| Category | Package | Started | Completed | Duration | Log(s) |
|---|---|---|---|---|---|
| FILE | exe | 2026-02-22 21:36:25 | 2026-02-22 21:41:19 | 294 seconds | Show Analysis Log |
2025-11-20 02:03:56,134 [root] INFO: Date set to: 20260222T21:36:16, timeout set to: 200
2026-02-22 21:36:16,072 [root] DEBUG: Starting analyzer from: C:\wla960fi
2026-02-22 21:36:16,073 [root] DEBUG: Storing results at: C:\ADDMiu
2026-02-22 21:36:16,073 [root] DEBUG: Pipe server name: \\.\PIPE\vJwpbVaupw
2026-02-22 21:36:16,073 [root] DEBUG: Python path: C:\Users\Admin\AppData\Local\Programs\Python\Python313-32
2026-02-22 21:36:16,073 [root] INFO: analysis running as an admin
2026-02-22 21:36:16,074 [root] INFO: analysis package specified: "exe"
2026-02-22 21:36:16,074 [root] DEBUG: importing analysis package module: "modules.packages.exe"...
2026-02-22 21:36:16,107 [root] DEBUG: imported analysis package "exe"
2026-02-22 21:36:16,107 [root] DEBUG: initializing analysis package "exe"...
2026-02-22 21:36:16,107 [lib.common.common] INFO: wrapping
2026-02-22 21:36:16,108 [lib.core.compound] INFO: C:\Temp already exists, skipping creation
2026-02-22 21:36:16,108 [root] DEBUG: New location of moved file: C:\Temp\astrsk-3.5.4.exe
2026-02-22 21:36:16,109 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2026-02-22 21:36:16,109 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2026-02-22 21:36:16,109 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2026-02-22 21:36:16,110 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2026-02-22 21:36:16,133 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-02-22 21:36:16,149 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-02-22 21:36:16,173 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-02-22 21:36:16,191 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-02-22 21:36:16,216 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-02-22 21:36:16,486 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2026-02-22 21:36:16,508 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2026-02-22 21:36:16,843 [lib.api.screenshot] INFO: Please upgrade Pillow to >= 5.4.1 for best performance
2026-02-22 21:36:16,844 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-02-22 21:36:16,848 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-02-22 21:36:16,848 [root] DEBUG: Initialized auxiliary module "Browser"
2026-02-22 21:36:16,849 [root] DEBUG: attempting to configure 'Browser' from data
2026-02-22 21:36:16,850 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-02-22 21:36:16,850 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-02-22 21:36:16,851 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-02-22 21:36:16,851 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-02-22 21:36:16,851 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-02-22 21:36:16,852 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-02-22 21:36:16,852 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-02-22 21:36:16,852 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature
2026-02-22 21:36:22,347 [modules.auxiliary.digisig] DEBUG: File has a valid signature
2026-02-22 21:36:22,348 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2026-02-22 21:36:22,350 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-02-22 21:36:22,350 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-02-22 21:36:22,352 [root] DEBUG: attempting to configure 'Disguise' from data
2026-02-22 21:36:22,355 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-02-22 21:36:22,356 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-02-22 21:36:22,356 [modules.auxiliary.disguise] INFO: Disguising GUID to 2f04ffcb-3b92-49c7-970a-0ffbb8ea631c
2026-02-22 21:36:22,357 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-02-22 21:36:22,357 [root] DEBUG: Initialized auxiliary module "Human"
2026-02-22 21:36:22,357 [root] DEBUG: attempting to configure 'Human' from data
2026-02-22 21:36:22,358 [root] DEBUG: module Human does not support data configuration, ignoring
2026-02-22 21:36:22,358 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-02-22 21:36:22,361 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-02-22 21:36:22,361 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-02-22 21:36:22,362 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-02-22 21:36:22,362 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-02-22 21:36:22,362 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-02-22 21:36:22,363 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-02-22 21:36:22,364 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-02-22 21:36:22,364 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-02-22 21:36:22,364 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-02-22 21:36:22,364 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-02-22 21:36:22,369 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 608
2026-02-22 21:36:22,526 [lib.api.process] INFO: Monitor config for <Process 608 lsass.exe>: C:\wla960fi\dll\608.ini
2026-02-22 21:36:22,528 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2026-02-22 21:36:22,535 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:22,552 [root] DEBUG: Loader: Injecting process 608 with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:22,559 [root] DEBUG: 608: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:22,561 [root] DEBUG: 608: Disabling sleep skipping.
2026-02-22 21:36:22,561 [root] DEBUG: 608: TLS secret dump mode enabled.
2026-02-22 21:36:22,599 [root] DEBUG: 608: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:22,600 [root] DEBUG: 608: Monitor initialised: 64-bit capemon loaded in process 608 at 0x00007FFEB5DB0000, thread 4488, image base 0x00007FF60EE30000, stack from 0x000000A5F4323000-0x000000A5F4330000
2026-02-22 21:36:22,601 [root] DEBUG: 608: Commandline: C:\Windows\system32\lsass.exe
2026-02-22 21:36:22,614 [root] DEBUG: 608: Hooked 5 out of 5 functions
2026-02-22 21:36:22,616 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-02-22 21:36:22,616 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:22,619 [lib.api.process] INFO: Injected into 64-bit <Process 608 lsass.exe>
2026-02-22 21:36:22,620 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-02-22 21:36:22,766 [root] DEBUG: 608: TLS 1.2 secrets logged to: C:\ADDMiu\tlsdump\tlsdump.log
2026-02-22 21:36:25,810 [root] INFO: Restarting WMI Service
2026-02-22 21:36:25,896 [root] DEBUG: package modules.packages.exe does not support configure, ignoring
2026-02-22 21:36:25,897 [root] WARNING: configuration error for package modules.packages.exe: error importing data.packages.exe: No module named 'data.packages'
2026-02-22 21:36:25,898 [lib.core.compound] INFO: C:\Temp already exists, skipping creation
2026-02-22 21:36:25,910 [lib.api.process] INFO: Successfully executed process from path "C:\Temp\astrsk-3.5.4.exe" with arguments "" with pid 4980
2026-02-22 21:36:25,911 [lib.api.process] INFO: Monitor config for <Process 4980 astrsk-3.5.4.exe>: C:\wla960fi\dll\4980.ini
2026-02-22 21:36:25,916 [lib.api.process] INFO: 32-bit DLL to inject is C:\wla960fi\dll\NTxJKhl.dll, loader C:\wla960fi\bin\yLmNWHm.exe
2026-02-22 21:36:25,936 [root] DEBUG: Loader: Injecting process 4980 (thread 4984) with C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:25,937 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:25,938 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:25,940 [lib.api.process] INFO: Injected into 32-bit <Process 4980 astrsk-3.5.4.exe>
2026-02-22 21:36:27,947 [lib.api.process] INFO: Successfully resumed <Process 4980 astrsk-3.5.4.exe>
2026-02-22 21:36:27,967 [root] DEBUG: 4980: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:27,969 [root] DEBUG: 4980: Disabling sleep skipping.
2026-02-22 21:36:27,970 [root] DEBUG: 4980: Dropped file limit defaulting to 100.
2026-02-22 21:36:27,987 [root] DEBUG: 4980: YaraInit: Compiled 43 rule files
2026-02-22 21:36:27,991 [root] DEBUG: 4980: YaraInit: Compiled rules saved to file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:27,992 [root] DEBUG: 4980: YaraScan: Scanning 0x00400000, size 0x1aa28b
2026-02-22 21:36:28,007 [root] DEBUG: 4980: YaraScan hit: NSIS
2026-02-22 21:36:28,008 [root] DEBUG: 4980: Monitor initialised: 32-bit capemon loaded in process 4980 at 0x731a0000, thread 4984, image base 0x400000, stack from 0x193000-0x1a0000
2026-02-22 21:36:28,009 [root] DEBUG: 4980: Commandline: "C:\Temp\astrsk-3.5.4.exe"
2026-02-22 21:36:28,060 [root] DEBUG: 4980: hook_api: LdrpCallInitRoutine export address 0x76FC2B50 obtained via GetFunctionAddress
2026-02-22 21:36:28,091 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-02-22 21:36:28,093 [root] DEBUG: 4980: set_hooks: Unable to hook GetCommandLineA
2026-02-22 21:36:28,094 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-02-22 21:36:28,094 [root] DEBUG: 4980: set_hooks: Unable to hook GetCommandLineW
2026-02-22 21:36:28,105 [root] DEBUG: 4980: Hooked 625 out of 627 functions
2026-02-22 21:36:28,120 [root] DEBUG: 4980: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:28,128 [root] DEBUG: 4980: RestoreHeaders: Restored original import table.
2026-02-22 21:36:28,129 [root] INFO: Loaded monitor into process with pid 4980
2026-02-22 21:36:28,142 [root] DEBUG: 4980: InstrumentationCallback: Added region at 0x7654274C (base 0x76520000) to tracked regions list (thread 4984).
2026-02-22 21:36:28,143 [root] DEBUG: 4980: ProcessTrackedRegion: Region at 0x76520000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-02-22 21:36:28,149 [root] DEBUG: 4980: caller_dispatch: Added region at 0x00400000 to tracked regions list (kernel32::SetErrorMode returns to 0x004033B8, thread 4984).
2026-02-22 21:36:28,150 [root] DEBUG: 4980: YaraScan: Scanning 0x00400000, size 0x1aa28b
2026-02-22 21:36:28,164 [root] DEBUG: 4980: YaraScan hit: NSIS
2026-02-22 21:36:28,171 [root] DEBUG: 4980: ProcessImageBase: Main module image at 0x00400000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:36:28,173 [root] DEBUG: 4980: DLL loaded at 0x739F0000: C:\Windows\system32\UXTHEME (0x74000 bytes).
2026-02-22 21:36:28,174 [root] DEBUG: 4980: DLL loaded at 0x73480000: C:\Windows\system32\USERENV (0x25000 bytes).
2026-02-22 21:36:28,180 [root] DEBUG: 4980: DLL loaded at 0x75D60000: C:\Windows\System32\cfgmgr32 (0x3b000 bytes).
2026-02-22 21:36:28,185 [root] DEBUG: 4980: DLL loaded at 0x76730000: C:\Windows\System32\SETUPAPI (0x438000 bytes).
2026-02-22 21:36:28,189 [root] DEBUG: 4980: DLL loaded at 0x73590000: C:\Windows\system32\APPHELP (0x9f000 bytes).
2026-02-22 21:36:28,191 [root] DEBUG: 4980: DLL loaded at 0x73C20000: C:\Windows\system32\PROPSYS (0xc2000 bytes).
2026-02-22 21:36:28,193 [root] DEBUG: 4980: DLL loaded at 0x73520000: C:\Windows\system32\DWMAPI (0x26000 bytes).
2026-02-22 21:36:28,201 [root] DEBUG: 4980: DLL loaded at 0x72F30000: C:\Windows\system32\OLEACC (0x53000 bytes).
2026-02-22 21:36:28,204 [root] DEBUG: 4980: DLL loaded at 0x76EA0000: C:\Windows\System32\CLBCATQ (0x7e000 bytes).
2026-02-22 21:36:28,206 [root] DEBUG: 4980: DLL loaded at 0x734F0000: C:\Windows\system32\NTMARTA (0x29000 bytes).
2026-02-22 21:36:28,208 [root] DEBUG: 4980: DLL loaded at 0x741F0000: C:\Windows\system32\VERSION (0x8000 bytes).
2026-02-22 21:36:28,211 [root] DEBUG: 4980: DLL loaded at 0x734E0000: C:\Windows\system32\SHFOLDER (0x6000 bytes).
2026-02-22 21:36:28,213 [root] DEBUG: 4980: DLL loaded at 0x75ED0000: C:\Windows\System32\shcore (0x87000 bytes).
2026-02-22 21:36:28,217 [root] DEBUG: 4980: set_hooks_by_export_directory: Hooked 0 out of 627 functions
2026-02-22 21:36:28,218 [root] DEBUG: 4980: DLL loaded at 0x73B80000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-02-22 21:36:28,220 [root] DEBUG: 4980: DLL loaded at 0x75800000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-02-22 21:36:28,228 [root] DEBUG: 4980: DLL loaded at 0x747A0000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-02-22 21:36:28,229 [root] DEBUG: 4980: DLL loaded at 0x747D0000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-02-22 21:36:28,258 [root] DEBUG: 4980: InstrumentationCallback: Added region at 0x75A163AC (base 0x758D0000) to tracked regions list (thread 4984).
