DEBUG: 3964: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:37,018 [root] DEBUG: 7728: NtTerminateProcess hook: Attempting to dump process 7728
2026-03-29 10:58:37,049 [root] DEBUG: 1012: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:37,065 [root] DEBUG: 3964: CreateProcessHandler: Injection info set for new process 6924: C:\Windows\system32\sc.exe, ImageBase: 0x00B20000
2026-03-29 10:58:37,065 [root] DEBUG: 7728: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:58:37,111 [root] DEBUG: 1012: YaraScan: Scanning 0x00B20000, size 0x12a80
2026-03-29 10:58:37,143 [root] INFO: Announced 32-bit process name: sc.exe pid: 6924
2026-03-29 10:58:37,158 [lib.api.process] INFO: Monitor config for <Process 6924 sc.exe>: C:\ltb6yatm\dll\6924.ini
2026-03-29 10:58:37,158 [root] INFO: Process with pid 7728 has terminated
2026-03-29 10:58:37,221 [root] DEBUG: 1012: Monitor initialised: 32-bit capemon loaded in process 1012 at 0x73f00000, thread 3224, image base 0xb20000, stack from 0xa34000-0xa40000
2026-03-29 10:58:37,221 [root] DEBUG: 1040: NtTerminateProcess hook: Attempting to dump process 1040
2026-03-29 10:58:37,237 [root] DEBUG: 1012: Commandline: sc  config RemoteAccess binpath= "C:\Windows\system32\wscript.exe //B C:\autoexec.vbs" start= auto
2026-03-29 10:58:37,252 [lib.api.process] INFO: 32-bit DLL to inject is C:\ltb6yatm\dll\aUdGyWws.dll, loader C:\ltb6yatm\bin\ReIIPbe.exe
2026-03-29 10:58:37,361 [root] DEBUG: 1040: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:58:37,377 [root] DEBUG: Loader: Injecting process 6924 (thread 7208) with C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:37,377 [root] DEBUG: 1040: DoProcessDump: Code modification detected, dumping Imagebase at 0x00AE0000.
2026-03-29 10:58:37,408 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:37,424 [root] DEBUG: 1040: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:58:37,424 [root] DEBUG: 1012: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:58:37,440 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\aUdGyWws.dll.
2026-03-29 10:58:37,502 [root] DEBUG: 1040: DumpProcess: Instantiating PeParser with address: 0x00AE0000.
2026-03-29 10:58:37,521 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:58:37,521 [lib.api.process] INFO: Injected into 32-bit <Process 6924 sc.exe>
2026-03-29 10:58:37,521 [root] DEBUG: 1040: DumpProcess: Module entry point VA is 0x00AF6B20.
2026-03-29 10:58:37,533 [root] DEBUG: 1012: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:58:37,596 [root] DEBUG: 3964: ProcessTrackedRegion: Region at 0x77150000 mapped as \Device\HarddiskVolume1\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-03-29 10:58:37,627 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\1040_129344403758729032026 to procdump\c80d73acc4576b72cf63f78f2307a93a5a08cbc7f1ee033a964f268f2197b1b8; Size is 346624; Max size: 100000000
2026-03-29 10:58:37,658 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:58:37,690 [root] DEBUG: 1040: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:58:37,690 [root] DEBUG: 6924: Python path set to 'C:\Python310'.
2026-03-29 10:58:37,690 [root] DEBUG: 1012: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:58:37,861 [root] INFO: Process with pid 1040 has terminated
2026-03-29 10:58:37,861 [root] DEBUG: 6924: Dropped file limit defaulting to 100.
2026-03-29 10:58:37,893 [root] DEBUG: 1012: Hooked 630 out of 632 functions
2026-03-29 10:58:37,971 [root] DEBUG: 6924: Disabling sleep skipping.
2026-03-29 10:58:37,971 [root] DEBUG: 1012: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:37,987 [root] DEBUG: 6924: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:37,987 [root] DEBUG: 1012: RestoreHeaders: Restored original import table.
2026-03-29 10:58:38,002 [root] DEBUG: 6924: YaraScan: Scanning 0x00B20000, size 0x12a80
2026-03-29 10:58:38,002 [root] INFO: Loaded monitor into process with pid 1012
2026-03-29 10:58:38,033 [root] DEBUG: 6924: Monitor initialised: 32-bit capemon loaded in process 6924 at 0x73f00000, thread 7208, image base 0xb20000, stack from 0x945000-0x950000
2026-03-29 10:58:38,174 [root] DEBUG: 1012: caller_dispatch: Added region at 0x00B20000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00B25DEA, thread 3224).
2026-03-29 10:58:38,205 [root] DEBUG: 6924: Commandline: sc  start RemoteAccess
2026-03-29 10:58:38,268 [root] DEBUG: 1012: YaraScan: Scanning 0x00B20000, size 0x12a80
2026-03-29 10:58:38,362 [root] DEBUG: 6924: hook_api: LdrpCallInitRoutine export address 0x77EB2A40 obtained via GetFunctionAddress
2026-03-29 10:58:38,424 [root] DEBUG: 1012: ProcessImageBase: Main module image at 0x00B20000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:38,502 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-03-29 10:58:38,502 [root] DEBUG: 6924: set_hooks: Unable to hook GetCommandLineA
2026-03-29 10:58:38,533 [root] DEBUG: 1012: NtTerminateProcess hook: Attempting to dump process 1012
2026-03-29 10:58:38,533 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-03-29 10:58:38,533 [root] DEBUG: 1012: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:58:38,549 [root] DEBUG: 6924: set_hooks: Unable to hook GetCommandLineW
2026-03-29 10:58:38,596 [root] INFO: Process with pid 1012 has terminated
2026-03-29 10:58:38,596 [root] DEBUG: 6924: Hooked 630 out of 632 functions
2026-03-29 10:58:38,643 [root] DEBUG: 6924: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:38,721 [root] DEBUG: 2168: NtTerminateProcess hook: Attempting to dump process 2168
2026-03-29 10:58:38,721 [root] DEBUG: 6924: RestoreHeaders: Restored original import table.
2026-03-29 10:58:38,721 [root] DEBUG: 2168: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:58:38,737 [root] INFO: Loaded monitor into process with pid 6924
2026-03-29 10:58:38,752 [root] DEBUG: 2168: DoProcessDump: Code modification detected, dumping Imagebase at 0x00AE0000.
2026-03-29 10:58:38,752 [root] DEBUG: 6924: caller_dispatch: Added region at 0x00B20000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00B25DEA, thread 7208).
2026-03-29 10:58:38,768 [root] DEBUG: 2168: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:58:38,768 [root] DEBUG: 6924: YaraScan: Scanning 0x00B20000, size 0x12a80
2026-03-29 10:58:38,783 [root] DEBUG: 2168: DumpProcess: Instantiating PeParser with address: 0x00AE0000.
2026-03-29 10:58:38,815 [root] DEBUG: 6924: ProcessImageBase: Main module image at 0x00B20000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:38,830 [root] DEBUG: 2168: DumpProcess: Module entry point VA is 0x00AF6B20.
2026-03-29 10:58:38,955 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\2168_232540023858729032026 to procdump\8591f402525ee8662a39d2b3ed014ee247096e3c52b210cd64607890e0fe59f7; Size is 346624; Max size: 100000000
2026-03-29 10:58:39,004 [root] INFO: Announced starting service "b'RemoteAccess'"
2026-03-29 10:58:39,018 [root] DEBUG: 2168: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:58:39,034 [root] INFO: Process with pid 2168 has terminated
2026-03-29 10:58:40,268 [root] INFO: Added new file to list with pid 5000 and path C:\Windows\INF\netsstpa.PNF
2026-03-29 10:58:41,846 [root] INFO: Added new file to list with pid 5000 and path C:\Windows\INF\netrasa.PNF
2026-03-29 10:58:46,815 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ￎ￲￪￠￧￠￭￮ ￢ ￤￮￱￲￳￯￥.
2026-03-29 10:58:46,862 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
2026-03-29 10:58:47,486 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 7400, handle 0x24f4: Error obtaining target process name
2026-03-29 10:58:47,612 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
2026-03-29 10:58:48,643 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2026-03-29 10:58:48,783 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2026-03-29 10:58:48,986 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
2026-03-29 10:58:49,174 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
2026-03-29 10:58:49,940 [root] DEBUG: 6924: NtTerminateProcess hook: Attempting to dump process 6924
2026-03-29 10:58:50,080 [root] DEBUG: 6924: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:58:50,112 [root] INFO: Process with pid 6924 appears to have terminated
2026-03-29 10:58:50,143 [root] INFO: Process with pid 6924 has terminated
2026-03-29 10:58:50,361 [root] DEBUG: 3964: NtTerminateProcess hook: Attempting to dump process 3964
2026-03-29 10:58:50,549 [root] DEBUG: 3964: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-03-29 10:58:50,752 [root] DEBUG: 3964: DoProcessDump: Code modification detected, dumping Imagebase at 0x00AE0000.
2026-03-29 10:58:51,049 [root] DEBUG: 3964: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-03-29 10:58:51,158 [root] DEBUG: 3964: DumpProcess: Instantiating PeParser with address: 0x00AE0000.
2026-03-29 10:58:51,377 [root] DEBUG: 3964: DumpProcess: Module entry point VA is 0x00AF6B20.
2026-03-29 10:58:52,018 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\3964_14125775158729032026 to procdump\48af1dd9bfe5b39dee945767e1485935b2445e118cdc6f5fc823f94757f270c8; Size is 346624; Max size: 100000000
2026-03-29 10:58:52,158 [root] DEBUG: 3964: DumpProcess: Module image dump success - dump size 0x54a00.
2026-03-29 10:58:52,424 [root] INFO: Process with pid 3964 has terminated
2026-03-29 10:58:53,736 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 6244: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 10:58:53,783 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 6244
2026-03-29 10:58:53,799 [lib.api.process] INFO: Monitor config for <Process 6244 dllhost.exe>: C:\ltb6yatm\dll\6244.ini
2026-03-29 10:58:53,862 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:53,988 [root] DEBUG: Loader: Injecting process 6244 (thread 1088) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:54,018 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:54,143 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:54,377 [lib.api.process] INFO: Injected into 64-bit <Process 6244 dllhost.exe>
2026-03-29 10:58:54,627 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 6244
2026-03-29 10:58:54,627 [lib.api.process] INFO: Monitor config for <Process 6244 dllhost.exe>: C:\ltb6yatm\dll\6244.ini
2026-03-29 10:58:54,705 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:58:54,815 [root] DEBUG: Loader: Injecting process 6244 (thread 1088) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:54,846 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:58:54,908 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:58:54,955 [lib.api.process] INFO: Injected into 64-bit <Process 6244 dllhost.exe>
2026-03-29 10:58:55,065 [root] DEBUG: 6244: Python path set to 'C:\Python310'.
2026-03-29 10:58:55,080 [root] DEBUG: 6244: Dropped file limit defaulting to 100.
2026-03-29 10:58:55,143 [root] DEBUG: 6244: Disabling sleep skipping.
2026-03-29 10:58:55,174 [root] DEBUG: 6244: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:58:55,221 [root] DEBUG: 6244: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:58:55,283 [root] DEBUG: 6244: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 10:58:55,549 [root] DEBUG: 6244: Monitor initialised: 64-bit capemon loaded in process 6244 at 0x00007FFEABE00000, thread 1088, image base 0x00007FF6F2810000, stack from 0x0000001087774000-0x0000001087780000
2026-03-29 10:58:55,627 [root] DEBUG: 6244: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-03-29 10:58:55,690 [root] DEBUG: 6244: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:58:55,783 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:58:55,877 [root] DEBUG: 6244: set_hooks: Unable to hook LockResource
2026-03-29 10:58:55,971 [root] DEBUG: 6244: Hooked 627 out of 628 functions
2026-03-29 10:58:56,002 [root] DEBUG: 6244: Syscall hook installed, syscall logging level 1
2026-03-29 10:58:56,033 [root] DEBUG: 6244: RestoreHeaders: Restored original import table.
2026-03-29 10:58:56,065 [root] INFO: Loaded monitor into process with pid 6244
2026-03-29 10:58:56,080 [root] DEBUG: 6244: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28117A9, thread 1088).
2026-03-29 10:58:56,080 [root] DEBUG: 6244: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 10:58:56,127 [root] DEBUG: 6244: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:58:56,143 [root] DEBUG: 6244: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:58:56,143 [root] DEBUG: 6244: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:58:56,158 [root] DEBUG: 6244: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:58:56,236 [root] DEBUG: 6244: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:58:56,330 [root] DEBUG: 6244: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 10:58:56,393 [root] DEBUG: 6244: DEBUG:Initialized 9 com hooks
2026-03-29 10:58:56,455 [root] DEBUG: 6244: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:58:56,455 [root] DEBUG: 6244: DLL loaded at 0x00007FFEE2610000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-03-29 10:58:56,487 [root] DEBUG: 6244: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-03-29 10:59:01,955 [root] INFO: Process with pid 6244 has terminated
2026-03-29 10:59:02,283 [root] DEBUG: 6244: NtTerminateProcess hook: Attempting to dump process 6244
2026-03-29 10:59:02,611 [root] DEBUG: 6244: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:59:16,221 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 2912: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:16,377 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 2912
2026-03-29 10:59:16,549 [lib.api.process] INFO: Monitor config for <Process 2912 backgroundTaskHost.exe>: C:\ltb6yatm\dll\2912.ini
2026-03-29 10:59:16,612 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5824: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:16,752 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 520: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.14326.22342.0_x64__8wekyb3d8bbwe\HxTsr.exe, ImageBase: 0x00007FF72EF60000
2026-03-29 10:59:16,815 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3696: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:16,861 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5824
2026-03-29 10:59:16,861 [root] INFO: Announced 64-bit process name: HxTsr.exe pid: 520
2026-03-29 10:59:16,861 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 3696
2026-03-29 10:59:16,861 [lib.api.process] INFO: Monitor config for <Process 5824 backgroundTaskHost.exe>: C:\ltb6yatm\dll\5824.ini
2026-03-29 10:59:16,877 [lib.api.process] INFO: Monitor config for <Process 520 HxTsr.exe>: C:\ltb6yatm\dll\520.ini
2026-03-29 10:59:16,877 [lib.api.process] INFO: Monitor config for <Process 3696 backgroundTaskHost.exe>: C:\ltb6yatm\dll\3696.ini
2026-03-29 10:59:16,893 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:16,986 [root] DEBUG: Loader: Injecting process 2912 (thread 5136) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,002 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:17,018 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,112 [lib.api.process] INFO: Injected into 64-bit <Process 2912 backgroundTaskHost.exe>
2026-03-29 10:59:17,112 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:17,127 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 2912
2026-03-29 10:59:17,143 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:17,158 [lib.api.process] INFO: Monitor config for <Process 2912 backgroundTaskHost.exe>: C:\ltb6yatm\dll\2912.ini
2026-03-29 10:59:17,158 [root] DEBUG: Loader: Injecting process 3696 (thread 912) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,190 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:17,237 [root] DEBUG: Loader: Injecting process 5824 (thread 1924) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,252 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:17,252 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:17,268 [root] DEBUG: Loader: Injecting process 2912 (thread 5136) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,299 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,315 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,362 [lib.api.process] INFO: Injected into 64-bit <Process 5824 backgroundTaskHost.exe>
2026-03-29 10:59:17,377 [lib.api.process] INFO: Injected into 64-bit <Process 3696 backgroundTaskHost.exe>
2026-03-29 10:59:17,377 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:17,393 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5824
2026-03-29 10:59:17,408 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,408 [lib.api.process] INFO: Monitor config for <Process 5824 backgroundTaskHost.exe>: C:\ltb6yatm\dll\5824.ini
2026-03-29 10:59:17,424 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 3696
2026-03-29 10:59:17,424 [lib.api.process] INFO: Injected into 64-bit <Process 2912 backgroundTaskHost.exe>
2026-03-29 10:59:17,440 [lib.api.process] INFO: Monitor config for <Process 3696 backgroundTaskHost.exe>: C:\ltb6yatm\dll\3696.ini
2026-03-29 10:59:17,549 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:17,596 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 2912
2026-03-29 10:59:17,627 [lib.api.process] INFO: Monitor config for <Process 2912 backgroundTaskHost.exe>: C:\ltb6yatm\dll\2912.ini
2026-03-29 10:59:17,643 [root] DEBUG: Loader: Injecting process 5824 (thread 1924) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,643 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:17,676 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:17,706 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:17,736 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,800 [root] DEBUG: Loader: Injecting process 2912 (thread 5136) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,815 [root] DEBUG: Loader: Injecting process 3696 (thread 912) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,815 [lib.api.process] INFO: Injected into 64-bit <Process 5824 backgroundTaskHost.exe>
2026-03-29 10:59:17,830 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:17,846 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:17,846 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5824
2026-03-29 10:59:17,877 [lib.api.process] INFO: Monitor config for <Process 5824 backgroundTaskHost.exe>: C:\ltb6yatm\dll\5824.ini
2026-03-29 10:59:17,877 [lib.api.process] INFO: Injected into 64-bit <Process 3696 backgroundTaskHost.exe>
2026-03-29 10:59:17,908 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 3696
2026-03-29 10:59:17,924 [lib.api.process] INFO: Monitor config for <Process 3696 backgroundTaskHost.exe>: C:\ltb6yatm\dll\3696.ini
2026-03-29 10:59:17,955 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:18,065 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:18,096 [root] DEBUG: Loader: Injecting process 5824 (thread 1924) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:18,190 [root] DEBUG: Loader: Injecting process 3696 (thread 912) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:18,971 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFB900000: C:\Windows\System32\Wldp (0x30000 bytes).
2026-03-29 10:59:18,987 [root] DEBUG: 4632: DLL loaded at 0x00007FFEFA080000: C:\Windows\SYSTEM32\windows.storage (0x795000 bytes).
2026-03-29 10:59:19,033 [root] DEBUG: 4632: NtTerminateProcess hook: Attempting to dump process 4632
2026-03-29 10:59:19,033 [root] DEBUG: 4632: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 10:59:19,268 [root] INFO: Process with pid 4632 has terminated
2026-03-29 10:59:22,596 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:22,893 [root] DEBUG: Loader: Injecting process 520 (thread 7144) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:23,236 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:23,455 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:23,596 [lib.api.process] INFO: Injected into 64-bit <Process 520 HxTsr.exe>
2026-03-29 10:59:23,721 [root] INFO: Announced 64-bit process name: HxTsr.exe pid: 520
2026-03-29 10:59:23,752 [lib.api.process] INFO: Monitor config for <Process 520 HxTsr.exe>: C:\ltb6yatm\dll\520.ini
2026-03-29 10:59:25,830 [root] DEBUG: 5000: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:59:25,908 [root] DEBUG: 5000: DLL loaded at 0x00007FFEE3510000: C:\Windows\System32\Windows.CloudStore.Schema.Shell (0xe7000 bytes).
2026-03-29 10:59:26,127 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:26,205 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:26,627 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:26,846 [lib.api.process] INFO: Injected into 64-bit <Process 2912 backgroundTaskHost.exe>
2026-03-29 10:59:27,002 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:27,205 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:27,612 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:28,033 [lib.api.process] INFO: Injected into 64-bit <Process 5824 backgroundTaskHost.exe>
2026-03-29 10:59:28,127 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 8088: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:28,315 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4516: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:28,330 [lib.api.process] INFO: Injected into 64-bit <Process 3696 backgroundTaskHost.exe>
2026-03-29 10:59:28,455 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 1232: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:28,502 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8088
2026-03-29 10:59:28,580 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 4516
2026-03-29 10:59:28,596 [lib.api.process] INFO: Monitor config for <Process 8088 backgroundTaskHost.exe>: C:\ltb6yatm\dll\8088.ini
2026-03-29 10:59:28,611 [lib.api.process] INFO: Monitor config for <Process 4516 backgroundTaskHost.exe>: C:\ltb6yatm\dll\4516.ini
2026-03-29 10:59:28,611 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:28,627 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4596: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:28,862 [root] DEBUG: 3696: Python path set to 'C:\Python310'.
2026-03-29 10:59:28,987 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 1232
2026-03-29 10:59:29,096 [root] DEBUG: Loader: Injecting process 520 (thread 7144) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:29,176 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:29,190 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:29,205 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 4596
2026-03-29 10:59:29,518 [lib.api.process] INFO: Monitor config for <Process 4596 backgroundTaskHost.exe>: C:\ltb6yatm\dll\4596.ini
2026-03-29 10:59:29,315 [root] DEBUG: 3696: Dropped file limit defaulting to 100.
2026-03-29 10:59:29,205 [lib.api.process] INFO: Monitor config for <Process 1232 backgroundTaskHost.exe>: C:\ltb6yatm\dll\1232.ini
2026-03-29 10:59:29,518 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:29,580 [root] DEBUG: Loader: Injecting process 8088 (thread 8020) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:29,643 [root] DEBUG: Loader: Injecting process 4516 (thread 7008) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:29,674 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:29,752 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:29,830 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:30,002 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:30,080 [lib.api.process] INFO: Injected into 64-bit <Process 520 HxTsr.exe>
2026-03-29 10:59:30,127 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:30,174 [root] DEBUG: Loader: Injecting process 4596 (thread 6328) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:30,268 [root] DEBUG: Loader: Injecting process 1232 (thread 4868) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:30,299 [root] DEBUG: 3696: Disabling sleep skipping.
2026-03-29 10:59:30,346 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:30,502 [root] INFO: Announced 64-bit process name: HxTsr.exe pid: 520
2026-03-29 10:59:30,518 [lib.api.process] INFO: Monitor config for <Process 520 HxTsr.exe>: C:\ltb6yatm\dll\520.ini
2026-03-29 10:59:30,549 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:30,565 [lib.api.process] INFO: Injected into 64-bit <Process 8088 backgroundTaskHost.exe>
2026-03-29 10:59:30,674 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:30,737 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:30,799 [root] DEBUG: 3696: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 10:59:30,877 [lib.api.process] INFO: Injected into 64-bit <Process 4516 backgroundTaskHost.exe>
2026-03-29 10:59:30,955 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:31,033 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:31,127 [lib.api.process] INFO: Injected into 64-bit <Process 4596 backgroundTaskHost.exe>
2026-03-29 10:59:31,190 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8088
2026-03-29 10:59:31,190 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 4516
2026-03-29 10:59:31,205 [lib.api.process] INFO: Monitor config for <Process 8088 backgroundTaskHost.exe>: C:\ltb6yatm\dll\8088.ini
2026-03-29 10:59:31,221 [lib.api.process] INFO: Injected into 64-bit <Process 1232 backgroundTaskHost.exe>
2026-03-29 10:59:31,268 [root] DEBUG: 3696: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 10:59:31,283 [lib.api.process] INFO: Monitor config for <Process 4516 backgroundTaskHost.exe>: C:\ltb6yatm\dll\4516.ini
2026-03-29 10:59:31,330 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:31,361 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 4596
2026-03-29 10:59:31,580 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 1232
2026-03-29 10:59:31,830 [root] DEBUG: 3696: YaraScan: Scanning 0x00007FF785FC0000, size 0x6020
2026-03-29 10:59:31,830 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:31,924 [lib.api.process] INFO: Monitor config for <Process 4596 backgroundTaskHost.exe>: C:\ltb6yatm\dll\4596.ini
2026-03-29 10:59:32,065 [lib.api.process] INFO: Monitor config for <Process 1232 backgroundTaskHost.exe>: C:\ltb6yatm\dll\1232.ini
2026-03-29 10:59:32,221 [root] DEBUG: Loader: Injecting process 8088 (thread 8020) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:32,471 [root] DEBUG: 3696: Monitor initialised: 64-bit capemon loaded in process 3696 at 0x00007FFEABE00000, thread 912, image base 0x00007FF785FC0000, stack from 0x000000B1EC574000-0x000000B1EC580000
2026-03-29 10:59:32,580 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:32,799 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:32,924 [root] DEBUG: Loader: Injecting process 4516 (thread 7008) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:33,111 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:33,424 [root] DEBUG: 3696: Commandline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXapskvk16gk8da8kch5g4qxh42vxccved.mca
2026-03-29 10:59:33,643 [root] DEBUG: Loader: Injecting process 4596 (thread 6328) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:33,940 [root] DEBUG: Loader: Injecting process 1232 (thread 4868) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:33,940 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:34,018 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:34,065 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:34,065 [lib.api.process] INFO: Injected into 64-bit <Process 8088 backgroundTaskHost.exe>
2026-03-29 10:59:34,127 [root] DEBUG: 3696: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 10:59:34,283 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:34,815 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:34,924 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:35,127 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 10:59:35,252 [root] INFO: Process with pid 8088 has terminated
2026-03-29 10:59:35,283 [lib.api.process] INFO: Injected into 64-bit <Process 4596 backgroundTaskHost.exe>
2026-03-29 10:59:35,331 [lib.api.process] INFO: Injected into 64-bit <Process 4516 backgroundTaskHost.exe>
2026-03-29 10:59:35,377 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:35,940 [root] DEBUG: 3696: set_hooks: Unable to hook LockResource
2026-03-29 10:59:36,018 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 7520: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:36,080 [lib.api.process] INFO: Injected into 64-bit <Process 1232 backgroundTaskHost.exe>
2026-03-29 10:59:36,158 [root] INFO: Process with pid 4596 has terminated
2026-03-29 10:59:36,237 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 4516
2026-03-29 10:59:36,330 [lib.api.process] INFO: Monitor config for <Process 4516 backgroundTaskHost.exe>: C:\ltb6yatm\dll\4516.ini
2026-03-29 10:59:36,361 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7520
2026-03-29 10:59:36,377 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:36,377 [lib.api.process] INFO: Monitor config for <Process 7520 backgroundTaskHost.exe>: C:\ltb6yatm\dll\7520.ini
2026-03-29 10:59:36,408 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 1232
2026-03-29 10:59:36,408 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:36,518 [root] DEBUG: 3696: Hooked 627 out of 628 functions
2026-03-29 10:59:36,533 [lib.api.process] INFO: Monitor config for <Process 1232 backgroundTaskHost.exe>: C:\ltb6yatm\dll\1232.ini
2026-03-29 10:59:36,580 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5220: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 10:59:36,627 [root] DEBUG: Loader: Injecting process 4516 (thread 7008) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:36,690 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:36,690 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:36,705 [root] DEBUG: Loader: Injecting process 520 (thread 7144) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:36,799 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5220
2026-03-29 10:59:36,830 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:36,830 [root] DEBUG: 3696: Syscall hook installed, syscall logging level 1
2026-03-29 10:59:36,846 [root] DEBUG: Loader: Injecting process 1232 (thread 4868) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:36,846 [lib.api.process] INFO: Monitor config for <Process 5220 backgroundTaskHost.exe>: C:\ltb6yatm\dll\5220.ini
2026-03-29 10:59:36,846 [root] DEBUG: Loader: Injecting process 7520 (thread 6552) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:36,877 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:36,893 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:36,908 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:36,925 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:36,940 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:36,940 [lib.api.process] INFO: Injected into 64-bit <Process 4516 backgroundTaskHost.exe>
2026-03-29 10:59:36,971 [root] DEBUG: 3696: RestoreHeaders: Restored original import table.
2026-03-29 10:59:37,033 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,127 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,143 [lib.api.process] INFO: Injected into 64-bit <Process 520 HxTsr.exe>
2026-03-29 10:59:37,143 [root] DEBUG: Loader: Injecting process 5220 (thread 3008) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,143 [lib.api.process] INFO: Injected into 64-bit <Process 1232 backgroundTaskHost.exe>
2026-03-29 10:59:37,158 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,237 [root] INFO: Loaded monitor into process with pid 3696
2026-03-29 10:59:37,252 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 10:59:37,346 [lib.api.process] INFO: Injected into 64-bit <Process 7520 backgroundTaskHost.exe>
2026-03-29 10:59:37,346 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,377 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 7520
2026-03-29 10:59:37,377 [lib.api.process] INFO: Injected into 64-bit <Process 5220 backgroundTaskHost.exe>
2026-03-29 10:59:37,408 [root] DEBUG: 3696: caller_dispatch: Added region at 0x00007FF785FC0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF785FC14D1, thread 912).
2026-03-29 10:59:37,408 [lib.api.process] INFO: Monitor config for <Process 7520 backgroundTaskHost.exe>: C:\ltb6yatm\dll\7520.ini
2026-03-29 10:59:37,424 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 5220
2026-03-29 10:59:37,440 [root] DEBUG: 3696: YaraScan: Scanning 0x00007FF785FC0000, size 0x6020
2026-03-29 10:59:37,455 [lib.api.process] INFO: Monitor config for <Process 5220 backgroundTaskHost.exe>: C:\ltb6yatm\dll\5220.ini
2026-03-29 10:59:37,487 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:37,487 [root] DEBUG: 3696: ProcessImageBase: Main module image at 0x00007FF785FC0000 unmodified (entropy change 0.000000e+00)
2026-03-29 10:59:37,549 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 10:59:37,565 [root] DEBUG: Loader: Injecting process 7520 (thread 6552) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,612 [root] DEBUG: Loader: Injecting process 5220 (thread 3008) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,612 [root] DEBUG: 3696: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 10:59:37,674 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:37,690 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 10:59:37,705 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,705 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 10:59:37,752 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 10:59:37,752 [lib.api.process] INFO: Injected into 64-bit <Process 7520 backgroundTaskHost.exe>
2026-03-29 10:59:37,768 [root] DEBUG: 3696: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 10:59:37,815 [lib.api.process] INFO: Injected into 64-bit <Process 5220 backgroundTaskHost.exe>
2026-03-29 10:59:37,830 [root] INFO: Process with pid 7520 has terminated
2026-03-29 10:59:37,908 [root] DEBUG: 3696: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 10:59:37,987 [root] INFO: Process with pid 5220 has terminated
2026-03-29 10:59:38,033 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEF4B0000: C:\Windows\System32\twinapi.appcore (0x200000 bytes).
2026-03-29 10:59:38,158 [root] DEBUG: 3696: DEBUG:Initialized 9 com hooks
2026-03-29 10:59:38,205 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF8C40000: C:\Windows\System32\WinTypes (0x154000 bytes).
2026-03-29 10:59:38,221 [root] DEBUG: 3696: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 10:59:38,502 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF01C0000: C:\Windows\SYSTEM32\mrmcorer (0xf4000 bytes).
2026-03-29 10:59:38,690 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE36A0000: C:\Windows\SYSTEM32\windows.staterepositoryclient (0x40000 bytes).
2026-03-29 10:59:38,705 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF09F0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7c9000 bytes).
2026-03-29 10:59:38,768 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF0350000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-03-29 10:59:39,549 [root] DEBUG: 3696: DLL loaded at 0x00007FFEFBEB0000: C:\Windows\system32\profapi (0x1f000 bytes).
2026-03-29 10:59:39,580 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF6DC0000: C:\Windows\SYSTEM32\AppxDeploymentClient (0xf7000 bytes).
2026-03-29 10:59:39,674 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF9770000: C:\Windows\system32\CoreMessaging (0xf2000 bytes).
2026-03-29 10:59:39,783 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEE330000: C:\Windows\system32\WindowManagementAPI (0xa1000 bytes).
2026-03-29 10:59:39,783 [root] DEBUG: 3696: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 10:59:39,799 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF9310000: C:\Windows\system32\CoreUIComponents (0x35e000 bytes).
2026-03-29 10:59:39,830 [root] DEBUG: 3696: DLL loaded at 0x00007FFEECA90000: C:\Windows\system32\TextInputFramework (0xf9000 bytes).
2026-03-29 10:59:39,846 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\PROPSYS (0xf6000 bytes).
2026-03-29 10:59:39,908 [root] DEBUG: 3696: DLL loaded at 0x00007FFEECB90000: C:\Windows\system32\InputHost (0x152000 bytes).
2026-03-29 10:59:39,987 [root] DEBUG: 3696: DLL loaded at 0x00007FFEECCF0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-03-29 10:59:40,143 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEF2C0000: C:\Windows\system32\bcp47mrm (0x2d000 bytes).
2026-03-29 10:59:40,408 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 10:59:40,502 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE0740000: C:\Windows\System32\biwinrt (0x53000 bytes).
2026-03-29 10:59:40,940 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDBDD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\NativeHostNE (0x12b000 bytes).
2026-03-29 10:59:41,002 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE69A0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\hostfxr (0x5d000 bytes).
2026-03-29 10:59:41,033 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE37B0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\hostpolicy (0x60000 bytes).
2026-03-29 10:59:41,393 [root] DEBUG: 3696: DLL loaded at 0x00007FFED8D70000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\coreclr (0x4a9000 bytes).
2026-03-29 10:59:41,549 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE791C0000, size: 0x10000.
2026-03-29 10:59:41,565 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:41,663 [root] DEBUG: 3696: DLL loaded at 0x00007FFED7EE0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Private.CoreLib (0xe8c000 bytes).
2026-03-29 10:59:41,815 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE79270000, size: 0x4000.
2026-03-29 10:59:41,815 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:41,893 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE79280000, size: 0x4000.
2026-03-29 10:59:41,924 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:42,440 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE79310000, size: 0x1000.
2026-03-29 10:59:42,455 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:42,737 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE79390000, size: 0x4000.
2026-03-29 10:59:43,033 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:43,268 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:43,674 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE791DD000, size: 0x1000.
2026-03-29 10:59:43,924 [root] DEBUG: 3696: DLL loaded at 0x00007FFED7D00000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\clrjit (0x1de000 bytes).
2026-03-29 10:59:44,002 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:44,033 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79280000.
2026-03-29 10:59:44,080 [root] DEBUG: 3696: DumpPEsInRange: Scanning range 0x00007FFE79310000 - 0x00007FFE793126A8.
2026-03-29 10:59:44,096 [root] DEBUG: 3696: ScanForDisguisedPE: No PE image located in range 0x00007FFE79310000-0x00007FFE793126A8.
2026-03-29 10:59:44,158 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\3696_39364459729032026 to CAPE\eedca89f185164248ae584d84d76fa621a97d13d64689520a1280bc6e5ab7baf; Size is 9896; Max size: 100000000
2026-03-29 10:59:44,205 [root] DEBUG: 3696: DumpMemory: Payload successfully created: C:\atsPQMC\CAPE\3696_39364459729032026 (size 9896 bytes)
2026-03-29 10:59:44,221 [root] DEBUG: 3696: DumpRegion: Dumped entire allocation from 0x00007FFE79310000, size 12288 bytes.
2026-03-29 10:59:44,236 [root] DEBUG: 3696: ProcessTrackedRegion: Dumped region at 0x00007FFE79310000.
2026-03-29 10:59:44,268 [root] DEBUG: 3696: YaraScan: Scanning 0x00007FFE79310000, size 0x26a8
2026-03-29 10:59:44,330 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDC910000: C:\Windows\SYSTEM32\icu (0x22e000 bytes).
2026-03-29 10:59:44,377 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:44,486 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE791D0000.
2026-03-29 10:59:44,658 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:44,799 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE794B0000, size: 0x4000.
2026-03-29 10:59:44,846 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:44,908 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF1DD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\NativeHost (0x6000 bytes).
2026-03-29 10:59:44,987 [root] DEBUG: 3696: DLL loaded at 0x000002966B940000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Runtime (0xe000 bytes).
2026-03-29 10:59:45,018 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:45,033 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE794B0000.
2026-03-29 10:59:45,080 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF0330000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices (0x19000 bytes).
2026-03-29 10:59:45,127 [root] DEBUG: 3696: DLL loaded at 0x00007FFED9D10000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\WinRT.Runtime (0x158000 bytes).
2026-03-29 10:59:45,205 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE3760000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Collections.Concurrent (0x45000 bytes).
2026-03-29 10:59:45,299 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDBD80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Collections (0x4f000 bytes).
2026-03-29 10:59:45,361 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEFC70000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Background.Tasks (0x12000 bytes).
2026-03-29 10:59:45,377 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:45,455 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:45,486 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEF6B0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Memory (0x25000 bytes).
2026-03-29 10:59:45,643 [root] DEBUG: 3696: DLL loaded at 0x00007FFEA8210000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Windows.SDK.NET (0x39fc000 bytes).
2026-03-29 10:59:45,877 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:45,908 [root] DEBUG: 3696: DLL loaded at 0x00007FFEED330000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Threading (0x12000 bytes).
2026-03-29 10:59:45,955 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE6960000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Private.Uri (0x3d000 bytes).
2026-03-29 10:59:46,018 [root] DEBUG: 3696: DLL loaded at 0x00007FFEED290000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ObjectModel (0x12000 bytes).
2026-03-29 10:59:46,049 [root] DEBUG: 3696: DLL loaded at 0x000002966B950000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors (0x8000 bytes).
2026-03-29 10:59:46,096 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF1CE0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ComponentModel (0x5000 bytes).
2026-03-29 10:59:46,111 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:46,174 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:46,205 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:46,237 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:46,237 [root] DEBUG: 3696: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE79900000, size: 0x4000.
2026-03-29 10:59:46,268 [root] DEBUG: 3696: AddTrackedRegion: GetEntropy failed.
2026-03-29 10:59:46,299 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 10:59:56,924 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
2026-03-29 10:59:57,018 [root] INFO: Added new file to list with pid 5000 and path C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
2026-03-29 11:01:08,330 [root] DEBUG: 5744: CreateProcessHandler: Injection info set for new process 2336: \\?\C:\Windows\system32\wbem\WMIADAP.EXE, ImageBase: 0x00007FF6F8D30000
2026-03-29 11:01:08,346 [root] INFO: Announced 64-bit process name: WMIADAP.exe pid: 2336
2026-03-29 11:01:08,377 [lib.api.process] INFO: Monitor config for <Process 2336 WMIADAP.exe>: C:\ltb6yatm\dll\2336.ini
2026-03-29 11:01:12,580 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:01:12,799 [root] DEBUG: Loader: Injecting process 2336 (thread 8088) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:13,080 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:01:13,174 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:13,190 [lib.api.process] INFO: Injected into 64-bit <Process 2336 WMIADAP.exe>
2026-03-29 11:01:13,205 [root] INFO: Announced 64-bit process name: WMIADAP.exe pid: 2336
2026-03-29 11:01:13,221 [lib.api.process] INFO: Monitor config for <Process 2336 WMIADAP.exe>: C:\ltb6yatm\dll\2336.ini
2026-03-29 11:01:17,393 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:01:17,533 [root] DEBUG: Loader: Injecting process 2336 (thread 8088) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:17,627 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:01:17,721 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:17,830 [lib.api.process] INFO: Injected into 64-bit <Process 2336 WMIADAP.exe>
2026-03-29 11:01:17,987 [root] DEBUG: 2336: Python path set to 'C:\Python310'.
2026-03-29 11:01:18,033 [root] DEBUG: 2336: Dropped file limit defaulting to 100.
2026-03-29 11:01:18,190 [root] DEBUG: 2336: Disabling sleep skipping.