2026-02-22 21:36:28,259 [root] DEBUG: 4980: ProcessTrackedRegion: Region at 0x758D0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-02-22 21:36:28,275 [root] DEBUG: 4980: DLL loaded at 0x73460000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-02-22 21:36:29,292 [root] DEBUG: 4980: DLL loaded at 0x76BD0000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-02-22 21:36:29,314 [root] DEBUG: 4980: DLL loaded at 0x72F20000: C:\Windows\system32\IconCodecService (0x8000 bytes).
2026-02-22 21:36:29,320 [root] DEBUG: 4980: DLL loaded at 0x72DA0000: C:\Windows\SYSTEM32\WindowsCodecs (0x171000 bytes).
2026-02-22 21:36:29,358 [root] DEBUG: 4980: DLL loaded at 0x729C0000: C:\Windows\System32\CoreMessaging (0x9b000 bytes).
2026-02-22 21:36:29,359 [root] DEBUG: 4980: DLL loaded at 0x728E0000: C:\Windows\SYSTEM32\wintypes (0xdc000 bytes).
2026-02-22 21:36:29,361 [root] DEBUG: 4980: DLL loaded at 0x72A60000: C:\Windows\System32\CoreUIComponents (0x27f000 bytes).
2026-02-22 21:36:29,362 [root] DEBUG: 4980: DLL loaded at 0x72CE0000: C:\Windows\SYSTEM32\textinputframework (0xb9000 bytes).
2026-02-22 21:36:29,378 [root] DEBUG: 4980: DLL loaded at 0x72840000: C:\Windows\SYSTEM32\TextShaping (0x95000 bytes).
2026-02-22 21:36:30,147 [root] DEBUG: 4980: api-cap: NtReadFile hook disabled due to count: 5000
2026-02-22 21:36:30,252 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\System.dll
2026-02-22 21:36:30,254 [root] DEBUG: 4980: DLL loaded at 0x72830000: C:\Temp\nscE329.tmp\System (0x7000 bytes).
2026-02-22 21:36:30,287 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\StdUtils.dll
2026-02-22 21:36:30,300 [root] DEBUG: 4980: ProcessTrackedRegion: Region at 0x76520000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-02-22 21:36:30,302 [root] DEBUG: 4980: DLL loaded at 0x72810000: C:\Temp\nscE329.tmp\StdUtils (0x1d000 bytes).
2026-02-22 21:36:30,315 [root] DEBUG: 4980: DLL loaded at 0x72770000: C:\Windows\system32\USP10 (0x17000 bytes).
2026-02-22 21:36:30,316 [root] DEBUG: 4980: DLL loaded at 0x72730000: C:\Windows\system32\msls31 (0x31000 bytes).
2026-02-22 21:36:30,317 [root] DEBUG: 4980: DLL loaded at 0x72790000: C:\Windows\system32\RichEd20 (0x7a000 bytes).
2026-02-22 21:36:30,476 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\SpiderBanner.dll
2026-02-22 21:36:30,480 [root] DEBUG: 4980: DLL loaded at 0x72720000: C:\Temp\nscE329.tmp\SpiderBanner (0x7000 bytes).
2026-02-22 21:36:30,689 [root] DEBUG: 4980: DLL loaded at 0x75860000: C:\Windows\System32\psapi (0x6000 bytes).
2026-02-22 21:36:30,703 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\nsExec.dll
2026-02-22 21:36:30,707 [root] DEBUG: 4980: DLL loaded at 0x72710000: C:\Temp\nscE329.tmp\nsExec (0x5000 bytes).
2026-02-22 21:36:30,710 [root] DEBUG: 4980: CreateProcessHandler: Injection info set for new process 648: C:\Windows\system32\cmd.exe, ImageBase: 0x00F10000
2026-02-22 21:36:30,711 [root] INFO: Announced 32-bit process name: cmd.exe pid: 648
2026-02-22 21:36:30,712 [lib.api.process] INFO: Monitor config for <Process 648 cmd.exe>: C:\wla960fi\dll\648.ini
2026-02-22 21:36:30,716 [lib.api.process] INFO: 32-bit DLL to inject is C:\wla960fi\dll\NTxJKhl.dll, loader C:\wla960fi\bin\yLmNWHm.exe
2026-02-22 21:36:30,730 [root] DEBUG: Loader: Injecting process 648 (thread 2972) with C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:30,732 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:30,732 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:30,735 [lib.api.process] INFO: Injected into 32-bit <Process 648 cmd.exe>
2026-02-22 21:36:30,748 [root] DEBUG: 4980: ProcessTrackedRegion: Region at 0x758D0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-02-22 21:36:30,826 [root] DEBUG: 648: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:30,827 [root] DEBUG: 648: Disabling sleep skipping.
2026-02-22 21:36:30,828 [root] DEBUG: 648: Dropped file limit defaulting to 100.
2026-02-22 21:36:30,835 [root] DEBUG: 648: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:30,836 [root] DEBUG: 648: YaraScan: Scanning 0x00F10000, size 0x595ee
2026-02-22 21:36:30,841 [root] DEBUG: 648: YaraScan hit: FindFixAndRun
2026-02-22 21:36:30,842 [root] DEBUG: 648: Monitor initialised: 32-bit capemon loaded in process 648 at 0x731a0000, thread 2972, image base 0xf10000, stack from 0xe3000-0x1e0000
2026-02-22 21:36:30,843 [root] DEBUG: 648: Commandline: "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq astrsk.exe" /FO csv | "C:\Windows\system32\find.exe" "astrsk.exe"
2026-02-22 21:36:30,876 [root] DEBUG: 648: hook_api: LdrpCallInitRoutine export address 0x76FC2B50 obtained via GetFunctionAddress
2026-02-22 21:36:30,908 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-02-22 21:36:30,909 [root] DEBUG: 648: set_hooks: Unable to hook GetCommandLineA
2026-02-22 21:36:30,910 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-02-22 21:36:30,911 [root] DEBUG: 648: set_hooks: Unable to hook GetCommandLineW
2026-02-22 21:36:30,921 [root] DEBUG: 648: Hooked 625 out of 627 functions
2026-02-22 21:36:30,926 [root] DEBUG: 648: set_hooks_exe: Hooked FindFixAndRun at 0x00F1AD60
2026-02-22 21:36:30,927 [root] DEBUG: 648: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:30,932 [root] DEBUG: 648: RestoreHeaders: Restored original import table.
2026-02-22 21:36:30,932 [root] INFO: Loaded monitor into process with pid 648
2026-02-22 21:36:30,934 [root] DEBUG: 648: caller_dispatch: Added region at 0x00F10000 to tracked regions list (ntdll::memcpy returns to 0x00F268FA, thread 2972).
2026-02-22 21:36:30,935 [root] DEBUG: 648: YaraScan: Scanning 0x00F10000, size 0x595ee
2026-02-22 21:36:30,940 [root] DEBUG: 648: ProcessImageBase: Main module image at 0x00F10000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:36:30,962 [root] DEBUG: 648: InstrumentationCallback: Added region at 0x75A163AC (base 0x758D0000) to tracked regions list (thread 2972).
2026-02-22 21:36:30,963 [root] DEBUG: 648: ProcessTrackedRegion: Region at 0x758D0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-02-22 21:36:31,018 [root] DEBUG: 648: CreateProcessHandler: Injection info set for new process 4596: C:\Windows\system32\tasklist.exe, ImageBase: 0x00E00000
2026-02-22 21:36:31,019 [root] INFO: Announced 32-bit process name: tasklist.exe pid: 4596
2026-02-22 21:36:31,020 [lib.api.process] INFO: Monitor config for <Process 4596 tasklist.exe>: C:\wla960fi\dll\4596.ini
2026-02-22 21:36:31,024 [lib.api.process] INFO: 32-bit DLL to inject is C:\wla960fi\dll\NTxJKhl.dll, loader C:\wla960fi\bin\yLmNWHm.exe
2026-02-22 21:36:31,061 [root] DEBUG: Loader: Injecting process 4596 (thread 4588) with C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:31,062 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:31,063 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:31,066 [lib.api.process] INFO: Injected into 32-bit <Process 4596 tasklist.exe>
2026-02-22 21:36:31,078 [root] DEBUG: 648: ProcessTrackedRegion: Region at 0x758D0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-02-22 21:36:31,089 [root] DEBUG: 648: CreateProcessHandler: Injection info set for new process 4700: C:\Windows\system32\find.exe, ImageBase: 0x00EB0000
2026-02-22 21:36:31,092 [root] INFO: Announced 32-bit process name: find.exe pid: 4700
2026-02-22 21:36:31,094 [lib.api.process] INFO: Monitor config for <Process 4700 find.exe>: C:\wla960fi\dll\4700.ini
2026-02-22 21:36:31,098 [lib.api.process] INFO: 32-bit DLL to inject is C:\wla960fi\dll\NTxJKhl.dll, loader C:\wla960fi\bin\yLmNWHm.exe
2026-02-22 21:36:31,109 [root] DEBUG: 4596: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:31,110 [root] DEBUG: 4596: Dropped file limit defaulting to 100.
2026-02-22 21:36:31,110 [root] DEBUG: Loader: Injecting process 4700 (thread 4704) with C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:31,111 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:31,113 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\NTxJKhl.dll.
2026-02-22 21:36:31,114 [root] DEBUG: 4596: Disabling sleep skipping.
2026-02-22 21:36:31,116 [lib.api.process] INFO: Injected into 32-bit <Process 4700 find.exe>
2026-02-22 21:36:31,116 [root] DEBUG: 4596: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:31,117 [root] DEBUG: 4596: YaraScan: Scanning 0x00E00000, size 0x15f8a
2026-02-22 21:36:31,119 [root] DEBUG: 4596: Monitor initialised: 32-bit capemon loaded in process 4596 at 0x731a0000, thread 4588, image base 0xe00000, stack from 0x636000-0x640000
2026-02-22 21:36:31,120 [root] DEBUG: 4596: Commandline: tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq astrsk.exe" /FO csv
2026-02-22 21:36:31,126 [root] DEBUG: 648: ProcessTrackedRegion: Region at 0x758D0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-02-22 21:36:31,150 [root] DEBUG: 4700: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:31,151 [root] DEBUG: 4700: Dropped file limit defaulting to 100.
2026-02-22 21:36:31,155 [root] DEBUG: 4700: Disabling sleep skipping.
2026-02-22 21:36:31,156 [root] DEBUG: 4596: hook_api: LdrpCallInitRoutine export address 0x76FC2B50 obtained via GetFunctionAddress
2026-02-22 21:36:31,158 [root] DEBUG: 4700: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:31,159 [root] DEBUG: 4700: YaraScan: Scanning 0x00EB0000, size 0x62b2
2026-02-22 21:36:31,160 [root] DEBUG: 4700: Monitor initialised: 32-bit capemon loaded in process 4700 at 0x731a0000, thread 4704, image base 0xeb0000, stack from 0x9c5000-0x9d0000
2026-02-22 21:36:31,161 [root] DEBUG: 4700: Commandline: "C:\Windows\system32\find.exe" "astrsk.exe"
2026-02-22 21:36:31,194 [root] DEBUG: 4700: hook_api: LdrpCallInitRoutine export address 0x76FC2B50 obtained via GetFunctionAddress
2026-02-22 21:36:31,202 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-02-22 21:36:31,203 [root] DEBUG: 4596: set_hooks: Unable to hook GetCommandLineA
2026-02-22 21:36:31,203 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-02-22 21:36:31,204 [root] DEBUG: 4596: set_hooks: Unable to hook GetCommandLineW
2026-02-22 21:36:31,214 [root] DEBUG: 4596: Hooked 625 out of 627 functions
2026-02-22 21:36:31,216 [root] DEBUG: 4596: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:31,221 [root] DEBUG: 4596: RestoreHeaders: Restored original import table.