2026-03-29 11:01:18,221 [root] DEBUG: 2336: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:01:18,317 [root] DEBUG: 2336: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:01:18,377 [root] DEBUG: 2336: YaraScan: Scanning 0x00007FF6F8D30000, size 0x302f8
2026-03-29 11:01:18,410 [root] DEBUG: 2336: Monitor initialised: 64-bit capemon loaded in process 2336 at 0x00007FFEABE00000, thread 8088, image base 0x00007FF6F8D30000, stack from 0x000000019CA70000-0x000000019CA80000
2026-03-29 11:01:18,471 [root] DEBUG: 2336: Commandline: wmiadap.exe /F /T /R
2026-03-29 11:01:18,518 [root] DEBUG: 2336: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:01:18,705 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:01:18,752 [root] DEBUG: 2336: set_hooks: Unable to hook LockResource
2026-03-29 11:01:18,830 [root] DEBUG: 2336: Hooked 627 out of 628 functions
2026-03-29 11:01:19,033 [root] DEBUG: 2336: Syscall hook installed, syscall logging level 1
2026-03-29 11:01:19,268 [root] DEBUG: 2336: RestoreHeaders: Restored original import table.
2026-03-29 11:01:19,471 [root] INFO: Loaded monitor into process with pid 2336
2026-03-29 11:01:19,643 [root] DEBUG: 2336: caller_dispatch: Added region at 0x00007FF6F8D30000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6F8D462B1, thread 8088).
2026-03-29 11:01:19,705 [root] DEBUG: 2336: YaraScan: Scanning 0x00007FF6F8D30000, size 0x302f8
2026-03-29 11:01:19,768 [root] DEBUG: 2336: ProcessImageBase: Main module image at 0x00007FF6F8D30000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:01:19,830 [root] DEBUG: 2336: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:01:19,846 [root] DEBUG: 2336: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:01:19,986 [root] DEBUG: 2336: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:01:20,236 [root] DEBUG: 2336: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:01:20,268 [root] DEBUG: 2336: DLL loaded at 0x00007FFEF1EB0000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-03-29 11:01:20,330 [root] DEBUG: 2336: DEBUG:Initialized 9 com hooks
2026-03-29 11:01:20,674 [root] DEBUG: 2336: DLL loaded at 0x00007FFEF2120000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-03-29 11:01:20,815 [root] DEBUG: 2336: DLL loaded at 0x00007FFEF2140000: C:\Windows\system32\wbem\fastprox (0x10b000 bytes).
2026-03-29 11:01:20,846 [root] DEBUG: 2336: DLL loaded at 0x00007FFEF08D0000: C:\Windows\SYSTEM32\amsi (0x20000 bytes).
2026-03-29 11:01:20,877 [root] DEBUG: 2336: Unable to set COM hook on WbemLocator_ConnectServer
2026-03-29 11:01:21,924 [root] DEBUG: 2336: Unable to set COM hook on WbemLocator_ConnectServer
2026-03-29 11:01:23,127 [root] DEBUG: 2336: Unable to set COM hook on WbemLocator_ConnectServer
2026-03-29 11:01:23,768 [root] DEBUG: 2336: DLL loaded at 0x00007FFEFD100000: C:\Windows\System32\PSAPI (0x8000 bytes).
2026-03-29 11:01:23,846 [root] DEBUG: 2336: DLL loaded at 0x00007FFEEF270000: C:\Windows\SYSTEM32\loadperf (0x25000 bytes).
2026-03-29 11:01:23,893 [root] DEBUG: 2336: Unable to set COM hook on WbemLocator_ConnectServer
2026-03-29 11:01:24,705 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5988: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x00007FF6402C0000
2026-03-29 11:01:24,846 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 5988
2026-03-29 11:01:25,065 [lib.api.process] INFO: Monitor config for <Process 5988 WmiPrvSE.exe>: C:\ltb6yatm\dll\5988.ini
2026-03-29 11:01:26,127 [root] DEBUG: 5000: api-cap: NtClose hook disabled due to count: 5000
2026-03-29 11:01:26,221 [root] DEBUG: 5000: OpenProcessHandler: Image base for process 6832 (handle 0x235c): 0x00007FF7568A0000.
2026-03-29 11:01:26,361 [root] DEBUG: 5000: api-cap: NtClose hook disabled due to count: 5001
2026-03-29 11:01:26,377 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 6832, handle 0x235c: C:\Windows\System32\conhost.exe
2026-03-29 11:01:28,893 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:01:29,408 [root] DEBUG: Loader: Injecting process 5988 (thread 1484) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:29,674 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:01:29,799 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:29,830 [lib.api.process] INFO: Injected into 64-bit <Process 5988 WmiPrvSE.exe>
2026-03-29 11:01:29,861 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 5988
2026-03-29 11:01:29,877 [lib.api.process] INFO: Monitor config for <Process 5988 WmiPrvSE.exe>: C:\ltb6yatm\dll\5988.ini
2026-03-29 11:01:33,424 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:01:33,752 [root] DEBUG: Loader: Injecting process 5988 (thread 1484) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:34,111 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:01:34,205 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:01:34,221 [lib.api.process] INFO: Injected into 64-bit <Process 5988 WmiPrvSE.exe>
2026-03-29 11:01:34,377 [root] DEBUG: 5988: Python path set to 'C:\Python310'.
2026-03-29 11:01:34,408 [root] DEBUG: 5988: Dropped file limit defaulting to 100.
2026-03-29 11:01:34,424 [root] DEBUG: 5988: Disabling sleep skipping.
2026-03-29 11:01:34,565 [root] DEBUG: 5988: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:01:34,908 [root] DEBUG: 5988: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:01:34,971 [root] DEBUG: 5988: YaraScan: Scanning 0x00007FF6402C0000, size 0x7dcfe
2026-03-29 11:01:35,127 [root] DEBUG: 5988: Monitor initialised: 64-bit capemon loaded in process 5988 at 0x00007FFEABE00000, thread 1484, image base 0x00007FF6402C0000, stack from 0x000000131AC70000-0x000000131AC80000
2026-03-29 11:01:35,377 [root] DEBUG: 5988: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -Embedding
2026-03-29 11:01:35,533 [root] DEBUG: 5988: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:01:35,658 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:01:35,674 [root] DEBUG: 5988: set_hooks: Unable to hook LockResource
2026-03-29 11:01:35,736 [root] DEBUG: 5988: Hooked 627 out of 628 functions
2026-03-29 11:01:35,768 [root] DEBUG: 5988: Syscall hook installed, syscall logging level 1
2026-03-29 11:01:35,783 [root] DEBUG: 5988: RestoreHeaders: Restored original import table.
2026-03-29 11:01:35,830 [root] INFO: Loaded monitor into process with pid 5988
2026-03-29 11:01:35,908 [root] DEBUG: 5988: caller_dispatch: Added region at 0x00007FF6402C0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF6402D2CD1, thread 1484).
2026-03-29 11:01:35,940 [root] DEBUG: 5988: YaraScan: Scanning 0x00007FF6402C0000, size 0x7dcfe
2026-03-29 11:01:36,002 [root] DEBUG: 5988: ProcessImageBase: Main module image at 0x00007FF6402C0000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:01:36,065 [root] DEBUG: 5988: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:01:36,080 [root] DEBUG: 5988: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:01:36,143 [root] DEBUG: 5988: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:01:36,158 [root] DEBUG: 5988: DEBUG:Initialized 9 com hooks
2026-03-29 11:01:36,190 [root] DEBUG: 5988: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:01:36,221 [root] DEBUG: 5988: DLL loaded at 0x00007FFEF1EB0000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-03-29 11:01:36,331 [root] DEBUG: 5988: DLL loaded at 0x00007FFEF2120000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-03-29 11:01:36,815 [root] DEBUG: 5988: DLL loaded at 0x00007FFEF4200000: C:\Windows\system32\wbem\wmiutils (0x28000 bytes).
2026-03-29 11:01:37,986 [root] DEBUG: 5988: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 11:01:38,065 [root] DEBUG: 5988: DLL loaded at 0x00007FFEF04E0000: C:\Windows\system32\wbem\esscli (0x7d000 bytes).
2026-03-29 11:01:38,221 [root] DEBUG: 5988: DLL loaded at 0x00007FFEEF060000: C:\Windows\system32\wbem\wmiprov (0x3d000 bytes).
2026-03-29 11:01:38,408 [root] DEBUG: 5988: DLL loaded at 0x00007FFEF78C0000: C:\Windows\SYSTEM32\WMICLNT (0x11000 bytes).
2026-03-29 11:01:49,393 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,627 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,768 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,799 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,830 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,861 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,861 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:49,971 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,143 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,174 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,346 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,361 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,424 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,502 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,565 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,596 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:50,799 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:51,080 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:51,424 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:51,783 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:51,955 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,283 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,643 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,658 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,768 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,783 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,799 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,815 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,830 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,846 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,861 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,893 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,908 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,924 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,940 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:52,986 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,049 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,080 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,143 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,268 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,377 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,486 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,611 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,627 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,627 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,643 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,658 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,721 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,877 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:53,908 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,111 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,159 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,159 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,174 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,190 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,190 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,221 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,221 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,236 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,268 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,283 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,283 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,315 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,424 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,440 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,440 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,471 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,486 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,502 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,502 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,518 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,533 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,533 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,549 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,565 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,565 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,580 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,596 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,596 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,690 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,705 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,721 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,736 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,877 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,893 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,893 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,908 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,924 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,924 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,971 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,971 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:54,986 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,002 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,112 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,127 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,190 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,299 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,315 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,330 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,362 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,408 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,455 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,455 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,533 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,549 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,596 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,611 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,627 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,690 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,705 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,705 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,721 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,752 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,752 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,768 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,783 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,893 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:55,971 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,033 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,049 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,065 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,096 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,096 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,111 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,127 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,143 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,174 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,190 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,252 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,299 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,299 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,315 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,346 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,455 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,690 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,799 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,815 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,831 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,846 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,862 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,862 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:56,987 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,096 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,112 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,127 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,143 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,174 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,174 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,205 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,221 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,237 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,361 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:01:57,377 [root] DEBUG: 2336: CAPEExceptionFilter: Exception 0xc0000005 accessing 0x0 caught at RVA 0xf3438 in capemon (expected in memory scans), passing to next handler.
2026-03-29 11:02:04,440 [root] DEBUG: 2336: DLL loaded at 0x0000011F03B40000: C:\Windows\system32\wbem\WmiApRes (0x3000 bytes).
2026-03-29 11:02:08,674 [root] DEBUG: 2336: api-cap: RegQueryValueExW hook disabled due to count: 5000
2026-03-29 11:02:08,940 [root] DEBUG: 2336: api-cap: GetLastInputInfo hook disabled due to count: 5000
2026-03-29 11:02:12,596 [root] DEBUG: 2336: DLL loaded at 0x0000011F03B40000: C:\Windows\system32\wbem\WmiApRes (0x3000 bytes).
2026-03-29 11:02:32,049 [root] INFO: Added new file to list with pid 7372 and path C:\Users\cape\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxGamingOverlayTraces_FT_Server_20260329075811.txt
2026-03-29 11:02:32,143 [root] DEBUG: 7372: NtTerminateProcess hook: Attempting to dump process 7372
2026-03-29 11:02:32,283 [root] DEBUG: 7372: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:02:32,690 [root] INFO: Process with pid 7372 has terminated
2026-03-29 11:02:32,799 [root] DEBUG: 5548: DLL loaded at 0x00007FFEDF9D0000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-03-29 11:02:33,362 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE6060000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-03-29 11:02:34,096 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF8C40000: C:\Windows\System32\WinTypes (0x154000 bytes).
2026-03-29 11:02:34,611 [root] DEBUG: 5548: DLL loaded at 0x00007FFEE9AA0000: C:\Windows\System32\StructuredQuery (0xa6000 bytes).
2026-03-29 11:02:35,002 [root] DEBUG: 5548: DLL loaded at 0x00007FFEDF7D0000: C:\Windows\system32\Windows.Storage.Search (0xc6000 bytes).
2026-03-29 11:02:36,283 [root] DEBUG: 5548: DLL loaded at 0x00007FFEDC540000: C:\Windows\System32\Windows.FileExplorer.Common (0x61000 bytes).
2026-03-29 11:02:36,408 [root] DEBUG: 5548: DLL loaded at 0x00007FFEF1310000: C:\Windows\System32\iertutil (0x2b1000 bytes).
2026-03-29 11:02:40,315 [root] INFO: Added new file to list with pid 5548 and path C:\Users\cape\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\GameBar_20260329080232_Sh.etl
2026-03-29 11:02:56,986 [root] DEBUG: 2336: DLL loaded at 0x0000011F03B40000: C:\Windows\system32\wbem\WmiApRes (0x3000 bytes).
2026-03-29 11:03:15,580 [root] INFO: Process with pid 5548 has terminated
2026-03-29 11:03:15,658 [root] DEBUG: 5548: NtTerminateProcess hook: Attempting to dump process 5548
2026-03-29 11:03:15,705 [root] DEBUG: 5548: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:03:29,127 [lib.common.results] INFO: Uploading file C:\Windows\INF\WmiApRpl\0009\WmiApRpl.ini to files\629c9685ec093edbf08d7954d0a835cca94870732f9898e0eeecdd85171232f2; Size is 49814; Max size: 100000000
2026-03-29 11:03:29,174 [lib.common.results] INFO: Uploading file C:\Windows\INF\WmiApRpl\0019\WmiApRpl.ini to files\629c9685ec093edbf08d7954d0a835cca94870732f9898e0eeecdd85171232f2; Size is 49814; Max size: 100000000
2026-03-29 11:03:29,283 [lib.common.results] INFO: Uploading file C:\Windows\INF\WmiApRpl\WmiApRpl.h to files\ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15; Size is 3444; Max size: 100000000
2026-03-29 11:03:29,424 [lib.common.results] INFO: Uploading file C:\Windows\INF\WmiApRpl\WmiApRpl.ini to files\629c9685ec093edbf08d7954d0a835cca94870732f9898e0eeecdd85171232f2; Size is 49814; Max size: 100000000
2026-03-29 11:03:29,486 [root] DEBUG: 2336: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 11:03:29,518 [root] INFO: Added new file to list with pid 2336 and path C:\Windows\INF\WmiApRpl\WmiApRpl.h
2026-03-29 11:03:29,565 [root] INFO: Added new file to list with pid 2336 and path C:\Windows\INF\WmiApRpl\WmiApRpl.ini
2026-03-29 11:03:32,752 [root] DEBUG: 2336: api-rate-cap: NtWriteFile hook disabled due to rate
2026-03-29 11:03:50,080 [root] DEBUG: 2336: NtTerminateProcess hook: Attempting to dump process 2336
2026-03-29 11:03:50,143 [root] DEBUG: 2336: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:03:50,221 [root] INFO: Process with pid 2336 has terminated
2026-03-29 11:04:16,861 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:16,877 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:16,971 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDAF30000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Linq.Expressions (0x37d000 bytes).
2026-03-29 11:04:17,018 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,049 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,096 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,111 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,190 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,377 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,455 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:17,565 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF7E50000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Exp (0x7f000 bytes).
2026-03-29 11:04:17,627 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE6B10000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Managed (0x1af000 bytes).
2026-03-29 11:04:17,690 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79390000.
2026-03-29 11:04:17,924 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:18,019 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEFA50000: C:\Windows\System32\Windows.ApplicationModel (0xe6000 bytes).
2026-03-29 11:04:18,174 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDAC30000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Utilities (0x2f2000 bytes).
2026-03-29 11:04:18,268 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF7E30000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Registry (0x1b000 bytes).
2026-03-29 11:04:18,377 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF7DD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\SharedUtilities (0x57000 bytes).
2026-03-29 11:04:18,533 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE07A0000: C:\Windows\System32\Windows.Storage.ApplicationData (0x68000 bytes).
2026-03-29 11:04:18,940 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEA1E0000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\VCRUNTIME140 (0x1e000 bytes).
2026-03-29 11:04:19,080 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:19,252 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEA200000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\VCRUNTIME140_1 (0xc000 bytes).
2026-03-29 11:04:19,393 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:19,674 [root] DEBUG: 3696: DLL loaded at 0x00007FFECF470000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\MSVCP140 (0x8d000 bytes).
2026-03-29 11:04:19,690 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79900000.
2026-03-29 11:04:19,815 [root] DEBUG: 3696: DLL loaded at 0x00007FFEEF2F0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Exp.WinRT (0x65000 bytes).
2026-03-29 11:04:19,846 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:19,955 [root] DEBUG: 3696: DLL loaded at 0x00007FFED6D10000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.WinUI (0xfeb000 bytes).
2026-03-29 11:04:20,268 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDA7C0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.AppCore.Managed (0x46e000 bytes).
2026-03-29 11:04:20,440 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:20,533 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF1310000: C:\Windows\system32\iertutil (0x2b1000 bytes).
2026-03-29 11:04:20,566 [root] DEBUG: 3696: DLL loaded at 0x00007FFEE6890000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-03-29 11:04:20,658 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:20,752 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:20,815 [root] DEBUG: 3696: DLL loaded at 0x00007FFEDBF30000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Security.Cryptography (0x205000 bytes).
2026-03-29 11:04:20,924 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:21,080 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:21,330 [root] DEBUG: 3696: DLL loaded at 0x00007FFEF7DB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Exp (0x16000 bytes).
2026-03-29 11:04:21,518 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:21,627 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5700: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exe, ImageBase: 0x00007FF63A140000
2026-03-29 11:04:21,674 [root] INFO: Announced 64-bit process name: PhoneExperienceHost.exe pid: 5700
2026-03-29 11:04:21,799 [lib.api.process] INFO: Monitor config for <Process 5700 PhoneExperienceHost.exe>: C:\ltb6yatm\dll\5700.ini
2026-03-29 11:04:21,908 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:22,315 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:22,565 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:23,018 [root] DEBUG: 3696: AllocationHandler: Allocation already in tracked region list: 0x00007FFE79310000.
2026-03-29 11:04:23,971 [root] INFO: Process with pid 3696 appears to have terminated
2026-03-29 11:04:26,815 [root] DEBUG: 5000: OpenProcessHandler: Injection info created for process 7376, handle 0xff0: C:\Windows\System32\WerFault.exe
2026-03-29 11:04:29,330 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:29,502 [root] DEBUG: Loader: Injecting process 5700 (thread 3424) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:29,549 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:29,565 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:29,643 [lib.api.process] INFO: Injected into 64-bit <Process 5700 PhoneExperienceHost.exe>
2026-03-29 11:04:29,736 [root] INFO: Announced 64-bit process name: PhoneExperienceHost.exe pid: 5700
2026-03-29 11:04:29,768 [lib.api.process] INFO: Monitor config for <Process 5700 PhoneExperienceHost.exe>: C:\ltb6yatm\dll\5700.ini
2026-03-29 11:04:35,002 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:35,487 [root] DEBUG: Loader: Injecting process 5700 (thread 3424) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:35,908 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:04:35,971 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:36,205 [lib.api.process] INFO: Injected into 64-bit <Process 5700 PhoneExperienceHost.exe>
2026-03-29 11:04:37,721 [root] INFO: Announced 64-bit process name: PhoneExperienceHost.exe pid: 5700
2026-03-29 11:04:37,815 [lib.api.process] INFO: Monitor config for <Process 5700 PhoneExperienceHost.exe>: C:\ltb6yatm\dll\5700.ini
2026-03-29 11:04:38,362 [root] INFO: Process with pid 5000 appears to have terminated
2026-03-29 11:04:40,111 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 2424: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 11:04:40,190 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 2424
2026-03-29 11:04:40,205 [lib.api.process] INFO: Monitor config for <Process 2424 dllhost.exe>: C:\ltb6yatm\dll\2424.ini
2026-03-29 11:04:40,346 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:40,549 [root] DEBUG: Loader: Injecting process 2424 (thread 2392) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:40,611 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:40,690 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:40,908 [lib.api.process] INFO: Injected into 64-bit <Process 2424 dllhost.exe>
2026-03-29 11:04:40,924 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 2424
2026-03-29 11:04:40,940 [lib.api.process] INFO: Monitor config for <Process 2424 dllhost.exe>: C:\ltb6yatm\dll\2424.ini
2026-03-29 11:04:41,018 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:41,080 [root] DEBUG: Loader: Injecting process 2424 (thread 2392) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:41,080 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:41,111 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:41,174 [lib.api.process] INFO: Injected into 64-bit <Process 2424 dllhost.exe>
2026-03-29 11:04:41,346 [root] DEBUG: 2424: Python path set to 'C:\Python310'.
2026-03-29 11:04:41,377 [root] DEBUG: 2424: Dropped file limit defaulting to 100.
2026-03-29 11:04:41,533 [root] DEBUG: 2424: Disabling sleep skipping.
2026-03-29 11:04:41,627 [root] DEBUG: 2424: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:04:41,736 [root] DEBUG: 2424: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:04:41,783 [root] DEBUG: 2424: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:04:41,908 [root] DEBUG: 2424: Monitor initialised: 64-bit capemon loaded in process 2424 at 0x00007FFEABE00000, thread 2392, image base 0x00007FF6F2810000, stack from 0x000000C7A61D4000-0x000000C7A61E0000
2026-03-29 11:04:42,018 [root] DEBUG: 2424: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-03-29 11:04:42,096 [root] DEBUG: 2424: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:04:42,502 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:04:42,690 [root] DEBUG: 2424: set_hooks: Unable to hook LockResource
2026-03-29 11:04:42,783 [root] DEBUG: 2424: Hooked 627 out of 628 functions
2026-03-29 11:04:42,908 [root] DEBUG: 2424: Syscall hook installed, syscall logging level 1
2026-03-29 11:04:43,143 [root] DEBUG: 2424: RestoreHeaders: Restored original import table.
2026-03-29 11:04:43,190 [root] INFO: Loaded monitor into process with pid 2424
2026-03-29 11:04:43,424 [root] DEBUG: 2424: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28112F2, thread 2392).
2026-03-29 11:04:43,643 [root] DEBUG: 2424: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:04:44,065 [root] DEBUG: 2424: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:04:44,221 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 1048: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe, ImageBase: 0x00007FF60D0A0000
2026-03-29 11:04:44,455 [root] DEBUG: 2424: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:04:44,487 [root] INFO: Announced 64-bit process name: StartMenuExperienceHost.exe pid: 1048
2026-03-29 11:04:44,549 [lib.api.process] INFO: Monitor config for <Process 1048 StartMenuExperienceHost.exe>: C:\ltb6yatm\dll\1048.ini
2026-03-29 11:04:44,549 [root] DEBUG: 2424: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:04:44,549 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3048: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe, ImageBase: 0x00007FF660170000
2026-03-29 11:04:44,596 [root] DEBUG: 2424: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:04:44,690 [root] INFO: Announced 64-bit process name: TextInputHost.exe pid: 3048
2026-03-29 11:04:44,783 [root] DEBUG: 2424: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:04:44,783 [lib.api.process] INFO: Monitor config for <Process 3048 TextInputHost.exe>: C:\ltb6yatm\dll\3048.ini
2026-03-29 11:04:45,065 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:45,533 [root] DEBUG: 2424: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 11:04:45,658 [root] DEBUG: Loader: Injecting process 5700 (thread 3424) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:45,924 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:04:45,924 [root] DEBUG: 2424: DEBUG:Initialized 9 com hooks
2026-03-29 11:04:45,955 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:46,080 [root] DEBUG: 2424: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 11:04:46,190 [lib.api.process] INFO: Injected into 64-bit <Process 5700 PhoneExperienceHost.exe>
2026-03-29 11:04:46,205 [root] DEBUG: 2424: DLL loaded at 0x00007FFEF6AE0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-03-29 11:04:46,361 [root] DEBUG: 2424: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-03-29 11:04:46,408 [root] DEBUG: 5700: Python path set to 'C:\Python310'.
2026-03-29 11:04:46,533 [root] DEBUG: 5700: Dropped file limit defaulting to 100.
2026-03-29 11:04:46,580 [root] DEBUG: 5700: Disabling sleep skipping.
2026-03-29 11:04:46,596 [root] DEBUG: 5700: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:04:46,830 [root] DEBUG: 5700: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:04:46,861 [root] DEBUG: 5700: YaraScan: Scanning 0x00007FF63A140000, size 0x56dfa
2026-03-29 11:04:46,893 [root] DEBUG: 5700: Monitor initialised: 64-bit capemon loaded in process 5700 at 0x00007FFEABE00000, thread 3424, image base 0x00007FF63A140000, stack from 0x0000002C8DD94000-0x0000002C8DDA0000
2026-03-29 11:04:46,908 [root] DEBUG: 5700: Commandline: "C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exe" -ComServer:Background -Embedding
2026-03-29 11:04:47,049 [root] DEBUG: 5700: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:04:47,205 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:04:47,221 [root] DEBUG: 5700: set_hooks: Unable to hook LockResource
2026-03-29 11:04:47,252 [root] DEBUG: 5700: Hooked 627 out of 628 functions
2026-03-29 11:04:47,283 [root] DEBUG: 5700: Syscall hook installed, syscall logging level 1
2026-03-29 11:04:47,315 [root] DEBUG: 5700: RestoreHeaders: Restored original import table.
2026-03-29 11:04:47,330 [root] INFO: Loaded monitor into process with pid 5700
2026-03-29 11:04:47,330 [root] DEBUG: 5700: caller_dispatch: Added region at 0x00007FF63A140000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF63A155F67, thread 3424).
2026-03-29 11:04:47,361 [root] DEBUG: 5700: YaraScan: Scanning 0x00007FF63A140000, size 0x56dfa
2026-03-29 11:04:47,377 [root] DEBUG: 5700: ProcessImageBase: Main module image at 0x00007FF63A140000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:04:47,408 [root] DEBUG: 5700: DLL loaded at 0x00007FFEED510000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\hostfxr (0x5d000 bytes).
2026-03-29 11:04:47,565 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEA560000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\hostpolicy (0x60000 bytes).
2026-03-29 11:04:47,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE17A0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\coreclr (0x4a9000 bytes).
2026-03-29 11:04:47,846 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE81BF0000, size: 0x10000.
2026-03-29 11:04:47,861 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:04:47,877 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:04:47,971 [root] DEBUG: 5700: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:04:48,002 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:04:48,096 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDDDA0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Private.CoreLib (0xe8c000 bytes).
2026-03-29 11:04:48,158 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE81CA0000, size: 0x4000.
2026-03-29 11:04:48,361 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:04:48,440 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE81CB0000, size: 0x4000.
2026-03-29 11:04:48,549 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:04:48,690 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE81D40000, size: 0x1000.
2026-03-29 11:04:48,752 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:04:48,846 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE81DC0000, size: 0x4000.
2026-03-29 11:04:48,893 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:04:48,908 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:49,005 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:04:49,143 [root] DEBUG: Loader: Injecting process 1048 (thread 4856) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:49,236 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE8A80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\PhoneExperienceHost (0x10a000 bytes).
2026-03-29 11:04:49,268 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:49,518 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:49,799 [root] DEBUG: 5700: DLL loaded at 0x0000015BF6180000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Runtime (0xe000 bytes).
2026-03-29 11:04:49,908 [lib.api.process] INFO: Injected into 64-bit <Process 1048 StartMenuExperienceHost.exe>
2026-03-29 11:04:50,190 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 11:04:50,221 [root] INFO: Announced 64-bit process name: StartMenuExperienceHost.exe pid: 1048
2026-03-29 11:04:50,299 [lib.api.process] INFO: Monitor config for <Process 1048 StartMenuExperienceHost.exe>: C:\ltb6yatm\dll\1048.ini
2026-03-29 11:04:50,424 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE0BB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.AppCore.Managed (0x46e000 bytes).
2026-03-29 11:04:50,455 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:50,596 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1CF0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Runtime.InteropServices (0x19000 bytes).
2026-03-29 11:04:50,674 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE2740000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\WinRT.Runtime (0x158000 bytes).
2026-03-29 11:04:50,721 [root] DEBUG: Loader: Injecting process 3048 (thread 1152) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:50,752 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE8A30000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Collections.Concurrent (0x45000 bytes).
2026-03-29 11:04:50,783 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:50,862 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:51,205 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE89E0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Collections (0x4f000 bytes).
2026-03-29 11:04:51,393 [lib.api.process] INFO: Injected into 64-bit <Process 3048 TextInputHost.exe>
2026-03-29 11:04:51,487 [root] INFO: Announced 64-bit process name: TextInputHost.exe pid: 3048
2026-03-29 11:04:51,502 [lib.api.process] INFO: Monitor config for <Process 3048 TextInputHost.exe>: C:\ltb6yatm\dll\3048.ini
2026-03-29 11:04:51,721 [root] INFO: Process with pid 2424 has terminated
2026-03-29 11:04:51,971 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1C80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Threading (0x12000 bytes).
2026-03-29 11:04:52,018 [root] DEBUG: 2424: NtTerminateProcess hook: Attempting to dump process 2424
2026-03-29 11:04:52,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:04:52,283 [root] DEBUG: 2424: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:04:52,361 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF0350000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-03-29 11:04:52,799 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEA1E0000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\VCRUNTIME140 (0x1e000 bytes).
2026-03-29 11:04:52,846 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEA200000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\VCRUNTIME140_1 (0xc000 bytes).
2026-03-29 11:04:52,893 [root] DEBUG: 5700: DLL loaded at 0x00007FFECF470000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\MSVCP140 (0x8d000 bytes).
2026-03-29 11:04:53,127 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 11:04:53,268 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6A30000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-03-29 11:04:53,346 [root] DEBUG: 5700: DLL loaded at 0x0000015BF61A0000: C:\Windows\SYSTEM32\icuuc (0x9000 bytes).
2026-03-29 11:04:53,471 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFAC70000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-03-29 11:04:53,643 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC910000: C:\Windows\SYSTEM32\icu (0x22e000 bytes).
2026-03-29 11:04:53,861 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE2560000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.AppCore.WinRT (0x1d8000 bytes).
2026-03-29 11:04:54,924 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEFC60000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Memory (0x25000 bytes).
2026-03-29 11:04:55,361 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 6152: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:04:55,533 [root] DEBUG: 5700: DEBUG:Initialized 9 com hooks
2026-03-29 11:04:55,611 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6152
2026-03-29 11:04:55,627 [lib.api.process] INFO: Monitor config for <Process 6152 SearchApp.exe>: C:\ltb6yatm\dll\6152.ini
2026-03-29 11:04:55,721 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:04:55,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE0880000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\clrjit (0x1de000 bytes).
2026-03-29 11:04:55,893 [root] DEBUG: 5700: DLL loaded at 0x0000015BF61E0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Diagnostics.Tracing (0x8000 bytes).
2026-03-29 11:04:56,096 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE81C0D000, size: 0x1000.
2026-03-29 11:04:56,283 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81CB0000.
2026-03-29 11:04:56,471 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDCDB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.WinUI (0xfeb000 bytes).
2026-03-29 11:04:56,877 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDFE80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Utilities (0x2f2000 bytes).
2026-03-29 11:04:57,111 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:57,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF7D80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Apps.TraceLogging (0xa000 bytes).
2026-03-29 11:04:57,486 [root] DEBUG: Loader: Injecting process 1048 (thread 4856) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:57,658 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:57,736 [root] DEBUG: 5700: DLL loaded at 0x0000019C8DAC0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\netstandard (0x1c000 bytes).
2026-03-29 11:04:57,877 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:58,018 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF0330000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Windows.AppLifecycle.Projection (0x13000 bytes).
2026-03-29 11:04:58,080 [lib.api.process] INFO: Injected into 64-bit <Process 1048 StartMenuExperienceHost.exe>
2026-03-29 11:04:58,440 [root] INFO: Announced 64-bit process name: StartMenuExperienceHost.exe pid: 1048
2026-03-29 11:04:58,502 [lib.api.process] INFO: Monitor config for <Process 1048 StartMenuExperienceHost.exe>: C:\ltb6yatm\dll\1048.ini
2026-03-29 11:04:58,611 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:04:58,925 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFBE70000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-03-29 11:04:59,112 [root] DEBUG: Loader: Injecting process 3048 (thread 1152) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:04:59,346 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF60C0000: C:\Windows\SYSTEM32\XmlLite (0x36000 bytes).
2026-03-29 11:04:59,455 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:04:59,611 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF8C40000: C:\Windows\SYSTEM32\wintypes (0x154000 bytes).
2026-03-29 11:04:59,768 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:00,002 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFBDE0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-03-29 11:05:00,268 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDCB40000: C:\Windows\SYSTEM32\RoMetadata (0x3b000 bytes).
2026-03-29 11:05:00,268 [lib.api.process] INFO: Injected into 64-bit <Process 3048 TextInputHost.exe>
2026-03-29 11:05:00,612 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDFC90000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\Microsoft.WindowsAppRuntime (0x1e6000 bytes).
2026-03-29 11:05:00,752 [root] INFO: Announced 64-bit process name: TextInputHost.exe pid: 3048
2026-03-29 11:05:00,830 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFBDC0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-03-29 11:05:00,846 [lib.api.process] INFO: Monitor config for <Process 3048 TextInputHost.exe>: C:\ltb6yatm\dll\3048.ini
2026-03-29 11:05:01,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF7730000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ComponentModel (0x5000 bytes).
2026-03-29 11:05:01,205 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEFF70000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ObjectModel (0x12000 bytes).
2026-03-29 11:05:01,238 [root] DEBUG: 5700: DLL loaded at 0x0000019C8DB40000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Numerics.Vectors (0x8000 bytes).
2026-03-29 11:05:01,300 [root] DEBUG: 5700: DLL loaded at 0x00007FFEECEF0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Private.Uri (0x3d000 bytes).
2026-03-29 11:05:01,440 [root] DEBUG: 5700: DumpPEsInRange: Scanning range 0x00007FFE81D40000 - 0x00007FFE81D42458.
2026-03-29 11:05:01,736 [root] DEBUG: 5700: ScanForDisguisedPE: No PE image located in range 0x00007FFE81D40000-0x00007FFE81D42458.
2026-03-29 11:05:01,783 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\5700_1653043215829032026 to CAPE\149b45fc688c30e509a023a184379c5e4ce407108d314bd5ebf88ffed70dd058; Size is 9304; Max size: 100000000
2026-03-29 11:05:01,815 [root] DEBUG: 5700: DumpMemory: Payload successfully created: C:\atsPQMC\CAPE\5700_1653043215829032026 (size 9304 bytes)
2026-03-29 11:05:01,815 [root] DEBUG: 5700: DumpRegion: Dumped entire allocation from 0x00007FFE81D40000, size 12288 bytes.
2026-03-29 11:05:01,830 [root] DEBUG: 5700: ProcessTrackedRegion: Dumped region at 0x00007FFE81D40000.
2026-03-29 11:05:01,877 [root] DEBUG: 5700: YaraScan: Scanning 0x00007FFE81D40000, size 0x2458
2026-03-29 11:05:01,908 [root] DEBUG: 5700: DLL loaded at 0x00007FFEA8210000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Windows.SDK.NET (0x39fc000 bytes).
2026-03-29 11:05:02,190 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:02,205 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:02,252 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82360000, size: 0x4000.
2026-03-29 11:05:02,268 [root] DEBUG: Loader: Injecting process 6152 (thread 5444) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:02,286 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:02,315 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:02,393 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:02,471 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:02,533 [lib.api.process] INFO: Injected into 64-bit <Process 6152 SearchApp.exe>
2026-03-29 11:05:02,533 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82360000.
2026-03-29 11:05:02,674 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6152
2026-03-29 11:05:02,705 [lib.api.process] INFO: Monitor config for <Process 6152 SearchApp.exe>: C:\ltb6yatm\dll\6152.ini
2026-03-29 11:05:02,705 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:02,752 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE823C0000, size: 0x1000.
2026-03-29 11:05:02,830 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:03,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:03,096 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82440000, size: 0x4000.
2026-03-29 11:05:03,143 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:03,330 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDFAD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Text.Json (0x1b4000 bytes).
2026-03-29 11:05:03,455 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6F00000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-03-29 11:05:03,455 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF9770000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-03-29 11:05:03,486 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEAA90000: C:\Windows\System32\execmodelclient (0x60000 bytes).
2026-03-29 11:05:03,611 [root] DEBUG: 5700: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:05:03,627 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEFBB0000: C:\Windows\System32\Windows.Shell.ServiceHostBuilder (0x1d000 bytes).
2026-03-29 11:05:03,877 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81DC0000.
2026-03-29 11:05:03,908 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE8830000: C:\Windows\system32\execmodelproxy (0x18000 bytes).
2026-03-29 11:05:03,940 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:04,112 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDF450000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Linq.Expressions (0x37d000 bytes).
2026-03-29 11:05:04,174 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82440000.
2026-03-29 11:05:04,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:04,440 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDF240000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Security.Cryptography (0x205000 bytes).
2026-03-29 11:05:04,518 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:04,674 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 804: C:\Windows\System32\smartscreen.exe, ImageBase: 0x00007FF7CA6A0000
2026-03-29 11:05:04,690 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFBEB0000: C:\Windows\SYSTEM32\profapi (0x1f000 bytes).
2026-03-29 11:05:04,705 [root] INFO: Announced 64-bit process name: smartscreen.exe pid: 804
2026-03-29 11:05:04,721 [root] DEBUG: 5700: DLL loaded at 0x00007FFEED490000: C:\Windows\SYSTEM32\Bcp47Langs (0x5b000 bytes).
2026-03-29 11:05:04,737 [lib.api.process] INFO: Monitor config for <Process 804 smartscreen.exe>: C:\ltb6yatm\dll\804.ini
2026-03-29 11:05:04,862 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF8DA0000: C:\Windows\SYSTEM32\dcomp (0x1e4000 bytes).
2026-03-29 11:05:04,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:04,986 [root] DEBUG: 5700: DLL loaded at 0x00007FFECD7C0000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\Microsoft.Internal.FrameworkUdk (0xf9000 bytes).
2026-03-29 11:05:05,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:05,033 [root] DEBUG: 5700: DLL loaded at 0x00007FFECD8C0000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\CoreMessagingXP (0xfd000 bytes).
2026-03-29 11:05:05,033 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:05,065 [root] DEBUG: 5700: DLL loaded at 0x00007FFECE1D0000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\Microsoft.UI.Windowing.Core (0x82000 bytes).
2026-03-29 11:05:05,096 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:05,111 [root] DEBUG: Loader: Injecting process 804 (thread 6068) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:05,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1310000: C:\Windows\SYSTEM32\iertutil (0x2b1000 bytes).
2026-03-29 11:05:05,158 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:05,158 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:05,221 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82560000, size: 0x4000.
2026-03-29 11:05:05,237 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:05,237 [root] DEBUG: Loader: Injecting process 1048 (thread 4856) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:05,268 [lib.api.process] INFO: Injected into 64-bit <Process 804 smartscreen.exe>
2026-03-29 11:05:05,283 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:05:05,283 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:05,315 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF15D0000: C:\Windows\SYSTEM32\srvcli (0x28000 bytes).