2026-02-22 21:36:31,222 [root] INFO: Loaded monitor into process with pid 4596
2026-02-22 21:36:31,226 [root] WARNING: b'Unable to place hook on GetCommandLineA'
2026-02-22 21:36:31,227 [root] DEBUG: 4700: set_hooks: Unable to hook GetCommandLineA
2026-02-22 21:36:31,228 [root] WARNING: b'Unable to place hook on GetCommandLineW'
2026-02-22 21:36:31,230 [root] DEBUG: 4700: set_hooks: Unable to hook GetCommandLineW
2026-02-22 21:36:31,232 [root] DEBUG: 4596: caller_dispatch: Added region at 0x00E00000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00E0EF6B, thread 4588).
2026-02-22 21:36:31,233 [root] DEBUG: 4596: YaraScan: Scanning 0x00E00000, size 0x15f8a
2026-02-22 21:36:31,236 [root] DEBUG: 4596: ProcessImageBase: Main module image at 0x00E00000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:36:31,244 [root] DEBUG: 4700: Hooked 625 out of 627 functions
2026-02-22 21:36:31,245 [root] DEBUG: 4596: set_hooks_by_export_directory: Hooked 0 out of 627 functions
2026-02-22 21:36:31,246 [root] DEBUG: 4596: DLL loaded at 0x73B80000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-02-22 21:36:31,247 [root] DEBUG: 4700: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:31,249 [root] DEBUG: 4596: DLL loaded at 0x75800000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-02-22 21:36:31,253 [root] DEBUG: 4700: RestoreHeaders: Restored original import table.
2026-02-22 21:36:31,254 [root] INFO: Loaded monitor into process with pid 4700
2026-02-22 21:36:31,260 [lib.api.process] INFO: Monitor config for <Process 740 svchost.exe>: C:\wla960fi\dll\740.ini
2026-02-22 21:36:31,264 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:31,273 [root] DEBUG: 4700: InstrumentationCallback: Added region at 0x75A163AC (base 0x758D0000) to tracked regions list (thread 4704).
2026-02-22 21:36:31,274 [root] DEBUG: 4700: ProcessTrackedRegion: Region at 0x758D0000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\KernelBase.dll is in known range, skipping
2026-02-22 21:36:31,275 [root] DEBUG: Loader: Injecting process 740 with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:31,276 [root] DEBUG: 4700: caller_dispatch: Added region at 0x00EB0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00EB240B, thread 4704).
2026-02-22 21:36:31,277 [root] DEBUG: 4700: YaraScan: Scanning 0x00EB0000, size 0x62b2
2026-02-22 21:36:31,280 [root] DEBUG: 4700: ProcessImageBase: Main module image at 0x00EB0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:36:31,281 [root] DEBUG: 740: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:31,281 [root] DEBUG: 740: Disabling sleep skipping.
2026-02-22 21:36:31,282 [root] DEBUG: 740: Dropped file limit defaulting to 100.
2026-02-22 21:36:31,285 [root] DEBUG: 740: Services hook set enabled
2026-02-22 21:36:31,288 [root] DEBUG: 4700: DLL loaded at 0x724B0000: C:\Windows\SYSTEM32\fsutilext (0xb000 bytes).
2026-02-22 21:36:31,289 [root] DEBUG: 740: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:31,314 [root] DEBUG: 740: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:31,315 [root] DEBUG: 740: Monitor initialised: 64-bit capemon loaded in process 740 at 0x00007FFEB5DB0000, thread 4944, image base 0x00007FF630560000, stack from 0x000000A00B875000-0x000000A00B880000
2026-02-22 21:36:31,316 [root] DEBUG: 740: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-02-22 21:36:31,342 [root] DEBUG: 740: Hooked 69 out of 69 functions
2026-02-22 21:36:31,345 [root] INFO: Loaded monitor into process with pid 740
2026-02-22 21:36:31,346 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-02-22 21:36:31,347 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:31,351 [lib.api.process] INFO: Injected into 64-bit <Process 740 svchost.exe>
2026-02-22 21:36:33,366 [lib.api.process] INFO: Monitor config for <Process 268 svchost.exe>: C:\wla960fi\dll\268.ini
2026-02-22 21:36:33,371 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:33,381 [root] DEBUG: Loader: Injecting process 268 with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:33,385 [root] DEBUG: 268: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:33,385 [root] DEBUG: 268: Disabling sleep skipping.
2026-02-22 21:36:33,386 [root] DEBUG: 268: Dropped file limit defaulting to 100.
2026-02-22 21:36:33,387 [root] DEBUG: 268: Services hook set enabled
2026-02-22 21:36:33,391 [root] DEBUG: 268: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:33,415 [root] DEBUG: 268: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:33,416 [root] DEBUG: 268: Monitor initialised: 64-bit capemon loaded in process 268 at 0x00007FFEB5DB0000, thread 3456, image base 0x00007FF630560000, stack from 0x0000009338475000-0x0000009338480000
2026-02-22 21:36:33,417 [root] DEBUG: 268: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2026-02-22 21:36:33,434 [root] DEBUG: 268: Hooked 69 out of 69 functions
2026-02-22 21:36:33,436 [root] INFO: Loaded monitor into process with pid 268
2026-02-22 21:36:33,440 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-02-22 21:36:33,443 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:33,447 [lib.api.process] INFO: Injected into 64-bit <Process 268 svchost.exe>
2026-02-22 21:36:35,450 [root] DEBUG: 4596: DLL loaded at 0x76EA0000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-02-22 21:36:35,456 [root] DEBUG: 4596: DLL loaded at 0x72430000: C:\Windows\SYSTEM32\wbemcomn (0x70000 bytes).
2026-02-22 21:36:35,457 [root] DEBUG: 4596: DLL loaded at 0x724A0000: C:\Windows\system32\wbem\wbemprox (0xd000 bytes).
2026-02-22 21:36:35,465 [root] DEBUG: 4596: DLL loaded at 0x723E0000: C:\Windows\system32\Winsta (0x47000 bytes).
2026-02-22 21:36:35,489 [root] DEBUG: 4596: DLL loaded at 0x723D0000: C:\Windows\system32\wbem\wbemsvc (0x10000 bytes).
2026-02-22 21:36:35,567 [root] DEBUG: 4596: DLL loaded at 0x72300000: C:\Windows\system32\wbem\fastprox (0xc9000 bytes).
2026-02-22 21:36:35,595 [root] DEBUG: 4596: DLL loaded at 0x734B0000: C:\Windows\SYSTEM32\amsi (0x18000 bytes).
2026-02-22 21:36:35,601 [root] DEBUG: 4596: DLL loaded at 0x73480000: C:\Windows\SYSTEM32\USERENV (0x25000 bytes).
2026-02-22 21:36:35,606 [root] DEBUG: 4596: DLL loaded at 0x73460000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-02-22 21:36:35,650 [root] DEBUG: Error 87 (0x57) - OpenProcessHandler: Error obtaining target process name: ᅬ¢¢↓¥ ¢¦¢■ ■¥¬¥■○.
2026-02-22 21:36:35,651 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 4, handle 0x330: Error obtaining target process name
2026-02-22 21:36:35,652 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 108, handle 0x330:
2026-02-22 21:36:35,654 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 284, handle 0x31c: C:\Windows\System32\smss.exe
2026-02-22 21:36:35,655 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 380, handle 0x330: C:\Windows\System32\csrss.exe
2026-02-22 21:36:35,656 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 456, handle 0x31c: C:\Windows\System32\wininit.exe
2026-02-22 21:36:35,657 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 464, handle 0x330: C:\Windows\System32\csrss.exe
2026-02-22 21:36:35,659 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 532, handle 0x31c: C:\Windows\System32\winlogon.exe
2026-02-22 21:36:35,662 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 600, handle 0x330: C:\Windows\System32\services.exe
2026-02-22 21:36:35,664 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 608, handle 0x31c: C:\Windows\System32\lsass.exe
2026-02-22 21:36:35,666 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 740, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,668 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 764, handle 0x31c: C:\Windows\System32\fontdrvhost.exe
2026-02-22 21:36:35,670 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 768, handle 0x330: C:\Windows\System32\fontdrvhost.exe
2026-02-22 21:36:35,671 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 856, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,673 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 964, handle 0x330: C:\Windows\System32\dwm.exe
2026-02-22 21:36:35,674 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 268, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,675 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 372, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,677 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 448, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,678 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 336, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,680 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1204, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,681 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1352, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,684 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1412, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,686 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1464, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,688 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1480, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,689 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1656, handle 0x330: C:\Windows\System32\spoolsv.exe
2026-02-22 21:36:35,690 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1764, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,692 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1424, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,693 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1732, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,694 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2084, handle 0x330: C:\Windows\System32\sihost.exe
2026-02-22 21:36:35,695 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2108, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,697 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2168, handle 0x330: C:\Windows\System32\taskhostw.exe
2026-02-22 21:36:35,698 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2232, handle 0x31c: C:\Windows\pyw.exe
2026-02-22 21:36:35,699 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2324, handle 0x330: C:\Windows\System32\ctfmon.exe
2026-02-22 21:36:35,700 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2424, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,702 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2552, handle 0x330: C:\Windows\explorer.exe
2026-02-22 21:36:35,703 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2704, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,704 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2888, handle 0x330: C:\Windows\System32\dasHost.exe
2026-02-22 21:36:35,705 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3020, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,707 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3100, handle 0x330: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
2026-02-22 21:36:35,708 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3248, handle 0x31c: C:\Windows\System32\RuntimeBroker.exe
2026-02-22 21:36:35,709 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3464, handle 0x330: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
2026-02-22 21:36:35,710 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3560, handle 0x31c: C:\Windows\System32\RuntimeBroker.exe
2026-02-22 21:36:35,711 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3756, handle 0x330: C:\Windows\System32\RuntimeBroker.exe
2026-02-22 21:36:35,712 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 1432, handle 0x31c: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
2026-02-22 21:36:35,713 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3016, handle 0x330: C:\Windows\System32\dllhost.exe
2026-02-22 21:36:35,715 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3628, handle 0x31c: C:\Windows\System32\ApplicationFrameHost.exe
2026-02-22 21:36:35,716 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2200, handle 0x330: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,717 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 884, handle 0x31c: C:\Windows\System32\svchost.exe
2026-02-22 21:36:35,719 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2980, handle 0x330: C:\Windows\servicing\TrustedInstaller.exe
2026-02-22 21:36:35,720 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 3228, handle 0x31c: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\TiWorker.exe
2026-02-22 21:36:35,721 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 4184, handle 0x330: C:\Windows\System32\sppsvc.exe
2026-02-22 21:36:35,722 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 4780, handle 0x31c: C:\Windows\System32\wbem\WmiPrvSE.exe
2026-02-22 21:36:35,723 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 4980, handle 0x330: C:\Temp\astrsk-3.5.4.exe
2026-02-22 21:36:35,724 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 5036, handle 0x31c: C:\Windows\System32\wbem\WmiPrvSE.exe
2026-02-22 21:36:35,725 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 648, handle 0x330: C:\Windows\SysWOW64\cmd.exe
2026-02-22 21:36:35,726 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 2544, handle 0x31c: C:\Windows\System32\conhost.exe
2026-02-22 21:36:35,727 [root] DEBUG: 4596: OpenProcessHandler: Injection info created for process 4700, handle 0x31c: C:\Windows\SysWOW64\find.exe
2026-02-22 21:36:35,743 [root] DEBUG: 4596: NtTerminateProcess hook: Attempting to dump process 4596
2026-02-22 21:36:35,744 [root] DEBUG: 4596: DoProcessDump: Skipping process dump as code is identical on disk.
2026-02-22 21:36:35,754 [root] INFO: Process with pid 4596 has terminated
2026-02-22 21:36:35,757 [root] DEBUG: 4700: NtTerminateProcess hook: Attempting to dump process 4700
2026-02-22 21:36:35,758 [root] DEBUG: 4700: DoProcessDump: Skipping process dump as code is identical on disk.
2026-02-22 21:36:35,770 [root] INFO: Process with pid 4700 has terminated
2026-02-22 21:36:35,777 [root] DEBUG: 648: NtTerminateProcess hook: Attempting to dump process 648
2026-02-22 21:36:35,778 [root] DEBUG: 648: VerifyCodeSection: Executable code does not match, 0x9d62 of 0x2bfcb matching
2026-02-22 21:36:35,779 [root] DEBUG: 648: DoProcessDump: Code modification detected, dumping Imagebase at 0x00F10000.
2026-02-22 21:36:35,780 [root] DEBUG: 648: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2026-02-22 21:36:35,781 [root] DEBUG: 648: DumpProcess: Instantiating PeParser with address: 0x00F10000.
2026-02-22 21:36:35,782 [root] DEBUG: 648: DumpProcess: Module entry point VA is 0x00016B20.
2026-02-22 21:36:35,794 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\648_2480949635361822022026 to procdump\dbb1de135671d159f7d23a51082d9f9da0ad09c4afd7caef680a19e6f10936dc; Size is 346624; Max size: 100000000
2026-02-22 21:36:35,811 [root] DEBUG: 648: DumpProcess: Module image dump success - dump size 0x54a00.
2026-02-22 21:36:35,819 [root] INFO: Process with pid 648 has terminated
2026-02-22 21:36:36,148 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\app-64.7z
2026-02-22 21:36:36,170 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\nsis7z.dll
2026-02-22 21:36:36,181 [root] DEBUG: 4980: DLL loaded at 0x726A0000: C:\Temp\nscE329.tmp\nsis7z (0x74000 bytes).
2026-02-22 21:36:36,214 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\chrome_100_percent.pak
2026-02-22 21:36:36,237 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\chrome_200_percent.pak
2026-02-22 21:36:36,495 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\icudtl.dat
2026-02-22 21:36:36,505 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\LICENSE.electron.txt
2026-02-22 21:36:36,563 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\LICENSES.chromium.html
2026-02-22 21:36:36,586 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\af.pak
2026-02-22 21:36:36,612 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\am.pak
2026-02-22 21:36:36,637 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ar.pak
2026-02-22 21:36:36,664 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\bg.pak
2026-02-22 21:36:36,690 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\bn.pak
2026-02-22 21:36:36,717 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ca.pak
2026-02-22 21:36:36,745 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\cs.pak
2026-02-22 21:36:36,770 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\da.pak
2026-02-22 21:36:36,795 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\de.pak
2026-02-22 21:36:36,821 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\el.pak
2026-02-22 21:36:36,844 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\en-GB.pak
2026-02-22 21:36:36,867 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\en-US.pak
2026-02-22 21:36:36,893 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\es-419.pak
2026-02-22 21:36:36,917 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\es.pak
2026-02-22 21:36:37,014 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\et.pak
2026-02-22 21:36:37,039 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\fa.pak
2026-02-22 21:36:37,064 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\fi.pak
2026-02-22 21:36:37,091 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\fil.pak
2026-02-22 21:36:37,116 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\fr.pak
2026-02-22 21:36:37,146 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\gu.pak
2026-02-22 21:36:37,172 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\he.pak
2026-02-22 21:36:37,202 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\hi.pak
2026-02-22 21:36:37,228 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\hr.pak
2026-02-22 21:36:37,254 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\hu.pak
2026-02-22 21:36:37,278 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\id.pak
2026-02-22 21:36:37,305 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\it.pak
2026-02-22 21:36:37,330 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ja.pak
2026-02-22 21:36:37,359 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\kn.pak
2026-02-22 21:36:37,384 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ko.pak
2026-02-22 21:36:37,408 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\lt.pak
2026-02-22 21:36:37,435 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\lv.pak
2026-02-22 21:36:37,465 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ml.pak
2026-02-22 21:36:37,492 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\mr.pak
2026-02-22 21:36:37,515 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ms.pak
2026-02-22 21:36:37,541 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\nb.pak
2026-02-22 21:36:37,650 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\nl.pak
2026-02-22 21:36:37,690 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\pl.pak
2026-02-22 21:36:37,714 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\pt-BR.pak
2026-02-22 21:36:37,737 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\pt-PT.pak
2026-02-22 21:36:37,762 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ro.pak
2026-02-22 21:36:37,790 [root] INFO: Added new file to list with pid None and path C:\Temp\nscE329.tmp\7z-out\locales\ru.pak
2026-02-22 21:36:37,814 [root] DEBUG: 4980: Dropped file limit reached.
2026-02-22 21:36:42,619 [root] DEBUG: 4980: api-rate-cap: memcpy hook disabled due to rate
2026-02-22 21:36:42,628 [root] DEBUG: 4980: DLL loaded at 0x72680000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2026-02-22 21:36:42,812 [root] DEBUG: 4980: DLL loaded at 0x72630000: C:\Windows\System32\Windows.FileExplorer.Common (0x49000 bytes).
2026-02-22 21:36:42,828 [root] DEBUG: 4980: DLL loaded at 0x723F0000: C:\Windows\System32\iertutil (0x236000 bytes).
2026-02-22 21:36:42,906 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ᅫ↑¢¢■○ ¬ ¦○¥.
2026-02-22 21:36:42,907 [root] DEBUG: 4980: OpenProcessHandler: Injection info created for process 2552, handle 0x514: Error obtaining target process name
2026-02-22 21:36:43,556 [root] INFO: Announced 64-bit process name: explorer.exe pid: 2552
2026-02-22 21:36:43,560 [lib.api.process] INFO: Monitor config for <Process 2552 explorer.exe>: C:\wla960fi\dll\2552.ini
2026-02-22 21:36:43,574 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:43,605 [root] DEBUG: Loader: Injecting process 2552 with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:43,612 [root] DEBUG: 2552: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:43,614 [root] DEBUG: 2552: Dropped file limit defaulting to 100.
2026-02-22 21:36:43,626 [root] DEBUG: 2552: Disabling sleep skipping.
2026-02-22 21:36:43,631 [root] DEBUG: 2552: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:43,680 [root] DEBUG: 2552: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:43,682 [root] DEBUG: 2552: YaraScan: Scanning 0x00007FF735FF0000, size 0x545316
2026-02-22 21:36:43,909 [root] DEBUG: 2552: Monitor initialised: 64-bit capemon loaded in process 2552 at 0x00007FFEB5DB0000, thread 5844, image base 0x00007FF735FF0000, stack from 0x0000000002B62000-0x0000000002B70000
2026-02-22 21:36:43,910 [root] DEBUG: 2552: Commandline: C:\Windows\Explorer.EXE
2026-02-22 21:36:43,929 [root] DEBUG: 2552: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:36:43,993 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:36:43,994 [root] DEBUG: 2552: set_hooks: Unable to hook LockResource
2026-02-22 21:36:44,022 [root] DEBUG: 2552: Hooked 619 out of 620 functions
2026-02-22 21:36:44,109 [root] DEBUG: 2552: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:44,121 [root] INFO: Loaded monitor into process with pid 2552
2026-02-22 21:36:44,131 [root] DEBUG: 2552: api-rate-cap: LdrpCallInitRoutine hook disabled due to rate
2026-02-22 21:36:44,139 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-02-22 21:36:44,140 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:44,144 [lib.api.process] INFO: Injected into 64-bit <Process 2552 explorer.exe>
2026-02-22 21:36:44,364 [root] DEBUG: 2552: caller_dispatch: Added region at 0x00007FF735FF0000 to tracked regions list (user32::GetLastInputInfo returns to 0x00007FF7360604C0, thread 2768).
2026-02-22 21:36:44,366 [root] DEBUG: 2552: YaraScan: Scanning 0x00007FF735FF0000, size 0x545316
2026-02-22 21:36:44,449 [root] DEBUG: 2552: ProcessImageBase: Main module image at 0x00007FF735FF0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:36:44,755 [root] DEBUG: 4980: DLL loaded at 0x72390000: C:\Windows\system32\ntshrui (0x5c000 bytes).
2026-02-22 21:36:46,245 [root] DEBUG: 268: DLL loaded at 0x00007FFED4F50000: C:\Windows\system32\sqmapi (0xe000 bytes).
2026-02-22 21:36:46,305 [root] DEBUG: 4980: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5000
2026-02-22 21:36:46,533 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 5104, handle 0xd04: C:\Windows\System32\conhost.exe
2026-02-22 21:36:46,604 [root] INFO: Announced starting service "b'WSearch'"
2026-02-22 21:36:46,607 [lib.api.process] INFO: Monitor config for <Process 600 services.exe>: C:\wla960fi\dll\600.ini
2026-02-22 21:36:46,621 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:46,636 [root] DEBUG: Loader: Injecting process 600 with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:46,640 [root] DEBUG: Loader: Copied config file C:\wla960fi\dll\600.ini to system path C:\600.ini
2026-02-22 21:36:46,645 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 600 C:\wla960fi\dll\YQEfXz.dll
2026-02-22 21:36:46,647 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:46,651 [lib.api.process] INFO: Injected into 64-bit <Process 600 services.exe>
2026-02-22 21:36:47,377 [root] DEBUG: 4980: DLL loaded at 0x72380000: C:\Windows\SYSTEM32\LINKINFO (0xb000 bytes).
2026-02-22 21:36:47,383 [root] DEBUG: 4980: DLL loaded at 0x72360000: C:\Windows\system32\srvcli (0x1d000 bytes).
2026-02-22 21:36:47,393 [root] DEBUG: 4980: DLL loaded at 0x72350000: C:\Windows\SYSTEM32\cscapi (0xe000 bytes).
2026-02-22 21:36:47,616 [root] DEBUG: 4980: DLL loaded at 0x10000000: C:\Temp\nscE329.tmp\WinShell (0x3000 bytes).
2026-02-22 21:36:47,719 [root] DEBUG: 4980: api-cap: NtClose hook disabled due to count: 5000
2026-02-22 21:36:47,759 [root] DEBUG: 4980: DLL loaded at 0x10000000: C:\Temp\nscE329.tmp\WinShell (0x3000 bytes).
2026-02-22 21:36:47,852 [lib.api.process] INFO: Monitor config for <Process 2552 explorer.exe>: C:\wla960fi\dll\2552.ini
2026-02-22 21:36:47,871 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:47,902 [root] DEBUG: Loader: Injecting process 2552 with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:47,908 [root] DEBUG: 2552: caller_dispatch: Added region at 0x0000000002B50000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x0000000002B50042, thread 3480).
2026-02-22 21:36:47,909 [root] DEBUG: 2552: DumpPEsInRange: Scanning range 0x0000000002B50000 - 0x0000000002B50133.
2026-02-22 21:36:47,911 [root] DEBUG: 2552: ScanForDisguisedPE: Size too small: 0x133 bytes
2026-02-22 21:36:47,930 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\2552_3706447361822022026 to CAPE\a6d396a6078a8723139cdcfcb327d5dcce3b444e40a03e515d91dc9a71178829; Size is 307; Max size: 100000000
2026-02-22 21:36:47,941 [root] DEBUG: 2552: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\2552_3706447361822022026 (size 307 bytes)
2026-02-22 21:36:47,943 [root] DEBUG: 2552: DumpRegion: Dumped entire allocation from 0x0000000002B50000, size 4096 bytes.
2026-02-22 21:36:47,945 [root] DEBUG: 2552: ProcessTrackedRegion: Dumped region at 0x0000000002B50000.
2026-02-22 21:36:47,946 [root] DEBUG: 2552: YaraScan: Scanning 0x0000000002B50000, size 0x133
2026-02-22 21:36:47,954 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-02-22 21:36:47,958 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:47,964 [lib.api.process] INFO: Injected into 64-bit <Process 2552 explorer.exe>
2026-02-22 21:36:48,848 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
2026-02-22 21:36:48,869 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 4324, handle 0x162c: C:\Windows\System32\conhost.exe
2026-02-22 21:36:48,874 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
2026-02-22 21:36:49,014 [root] INFO: Announced starting service "b'WSearch'"
2026-02-22 21:36:49,043 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
2026-02-22 21:36:49,048 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2026-02-22 21:36:49,245 [root] DEBUG: 2552: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:36:49,256 [root] DEBUG: 2552: DLL loaded at 0x00007FFEC3D90000: C:\Windows\System32\provsvc (0x7d000 bytes).