2026-03-29 11:05:05,315 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:05,346 [lib.api.process] INFO: Injected into 64-bit <Process 1048 StartMenuExperienceHost.exe>
2026-03-29 11:05:05,346 [root] INFO: Announced 64-bit process name: smartscreen.exe pid: 804
2026-03-29 11:05:05,408 [lib.api.process] INFO: Monitor config for <Process 804 smartscreen.exe>: C:\ltb6yatm\dll\804.ini
2026-03-29 11:05:05,549 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:05,580 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFB390000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-03-29 11:05:05,580 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:05,612 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:05,721 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1600000: C:\Windows\SYSTEM32\urlmon (0x1ec000 bytes).
2026-03-29 11:05:05,768 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:05,846 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:05,986 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEB570000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-03-29 11:05:06,049 [root] DEBUG: Loader: Injecting process 804 (thread 6068) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:06,083 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 7340: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 11:05:06,096 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFA860000: C:\Windows\SYSTEM32\dxgi (0xf3000 bytes).
2026-03-29 11:05:06,127 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:05:06,158 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 7340
2026-03-29 11:05:06,158 [lib.api.process] INFO: Monitor config for <Process 7340 dllhost.exe>: C:\ltb6yatm\dll\7340.ini
2026-03-29 11:05:06,221 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF89D0000: C:\Windows\SYSTEM32\d3d11 (0x263000 bytes).
2026-03-29 11:05:06,237 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:06,283 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:06,346 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF5730000: C:\Windows\SYSTEM32\VERSION (0xa000 bytes).
2026-03-29 11:05:06,346 [lib.api.process] INFO: Injected into 64-bit <Process 804 smartscreen.exe>
2026-03-29 11:05:06,377 [root] INFO: Announced starting service "b'camsvc'"
2026-03-29 11:05:06,377 [root] DEBUG: Loader: Injecting process 7340 (thread 6792) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:06,377 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF8410000: C:\Windows\SYSTEM32\d2d1 (0x5c0000 bytes).
2026-03-29 11:05:06,580 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:06,596 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:06,611 [root] DEBUG: 5700: DLL loaded at 0x00007FFECA9A0000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml (0xe5e000 bytes).
2026-03-29 11:05:06,658 [root] DEBUG: 804: Python path set to 'C:\Python310'.
2026-03-29 11:05:06,690 [root] DEBUG: Loader: Injecting process 3048 (thread 1152) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:06,723 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:06,736 [root] DEBUG: 804: Dropped file limit defaulting to 100.
2026-03-29 11:05:06,830 [lib.api.process] INFO: Injected into 64-bit <Process 7340 dllhost.exe>
2026-03-29 11:05:06,908 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:05:07,221 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 7340
2026-03-29 11:05:07,393 [root] DEBUG: 804: Disabling sleep skipping.
2026-03-29 11:05:07,408 [lib.api.process] INFO: Monitor config for <Process 7340 dllhost.exe>: C:\ltb6yatm\dll\7340.ini
2026-03-29 11:05:07,549 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81C00000.
2026-03-29 11:05:07,596 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:07,705 [root] DEBUG: 804: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:05:07,924 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:08,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:08,080 [lib.api.process] INFO: Injected into 64-bit <Process 3048 TextInputHost.exe>
2026-03-29 11:05:08,330 [root] DEBUG: 804: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:05:08,362 [root] DEBUG: Loader: Injecting process 7340 (thread 6792) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:08,377 [root] DEBUG: 804: YaraScan: Scanning 0x00007FF7CA6A0000, size 0x24ad28
2026-03-29 11:05:08,455 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:08,471 [root] DEBUG: 804: Monitor initialised: 64-bit capemon loaded in process 804 at 0x00007FFEABE00000, thread 6068, image base 0x00007FF7CA6A0000, stack from 0x0000008915514000-0x0000008915520000
2026-03-29 11:05:08,533 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:08,533 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:08,549 [root] DEBUG: 804: Commandline: C:\Windows\System32\smartscreen.exe -Embedding
2026-03-29 11:05:08,612 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF4B0000: C:\Windows\System32\twinapi.appcore (0x200000 bytes).
2026-03-29 11:05:08,612 [lib.api.process] INFO: Injected into 64-bit <Process 7340 dllhost.exe>
2026-03-29 11:05:08,721 [root] DEBUG: 804: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:05:09,049 [root] DEBUG: Loader: Injecting process 6152 (thread 5444) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:09,252 [root] DEBUG: 7340: Python path set to 'C:\Python310'.
2026-03-29 11:05:09,627 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:09,658 [root] DEBUG: 7340: Dropped file limit defaulting to 100.
2026-03-29 11:05:09,690 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:05:09,705 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEE330000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-03-29 11:05:09,705 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:09,737 [lib.api.process] INFO: Injected into 64-bit <Process 6152 SearchApp.exe>
2026-03-29 11:05:09,752 [root] DEBUG: 804: set_hooks: Unable to hook LockResource
2026-03-29 11:05:09,830 [root] DEBUG: 7340: Disabling sleep skipping.
2026-03-29 11:05:09,877 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF9310000: C:\Windows\System32\CoreUIComponents (0x35e000 bytes).
2026-03-29 11:05:09,893 [root] DEBUG: 804: Hooked 627 out of 628 functions
2026-03-29 11:05:10,033 [root] DEBUG: 7340: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:05:10,127 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6152
2026-03-29 11:05:10,143 [root] DEBUG: 7340: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:05:10,174 [root] DEBUG: 5700: DLL loaded at 0x00007FFEECA90000: C:\Windows\System32\TextInputFramework (0xf9000 bytes).
2026-03-29 11:05:10,190 [lib.api.process] INFO: Monitor config for <Process 6152 SearchApp.exe>: C:\ltb6yatm\dll\6152.ini
2026-03-29 11:05:10,205 [root] DEBUG: 7340: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:05:10,236 [root] DEBUG: 804: Syscall hook installed, syscall logging level 1
2026-03-29 11:05:10,236 [root] DEBUG: 5700: DLL loaded at 0x00007FFEECB90000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-03-29 11:05:10,252 [root] DEBUG: 7340: Monitor initialised: 64-bit capemon loaded in process 7340 at 0x00007FFEABE00000, thread 6792, image base 0x00007FF6F2810000, stack from 0x00000027132F4000-0x0000002713300000
2026-03-29 11:05:10,268 [root] DEBUG: 804: RestoreHeaders: Restored original import table.
2026-03-29 11:05:10,283 [root] DEBUG: 7340: Commandline: C:\Windows\system32\DllHost.exe /Processid:{133EAC4F-5891-4D04-BADA-D84870380A80}
2026-03-29 11:05:10,283 [root] DEBUG: 5700: DLL loaded at 0x00007FFEECCF0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-03-29 11:05:10,377 [root] INFO: Loaded monitor into process with pid 804
2026-03-29 11:05:10,455 [root] DEBUG: 7340: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:05:10,705 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEFA50000: C:\Windows\System32\Windows.ApplicationModel (0xe6000 bytes).
2026-03-29 11:05:10,752 [root] DEBUG: 804: caller_dispatch: Added region at 0x00007FF7CA6A0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF7CA7B72D2, thread 6068).
2026-03-29 11:05:10,908 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:05:11,158 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEB7F0000: C:\Windows\System32\Windows.UI.Immersive (0x13a000 bytes).
2026-03-29 11:05:11,174 [root] DEBUG: 7340: set_hooks: Unable to hook LockResource
2026-03-29 11:05:11,315 [root] DEBUG: 804: YaraScan: Scanning 0x00007FF7CA6A0000, size 0x24ad28
2026-03-29 11:05:11,455 [root] DEBUG: 7340: Hooked 627 out of 628 functions
2026-03-29 11:05:11,580 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF9A90000: C:\Windows\SYSTEM32\resourcepolicyclient (0x14000 bytes).
2026-03-29 11:05:11,768 [root] DEBUG: 804: ProcessImageBase: Main module image at 0x00007FF7CA6A0000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:05:11,846 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDEE40000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Managed (0x1af000 bytes).
2026-03-29 11:05:11,955 [root] DEBUG: 7340: Syscall hook installed, syscall logging level 1
2026-03-29 11:05:12,143 [root] DEBUG: 804: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:05:12,268 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC180000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.InteractiveExperiences.Projection (0x351000 bytes).
2026-03-29 11:05:12,424 [root] DEBUG: 7340: RestoreHeaders: Restored original import table.
2026-03-29 11:05:12,596 [root] DEBUG: 5700: DLL loaded at 0x00007FFEED7B0000: C:\Windows\SYSTEM32\d3d10warp (0x6f6000 bytes).
2026-03-29 11:05:12,740 [root] INFO: Loaded monitor into process with pid 7340
2026-03-29 11:05:12,768 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFBFA0000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-03-29 11:05:12,815 [root] DEBUG: 7340: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28112F2, thread 6792).
2026-03-29 11:05:12,846 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:12,877 [root] DEBUG: 7340: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:05:13,049 [root] DEBUG: 7340: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:05:13,127 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF7580000: C:\Windows\SYSTEM32\dxcore (0x3b000 bytes).
2026-03-29 11:05:13,205 [root] DEBUG: 7340: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:05:13,253 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE8000000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Exp (0x7f000 bytes).
2026-03-29 11:05:13,253 [root] DEBUG: 7340: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:05:13,253 [root] DEBUG: 804: DEBUG:Initialized 9 com hooks
2026-03-29 11:05:13,393 [root] DEBUG: 7340: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:05:13,627 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEA690000: C:\Windows\SYSTEM32\TextShaping (0xac000 bytes).
2026-03-29 11:05:14,111 [root] DEBUG: 7340: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:05:14,424 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4E7F41000, size: 0x1000.
2026-03-29 11:05:14,674 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:14,783 [root] DEBUG: 804: DLL loaded at 0x00007FFEEA0E0000: C:\Windows\System32\smartscreenps (0x52000 bytes).
2026-03-29 11:05:14,861 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE8120000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\SharedUtilities (0x57000 bytes).
2026-03-29 11:05:15,002 [root] DEBUG: 644: DLL loaded at 0x00007FFEEA210000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-03-29 11:05:15,252 [root] DEBUG: 7340: DEBUG:Initialized 9 com hooks
2026-03-29 11:05:15,361 [root] DEBUG: 804: DLL loaded at 0x00007FFEFB070000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-03-29 11:05:15,862 [root] DEBUG: 7340: DLL loaded at 0x00007FFEFDBE0000: C:\Windows\System32\shell32 (0x743000 bytes).
2026-03-29 11:05:15,940 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE07A0000: C:\Windows\System32\Windows.Storage.ApplicationData (0x68000 bytes).
2026-03-29 11:05:16,096 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:16,596 [root] DEBUG: 804: DLL loaded at 0x00007FFEF6370000: C:\Windows\SYSTEM32\policymanager (0xa0000 bytes).
2026-03-29 11:05:16,674 [root] DEBUG: 5700: DLL loaded at 0x00007FFEECFC0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Exp.WinRT (0x65000 bytes).
2026-03-29 11:05:16,877 [root] DEBUG: Loader: Injecting process 6152 (thread 5444) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:17,112 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:17,236 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:05:17,518 [root] DEBUG: 7340: DLL loaded at 0x00007FFEEFB60000: C:\Windows\System32\TaskSchdPS (0x12000 bytes).
2026-03-29 11:05:17,674 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE6890000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-03-29 11:05:17,736 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82660000, size: 0x4000.
2026-03-29 11:05:17,768 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:17,768 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:17,846 [lib.api.process] INFO: Injected into 64-bit <Process 6152 SearchApp.exe>
2026-03-29 11:05:18,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82560000.
2026-03-29 11:05:18,096 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3228: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:05:18,127 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:18,221 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 3228
2026-03-29 11:05:18,299 [lib.api.process] INFO: Monitor config for <Process 3228 SearchApp.exe>: C:\ltb6yatm\dll\3228.ini
2026-03-29 11:05:18,330 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF1D0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Exp (0x16000 bytes).
2026-03-29 11:05:18,426 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:18,658 [root] DEBUG: 5700: DLL loaded at 0x00007FFECA920000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\MRM (0x4c000 bytes).
2026-03-29 11:05:18,721 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF2C0000: C:\Windows\SYSTEM32\bcp47mrm (0x2d000 bytes).
2026-03-29 11:05:18,736 [root] DEBUG: 5700: DLL loaded at 0x00007FFECA970000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources (0x28000 bytes).
2026-03-29 11:05:18,846 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6DC0000: C:\Windows\SYSTEM32\AppxDeploymentClient (0xf7000 bytes).
2026-03-29 11:05:18,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:18,955 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEB3C0000: C:\Windows\System32\Windows.Globalization (0x1a6000 bytes).
2026-03-29 11:05:19,033 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:19,158 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE3410000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\SharedUtilities.Controls (0x5d000 bytes).
2026-03-29 11:05:19,268 [root] DEBUG: 5700: DLL loaded at 0x0000019C95AB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Shell (0x8000 bytes).
2026-03-29 11:05:19,361 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDB8C0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Messaging.Managed (0x326000 bytes).
2026-03-29 11:05:19,658 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDBC90000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.OnboardingSDK (0x2cd000 bytes).
2026-03-29 11:05:19,955 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 6628: C:\Windows\System32\mobsync.exe, ImageBase: 0x00007FF7802B0000
2026-03-29 11:05:20,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:20,096 [root] INFO: Announced 64-bit process name: mobsync.exe pid: 6628
2026-03-29 11:05:20,111 [lib.api.process] INFO: Monitor config for <Process 6628 mobsync.exe>: C:\ltb6yatm\dll\6628.ini
2026-03-29 11:05:20,393 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE0680000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Settings.Managed (0xbf000 bytes).
2026-03-29 11:05:20,455 [root] DEBUG: 5700: DLL loaded at 0x0000019C95AC0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Settings (0x6000 bytes).
2026-03-29 11:05:20,549 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:20,549 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC760000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhoneControls.Managed (0x126000 bytes).
2026-03-29 11:05:20,721 [root] DEBUG: Loader: Injecting process 6628 (thread 3012) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:20,861 [root] DEBUG: 5700: DLL loaded at 0x00007FFECA1B0000: C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.7_7000.770.750.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.Controls (0x651000 bytes).
2026-03-29 11:05:20,955 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:21,065 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:21,643 [lib.api.process] INFO: Injected into 64-bit <Process 6628 mobsync.exe>
2026-03-29 11:05:21,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE0480000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Audio (0x8b000 bytes).
2026-03-29 11:05:21,893 [root] INFO: Announced 64-bit process name: mobsync.exe pid: 6628
2026-03-29 11:05:21,971 [lib.api.process] INFO: Monitor config for <Process 6628 mobsync.exe>: C:\ltb6yatm\dll\6628.ini
2026-03-29 11:05:21,971 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDB6E0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Calling.Managed (0x1d3000 bytes).
2026-03-29 11:05:22,330 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:22,486 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDB420000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Connectivity.Bluetooth.Managed (0x2b2000 bytes).
2026-03-29 11:05:22,674 [root] DEBUG: Loader: Injecting process 6628 (thread 3012) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:22,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDFA30000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Connectivity.Managed (0x9f000 bytes).
2026-03-29 11:05:22,971 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:23,080 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:23,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDF8A0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Connectivity.YPP.Managed (0xe3000 bytes).
2026-03-29 11:05:23,252 [lib.api.process] INFO: Injected into 64-bit <Process 6628 mobsync.exe>
2026-03-29 11:05:23,268 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDB310000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contacts.Managed (0x10d000 bytes).
2026-03-29 11:05:23,377 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:23,424 [root] DEBUG: 6628: Python path set to 'C:\Python310'.
2026-03-29 11:05:23,533 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE0810000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Continuity.Managed (0x67000 bytes).
2026-03-29 11:05:23,611 [root] DEBUG: Loader: Injecting process 3228 (thread 1424) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:23,674 [root] DEBUG: 6628: Dropped file limit defaulting to 100.
2026-03-29 11:05:23,705 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDB170000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Devices.Managed (0x198000 bytes).
2026-03-29 11:05:23,768 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:23,940 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDADF0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Fre.Managed (0x37d000 bytes).
2026-03-29 11:05:24,221 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:24,283 [root] DEBUG: 6628: Disabling sleep skipping.
2026-03-29 11:05:24,346 [lib.api.process] INFO: Injected into 64-bit <Process 3228 SearchApp.exe>
2026-03-29 11:05:24,362 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDA900000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Help (0x4e8000 bytes).
2026-03-29 11:05:24,471 [root] DEBUG: 6628: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:05:24,674 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 3228
2026-03-29 11:05:24,801 [root] DEBUG: 6628: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:05:24,815 [lib.api.process] INFO: Monitor config for <Process 3228 SearchApp.exe>: C:\ltb6yatm\dll\3228.ini
2026-03-29 11:05:24,971 [root] DEBUG: 6628: YaraScan: Scanning 0x00007FF7802B0000, size 0x1d056
2026-03-29 11:05:25,361 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC6F0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Hotspot.Managed (0x61000 bytes).
2026-03-29 11:05:25,408 [root] DEBUG: 6628: Monitor initialised: 64-bit capemon loaded in process 6628 at 0x00007FFEABE00000, thread 3012, image base 0x00007FF7802B0000, stack from 0x000000CD80BE4000-0x000000CD80BF0000
2026-03-29 11:05:25,580 [root] DEBUG: 6628: Commandline: C:\Windows\System32\mobsync.exe -Embedding
2026-03-29 11:05:25,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDA590000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Notifications.Managed (0x361000 bytes).
2026-03-29 11:05:26,065 [root] DEBUG: 6628: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:05:26,643 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:05:26,768 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEDF90000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Oem (0x22000 bytes).
2026-03-29 11:05:26,893 [root] DEBUG: 6628: set_hooks: Unable to hook LockResource
2026-03-29 11:05:26,971 [root] DEBUG: 6628: Hooked 627 out of 628 functions
2026-03-29 11:05:27,033 [root] DEBUG: 6628: Syscall hook installed, syscall logging level 1
2026-03-29 11:05:27,111 [root] DEBUG: 6628: RestoreHeaders: Restored original import table.
2026-03-29 11:05:27,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDA440000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Photos.Managed (0x145000 bytes).
2026-03-29 11:05:27,237 [root] INFO: Loaded monitor into process with pid 6628
2026-03-29 11:05:27,330 [root] DEBUG: 6628: caller_dispatch: Added region at 0x00007FF7802B0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF7802B4861, thread 3012).
2026-03-29 11:05:27,565 [root] DEBUG: 6628: YaraScan: Scanning 0x00007FF7802B0000, size 0x1d056
2026-03-29 11:05:27,643 [root] DEBUG: 6628: ProcessImageBase: Main module image at 0x00007FF7802B0000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:05:27,830 [root] DEBUG: 6628: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 11:05:28,002 [root] DEBUG: 6628: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:05:28,127 [root] DEBUG: 6628: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:05:28,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDA1F0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.ScreenMirroring.Managed (0x244000 bytes).
2026-03-29 11:05:28,174 [root] DEBUG: 6628: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:05:28,221 [root] DEBUG: 6628: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:05:28,268 [root] DEBUG: 6628: DEBUG:Initialized 9 com hooks
2026-03-29 11:05:28,330 [root] DEBUG: 6628: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:05:28,377 [root] DEBUG: 6628: DLL loaded at 0x00007FFEE1DC0000: C:\Windows\System32\SyncCenter (0x83000 bytes).
2026-03-29 11:05:28,565 [root] DEBUG: 6628: DLL loaded at 0x00007FFEE4630000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32 (0x29a000 bytes).
2026-03-29 11:05:28,658 [root] DEBUG: 6628: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:05:28,736 [root] DEBUG: 6628: DLL loaded at 0x00007FFEEE110000: C:\Windows\System32\ActXPrxy (0xa1000 bytes).