2026-02-22 21:36:49,334 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
2026-02-22 21:36:49,403 [root] DEBUG: 2552: api-rate-cap: memcpy hook disabled due to rate
2026-02-22 21:36:49,656 [root] DEBUG: 740: CreateProcessHandler: Injection info set for new process 6200: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6F8170000
2026-02-22 21:36:49,657 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 6200
2026-02-22 21:36:49,658 [lib.api.process] INFO: Monitor config for <Process 6200 dllhost.exe>: C:\wla960fi\dll\6200.ini
2026-02-22 21:36:49,666 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:49,677 [root] DEBUG: Loader: Injecting process 6200 (thread 6204) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:49,678 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:49,679 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:49,682 [lib.api.process] INFO: Injected into 64-bit <Process 6200 dllhost.exe>
2026-02-22 21:36:49,684 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 6200
2026-02-22 21:36:49,685 [lib.api.process] INFO: Monitor config for <Process 6200 dllhost.exe>: C:\wla960fi\dll\6200.ini
2026-02-22 21:36:49,691 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:49,702 [root] DEBUG: Loader: Injecting process 6200 (thread 6204) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:49,703 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:49,704 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:49,707 [lib.api.process] INFO: Injected into 64-bit <Process 6200 dllhost.exe>
2026-02-22 21:36:49,721 [root] DEBUG: 6200: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:49,722 [root] DEBUG: 6200: Dropped file limit defaulting to 100.
2026-02-22 21:36:49,727 [root] DEBUG: 6200: Disabling sleep skipping.
2026-02-22 21:36:49,729 [root] DEBUG: 6200: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:49,757 [root] DEBUG: 6200: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:49,758 [root] DEBUG: 6200: YaraScan: Scanning 0x00007FF6F8170000, size 0x8026
2026-02-22 21:36:49,760 [root] DEBUG: 6200: Monitor initialised: 64-bit capemon loaded in process 6200 at 0x00007FFEB5DB0000, thread 6204, image base 0x00007FF6F8170000, stack from 0x000000123EAF5000-0x000000123EB00000
2026-02-22 21:36:49,761 [root] DEBUG: 6200: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-02-22 21:36:49,773 [root] DEBUG: 6200: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:36:49,823 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:36:49,825 [root] DEBUG: 6200: set_hooks: Unable to hook LockResource
2026-02-22 21:36:49,837 [root] DEBUG: 6200: Hooked 619 out of 620 functions
2026-02-22 21:36:49,839 [root] DEBUG: 6200: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:49,848 [root] DEBUG: 6200: RestoreHeaders: Restored original import table.
2026-02-22 21:36:49,849 [root] INFO: Loaded monitor into process with pid 6200
2026-02-22 21:36:49,851 [root] DEBUG: 6200: caller_dispatch: Added region at 0x00007FF6F8170000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6F81712F2, thread 6204).
2026-02-22 21:36:49,851 [root] DEBUG: 6200: YaraScan: Scanning 0x00007FF6F8170000, size 0x8026
2026-02-22 21:36:49,854 [root] DEBUG: 6200: ProcessImageBase: Main module image at 0x00007FF6F8170000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:36:49,859 [root] DEBUG: 6200: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:36:49,861 [root] DEBUG: 6200: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:36:49,863 [root] DEBUG: 6200: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:36:49,871 [root] DEBUG: 6200: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:36:49,915 [root] DEBUG: 6200: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:36:49,951 [root] DEBUG: 6200: DLL loaded at 0x00007FFEE1880000: C:\Windows\System32\shcore (0xad000 bytes).
2026-02-22 21:36:49,953 [root] DEBUG: 6200: DLL loaded at 0x00007FFECDA20000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-02-22 21:36:49,969 [root] DEBUG: 6200: DLL loaded at 0x00007FFEDC720000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-02-22 21:36:49,994 [root] DEBUG: 4980: DLL loaded at 0x722C0000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-02-22 21:36:50,058 [root] DEBUG: 4980: DLL loaded at 0x72280000: C:\Windows\System32\OneCoreCommonProxyStub (0x3d000 bytes).
2026-02-22 21:36:50,090 [root] DEBUG: 4980: DLL loaded at 0x71EC0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3ba000 bytes).
2026-02-22 21:36:50,950 [root] DEBUG: 2552: DLL loaded at 0x00007FFEC9F70000: C:\Windows\system32\twext (0x33000 bytes).
2026-02-22 21:36:51,176 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000011.db to files\cec63c83931b4e64f7d0129626d740d1de4c9909d811eba43fa2d9b4144a51f1; Size is 68592; Max size: 100000000
2026-02-22 21:36:51,196 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db to files\ec98bb165219bfe58b2b06f7228058145ebf66176f04e4bdab43bd969e275bb2; Size is 65040; Max size: 100000000
2026-02-22 21:36:51,201 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db
2026-02-22 21:36:51,307 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000011.db to files\cec63c83931b4e64f7d0129626d740d1de4c9909d811eba43fa2d9b4144a51f1; Size is 68592; Max size: 100000000
2026-02-22 21:36:51,615 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ᅫ↑¢¢■○ ¬ ¦○¥.
2026-02-22 21:36:51,616 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 1432, handle 0x2250: Error obtaining target process name
2026-02-22 21:36:51,618 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ᅫ↑¢¢■○ ¬ ¦○¥.
2026-02-22 21:36:51,619 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 3464, handle 0x2220: Error obtaining target process name
2026-02-22 21:36:51,683 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ᅫ↑¢¢■○ ¬ ¦○¥.
2026-02-22 21:36:51,686 [root] DEBUG: 2552: DLL loaded at 0x000000006C000000: C:\Program Files\7-Zip\7-zip (0x1c000 bytes).
2026-02-22 21:36:51,688 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 4980, handle 0x2274: Error obtaining target process name
2026-02-22 21:36:51,726 [root] DEBUG: 2552: DLL loaded at 0x0000000006600000: C:\Windows\system32\sfc (0x3000 bytes).
2026-02-22 21:36:51,730 [root] DEBUG: 2552: DLL loaded at 0x00007FFEB6370000: C:\Windows\system32\msi (0x337000 bytes).
2026-02-22 21:36:51,731 [root] DEBUG: 2552: DLL loaded at 0x00007FFED4F40000: C:\Windows\system32\acppage (0x19000 bytes).
2026-02-22 21:36:51,898 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 6784, handle 0x2220: C:\Windows\System32\conhost.exe
2026-02-22 21:36:51,939 [root] INFO: Announced starting service "b'WSearch'"
2026-02-22 21:36:51,953 [root] DEBUG: 2552: CreateProcessHandler: Injection info set for new process 6836: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:36:51,955 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 6836
2026-02-22 21:36:51,956 [lib.api.process] INFO: Monitor config for <Process 6836 astrsk.exe>: C:\wla960fi\dll\6836.ini
2026-02-22 21:36:53,072 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 6884, handle 0x230c: C:\Windows\System32\conhost.exe
2026-02-22 21:36:53,116 [root] INFO: Announced starting service "b'WSearch'"
2026-02-22 21:36:53,404 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:36:53,410 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:53,421 [root] DEBUG: Loader: Injecting process 6836 (thread 6840) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:53,423 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:53,424 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:53,426 [lib.api.process] INFO: Injected into 64-bit <Process 6836 astrsk.exe>
2026-02-22 21:36:53,430 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 6836
2026-02-22 21:36:53,430 [lib.api.process] INFO: Monitor config for <Process 6836 astrsk.exe>: C:\wla960fi\dll\6836.ini
2026-02-22 21:36:54,162 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
2026-02-22 21:36:54,414 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:36:54,419 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:54,429 [root] DEBUG: Loader: Injecting process 6836 (thread 6840) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:54,430 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:36:54,431 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:54,434 [lib.api.process] INFO: Injected into 64-bit <Process 6836 astrsk.exe>
2026-02-22 21:36:54,486 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 6272, handle 0x2220: C:\Windows\System32\conhost.exe
2026-02-22 21:36:54,533 [root] INFO: Announced starting service "b'PcaSvc'"
2026-02-22 21:36:54,692 [root] DEBUG: 2552: CreateProcessHandler: Injection info set for new process 6792: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:36:54,694 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 6792
2026-02-22 21:36:54,696 [lib.api.process] INFO: Monitor config for <Process 6792 astrsk.exe>: C:\wla960fi\dll\6792.ini
2026-02-22 21:36:55,550 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 6836
2026-02-22 21:36:55,552 [lib.api.process] INFO: Monitor config for <Process 6836 astrsk.exe>: C:\wla960fi\dll\6836.ini
2026-02-22 21:36:55,654 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:36:55,662 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:55,682 [root] DEBUG: Loader: Injecting process 6792 (thread 6788) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:55,684 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:36:55,686 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:55,690 [lib.api.process] INFO: Injected into 64-bit <Process 6792 astrsk.exe>
2026-02-22 21:36:55,693 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 6792
2026-02-22 21:36:55,695 [lib.api.process] INFO: Monitor config for <Process 6792 astrsk.exe>: C:\wla960fi\dll\6792.ini
2026-02-22 21:36:56,452 [root] INFO: Process with pid 6200 has terminated
2026-02-22 21:36:56,455 [root] DEBUG: 6200: NtTerminateProcess hook: Attempting to dump process 6200
2026-02-22 21:36:56,456 [root] DEBUG: 6200: DoProcessDump: Skipping process dump as code is identical on disk.
2026-02-22 21:36:56,623 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:36:56,629 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:56,641 [root] DEBUG: Loader: Injecting process 6836 (thread 6840) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:56,642 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:36:56,643 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:56,646 [lib.api.process] INFO: Injected into 64-bit <Process 6836 astrsk.exe>
2026-02-22 21:36:56,663 [root] DEBUG: 6836: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:56,665 [root] DEBUG: 6836: Dropped file limit defaulting to 100.
2026-02-22 21:36:56,668 [root] DEBUG: 6836: Disabling sleep skipping.
2026-02-22 21:36:56,670 [root] DEBUG: 6836: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:56,695 [root] DEBUG: 6836: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:56,697 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:36:56,756 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:36:56,761 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:56,775 [root] DEBUG: Loader: Injecting process 6792 (thread 6788) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:56,776 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:36:56,777 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:56,780 [lib.api.process] INFO: Injected into 64-bit <Process 6792 astrsk.exe>
2026-02-22 21:36:56,831 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 6408, handle 0x23d4: C:\Windows\System32\conhost.exe
2026-02-22 21:36:56,881 [root] INFO: Announced starting service "b'PcaSvc'"
2026-02-22 21:36:56,959 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: ᅫ↑¢¢■○ ¬ ¦○¥.
2026-02-22 21:36:56,960 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 3100, handle 0x21f4: Error obtaining target process name
2026-02-22 21:36:57,702 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:36:57,704 [root] DEBUG: 6836: Monitor initialised: 64-bit capemon loaded in process 6836 at 0x00007FFEB5DB0000, thread 6840, image base 0x00007FF7778F0000, stack from 0x000000156C1F5000-0x000000156C200000
2026-02-22 21:36:57,705 [root] DEBUG: 6836: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe"
2026-02-22 21:36:57,723 [root] DEBUG: 6836: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:36:57,788 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:36:57,789 [root] DEBUG: 6836: set_hooks: Unable to hook LockResource
2026-02-22 21:36:57,809 [root] DEBUG: 6836: Hooked 619 out of 620 functions
2026-02-22 21:36:57,891 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 6792
2026-02-22 21:36:57,892 [lib.api.process] INFO: Monitor config for <Process 6792 astrsk.exe>: C:\wla960fi\dll\6792.ini
2026-02-22 21:36:58,251 [root] DEBUG: 4980: NtTerminateProcess hook: Attempting to dump process 4980
2026-02-22 21:36:58,255 [root] DEBUG: 4980: DoProcessDump: Skipping process dump as code is identical on disk.
2026-02-22 21:36:58,277 [root] DEBUG: 4980: DLL loaded at 0x72830000: C:\Windows\system32\netutils (0xb000 bytes).
2026-02-22 21:36:58,298 [root] INFO: Process with pid 4980 has terminated
2026-02-22 21:36:58,813 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:36:58,814 [root] DEBUG: 6836: Syscall hook installed, syscall logging level 1
2026-02-22 21:36:58,824 [root] DEBUG: 6836: RestoreHeaders: Restored original import table.
2026-02-22 21:36:58,825 [root] INFO: Loaded monitor into process with pid 6836
2026-02-22 21:36:58,845 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:36:58,856 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:36:59,095 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:36:59,103 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:36:59,116 [root] DEBUG: Loader: Injecting process 6792 (thread 6788) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:59,118 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:36:59,120 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:36:59,124 [lib.api.process] INFO: Injected into 64-bit <Process 6792 astrsk.exe>
2026-02-22 21:36:59,143 [root] DEBUG: 6792: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:36:59,145 [root] DEBUG: 6792: Dropped file limit defaulting to 100.