2026-03-29 11:05:28,877 [root] DEBUG: 6628: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 11:05:29,143 [root] DEBUG: 6628: DLL loaded at 0x00007FFEF09F0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7c9000 bytes).
2026-03-29 11:05:29,408 [root] DEBUG: 6628: DLL loaded at 0x00007FFEFE6C0000: C:\Windows\System32\MSCTF (0x115000 bytes).
2026-03-29 11:05:29,487 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDA0C0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.SharedContent.Managed (0x123000 bytes).
2026-03-29 11:05:29,487 [root] DEBUG: 6628: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\PROPSYS (0xf6000 bytes).
2026-03-29 11:05:29,674 [root] DEBUG: 6628: DLL loaded at 0x00007FFEF6A30000: C:\Windows\system32\WTSAPI32 (0x14000 bytes).
2026-03-29 11:05:29,908 [root] DEBUG: 6628: DLL loaded at 0x00007FFEDC640000: C:\Windows\system32\SyncInfrastructure (0x6e000 bytes).
2026-03-29 11:05:29,971 [root] DEBUG: 5700: DLL loaded at 0x00007FFED9060000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Shell (0x1bc000 bytes).
2026-03-29 11:05:29,986 [root] DEBUG: 6628: DLL loaded at 0x00007FFEED570000: C:\Windows\System32\cscui (0xcd000 bytes).
2026-03-29 11:05:30,127 [root] DEBUG: 6628: DLL loaded at 0x00007FFEFBC50000: C:\Windows\system32\WINSTA (0x5a000 bytes).
2026-03-29 11:05:30,174 [root] DEBUG: 6628: DLL loaded at 0x00007FFEE7F80000: C:\Windows\System32\CSCAPI (0x12000 bytes).
2026-03-29 11:05:30,861 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:30,908 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE828D0000, size: 0x4000.
2026-03-29 11:05:31,018 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:31,643 [root] DEBUG: 5700: DLL loaded at 0x00007FFEED320000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Calling.Shims (0x21000 bytes).
2026-03-29 11:05:31,752 [root] DEBUG: 5700: DLL loaded at 0x0000015BF6110000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Connectivity.Bluetooth (0xa000 bytes).
2026-03-29 11:05:31,799 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:31,846 [root] DEBUG: Loader: Injecting process 3228 (thread 1424) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:31,877 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:31,877 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:31,924 [lib.api.process] INFO: Injected into 64-bit <Process 3228 SearchApp.exe>
2026-03-29 11:05:31,924 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC5D0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.Common (0x69000 bytes).
2026-03-29 11:05:32,018 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE1540000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.Onboarding (0x44000 bytes).
2026-03-29 11:05:32,127 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE828D0000.
2026-03-29 11:05:32,174 [root] DEBUG: 5700: DLL loaded at 0x0000019C95AD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Help (0x8000 bytes).
2026-03-29 11:05:32,346 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:32,440 [root] DEBUG: 5700: DLL loaded at 0x00007FFEED4F0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhoneControls.Projection (0x1a000 bytes).
2026-03-29 11:05:32,861 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE829F0000, size: 0x4000.
2026-03-29 11:05:32,893 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:32,893 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:32,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:32,986 [root] INFO: Process with pid 3228 has terminated
2026-03-29 11:05:33,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,080 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5200: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:05:33,143 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,236 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 5200
2026-03-29 11:05:33,252 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,268 [lib.api.process] INFO: Monitor config for <Process 5200 SearchApp.exe>: C:\ltb6yatm\dll\5200.ini
2026-03-29 11:05:33,283 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,330 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,361 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,580 [root] DEBUG: 5700: DLL loaded at 0x00007FFEED290000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.DependencyInjection.Abstractions (0x20000 bytes).
2026-03-29 11:05:33,674 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEA480000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Windows.ApplicationModel.Resources.Projection (0x22000 bytes).
2026-03-29 11:05:33,690 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82660000.
2026-03-29 11:05:33,783 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE7DB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Background (0x17000 bytes).
2026-03-29 11:05:33,799 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:33,830 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF04D0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Internal.Bluetooth.Pal (0x7000 bytes).
2026-03-29 11:05:33,861 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE6AF0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Http (0x2e000 bytes).
2026-03-29 11:05:33,861 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE829F0000.
2026-03-29 11:05:34,002 [root] DEBUG: 5700: DLL loaded at 0x00007FFED9DB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Polly (0xba000 bytes).
2026-03-29 11:05:34,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:34,049 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE3760000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Connectivity.Bluetooth.Shims (0x39000 bytes).
2026-03-29 11:05:34,080 [root] DEBUG: 5700: DLL loaded at 0x0000015BF61F0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Runtime.CompilerServices.Unsafe (0x8000 bytes).
2026-03-29 11:05:34,111 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8EA0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Net.Http (0x1b2000 bytes).
2026-03-29 11:05:34,111 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:34,190 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE4960000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging (0x16000 bytes).
2026-03-29 11:05:34,236 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE0650000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Logging.Abstractions (0x21000 bytes).
2026-03-29 11:05:34,315 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3528: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF76BCF0000
2026-03-29 11:05:34,330 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE1DA0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Options (0x20000 bytes).
2026-03-29 11:05:34,377 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 3528
2026-03-29 11:05:34,377 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF0060000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Diagnostics (0xf000 bytes).
2026-03-29 11:05:34,440 [lib.api.process] INFO: Monitor config for <Process 3528 ShellExperienceHost.exe>: C:\ltb6yatm\dll\3528.ini
2026-03-29 11:05:34,455 [root] DEBUG: 5700: DLL loaded at 0x00007FFED9D40000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Diagnostics.DiagnosticSource (0x6c000 bytes).
2026-03-29 11:05:34,565 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8E00000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Linq (0x9e000 bytes).
2026-03-29 11:05:34,580 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:34,612 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEFB50000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Connectivity.YPP (0x9000 bytes).
2026-03-29 11:05:34,658 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDFA00000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.Shims (0x2e000 bytes).
2026-03-29 11:05:34,689 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF270000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Testably.Abstractions.FileSystem.Interface (0xb000 bytes).
2026-03-29 11:05:34,752 [root] DEBUG: 5700: DLL loaded at 0x00007FFEE1130000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\TestableIO.System.IO.Abstractions.Wrappers (0x1c000 bytes).
2026-03-29 11:05:34,783 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8D80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.ServicesClient (0x77000 bytes).
2026-03-29 11:05:34,846 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8CA0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.Auth (0xde000 bytes).
2026-03-29 11:05:34,893 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,018 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,158 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82B30000, size: 0x4000.
2026-03-29 11:05:35,174 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:35,190 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,283 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,315 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,377 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDEDF0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Reflection.Emit (0x47000 bytes).
2026-03-29 11:05:35,424 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,455 [root] DEBUG: 5700: DLL loaded at 0x0000019C95B70000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Hotspot (0x6000 bytes).
2026-03-29 11:05:35,565 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,627 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82B30000.
2026-03-29 11:05:35,674 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8B10000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.AppProxyConnection (0x181000 bytes).
2026-03-29 11:05:35,815 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:35,971 [root] DEBUG: 5700: DLL loaded at 0x0000019C95BA0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Calling (0x6000 bytes).
2026-03-29 11:05:36,502 [root] DEBUG: 5700: DLL loaded at 0x0000019C95BB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.SharedContent (0x6000 bytes).
2026-03-29 11:05:36,611 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:37,455 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:37,533 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:37,783 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5128: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 11:05:37,877 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:38,002 [root] DEBUG: Loader: Injecting process 5200 (thread 2332) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:38,002 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 5128
2026-03-29 11:05:38,018 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:38,033 [lib.api.process] INFO: Monitor config for <Process 5128 dllhost.exe>: C:\ltb6yatm\dll\5128.ini
2026-03-29 11:05:38,033 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:38,065 [lib.api.process] INFO: Injected into 64-bit <Process 5200 SearchApp.exe>
2026-03-29 11:05:38,065 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:38,161 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 5200
2026-03-29 11:05:38,205 [root] DEBUG: Loader: Injecting process 5128 (thread 2220) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:38,205 [lib.api.process] INFO: Monitor config for <Process 5200 SearchApp.exe>: C:\ltb6yatm\dll\5200.ini
2026-03-29 11:05:38,299 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:38,315 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:38,330 [lib.api.process] INFO: Injected into 64-bit <Process 5128 dllhost.exe>
2026-03-29 11:05:38,362 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 5128
2026-03-29 11:05:38,362 [lib.api.process] INFO: Monitor config for <Process 5128 dllhost.exe>: C:\ltb6yatm\dll\5128.ini
2026-03-29 11:05:38,658 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:38,721 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82BC0000, size: 0x4000.
2026-03-29 11:05:38,768 [root] DEBUG: Loader: Injecting process 5128 (thread 2220) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:38,783 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:38,799 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:38,830 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:38,861 [lib.api.process] INFO: Injected into 64-bit <Process 5128 dllhost.exe>
2026-03-29 11:05:39,033 [root] DEBUG: 5128: Python path set to 'C:\Python310'.
2026-03-29 11:05:39,049 [root] DEBUG: 5128: Dropped file limit defaulting to 100.
2026-03-29 11:05:39,080 [root] DEBUG: 5128: Disabling sleep skipping.
2026-03-29 11:05:39,096 [root] DEBUG: 5128: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:05:39,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8810000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP (0x2f4000 bytes).
2026-03-29 11:05:39,143 [root] DEBUG: 5128: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:05:39,236 [root] DEBUG: 5128: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:05:39,299 [root] DEBUG: 5128: Monitor initialised: 64-bit capemon loaded in process 5128 at 0x00007FFEABE00000, thread 2220, image base 0x00007FF6F2810000, stack from 0x0000001AFE0F4000-0x0000001AFE100000
2026-03-29 11:05:39,471 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:39,815 [root] DEBUG: 5128: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-03-29 11:05:40,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:40,252 [root] DEBUG: 5128: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:05:40,580 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8650000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.PlatformSdk (0x1bc000 bytes).
2026-03-29 11:05:40,783 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:41,002 [root] DEBUG: 6628: NtTerminateProcess hook: Attempting to dump process 6628
2026-03-29 11:05:41,049 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:05:41,111 [root] DEBUG: 6628: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:05:41,158 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:41,174 [root] DEBUG: 5128: set_hooks: Unable to hook LockResource
2026-03-29 11:05:41,236 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1DB0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Caching.Memory (0x16000 bytes).
2026-03-29 11:05:41,299 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:41,424 [root] DEBUG: 7340: DLL loaded at 0x00007FFEFB900000: C:\Windows\System32\Wldp (0x30000 bytes).
2026-03-29 11:05:41,533 [root] DEBUG: Loader: Injecting process 3528 (thread 2112) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:41,580 [root] INFO: Process with pid 6628 has terminated
2026-03-29 11:05:41,643 [root] DEBUG: 5128: Hooked 627 out of 628 functions
2026-03-29 11:05:41,674 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1DA0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Caching.Abstractions (0xf000 bytes).
2026-03-29 11:05:41,690 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:41,705 [root] DEBUG: 7340: DLL loaded at 0x00007FFEFA080000: C:\Windows\SYSTEM32\windows.storage (0x795000 bytes).
2026-03-29 11:05:41,737 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:41,768 [root] DEBUG: 5128: Syscall hook installed, syscall logging level 1
2026-03-29 11:05:41,799 [root] INFO: Process with pid 7340 has terminated
2026-03-29 11:05:41,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC660000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\LibNanoAPI.Projection (0x47000 bytes).
2026-03-29 11:05:41,862 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:41,908 [root] DEBUG: 5128: RestoreHeaders: Restored original import table.
2026-03-29 11:05:41,908 [root] DEBUG: 7340: NtTerminateProcess hook: Attempting to dump process 7340
2026-03-29 11:05:41,924 [lib.api.process] INFO: Injected into 64-bit <Process 3528 ShellExperienceHost.exe>
2026-03-29 11:05:41,940 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1D90000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Hosting.Abstractions (0x10000 bytes).
2026-03-29 11:05:41,971 [root] INFO: Loaded monitor into process with pid 5128
2026-03-29 11:05:42,002 [root] DEBUG: 7340: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:05:42,033 [root] DEBUG: 5128: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28117A9, thread 2220).
2026-03-29 11:05:42,111 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 3528
2026-03-29 11:05:42,221 [root] DEBUG: 5128: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:05:42,221 [lib.api.process] INFO: Monitor config for <Process 3528 ShellExperienceHost.exe>: C:\ltb6yatm\dll\3528.ini
2026-03-29 11:05:42,346 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC8E0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.PlatformSdk.Protocol (0x2c000 bytes).
2026-03-29 11:05:42,346 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:42,487 [root] DEBUG: 5128: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:05:42,565 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDBC40000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.YPP.SideChannel (0x45000 bytes).
2026-03-29 11:05:42,721 [root] DEBUG: 5128: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:05:42,768 [root] DEBUG: 5128: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:05:42,786 [root] DEBUG: 5128: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:05:42,893 [root] DEBUG: 5128: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:05:43,018 [root] DEBUG: 5700: DLL loaded at 0x00007FFED85A0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\DotNetty.Transport (0xab000 bytes).
2026-03-29 11:05:43,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:43,330 [root] DEBUG: 5700: DLL loaded at 0x00007FFED84C0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\DotNetty.Common (0xd7000 bytes).
2026-03-29 11:05:43,408 [root] DEBUG: 5128: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 11:05:43,424 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:43,486 [root] DEBUG: 5700: DLL loaded at 0x0000015BF6170000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Continuity (0x6000 bytes).
2026-03-29 11:05:43,533 [root] DEBUG: 5128: DEBUG:Initialized 9 com hooks
2026-03-29 11:05:43,611 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:43,674 [root] DEBUG: 5128: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 11:05:43,752 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDA080000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.DependencyInjection (0x32000 bytes).
2026-03-29 11:05:43,987 [root] DEBUG: 5128: DLL loaded at 0x00007FFEF6AE0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-03-29 11:05:44,158 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82CB0000, size: 0x4000.
2026-03-29 11:05:44,221 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82BC0000.
2026-03-29 11:05:44,268 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:44,315 [root] DEBUG: 5128: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-03-29 11:05:44,361 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:44,502 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:44,580 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:44,674 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:44,768 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:44,799 [root] DEBUG: 5700: DLL loaded at 0x0000019C8DB70000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Threading.ThreadPool (0x8000 bytes).
2026-03-29 11:05:44,986 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:45,065 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:45,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFB470000: C:\Windows\SYSTEM32\logoncli (0x43000 bytes).
2026-03-29 11:05:45,330 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:45,565 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:45,736 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82D20000, size: 0x4000.
2026-03-29 11:05:45,846 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:45,893 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:46,174 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFB070000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-03-29 11:05:46,268 [root] DEBUG: Loader: Injecting process 5200 (thread 2332) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:46,393 [root] DEBUG: 5700: DLL loaded at 0x00007FFED9D00000: C:\Windows\System32\Windows.Management.Workplace (0x40000 bytes).
2026-03-29 11:05:46,424 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:46,549 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:46,612 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6370000: C:\Windows\System32\policymanager (0xa0000 bytes).
2026-03-29 11:05:46,955 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:47,408 [lib.api.process] INFO: Injected into 64-bit <Process 5200 SearchApp.exe>
2026-03-29 11:05:47,440 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:47,549 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6DC0000: C:\Windows\SYSTEM32\AppxDeploymentClient (0xf7000 bytes).
2026-03-29 11:05:47,643 [root] INFO: Process with pid 5200 has terminated
2026-03-29 11:05:48,033 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:48,174 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6DC0000: C:\Windows\SYSTEM32\AppxDeploymentClient (0xf7000 bytes).
2026-03-29 11:05:48,283 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4240: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:05:48,424 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:48,518 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4240
2026-03-29 11:05:48,721 [lib.api.process] INFO: Monitor config for <Process 4240 SearchApp.exe>: C:\ltb6yatm\dll\4240.ini
2026-03-29 11:05:49,361 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:49,471 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF6DC0000: C:\Windows\SYSTEM32\AppxDeploymentClient (0xf7000 bytes).
2026-03-29 11:05:49,643 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:49,815 [root] INFO: Process with pid 5128 has terminated
2026-03-29 11:05:50,002 [root] DEBUG: 5128: NtTerminateProcess hook: Attempting to dump process 5128
2026-03-29 11:05:50,065 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:50,158 [root] DEBUG: 5128: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:05:50,205 [root] DEBUG: 5700: DLL loaded at 0x0000019C95B90000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.Lightweight (0x8000 bytes).
2026-03-29 11:05:50,268 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:50,361 [root] DEBUG: 5700: DLL loaded at 0x0000019C95BC0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Reflection.Emit.ILGeneration (0x8000 bytes).
2026-03-29 11:05:50,471 [root] DEBUG: 5700: DLL loaded at 0x0000019C95BD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Reflection.Primitives (0x8000 bytes).
2026-03-29 11:05:50,596 [root] DEBUG: Loader: Injecting process 3528 (thread 2112) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:50,736 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF1D80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Web.HttpUtility (0xd000 bytes).
2026-03-29 11:05:50,861 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:50,971 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC6D0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Collections.Specialized (0x17000 bytes).
2026-03-29 11:05:51,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82CB0000.
2026-03-29 11:05:51,096 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:51,190 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82D20000.
2026-03-29 11:05:51,221 [lib.api.process] INFO: Injected into 64-bit <Process 3528 ShellExperienceHost.exe>
2026-03-29 11:05:51,283 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:51,330 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 3528
2026-03-29 11:05:51,424 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC640000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Win32.SystemEvents (0x17000 bytes).
2026-03-29 11:05:51,440 [lib.api.process] INFO: Monitor config for <Process 3528 ShellExperienceHost.exe>: C:\ltb6yatm\dll\3528.ini
2026-03-29 11:05:51,549 [root] DEBUG: 5700: DLL loaded at 0x0000019C95B80000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Threading.Thread (0x8000 bytes).
2026-03-29 11:05:51,705 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:51,752 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFE6C0000: C:\Windows\System32\MSCTF (0x115000 bytes).
2026-03-29 11:05:51,924 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF1C0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ComponentModel.EventBasedAsync (0x9000 bytes).
2026-03-29 11:05:52,096 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:52,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:52,518 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:52,877 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:53,002 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82DD0000, size: 0x4000.
2026-03-29 11:05:53,033 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:53,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:53,143 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC5B0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Win32.Registry (0x1b000 bytes).
2026-03-29 11:05:53,236 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81CA0000.
2026-03-29 11:05:54,065 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:54,236 [root] DEBUG: 5700: DLL loaded at 0x00007FFED83A0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhoneAppProxy.Core (0x11c000 bytes).
2026-03-29 11:05:54,440 [root] DEBUG: 5700: DLL loaded at 0x00007FFED8360000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhoneAppProxy.Telemetry (0x3e000 bytes).
2026-03-29 11:05:54,487 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:54,565 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:54,752 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF160000: C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.33728.0_x64__8wekyb3d8bbwe\MSVCP140_1 (0x9000 bytes).
2026-03-29 11:05:54,815 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFB850000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-03-29 11:05:54,971 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7C40000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\LibNanoAPI (0x714000 bytes).
2026-03-29 11:05:54,986 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82DD0000.
2026-03-29 11:05:55,049 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82E80000, size: 0x4000.
2026-03-29 11:05:55,065 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:55,221 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:55,330 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:55,426 [root] DEBUG: Loader: Injecting process 4240 (thread 2252) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:55,815 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:05:56,440 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:56,705 [lib.api.process] INFO: Injected into 64-bit <Process 4240 SearchApp.exe>
2026-03-29 11:05:56,783 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4240
2026-03-29 11:05:56,799 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:56,815 [lib.api.process] INFO: Monitor config for <Process 4240 SearchApp.exe>: C:\ltb6yatm\dll\4240.ini
2026-03-29 11:05:56,861 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE81D40000.
2026-03-29 11:05:57,002 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEF0A0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.DriveInfo (0xb000 bytes).
2026-03-29 11:05:57,127 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDC4F0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.IO.FileSystem.Watcher (0x13000 bytes).
2026-03-29 11:05:57,237 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFB900000: C:\Windows\System32\Wldp (0x30000 bytes).
2026-03-29 11:05:57,254 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFA080000: C:\Windows\SYSTEM32\windows.storage (0x795000 bytes).
2026-03-29 11:05:57,518 [root] DEBUG: 5700: DLL loaded at 0x00007FFEDF9D0000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-03-29 11:05:57,643 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82EA0000, size: 0x1000.
2026-03-29 11:05:57,846 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:58,080 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:58,252 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:58,424 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:58,596 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:59,065 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:59,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:59,471 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:59,627 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:05:59,658 [root] DEBUG: 5700: DumpPEsInRange: Scanning range 0x00007FFE82EA0000 - 0x00007FFE82EA7F74.
2026-03-29 11:05:59,658 [root] DEBUG: 5700: ScanForDisguisedPE: No PE image located in range 0x00007FFE82EA0000-0x00007FFE82EA7F74.
2026-03-29 11:05:59,690 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:05:59,705 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\5700_6574870595829032026 to CAPE\b60d82206d432c706afe79dd7ddb63577cd1926b7b96fe4dc522e18c5401728a; Size is 32800; Max size: 100000000
2026-03-29 11:05:59,736 [root] DEBUG: Loader: Injecting process 3528 (thread 2112) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:59,783 [root] DEBUG: 5700: DumpMemory: Payload successfully created: C:\atsPQMC\CAPE\5700_6574870595829032026 (size 32800 bytes)
2026-03-29 11:05:59,830 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:05:59,861 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE82F60000, size: 0x4000.
2026-03-29 11:05:59,924 [root] DEBUG: 5700: DumpRegion: Dumped entire allocation from 0x00007FFE82EA0000, size 36864 bytes.
2026-03-29 11:05:59,943 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:05:59,955 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:05:59,986 [lib.api.process] INFO: Injected into 64-bit <Process 3528 ShellExperienceHost.exe>
2026-03-29 11:06:00,018 [root] DEBUG: 5700: ProcessTrackedRegion: Dumped region at 0x00007FFE82EA0000.
2026-03-29 11:06:00,315 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:00,346 [root] DEBUG: 5700: YaraScan: Scanning 0x00007FFE82EA0000, size 0x7f74
2026-03-29 11:06:00,377 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:00,752 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7C10000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Rest.ClientRuntime (0x2e000 bytes).
2026-03-29 11:06:00,877 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7BD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Net.Primitives (0x35000 bytes).
2026-03-29 11:06:00,893 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:00,955 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7B70000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Net.Requests (0x5b000 bytes).
2026-03-29 11:06:01,033 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7AD0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Polly.Core (0x94000 bytes).
2026-03-29 11:06:01,065 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:01,549 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:01,690 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:01,705 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:01,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:02,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:02,127 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7A20000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Net.Security (0xa3000 bytes).
2026-03-29 11:06:02,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:02,424 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7920000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Text.RegularExpressions (0xf7000 bytes).
2026-03-29 11:06:02,486 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82F60000.
2026-03-29 11:06:02,533 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:02,596 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:02,643 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7760000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Newtonsoft.Json (0x1b8000 bytes).
2026-03-29 11:06:02,690 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:02,784 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:03,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82E80000.
2026-03-29 11:06:03,393 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:03,549 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE83050000, size: 0x4000.
2026-03-29 11:06:03,596 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:06:03,705 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:03,877 [root] DEBUG: 5700: DLL loaded at 0x00007FFEF9CA0000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-03-29 11:06:03,893 [root] DEBUG: 5700: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:06:03,908 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7720000: C:\Windows\System32\Windows.Energy (0x37000 bytes).
2026-03-29 11:06:04,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,205 [root] DEBUG: 5700: DLL loaded at 0x00007FFEFBC50000: C:\Windows\SYSTEM32\WINSTA (0x5a000 bytes).
2026-03-29 11:06:04,236 [root] DEBUG: 5700: DLL loaded at 0x00007FFED9CE0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Threading.Channels (0x20000 bytes).
2026-03-29 11:06:04,299 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,315 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,346 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,393 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,408 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE83050000.
2026-03-29 11:06:04,424 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,565 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,768 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,877 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:04,893 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,955 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:04,986 [root] DEBUG: Loader: Injecting process 4240 (thread 2252) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:05,002 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEE870000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Internal.Diagnostics (0xb000 bytes).
2026-03-29 11:06:05,096 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:05,127 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:05,190 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE83100000, size: 0x4000.
2026-03-29 11:06:05,221 [lib.api.process] INFO: Injected into 64-bit <Process 4240 SearchApp.exe>
2026-03-29 11:06:05,236 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:06:05,252 [root] INFO: Process with pid 4240 has terminated
2026-03-29 11:06:05,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:05,518 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:05,674 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:05,877 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:05,924 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 1152: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:06:06,018 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE83100000.
2026-03-29 11:06:06,049 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1152
2026-03-29 11:06:06,065 [lib.api.process] INFO: Monitor config for <Process 1152 SearchApp.exe>: C:\ltb6yatm\dll\1152.ini
2026-03-29 11:06:06,080 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:06,174 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:06,268 [root] DEBUG: 5700: DumpPEsInRange: Scanning range 0x00007FFE823C0000 - 0x00007FFE823C0B6A.
2026-03-29 11:06:06,283 [root] DEBUG: 5700: ScanForDisguisedPE: No PE image located in range 0x00007FFE823C0000-0x00007FFE823C0B6A.
2026-03-29 11:06:06,393 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\5700_804967866829032026 to CAPE\e4938ffd42d629f671519a80631ba17f3e175559ac80043ca72f51c18496ba48; Size is 2922; Max size: 100000000
2026-03-29 11:06:06,471 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE83160000, size: 0x4000.
2026-03-29 11:06:06,565 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:06:06,580 [root] DEBUG: 5700: DumpMemory: Payload successfully created: C:\atsPQMC\CAPE\5700_804967866829032026 (size 2922 bytes)
2026-03-29 11:06:06,596 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE83160000.
2026-03-29 11:06:06,611 [root] DEBUG: 5700: DumpRegion: Dumped entire allocation from 0x00007FFE823C0000, size 4096 bytes.
2026-03-29 11:06:06,658 [root] DEBUG: 5700: ProcessTrackedRegion: Dumped region at 0x00007FFE823C0000.
2026-03-29 11:06:06,737 [root] DEBUG: 5700: YaraScan: Scanning 0x00007FFE823C0000, size 0xb6a
2026-03-29 11:06:06,799 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7330000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Text.Encodings.Web (0x1e000 bytes).
2026-03-29 11:06:06,955 [root] DEBUG: 5700: DLL loaded at 0x0000019C95FC0000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Text.Encoding.Extensions (0x8000 bytes).
2026-03-29 11:06:07,002 [root] DEBUG: 5700: DLL loaded at 0x0000019C96230000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.Runtime.Intrinsics (0x8000 bytes).
2026-03-29 11:06:07,096 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 2684: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF76BCF0000
2026-03-29 11:06:07,112 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE83190000, size: 0x4000.
2026-03-29 11:06:07,127 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 2684
2026-03-29 11:06:07,143 [lib.api.process] INFO: Monitor config for <Process 2684 ShellExperienceHost.exe>: C:\ltb6yatm\dll\2684.ini
2026-03-29 11:06:07,143 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:06:07,315 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEE3E0000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-03-29 11:06:07,346 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7260000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.ScreenMirroring.WinRT (0xcb000 bytes).
2026-03-29 11:06:07,486 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:07,596 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7240000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Extensions.Primitives (0x12000 bytes).
2026-03-29 11:06:07,674 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:07,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE823C0000.
2026-03-29 11:06:08,205 [root] DEBUG: 5700: AllocationHandler: Adding allocation to tracked region list: 0x00007FFE831C0000, size: 0x4000.
2026-03-29 11:06:08,252 [root] DEBUG: 5700: AddTrackedRegion: GetEntropy failed.
2026-03-29 11:06:08,408 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7180000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ComponentModel.TypeConverter (0xba000 bytes).
2026-03-29 11:06:08,643 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7160000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\System.ComponentModel.Primitives (0x11000 bytes).
2026-03-29 11:06:08,815 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:08,986 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:09,721 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:09,830 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:09,987 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:10,158 [root] DEBUG: 5700: DLL loaded at 0x00007FFED7100000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\Microsoft.Windows.Widgets.Projection (0x5b000 bytes).
2026-03-29 11:06:10,190 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:10,299 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:10,643 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:10,877 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:10,924 [root] DEBUG: Loader: Injecting process 1152 (thread 5500) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:11,036 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:11,130 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:11,315 [lib.api.process] INFO: Injected into 64-bit <Process 1152 SearchApp.exe>
2026-03-29 11:06:11,379 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1152
2026-03-29 11:06:11,424 [lib.api.process] INFO: Monitor config for <Process 1152 SearchApp.exe>: C:\ltb6yatm\dll\1152.ini
2026-03-29 11:06:11,486 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:11,799 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:12,111 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE83190000.
2026-03-29 11:06:12,299 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:12,486 [root] DEBUG: 5700: DLL loaded at 0x00007FFEEE840000: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.25072.79.0_x64__8wekyb3d8bbwe\YourPhone.Contracts.Background.ProxyStub (0x9000 bytes).
2026-03-29 11:06:12,627 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:12,783 [root] DEBUG: Loader: Injecting process 2684 (thread 3496) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:12,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:13,080 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:13,221 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:13,440 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:13,580 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:13,736 [lib.api.process] INFO: Injected into 64-bit <Process 2684 ShellExperienceHost.exe>
2026-03-29 11:06:13,861 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:13,986 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 2684
2026-03-29 11:06:14,002 [lib.api.process] INFO: Monitor config for <Process 2684 ShellExperienceHost.exe>: C:\ltb6yatm\dll\2684.ini
2026-03-29 11:06:14,099 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:14,299 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:14,440 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:14,533 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:14,580 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:14,815 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:15,143 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:15,252 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:15,393 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:15,471 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:15,815 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:16,221 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:16,752 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:17,268 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:17,596 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:17,846 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:17,987 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:18,580 [root] DEBUG: Loader: Injecting process 1152 (thread 5500) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:18,705 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:18,909 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:19,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:19,315 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:19,486 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:19,690 [lib.api.process] INFO: Injected into 64-bit <Process 1152 SearchApp.exe>
2026-03-29 11:06:19,783 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:20,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:20,111 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1152
2026-03-29 11:06:20,330 [lib.api.process] INFO: Monitor config for <Process 1152 SearchApp.exe>: C:\ltb6yatm\dll\1152.ini
2026-03-29 11:06:20,393 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:20,518 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:20,861 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:20,924 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:21,158 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:21,205 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:21,330 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:21,518 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:21,533 [root] DEBUG: Loader: Injecting process 2684 (thread 3496) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:21,643 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:21,658 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:21,783 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:21,862 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:21,893 [lib.api.process] INFO: Injected into 64-bit <Process 2684 ShellExperienceHost.exe>
2026-03-29 11:06:21,955 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 2684
2026-03-29 11:06:21,971 [root] DEBUG: 5700: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5000
2026-03-29 11:06:21,987 [lib.api.process] INFO: Monitor config for <Process 2684 ShellExperienceHost.exe>: C:\ltb6yatm\dll\2684.ini
2026-03-29 11:06:22,002 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,080 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,252 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,487 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,721 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,768 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,815 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,877 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:22,987 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:23,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:23,158 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:23,330 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:23,440 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:23,486 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE831C0000.
2026-03-29 11:06:23,565 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:23,862 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:24,049 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:24,080 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:24,205 [root] DEBUG: 5700: AllocationHandler: Allocation already in tracked region list: 0x00007FFE82EA0000.
2026-03-29 11:06:27,940 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:28,018 [root] DEBUG: Loader: Injecting process 1152 (thread 5500) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:28,049 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:06:28,143 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:28,174 [lib.api.process] INFO: Injected into 64-bit <Process 1152 SearchApp.exe>
2026-03-29 11:06:28,237 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:28,330 [root] DEBUG: Loader: Injecting process 2684 (thread 3496) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:28,346 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 1988: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:06:28,346 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1988
2026-03-29 11:06:28,346 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:06:28,361 [lib.api.process] INFO: Monitor config for <Process 1988 SearchApp.exe>: C:\ltb6yatm\dll\1988.ini
2026-03-29 11:06:28,377 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:28,408 [lib.api.process] INFO: Injected into 64-bit <Process 2684 ShellExperienceHost.exe>
2026-03-29 11:06:31,018 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3300: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 11:06:31,128 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 3300
2026-03-29 11:06:31,159 [lib.api.process] INFO: Monitor config for <Process 3300 dllhost.exe>: C:\ltb6yatm\dll\3300.ini
2026-03-29 11:06:31,189 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:31,314 [root] DEBUG: Loader: Injecting process 3300 (thread 5576) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:31,424 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:31,487 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:31,596 [lib.api.process] INFO: Injected into 64-bit <Process 3300 dllhost.exe>
2026-03-29 11:06:31,612 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 3300
2026-03-29 11:06:31,627 [lib.api.process] INFO: Monitor config for <Process 3300 dllhost.exe>: C:\ltb6yatm\dll\3300.ini
2026-03-29 11:06:31,674 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:31,783 [root] DEBUG: Loader: Injecting process 3300 (thread 5576) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:31,893 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:31,908 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:31,924 [lib.api.process] INFO: Injected into 64-bit <Process 3300 dllhost.exe>
2026-03-29 11:06:31,986 [root] DEBUG: 3300: Python path set to 'C:\Python310'.
2026-03-29 11:06:32,002 [root] DEBUG: 3300: Dropped file limit defaulting to 100.
2026-03-29 11:06:32,018 [root] DEBUG: 3300: Disabling sleep skipping.
2026-03-29 11:06:32,065 [root] DEBUG: 3300: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:06:32,143 [root] DEBUG: 3300: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:06:32,283 [root] DEBUG: 3300: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:06:32,361 [root] DEBUG: 3300: Monitor initialised: 64-bit capemon loaded in process 3300 at 0x00007FFEABE00000, thread 5576, image base 0x00007FF6F2810000, stack from 0x000000B3E4EF4000-0x000000B3E4F00000
2026-03-29 11:06:32,455 [root] DEBUG: 3300: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-03-29 11:06:32,533 [root] DEBUG: 3300: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:06:32,627 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:06:32,893 [root] DEBUG: 3300: set_hooks: Unable to hook LockResource
2026-03-29 11:06:33,018 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:33,299 [root] DEBUG: 3300: Hooked 627 out of 628 functions
2026-03-29 11:06:33,486 [root] DEBUG: Loader: Injecting process 1988 (thread 5200) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:33,518 [root] DEBUG: 3300: Syscall hook installed, syscall logging level 1
2026-03-29 11:06:33,565 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:33,658 [root] DEBUG: 3300: RestoreHeaders: Restored original import table.
2026-03-29 11:06:33,752 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:33,830 [root] INFO: Loaded monitor into process with pid 3300
2026-03-29 11:06:33,846 [lib.api.process] INFO: Injected into 64-bit <Process 1988 SearchApp.exe>
2026-03-29 11:06:33,955 [root] DEBUG: 3300: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28117A9, thread 5576).
2026-03-29 11:06:33,987 [root] DEBUG: 3300: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:06:33,987 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1988
2026-03-29 11:06:34,112 [root] DEBUG: 3300: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:06:34,112 [lib.api.process] INFO: Monitor config for <Process 1988 SearchApp.exe>: C:\ltb6yatm\dll\1988.ini
2026-03-29 11:06:34,158 [root] DEBUG: 3300: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:06:34,205 [root] DEBUG: 3300: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:06:34,299 [root] DEBUG: 3300: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:06:34,365 [root] DEBUG: 3300: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:06:34,940 [root] DEBUG: 3300: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 11:06:35,190 [root] DEBUG: 3300: DEBUG:Initialized 9 com hooks
2026-03-29 11:06:35,455 [root] DEBUG: 3300: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 11:06:35,580 [root] DEBUG: 3300: DLL loaded at 0x00007FFEF6AE0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-03-29 11:06:35,799 [root] DEBUG: 3300: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-03-29 11:06:41,283 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:41,643 [root] INFO: Process with pid 3300 has terminated
2026-03-29 11:06:41,721 [root] DEBUG: Loader: Injecting process 1988 (thread 5200) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:41,864 [root] DEBUG: 3300: NtTerminateProcess hook: Attempting to dump process 3300
2026-03-29 11:06:42,002 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:42,065 [root] DEBUG: 3300: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:06:42,111 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:42,269 [lib.api.process] INFO: Injected into 64-bit <Process 1988 SearchApp.exe>
2026-03-29 11:06:42,330 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 1988
2026-03-29 11:06:42,377 [lib.api.process] INFO: Monitor config for <Process 1988 SearchApp.exe>: C:\ltb6yatm\dll\1988.ini
2026-03-29 11:06:49,908 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:50,065 [root] DEBUG: Loader: Injecting process 1988 (thread 5200) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:50,111 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-03-29 11:06:50,190 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:50,205 [lib.api.process] INFO: Injected into 64-bit <Process 1988 SearchApp.exe>
2026-03-29 11:06:50,424 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 6232: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:06:50,455 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6232
2026-03-29 11:06:50,486 [lib.api.process] INFO: Monitor config for <Process 6232 SearchApp.exe>: C:\ltb6yatm\dll\6232.ini
2026-03-29 11:06:56,705 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:06:57,018 [root] DEBUG: Loader: Injecting process 6232 (thread 4072) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:57,143 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:06:57,393 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:06:57,471 [lib.api.process] INFO: Injected into 64-bit <Process 6232 SearchApp.exe>
2026-03-29 11:06:57,705 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 6232
2026-03-29 11:06:57,737 [lib.api.process] INFO: Monitor config for <Process 6232 SearchApp.exe>: C:\ltb6yatm\dll\6232.ini
2026-03-29 11:07:01,111 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5836: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F2810000
2026-03-29 11:07:01,330 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 5836
2026-03-29 11:07:01,346 [lib.api.process] INFO: Monitor config for <Process 5836 dllhost.exe>: C:\ltb6yatm\dll\5836.ini
2026-03-29 11:07:01,924 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:07:02,330 [root] DEBUG: Loader: Injecting process 5836 (thread 6100) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:02,549 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:07:02,893 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:03,190 [lib.api.process] INFO: Injected into 64-bit <Process 5836 dllhost.exe>
2026-03-29 11:07:03,455 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 5836
2026-03-29 11:07:03,533 [lib.api.process] INFO: Monitor config for <Process 5836 dllhost.exe>: C:\ltb6yatm\dll\5836.ini
2026-03-29 11:07:03,861 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:07:04,112 [root] DEBUG: Loader: Injecting process 5836 (thread 6100) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:04,346 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:07:04,565 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:04,799 [lib.api.process] INFO: Injected into 64-bit <Process 5836 dllhost.exe>
2026-03-29 11:07:05,033 [root] DEBUG: 5836: Python path set to 'C:\Python310'.
2026-03-29 11:07:05,268 [root] DEBUG: 5836: Dropped file limit defaulting to 100.