2026-02-22 21:36:59,149 [root] DEBUG: 6792: Disabling sleep skipping.
2026-02-22 21:36:59,151 [root] DEBUG: 6792: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:36:59,175 [root] DEBUG: 6792: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:36:59,177 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:36:59,667 [root] DEBUG: 2552: api-cap: RegQueryValueExW hook disabled due to count: 5000
2026-02-22 21:36:59,698 [root] DEBUG: 2552: api-cap: RegOpenKeyExW hook disabled due to count: 5000
2026-02-22 21:36:59,859 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:36:59,864 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:00,179 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:00,181 [root] DEBUG: 6792: Monitor initialised: 64-bit capemon loaded in process 6792 at 0x00007FFEB5DB0000, thread 6788, image base 0x00007FF7778F0000, stack from 0x00000002FE7F5000-0x00000002FE800000
2026-02-22 21:37:00,183 [root] DEBUG: 6792: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe"
2026-02-22 21:37:00,197 [root] DEBUG: 6792: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:37:00,253 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:37:00,254 [root] DEBUG: 6792: set_hooks: Unable to hook LockResource
2026-02-22 21:37:00,268 [root] DEBUG: 6792: Hooked 619 out of 620 functions
2026-02-22 21:37:00,866 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:00,870 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:01,273 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:01,274 [root] DEBUG: 6792: Syscall hook installed, syscall logging level 1
2026-02-22 21:37:01,283 [root] DEBUG: 6792: RestoreHeaders: Restored original import table.
2026-02-22 21:37:01,285 [root] INFO: Loaded monitor into process with pid 6792
2026-02-22 21:37:01,302 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:37:01,313 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:01,872 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:01,877 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:02,315 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:02,320 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:02,879 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:02,885 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:03,322 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:03,326 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:03,887 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:03,891 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:04,329 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:04,335 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:04,895 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:04,902 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:05,338 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:05,347 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:05,904 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:05,907 [root] DEBUG: 6836: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:37:05,910 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:06,351 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:06,356 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:06,422 [root] DEBUG: 6836: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 6840).
2026-02-22 21:37:06,431 [root] DEBUG: 6836: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:06,954 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:07,191 [root] DEBUG: 6836: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:37:07,359 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:07,365 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:07,434 [root] DEBUG: 6836: Yara error: Scanning timed out
2026-02-22 21:37:07,674 [root] DEBUG: 6836: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:37:08,034 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:37:08,036 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:37:08,060 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:37:08,081 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:37:08,279 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:37:08,367 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:08,370 [root] DEBUG: 6792: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:37:08,374 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:08,397 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:37:08,679 [root] DEBUG: 6836: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:37:08,740 [root] DEBUG: 6792: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 6788).
2026-02-22 21:37:08,746 [root] DEBUG: 6792: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:09,172 [root] DEBUG: 6836: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:37:09,173 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:37:09,228 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE21A0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-02-22 21:37:09,490 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:09,737 [root] DEBUG: 6792: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:37:09,749 [root] DEBUG: 6792: Yara error: Scanning timed out
2026-02-22 21:37:09,873 [root] DEBUG: 2552: api-cap: NtClose hook disabled due to count: 5000
2026-02-22 21:37:09,874 [root] DEBUG: 2552: api-cap: NtClose hook disabled due to count: 5001
2026-02-22 21:37:10,004 [root] DEBUG: 6792: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:37:10,338 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:37:10,340 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:37:10,369 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:37:10,389 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:37:10,548 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:37:10,658 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:37:11,002 [root] DEBUG: 6792: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:37:11,515 [root] DEBUG: 6792: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:37:11,517 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:37:11,560 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE21A0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-02-22 21:37:12,407 [root] DEBUG: 6836: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:37:12,840 [root] DEBUG: 6836: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC0C0000.
2026-02-22 21:37:13,125 [root] DEBUG: 6836: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:37:14,761 [root] DEBUG: 6792: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:37:15,266 [root] DEBUG: 6792: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC0C0000.
2026-02-22 21:37:15,354 [root] DEBUG: 2552: CreateProcessHandler: Injection info set for new process 7708: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:15,435 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:37:15,437 [root] DEBUG: 2552: CreateProcessHandler: Injection info set for new process 7708: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:15,450 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7708
2026-02-22 21:37:15,453 [lib.api.process] INFO: Monitor config for <Process 7708 astrsk.exe>: C:\wla960fi\dll\7708.ini
2026-02-22 21:37:15,468 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:37:16,365 [root] DEBUG: 2552: api-cap: RegCloseKey hook disabled due to count: 5000
2026-02-22 21:37:16,777 [root] DEBUG: 2552: api-cap: NtQueryKey hook disabled due to count: 5000
2026-02-22 21:37:16,830 [root] DEBUG: 2552: api-cap: NtQueryKey hook disabled due to count: 5001
2026-02-22 21:37:16,846 [root] DEBUG: 2552: CreateProcessHandler: Injection info set for new process 7768: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:16,850 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7768
2026-02-22 21:37:16,851 [lib.api.process] INFO: Monitor config for <Process 7768 astrsk.exe>: C:\wla960fi\dll\7768.ini
2026-02-22 21:37:17,307 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:17,316 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:17,346 [root] DEBUG: Loader: Injecting process 7708 (thread 7712) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:17,350 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:37:17,352 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:17,363 [lib.api.process] INFO: Injected into 64-bit <Process 7708 astrsk.exe>
2026-02-22 21:37:17,366 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7708
2026-02-22 21:37:17,367 [lib.api.process] INFO: Monitor config for <Process 7708 astrsk.exe>: C:\wla960fi\dll\7708.ini
2026-02-22 21:37:18,459 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:18,466 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:18,493 [root] DEBUG: Loader: Injecting process 7768 (thread 7772) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:18,496 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:37:18,499 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:18,512 [lib.api.process] INFO: Injected into 64-bit <Process 7768 astrsk.exe>
2026-02-22 21:37:18,519 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7768
2026-02-22 21:37:18,521 [lib.api.process] INFO: Monitor config for <Process 7768 astrsk.exe>: C:\wla960fi\dll\7768.ini
2026-02-22 21:37:19,048 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:19,050 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:19,085 [root] DEBUG: Loader: Injecting process 7708 (thread 7712) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:19,101 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:19,104 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:19,141 [lib.api.process] INFO: Injected into 64-bit <Process 7708 astrsk.exe>
2026-02-22 21:37:19,339 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 7952, handle 0x2160: C:\Windows\System32\conhost.exe
2026-02-22 21:37:19,346 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 7944, handle 0x2160: C:\Windows\SysWOW64\sc.exe
2026-02-22 21:37:19,426 [root] INFO: Announced starting service "b'PcaSvc'"
2026-02-22 21:37:20,234 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:20,238 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:20,267 [root] DEBUG: Loader: Injecting process 7768 (thread 7772) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:20,268 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:20,269 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:20,278 [lib.api.process] INFO: Injected into 64-bit <Process 7768 astrsk.exe>
2026-02-22 21:37:20,443 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 8040, handle 0x22b0: C:\Windows\System32\conhost.exe
2026-02-22 21:37:20,465 [root] DEBUG: 2552: OpenProcessHandler: Injection info created for process 8032, handle 0x22b0: C:\Windows\SysWOW64\sc.exe
2026-02-22 21:37:20,469 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7708
2026-02-22 21:37:20,471 [lib.api.process] INFO: Monitor config for <Process 7708 astrsk.exe>: C:\wla960fi\dll\7708.ini
2026-02-22 21:37:20,487 [root] INFO: Announced starting service "b'PcaSvc'"
2026-02-22 21:37:21,503 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7768
2026-02-22 21:37:21,504 [lib.api.process] INFO: Monitor config for <Process 7768 astrsk.exe>: C:\wla960fi\dll\7768.ini
2026-02-22 21:37:22,615 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:22,626 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:22,655 [root] DEBUG: Loader: Injecting process 7708 (thread 7712) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:22,656 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:22,658 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:22,670 [lib.api.process] INFO: Injected into 64-bit <Process 7708 astrsk.exe>
2026-02-22 21:37:22,696 [root] DEBUG: 7708: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:37:22,701 [root] DEBUG: 7708: Dropped file limit defaulting to 100.
2026-02-22 21:37:22,709 [root] DEBUG: 7708: Disabling sleep skipping.
2026-02-22 21:37:22,713 [root] DEBUG: 7708: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:37:22,751 [root] DEBUG: 7708: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:37:22,757 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:23,785 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:23,803 [root] DEBUG: 7708: Monitor initialised: 64-bit capemon loaded in process 7708 at 0x00007FFEB5DB0000, thread 7712, image base 0x00007FF7778F0000, stack from 0x0000000C503F5000-0x0000000C50400000
2026-02-22 21:37:23,805 [root] DEBUG: 7708: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe"
2026-02-22 21:37:23,849 [root] DEBUG: 7708: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:37:23,857 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE0500000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-02-22 21:37:23,862 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDEC70000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-02-22 21:37:23,904 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:37:23,908 [root] DEBUG: 7708: set_hooks: Unable to hook LockResource
2026-02-22 21:37:23,923 [root] DEBUG: 7708: Hooked 619 out of 620 functions
2026-02-22 21:37:24,174 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\config.json.tmp-178544409965668e
2026-02-22 21:37:24,328 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\config.json.tmp-178544428678e69d
2026-02-22 21:37:24,401 [root] DEBUG: 6836: DLL loaded at 0x00007FFECF5A0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-02-22 21:37:24,480 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:37:24,579 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:37:24,685 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:37:24,703 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:37:24,974 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:24,977 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:37:25,026 [root] DEBUG: 7708: Syscall hook installed, syscall logging level 1
2026-02-22 21:37:25,036 [root] DEBUG: 7708: RestoreHeaders: Restored original import table.
2026-02-22 21:37:25,043 [root] INFO: Loaded monitor into process with pid 7708
2026-02-22 21:37:25,061 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:37:25,075 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:25,291 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDE0B0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-02-22 21:37:25,294 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDC8A0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-02-22 21:37:25,297 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDDD50000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-02-22 21:37:25,299 [root] DEBUG: 6836: DLL loaded at 0x00007FFED8F50000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-02-22 21:37:25,606 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDB970000: C:\Windows\SYSTEM32\twinapi.appcore (0x203000 bytes).
2026-02-22 21:37:25,607 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDBB90000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-02-22 21:37:25,630 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDC720000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-02-22 21:37:25,632 [root] DEBUG: 6836: DLL loaded at 0x00007FFED8DF0000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-02-22 21:37:25,634 [root] DEBUG: 6836: DLL loaded at 0x00007FFED9050000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-02-22 21:37:25,884 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE0500000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-02-22 21:37:25,888 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDEC70000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-02-22 21:37:26,078 [root] DEBUG: 6792: DLL loaded at 0x00007FFECF5A0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-02-22 21:37:26,100 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:26,116 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:26,139 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:37:26,226 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:37:26,331 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:37:26,345 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:37:26,441 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE0AC0000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-02-22 21:37:26,639 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDC880000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-02-22 21:37:26,906 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:37:27,071 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE0970000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-02-22 21:37:27,114 [root] DEBUG: 6836: CreateProcessHandler: Injection info set for new process 7360: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:27,160 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDB400000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-02-22 21:37:27,162 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:27,192 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:37:27,195 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:37:27,196 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDB440000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-02-22 21:37:27,199 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDE0B0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-02-22 21:37:27,202 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDC8A0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-02-22 21:37:27,205 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDDD50000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-02-22 21:37:27,207 [root] DEBUG: 6792: DLL loaded at 0x00007FFED8F50000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-02-22 21:37:27,233 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:27,464 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE1420000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-02-22 21:37:27,471 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE0870000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-02-22 21:37:27,474 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDABE0000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-02-22 21:37:27,482 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDB970000: C:\Windows\SYSTEM32\twinapi.appcore (0x203000 bytes).
2026-02-22 21:37:27,485 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDBB90000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-02-22 21:37:27,488 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDC720000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-02-22 21:37:27,490 [root] DEBUG: 6792: DLL loaded at 0x00007FFED8DF0000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-02-22 21:37:27,493 [root] DEBUG: 6792: DLL loaded at 0x00007FFED9050000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-02-22 21:37:28,164 [root] DEBUG: 6836: DLL loaded at 0x00007FFED5000000: C:\Windows\system32\IconCodecService (0x9000 bytes).