2026-03-29 11:07:05,424 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:07:05,658 [root] DEBUG: 5836: Disabling sleep skipping.
2026-03-29 11:07:05,846 [root] DEBUG: Loader: Injecting process 6232 (thread 4072) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:06,049 [root] DEBUG: 5836: YaraInit: Compiled rules loaded from existing file C:\ltb6yatm\data\yara\capemon.yac
2026-03-29 11:07:06,143 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:07:06,268 [root] DEBUG: 5836: RtlInsertInvertedFunctionTable 0x00007FFEFE86090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEFE9BD500
2026-03-29 11:07:06,377 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:06,518 [lib.api.process] INFO: Injected into 64-bit <Process 6232 SearchApp.exe>
2026-03-29 11:07:06,518 [root] DEBUG: 5836: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:07:06,674 [root] DEBUG: 5836: Monitor initialised: 64-bit capemon loaded in process 5836 at 0x00007FFEABE00000, thread 6100, image base 0x00007FF6F2810000, stack from 0x000000DE5CFA4000-0x000000DE5CFB0000
2026-03-29 11:07:06,690 [root] DEBUG: 5836: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-03-29 11:07:06,736 [root] DEBUG: 5836: hook_api: LdrpCallInitRoutine export address 0x00007FFEFE8699BC obtained via GetFunctionAddress
2026-03-29 11:07:07,033 [root] WARNING: b'Unable to place hook on LockResource'
2026-03-29 11:07:07,049 [root] DEBUG: 5836: set_hooks: Unable to hook LockResource
2026-03-29 11:07:07,143 [root] DEBUG: 5836: Hooked 627 out of 628 functions
2026-03-29 11:07:07,221 [root] DEBUG: 5836: Syscall hook installed, syscall logging level 1
2026-03-29 11:07:07,236 [root] DEBUG: 5836: RestoreHeaders: Restored original import table.
2026-03-29 11:07:07,252 [root] INFO: Loaded monitor into process with pid 5836
2026-03-29 11:07:07,283 [root] DEBUG: 5836: caller_dispatch: Added region at 0x00007FF6F2810000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F28117A9, thread 6100).
2026-03-29 11:07:07,377 [root] DEBUG: 5836: YaraScan: Scanning 0x00007FF6F2810000, size 0x8026
2026-03-29 11:07:07,471 [root] DEBUG: 5836: ProcessImageBase: Main module image at 0x00007FF6F2810000 unmodified (entropy change 0.000000e+00)
2026-03-29 11:07:07,565 [root] DEBUG: 5836: set_hooks_by_export_directory: Hooked 0 out of 628 functions
2026-03-29 11:07:07,596 [root] INFO: Process with pid 6232 has terminated
2026-03-29 11:07:07,627 [root] DEBUG: 5836: DLL loaded at 0x00007FFEF9E80000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-03-29 11:07:07,658 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4268: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:07:07,705 [root] DEBUG: 5836: DLL loaded at 0x00007FFEFC380000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-03-29 11:07:07,736 [root] INFO: Announced 64-bit process name: SearchApp.exe pid: 4268
2026-03-29 11:07:07,736 [lib.api.process] INFO: Monitor config for <Process 4268 SearchApp.exe>: C:\ltb6yatm\dll\4268.ini
2026-03-29 11:07:07,784 [root] DEBUG: 5836: DLL loaded at 0x00007FFEFCC00000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-03-29 11:07:07,908 [root] DEBUG: 5836: DLL loaded at 0x00007FFEF9980000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-03-29 11:07:08,002 [root] DEBUG: 5836: DEBUG:Initialized 9 com hooks
2026-03-29 11:07:08,174 [root] DEBUG: 5836: DLL loaded at 0x00007FFEFE330000: C:\Windows\System32\shcore (0xad000 bytes).
2026-03-29 11:07:08,190 [root] DEBUG: 5836: DLL loaded at 0x00007FFEF6AE0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-03-29 11:07:08,268 [root] DEBUG: 5836: DLL loaded at 0x00007FFEF6F00000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-03-29 11:07:11,971 [root] INFO: Analysis timeout hit, terminating analysis
2026-03-29 11:07:11,987 [lib.api.process] INFO: Terminate event set for <Process 752 svchost.exe>
2026-03-29 11:07:11,987 [root] DEBUG: 752: Terminate Event: Attempting to dump process 752
2026-03-29 11:07:12,002 [root] DEBUG: 752: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:12,096 [root] INFO: Added new file to list with pid 752 and path C:\ProgramData\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\S-1-5-21-3749840076-4109591986-3192690632-1000\SystemAppData\Helium\Cache\5d5984b6671e7683.dat
2026-03-29 11:07:12,111 [lib.api.process] INFO: Termination confirmed for <Process 752 svchost.exe>
2026-03-29 11:07:12,127 [root] DEBUG: 752: Terminate Event: monitor shutdown complete for process 752
2026-03-29 11:07:12,127 [root] INFO: Terminate event set for process 752
2026-03-29 11:07:12,190 [root] DEBUG: 3792: Terminate Event: Attempting to dump process 3792
2026-03-29 11:07:12,190 [lib.api.process] INFO: Terminate event set for <Process 3792 explorer.exe>
2026-03-29 11:07:12,205 [root] DEBUG: 3792: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:12,283 [root] INFO: Added new file to list with pid 3792 and path C:\Users\cape\AppData\Local\Microsoft\Windows\INetCache\IE\NBR01339\TMP[1].TMP
2026-03-29 11:07:12,299 [lib.api.process] INFO: Termination confirmed for <Process 3792 explorer.exe>
2026-03-29 11:07:12,299 [root] DEBUG: 3792: Terminate Event: monitor shutdown complete for process 3792
2026-03-29 11:07:12,299 [root] INFO: Terminate event set for process 3792
2026-03-29 11:07:12,315 [root] DEBUG: 5744: Terminate Event: Attempting to dump process 5744
2026-03-29 11:07:12,330 [root] DEBUG: 5744: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:12,330 [lib.api.process] INFO: Terminate event set for <Process 5744 svchost.exe>
2026-03-29 11:07:12,361 [root] DEBUG: 5744: Terminate Event: monitor shutdown complete for process 5744
2026-03-29 11:07:13,658 [root] INFO: Process with pid 5836 has terminated
2026-03-29 11:07:13,736 [root] DEBUG: 5836: NtTerminateProcess hook: Attempting to dump process 5836
2026-03-29 11:07:13,768 [root] DEBUG: 5836: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:13,877 [lib.api.process] INFO: 64-bit DLL to inject is C:\ltb6yatm\dll\xzHEKGQ.dll, loader C:\ltb6yatm\bin\FktMnuSd.exe
2026-03-29 11:07:13,924 [root] DEBUG: Loader: Injecting process 4268 (thread 2912) with C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:13,986 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-03-29 11:07:14,018 [root] DEBUG: Successfully injected DLL C:\ltb6yatm\dll\xzHEKGQ.dll.
2026-03-29 11:07:14,049 [lib.api.process] INFO: Injected into 64-bit <Process 4268 SearchApp.exe>
2026-03-29 11:07:14,158 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 7644: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:07:15,205 [root] INFO: Process with pid 7644 has terminated
2026-03-29 11:07:15,690 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 1004: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF63B3C0000
2026-03-29 11:07:17,283 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 1168: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe, ImageBase: 0x00007FF73AD60000
2026-03-29 11:07:17,393 [lib.api.process] INFO: Termination confirmed for <Process 5744 svchost.exe>
2026-03-29 11:07:17,596 [root] INFO: Terminate event set for process 5744
2026-03-29 11:07:17,674 [lib.api.process] INFO: Terminate event set for <Process 5988 WmiPrvSE.exe>
2026-03-29 11:07:17,737 [root] DEBUG: 5988: Terminate Event: Attempting to dump process 5988
2026-03-29 11:07:17,955 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 5536: C:\Windows\System32\RuntimeBroker.exe, ImageBase: 0x00007FF621170000
2026-03-29 11:07:18,080 [root] DEBUG: 5988: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:18,236 [lib.api.process] INFO: Termination confirmed for <Process 5988 WmiPrvSE.exe>
2026-03-29 11:07:18,283 [root] INFO: Terminate event set for process 5988
2026-03-29 11:07:18,362 [lib.api.process] INFO: Terminate event set for <Process 5700 PhoneExperienceHost.exe>
2026-03-29 11:07:18,330 [root] DEBUG: 5988: Terminate Event: monitor shutdown complete for process 5988
2026-03-29 11:07:18,518 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 2788: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF76BCF0000
2026-03-29 11:07:18,643 [root] DEBUG: 5700: Terminate Event: Attempting to dump process 5700
2026-03-29 11:07:19,080 [root] DEBUG: 5700: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:19,346 [root] DEBUG: 5700: DumpPEsInRange: Scanning range 0x00007FFE831C0000 - 0x00007FFE831CC3EE.
2026-03-29 11:07:19,486 [root] DEBUG: 5700: ScanForDisguisedPE: No PE image located in range 0x00007FFE831C0000-0x00007FFE831CC3EE.
2026-03-29 11:07:19,658 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 7628: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 11:07:19,799 [lib.common.results] INFO: Uploading file C:\atsPQMC\CAPE\5700_21853197829032026 to CAPE\eb2a15843ed54fd447e9070066d2bbc46b484799018c2589529c9d591bb822dd; Size is 50158; Max size: 100000000
2026-03-29 11:07:20,502 [root] DEBUG: 5700: DumpMemory: Payload successfully created: C:\atsPQMC\CAPE\5700_21853197829032026 (size 50158 bytes)
2026-03-29 11:07:21,049 [root] DEBUG: 5700: DumpRegion: Dumped entire allocation from 0x00007FFE831C0000, size 65536 bytes.
2026-03-29 11:07:21,424 [root] DEBUG: 5700: ProcessTrackedRegion: Dumped region at 0x00007FFE831C0000.
2026-03-29 11:07:21,936 [root] DEBUG: 5700: YaraScan: Scanning 0x00007FFE831C0000, size 0xc3ee
2026-03-29 11:07:22,209 [lib.api.process] INFO: Termination confirmed for <Process 5700 PhoneExperienceHost.exe>
2026-03-29 11:07:22,430 [root] DEBUG: 5700: Terminate Event: monitor shutdown complete for process 5700
2026-03-29 11:07:22,441 [root] INFO: Terminate event set for process 5700
2026-03-29 11:07:23,085 [lib.api.process] INFO: Terminate event set for <Process 804 smartscreen.exe>
2026-03-29 11:07:23,252 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 3308: C:\Windows\System32\RuntimeBroker.exe, ImageBase: 0x00007FF621170000
2026-03-29 11:07:23,664 [root] DEBUG: 804: Terminate Event: Attempting to dump process 804
2026-03-29 11:07:24,418 [root] DEBUG: 804: DoProcessDump: Skipping process dump as code is identical on disk.
2026-03-29 11:07:24,593 [lib.api.process] INFO: Termination confirmed for <Process 804 smartscreen.exe>
2026-03-29 11:07:24,927 [root] INFO: Terminate event set for process 804
2026-03-29 11:07:24,994 [root] INFO: Created shutdown mutex
2026-03-29 11:07:25,062 [root] DEBUG: 804: Terminate Event: monitor shutdown complete for process 804
2026-03-29 11:07:26,256 [root] INFO: Shutting down package
2026-03-29 11:07:26,422 [root] INFO: Stopping auxiliary modules
2026-03-29 11:07:26,657 [root] INFO: Stopping auxiliary module: Browser
2026-03-29 11:07:26,783 [root] INFO: Stopping auxiliary module: Human
2026-03-29 11:07:28,667 [root] INFO: Stopping auxiliary module: Screenshots
2026-03-29 11:07:29,762 [root] DEBUG: 752: CreateProcessHandler: Injection info set for new process 4564: C:\Windows\system32\BackgroundTaskHost.exe, ImageBase: 0x00007FF785FC0000
2026-03-29 11:07:29,818 [root] INFO: Finishing auxiliary modules
2026-03-29 11:07:29,954 [root] INFO: Shutting down pipe server and dumping dropped files
2026-03-29 11:07:30,143 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms to files\b044f900caf7f7ed584fc54b10c2839616f27ba3e8230343e3727246e9620597; Size is 7168; Max size: 100000000
2026-03-29 11:07:30,313 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms to files\07aceb40c46fd8c7c36ff46f79c1063a632588fedc69bdc7e61994a91555eda7; Size is 1536; Max size: 100000000
2026-03-29 11:07:30,402 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\dd7c3b1adb1c168b.automaticDestinations-ms to files\0cd140c09353d539f7c813b984afbbbd9717d575362f983bd7d2297b90794858; Size is 3584; Max size: 100000000
2026-03-29 11:07:30,480 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay---.lnk to files\52594ba17b85dd0b3fdd9aecef3b4c22ca5109d5074455edbbecabe3484316c5; Size is 156; Max size: 100000000
2026-03-29 11:07:30,682 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Roaming\Microsoft\Windows\Recent\Интернет.lnk to files\b68e121586ef846dc2be14897087566ac72f6e6339f193609a5fc6f766e5c4aa; Size is 104; Max size: 100000000
2026-03-29 11:07:31,014 [lib.common.results] INFO: Uploading file C:\Windows\INF\netsstpa.PNF to files\d1b2cd3542820901ff3f793c5d09a52bd9bf08e70171d16f3930f9ea26baa602; Size is 6844; Max size: 100000000
2026-03-29 11:07:31,157 [lib.common.results] INFO: Uploading file C:\Windows\INF\netrasa.PNF to files\b7b2a5a948c93326a26a840cc8f66abec8819ba74d167f188a4f4d895b1cff0b; Size is 24020; Max size: 100000000
2026-03-29 11:07:31,317 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db to files\04d6504a9b35221609359ae45c227ea8ea594adda0dc4bbf873a85650558d2b8; Size is 1048576; Max size: 100000000
2026-03-29 11:07:31,496 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db to files\3ef511d0b434711ed41dbe5e2c0ce0b39a5662230a86fc75ae8974a950270756; Size is 29232; Max size: 100000000
2026-03-29 11:07:31,618 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db to files\26d969de4b2497ec25982f2025e5d07b2bddfc3f1168ec0245732a76f10a6558; Size is 14688; Max size: 100000000
2026-03-29 11:07:31,851 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db to files\e1a2084042c7ec58ab9bdf718bb88dad9e31ad651d58a64ec0cf022f18977092; Size is 1048576; Max size: 100000000
2026-03-29 11:07:32,174 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db to files\ac169461ac1a8fad022b90a531e7e92edc6d5425aacecf4f8c7cba4cac4200f6; Size is 1048576; Max size: 100000000
2026-03-29 11:07:32,230 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db to files\d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9; Size is 24; Max size: 100000000
2026-03-29 11:07:32,353 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db to files\ec9db6b40d431b4ff29d975e0be2a8b9767e9a9e642ff8daabb567e312614836; Size is 1048576; Max size: 100000000
2026-03-29 11:07:32,473 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\XboxGamingOverlayTraces_FT_Server_20260329075811.txt to files\be7a8c403ec94c30b37214fa18c60a8f9bef7b8906970c7fd47c9ffcd296563f; Size is 1598; Max size: 100000000
2026-03-29 11:07:32,520 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\GameBar_20260329080232_Sh.etl to files\b25e0586c34feb45d26113fa3f3124db544c22f1007d04c946d067542052148d; Size is 10881; Max size: 100000000
2026-03-29 11:07:32,583 [lib.common.results] INFO: Uploading file C:\Windows\INF\WmiApRpl\WmiApRpl.h to files\ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15; Size is 3444; Max size: 100000000
2026-03-29 11:07:32,614 [lib.common.results] INFO: Uploading file C:\Windows\INF\WmiApRpl\WmiApRpl.ini to files\629c9685ec093edbf08d7954d0a835cca94870732f9898e0eeecdd85171232f2; Size is 49814; Max size: 100000000
2026-03-29 11:07:32,614 [root] INFO: Error dumping file from path "c:\programdata\packages\microsoft.yourphone_8wekyb3d8bbwe\s-1-5-21-3749840076-4109591986-3192690632-1000\systemappdata\helium\cache\5d5984b6671e7683.dat": [Errno 13] Permission denied: 'c:\\programdata\\packages\\microsoft.yourphone_8wekyb3d8bbwe\\s-1-5-21-3749840076-4109591986-3192690632-1000\\systemappdata\\helium\\cache\\5d5984b6671e7683.dat'
2026-03-29 11:07:32,645 [lib.common.results] INFO: Uploading file C:\Users\cape\AppData\Local\Microsoft\Windows\INetCache\IE\NBR01339\TMP[1].TMP to files\4ba1f0b693930843310a83e21ac7aed07c561632c9f3aba958fec8db5350cd14; Size is 34785; Max size: 100000000
2026-03-29 11:07:32,739 [root] WARNING: Folder at path "C:\atsPQMC\debugger" does not exist, skipping
2026-03-29 11:07:32,770 [root] INFO: Uploading files at path "C:\atsPQMC\tlsdump"
2026-03-29 11:07:32,788 [lib.common.results] INFO: Uploading file C:\atsPQMC\tlsdump\tlsdump.log to tlsdump\tlsdump.log; Size is 21920; Max size: 100000000
2026-03-29 11:07:32,895 [root] WARNING: Monitor injection attempted but failed for process 7800
2026-03-29 11:07:32,958 [root] WARNING: Monitor injection attempted but failed for process 3452
2026-03-29 11:07:32,958 [root] WARNING: Monitor injection attempted but failed for process 2912
2026-03-29 11:07:33,036 [root] WARNING: Monitor injection attempted but failed for process 5824
2026-03-29 11:07:33,130 [root] WARNING: Monitor injection attempted but failed for process 520
2026-03-29 11:07:33,145 [root] WARNING: Monitor injection attempted but failed for process 8088
2026-03-29 11:07:33,145 [root] WARNING: Monitor injection attempted but failed for process 4516
2026-03-29 11:07:33,176 [root] WARNING: Monitor injection attempted but failed for process 1232
2026-03-29 11:07:33,176 [root] WARNING: Monitor injection attempted but failed for process 4596
2026-03-29 11:07:33,192 [root] WARNING: Monitor injection attempted but failed for process 7520
2026-03-29 11:07:33,208 [root] WARNING: Monitor injection attempted but failed for process 5220
2026-03-29 11:07:33,317 [root] WARNING: Monitor injection attempted but failed for process 1048
2026-03-29 11:07:33,333 [root] WARNING: Monitor injection attempted but failed for process 3048
2026-03-29 11:07:33,364 [root] WARNING: Monitor injection attempted but failed for process 6152
2026-03-29 11:07:33,380 [root] WARNING: Monitor injection attempted but failed for process 3228
2026-03-29 11:07:33,380 [root] WARNING: Monitor injection attempted but failed for process 5200
2026-03-29 11:07:33,426 [root] WARNING: Monitor injection attempted but failed for process 3528
2026-03-29 11:07:33,505 [root] WARNING: Monitor injection attempted but failed for process 4240
2026-03-29 11:07:33,520 [root] WARNING: Monitor injection attempted but failed for process 1152
2026-03-29 11:07:33,598 [root] WARNING: Monitor injection attempted but failed for process 2684
2026-03-29 11:07:33,645 [root] WARNING: Monitor injection attempted but failed for process 1988
2026-03-29 11:07:33,661 [root] WARNING: Monitor injection attempted but failed for process 6232
2026-03-29 11:07:33,676 [root] WARNING: Monitor injection attempted but failed for process 4268
2026-03-29 11:07:33,708 [root] INFO: Analysis completed

Process Log

Pre-Script Log

During-Script Log