2026-02-22 21:37:28,220 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDB5D0000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-02-22 21:37:28,270 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:28,273 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE0AC0000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-02-22 21:37:28,572 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:28,737 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDC880000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-02-22 21:37:28,833 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDB400000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-02-22 21:37:28,834 [root] DEBUG: 6836: DLL loaded at 0x00007FFED7060000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-02-22 21:37:28,959 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDB440000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-02-22 21:37:29,125 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDE960000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-02-22 21:37:29,190 [root] DEBUG: 6792: CreateProcessHandler: Injection info set for new process 8324: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:29,195 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE1420000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-02-22 21:37:29,200 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:37:29,200 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:37:29,201 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE0870000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-02-22 21:37:29,240 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDABE0000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-02-22 21:37:29,331 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE0970000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-02-22 21:37:29,395 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDF450000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-02-22 21:37:29,404 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDCFB0000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-02-22 21:37:29,409 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDD7E0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-02-22 21:37:29,413 [root] DEBUG: 6836: DLL loaded at 0x00007FFECDEE0000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-02-22 21:37:29,581 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:29,733 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:30,538 [root] DEBUG: 6792: DLL loaded at 0x00007FFED5000000: C:\Windows\system32\IconCodecService (0x9000 bytes).
2026-02-22 21:37:30,809 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Code Cache\js\index
2026-02-22 21:37:30,871 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Code Cache\wasm\index
2026-02-22 21:37:31,181 [root] DEBUG: 6836: CreateProcessHandler: Injection info set for new process 8412: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:31,198 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDB5D0000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-02-22 21:37:31,259 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:31,278 [root] DEBUG: 6836: DLL loaded at 0x00007FFED9880000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-02-22 21:37:31,294 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Code Cache\wasm\index-dir\temp-index
2026-02-22 21:37:31,326 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Code Cache\js\index-dir\temp-index
2026-02-22 21:37:31,372 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8412
2026-02-22 21:37:31,373 [lib.api.process] INFO: Monitor config for <Process 8412 astrsk.exe>: C:\wla960fi\dll\8412.ini
2026-02-22 21:37:31,376 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\NetworkDataMigrated
2026-02-22 21:37:31,473 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Local Storage\leveldb\MANIFEST-000001
2026-02-22 21:37:31,571 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Local Storage\leveldb\000001.dbtmp
2026-02-22 21:37:31,635 [root] DEBUG: 6836: DLL loaded at 0x00007FFEC3CA0000: C:\Windows\System32\MsSpellCheckingFacility (0xed000 bytes).
2026-02-22 21:37:31,760 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:31,804 [root] DEBUG: 6836: api-rate-cap: memcpy hook disabled due to rate
2026-02-22 21:37:31,809 [root] DEBUG: 6792: DLL loaded at 0x00007FFED7060000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-02-22 21:37:31,974 [root] DEBUG: 6836: DLL loaded at 0x00007FFED97F0000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-02-22 21:37:31,986 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDE960000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-02-22 21:37:32,039 [root] DEBUG: 6836: DLL loaded at 0x00007FFED6750000: C:\Windows\System32\Windows.Globalization (0x1a6000 bytes).
2026-02-22 21:37:32,190 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDA360000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-02-22 21:37:32,234 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDF450000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-02-22 21:37:32,246 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDCFB0000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-02-22 21:37:32,256 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDD7E0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-02-22 21:37:32,258 [root] DEBUG: 6792: DLL loaded at 0x00007FFECDEE0000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-02-22 21:37:32,312 [root] DEBUG: 6836: DLL loaded at 0x00007FFECFB70000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-02-22 21:37:33,007 [root] DEBUG: 6836: DLL loaded at 0x00007FFEC96D0000: C:\Windows\SYSTEM32\atlthunk (0xd000 bytes).
2026-02-22 21:37:33,387 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:33,407 [root] DEBUG: 6792: CreateProcessHandler: Injection info set for new process 8580: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:33,481 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\GPUCache\index
2026-02-22 21:37:33,560 [root] DEBUG: 6836: DLL loaded at 0x00007FFECDE70000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-02-22 21:37:33,569 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8580
2026-02-22 21:37:33,571 [lib.api.process] INFO: Monitor config for <Process 8580 astrsk.exe>: C:\wla960fi\dll\8580.ini
2026-02-22 21:37:33,573 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\GPUCache\data_0
2026-02-22 21:37:33,620 [root] DEBUG: 6792: DLL loaded at 0x00007FFED9880000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-02-22 21:37:33,627 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:33,872 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\GPUCache\data_1
2026-02-22 21:37:33,930 [root] DEBUG: 6792: DLL loaded at 0x00007FFEC3CA0000: C:\Windows\System32\MsSpellCheckingFacility (0xed000 bytes).
2026-02-22 21:37:33,975 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Local Storage\leveldb\LOCK
2026-02-22 21:37:34,055 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\GPUCache\data_2
2026-02-22 21:37:34,138 [root] DEBUG: 6792: api-rate-cap: memcpy hook disabled due to rate
2026-02-22 21:37:34,205 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:34,208 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:34,338 [root] DEBUG: 6836: DLL loaded at 0x00007FFED5E60000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-02-22 21:37:34,626 [root] DEBUG: Loader: Injecting process 7768 (thread 7772) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:34,630 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\GPUCache\data_3
2026-02-22 21:37:34,649 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDA360000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-02-22 21:37:34,649 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:34,697 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:34,961 [root] DEBUG: 6792: DLL loaded at 0x00007FFED97F0000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-02-22 21:37:34,982 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:34,994 [root] DEBUG: 7708: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 7712).
2026-02-22 21:37:35,002 [root] DEBUG: 7708: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:37:35,018 [lib.api.process] INFO: Injected into 64-bit <Process 7768 astrsk.exe>
2026-02-22 21:37:35,019 [root] DEBUG: 6792: DLL loaded at 0x00007FFED6750000: C:\Windows\System32\Windows.Globalization (0x1a6000 bytes).
2026-02-22 21:37:35,062 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:35,618 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnWebGPUCache\index
2026-02-22 21:37:35,688 [root] DEBUG: 7708: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:36,353 [root] DEBUG: 7768: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:37:36,389 [root] DEBUG: 6792: DLL loaded at 0x00007FFECFB70000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-02-22 21:37:36,714 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:37:36,729 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnWebGPUCache\data_0
2026-02-22 21:37:36,802 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:36,831 [root] DEBUG: 7768: Dropped file limit defaulting to 100.
2026-02-22 21:37:36,850 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\9140c16e-9e68-4d53-921b-d08c66df9e5c.tmp
2026-02-22 21:37:36,873 [root] DEBUG: 7708: Yara error: Scanning timed out
2026-02-22 21:37:37,048 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\.updaterId
2026-02-22 21:37:37,137 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Local Storage\leveldb\LOG
2026-02-22 21:37:37,574 [root] DEBUG: 6836: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:37:37,767 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnWebGPUCache\data_1
2026-02-22 21:37:37,957 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnGraphiteCache\index
2026-02-22 21:37:37,975 [root] DEBUG: 7708: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:37:38,016 [root] DEBUG: 6792: DLL loaded at 0x00007FFEC96D0000: C:\Windows\SYSTEM32\atlthunk (0xd000 bytes).
2026-02-22 21:37:38,044 [root] DEBUG: 7708: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:37:38,065 [root] DEBUG: 7768: Disabling sleep skipping.
2026-02-22 21:37:38,090 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnWebGPUCache\data_2
2026-02-22 21:37:38,093 [root] DEBUG: 7768: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:37:38,132 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnGraphiteCache\data_0
2026-02-22 21:37:38,152 [root] DEBUG: 6836: DLL loaded at 0x00007FFEE0450000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-02-22 21:37:38,185 [root] DEBUG: 7768: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:37:38,193 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnWebGPUCache\data_3
2026-02-22 21:37:38,233 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnGraphiteCache\data_1
2026-02-22 21:37:38,277 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDFB90000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-02-22 21:37:38,326 [root] DEBUG: 6792: DLL loaded at 0x00007FFECDE70000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-02-22 21:37:38,374 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:38,579 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnGraphiteCache\data_2
2026-02-22 21:37:38,655 [root] DEBUG: 6792: DLL loaded at 0x00007FFED5E60000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-02-22 21:37:38,811 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:37:38,824 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DawnGraphiteCache\data_3
2026-02-22 21:37:38,968 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DIPS-journal
2026-02-22 21:37:39,104 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:37:39,396 [root] DEBUG: 6836: DLL loaded at 0x00007FFEDF420000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-02-22 21:37:39,404 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:39,420 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:37:39,630 [root] DEBUG: 7768: Monitor initialised: 64-bit capemon loaded in process 7768 at 0x00007FFEB5DB0000, thread 7772, image base 0x00007FF7778F0000, stack from 0x0000003B7E9F5000-0x0000003B7EA00000
2026-02-22 21:37:39,634 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:37:39,817 [root] DEBUG: 7768: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe"
2026-02-22 21:37:40,323 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:37:40,505 [root] DEBUG: 7768: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:37:40,568 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\64c240cb-cb23-457a-bf77-39dfa5ca7562.tmp
2026-02-22 21:37:40,579 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\fcb82bcb-7102-40d3-9a36-c3ff9e2ab7b9.tmp
2026-02-22 21:37:40,855 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:37:40,915 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:37:40,937 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:37:41,050 [root] DEBUG: 2552: api-cap: GetSystemMetrics hook disabled due to count: 5000
2026-02-22 21:37:41,084 [root] DEBUG: 7768: set_hooks: Unable to hook LockResource
2026-02-22 21:37:41,150 [root] DEBUG: 6792: api-cap: timeGetTime hook disabled due to count: 5000
2026-02-22 21:37:41,196 [root] DEBUG: 6792: api-cap: timeGetTime hook disabled due to count: 5003
2026-02-22 21:37:41,202 [root] DEBUG: 6792: api-cap: timeGetTime hook disabled due to count: 5001
2026-02-22 21:37:41,208 [root] DEBUG: 7768: Hooked 619 out of 620 functions
2026-02-22 21:37:41,210 [root] DEBUG: 6792: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:37:41,317 [root] DEBUG: 7708: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:37:41,444 [root] DEBUG: 6792:
2026-02-22 21:37:41,813 [root] DEBUG: 6792: DLL loaded at 0x00007FFEE0450000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-02-22 21:37:41,932 [root] DEBUG: 7708: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:37:41,942 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDFB90000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-02-22 21:37:41,985 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:37:42,078 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:42,108 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:42,173 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE21A0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-02-22 21:37:42,391 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:42,407 [root] DEBUG: Loader: Injecting process 7360 (thread 3888) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:42,451 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:37:42,461 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:42,480 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:42,491 [lib.api.process] INFO: Injected into 64-bit <Process 7360 astrsk.exe>
2026-02-22 21:37:42,496 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:42,499 [root] DEBUG: 6792: DLL loaded at 0x00007FFEDF420000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-02-22 21:37:42,504 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\Local State~RF5fbdc.TMP to files\89afaa8b9c23208141180c9efa1736885d4db563ae0b174895b4253a7dce4b5d; Size is 434; Max size: 100000000
2026-02-22 21:37:42,564 [root] DEBUG: 7768: Syscall hook installed, syscall logging level 1
2026-02-22 21:37:42,581 [root] DEBUG: Loader: Injecting process 8324 (thread 8328) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:42,595 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:37:42,597 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:37:42,599 [root] DEBUG: 7768: RestoreHeaders: Restored original import table.
2026-02-22 21:37:42,602 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:37:42,618 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:42,622 [root] INFO: Loaded monitor into process with pid 7768
2026-02-22 21:37:42,753 [lib.api.process] INFO: Injected into 64-bit <Process 8324 astrsk.exe>
2026-02-22 21:37:42,753 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\90c96f2c-db0c-4348-a9ea-f667639d4c84.tmp
2026-02-22 21:37:42,840 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:37:42,866 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:37:42,867 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:37:42,979 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:43,421 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:43,473 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:43,672 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:43,674 [root] DEBUG: Loader: Injecting process 8412 (thread 8416) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:43,680 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:43,695 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:37:43,746 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:43,750 [root] DEBUG: Loader: Injecting process 8580 (thread 8584) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:43,771 [lib.api.process] INFO: Injected into 64-bit <Process 8412 astrsk.exe>
2026-02-22 21:37:43,774 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:37:43,791 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:43,799 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\Preferences~RF601c7.TMP to files\2b71b6187f43507cab9a2b6603e219f5db21726129447c3afb657e70a08280e3; Size is 90; Max size: 100000000
2026-02-22 21:37:43,814 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8412
2026-02-22 21:37:43,815 [lib.api.process] INFO: Monitor config for <Process 8412 astrsk.exe>: C:\wla960fi\dll\8412.ini
2026-02-22 21:37:43,820 [lib.api.process] INFO: Injected into 64-bit <Process 8580 astrsk.exe>
2026-02-22 21:37:43,827 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\DIPS-journal to files\a3f23f86220627d6add5c52fcced04d9ea0865f849f38f5e8f29e797799c4cc3; Size is 512; Max size: 100000000
2026-02-22 21:37:43,828 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8580
2026-02-22 21:37:43,830 [lib.api.process] INFO: Monitor config for <Process 8580 astrsk.exe>: C:\wla960fi\dll\8580.ini
2026-02-22 21:37:44,021 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:44,076 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:44,082 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\DIPS
2026-02-22 21:37:44,991 [root] DEBUG: 7708: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:37:45,119 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:45,146 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:45,413 [root] DEBUG: 7708: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC0C0000.
2026-02-22 21:37:45,444 [root] DEBUG: 7708: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:37:45,568 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:45,580 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:45,615 [root] DEBUG: Loader: Injecting process 7360 (thread 3888) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:45,622 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:45,624 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:45,653 [lib.api.process] INFO: Injected into 64-bit <Process 7360 astrsk.exe>
2026-02-22 21:37:45,698 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:45,704 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:45,761 [root] DEBUG: Loader: Injecting process 8324 (thread 8328) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:45,774 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:45,777 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:45,797 [lib.api.process] INFO: Injected into 64-bit <Process 8324 astrsk.exe>
2026-02-22 21:37:46,130 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:46,142 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:46,164 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:37:46,167 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:37:46,169 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:46,174 [root] DEBUG: Loader: Injecting process 8580 (thread 8584) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:46,176 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:46,179 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:46,181 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:46,190 [root] DEBUG: Loader: Injecting process 8412 (thread 8416) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:46,191 [lib.api.process] INFO: Injected into 64-bit <Process 8580 astrsk.exe>
2026-02-22 21:37:46,193 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:37:46,318 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:37:46,357 [lib.api.process] INFO: Injected into 64-bit <Process 8412 astrsk.exe>
2026-02-22 21:37:46,377 [root] DEBUG: 8580: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:37:46,377 [root] DEBUG: 8412: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:37:46,382 [root] DEBUG: 8580: Dropped file limit defaulting to 100.
2026-02-22 21:37:46,382 [root] DEBUG: 8412: Dropped file limit defaulting to 100.
2026-02-22 21:37:46,384 [root] DEBUG: 6792: CreateProcessHandler: Injection info set for new process 9588: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:46,390 [root] DEBUG: 8580: Disabling sleep skipping.
2026-02-22 21:37:46,393 [root] DEBUG: 8412: Disabling sleep skipping.
2026-02-22 21:37:46,397 [root] DEBUG: 8580: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:37:46,422 [root] DEBUG: 8412: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:37:46,445 [root] DEBUG: 8580: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:37:46,454 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 9588
2026-02-22 21:37:46,455 [root] DEBUG: 8412: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:37:46,456 [lib.api.process] INFO: Monitor config for <Process 9588 astrsk.exe>: C:\wla960fi\dll\9588.ini
2026-02-22 21:37:46,461 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:46,572 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:47,425 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:47,613 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:47,622 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:47,628 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:47,632 [root] DEBUG: 6836: CreateProcessHandler: Injection info set for new process 9724: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:37:47,635 [root] DEBUG: 8580: Monitor initialised: 64-bit capemon loaded in process 8580 at 0x00007FFEB5DB0000, thread 8584, image base 0x00007FF7778F0000, stack from 0x000000BE2D9F5000-0x000000BE2DA00000
2026-02-22 21:37:47,639 [root] DEBUG: 8412: Monitor initialised: 64-bit capemon loaded in process 8412 at 0x00007FFEB5DB0000, thread 8416, image base 0x00007FF7778F0000, stack from 0x000000F98B5F5000-0x000000F98B600000
2026-02-22 21:37:47,640 [root] DEBUG: 8580: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --field-trial-handle=1884,i,3550053115993098354,12756643441492847563,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessC
2026-02-22 21:37:47,658 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\f7432600-f998-446f-a510-61972e114379.tmp
2026-02-22 21:37:47,659 [root] DEBUG: 8412: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --field-trial-handle=1848,i,11752051608971980875,11678663325144031184,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcess
2026-02-22 21:37:47,697 [root] DEBUG: 8580: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:37:47,751 [root] DEBUG: 8412: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:37:47,806 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 9724
2026-02-22 21:37:47,809 [lib.api.process] INFO: Monitor config for <Process 9724 astrsk.exe>: C:\wla960fi\dll\9724.ini
2026-02-22 21:37:47,828 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:37:47,830 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:37:47,855 [root] DEBUG: 8580: set_hooks: Unable to hook LockResource
2026-02-22 21:37:47,880 [root] DEBUG: 8580: Hooked 619 out of 620 functions
2026-02-22 21:37:47,883 [root] DEBUG: 8412: set_hooks: Unable to hook LockResource
2026-02-22 21:37:48,420 [root] DEBUG: 8412: Hooked 619 out of 620 functions
2026-02-22 21:37:49,015 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:49,021 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:49,050 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:49,433 [root] DEBUG: 8580: Syscall hook installed, syscall logging level 1
2026-02-22 21:37:49,472 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:49,486 [root] DEBUG: 8580: RestoreHeaders: Restored original import table.
2026-02-22 21:37:49,494 [root] DEBUG: 8412: Syscall hook installed, syscall logging level 1
2026-02-22 21:37:49,508 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\Preferences~RF616e6.TMP to files\2b71b6187f43507cab9a2b6603e219f5db21726129447c3afb657e70a08280e3; Size is 90; Max size: 100000000
2026-02-22 21:37:49,510 [root] INFO: Loaded monitor into process with pid 8580
2026-02-22 21:37:49,530 [root] DEBUG: 8412: RestoreHeaders: Restored original import table.
2026-02-22 21:37:49,550 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:37:49,565 [root] INFO: Loaded monitor into process with pid 8412
2026-02-22 21:37:49,596 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:49,652 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:37:49,903 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:50,393 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:50,634 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:50,644 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:50,924 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:51,095 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:51,459 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:51,964 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:52,246 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\f7332be2-ec18-4a25-a422-469917c60bf7.tmp
2026-02-22 21:37:52,308 [root] DEBUG: 7768: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:37:52,320 [root] DEBUG: 7768: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 7772).
2026-02-22 21:37:52,342 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:52,360 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:52,471 [root] DEBUG: 7768: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:53,096 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:53,655 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:53,954 [root] DEBUG: 7768: Yara error: Scanning timed out
2026-02-22 21:37:54,107 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:54,166 [root] DEBUG: 7768: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:37:54,174 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:54,185 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:54,219 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:54,495 [root] DEBUG: 7768: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:37:55,240 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:37:55,245 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:55,249 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:55,256 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:55,269 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:37:55,271 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:55,949 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:37:56,144 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\Preferences~RF62ed3.TMP to files\eb8c6196ef8ce6139b1089f636a7927c9113df4648368db4c2c0d2cbf487c6ea; Size is 54; Max size: 100000000
2026-02-22 21:37:56,145 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:37:56,249 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE0500000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-02-22 21:37:56,315 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDEC70000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-02-22 21:37:56,372 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:56,393 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:37:56,398 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:56,410 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:56,502 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:56,504 [root] DEBUG: 7708: DLL loaded at 0x00007FFECF5A0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-02-22 21:37:56,559 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:37:56,818 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:37:56,908 [root] DEBUG: 7768: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:37:57,482 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:37:57,534 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:57,540 [root] DEBUG: 7768: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:37:57,542 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:57,545 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:57,572 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:37:57,609 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:57,696 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE21A0000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-02-22 21:37:58,612 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:37:58,700 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:37:58,705 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:37:58,760 [root] DEBUG: 8580: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:37:58,770 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:37:58,953 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:59,024 [root] DEBUG: 8580: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 8584).
2026-02-22 21:37:59,033 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:37:59,440 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:38:00,128 [root] DEBUG: 8580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:00,398 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDE0B0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-02-22 21:38:00,460 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:38:00,658 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:38:00,834 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDC8A0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-02-22 21:38:00,925 [root] DEBUG: 8580: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:38:00,930 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDDD50000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-02-22 21:38:00,950 [root] DEBUG: 8412: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:38:00,950 [root] DEBUG: 8412: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 8416).
2026-02-22 21:38:00,966 [root] DEBUG: 7708: DLL loaded at 0x00007FFED8F50000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-02-22 21:38:01,063 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:01,243 [root] DEBUG: 8412: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:01,918 [root] DEBUG: 8580: Yara error: Scanning timed out
2026-02-22 21:38:02,216 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDB970000: C:\Windows\SYSTEM32\twinapi.appcore (0x203000 bytes).
2026-02-22 21:38:02,233 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:38:02,496 [root] DEBUG: 8580: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:38:02,520 [root] DEBUG: 8412: Yara error: Scanning timed out
2026-02-22 21:38:02,640 [root] DEBUG: 8412: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:38:02,737 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDBB90000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-02-22 21:38:02,764 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDC720000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-02-22 21:38:02,770 [root] DEBUG: 8412: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:38:02,987 [root] DEBUG: 7708: DLL loaded at 0x00007FFED8DF0000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-02-22 21:38:02,993 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:38:02,997 [root] DEBUG: 7768: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:38:03,136 [root] DEBUG: 7708: DLL loaded at 0x00007FFED9050000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-02-22 21:38:03,240 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:38:03,657 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:38:03,676 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:38:03,704 [root] DEBUG: 7768: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC0C0000.
2026-02-22 21:38:03,720 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:38:03,756 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:38:03,894 [root] DEBUG: 7768: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:03,898 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:38:03,929 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:38:03,953 [root] DEBUG: 7768: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:04,010 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE0AC0000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-02-22 21:38:04,536 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:38:04,905 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:38:05,121 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDC880000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-02-22 21:38:05,200 [root] DEBUG: 8580: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:38:05,272 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:38:05,493 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDB400000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-02-22 21:38:05,964 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:38:06,318 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDB440000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-02-22 21:38:06,625 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:38:06,719 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:06,828 [root] DEBUG: 8412: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:38:06,892 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE1420000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-02-22 21:38:06,904 [root] DEBUG: 7708: CreateProcessHandler: Injection info set for new process 3548: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:38:06,908 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:38:07,033 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE0870000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-02-22 21:38:07,040 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 3548
2026-02-22 21:38:07,041 [lib.api.process] INFO: Monitor config for <Process 3548 astrsk.exe>: C:\wla960fi\dll\3548.ini
2026-02-22 21:38:07,048 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:38:07,049 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDABE0000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-02-22 21:38:08,283 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:38:09,667 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE0970000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-02-22 21:38:09,727 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:38:09,843 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Shared Dictionary\cache\index
2026-02-22 21:38:09,850 [root] DEBUG: 8580: DLL loaded at 0x00007FFED87C0000: C:\Windows\System32\rasadhlp (0xa000 bytes).
2026-02-22 21:38:09,851 [root] DEBUG: 7708: DLL loaded at 0x00007FFED5000000: C:\Windows\system32\IconCodecService (0x9000 bytes).
2026-02-22 21:38:10,155 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:38:12,170 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDB5D0000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-02-22 21:38:13,441 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:38:13,723 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Shared Dictionary\cache\index-dir\temp-index
2026-02-22 21:38:13,757 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\Cache_Data\index
2026-02-22 21:38:13,803 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:38:13,991 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:14,367 [root] DEBUG: 7708: DLL loaded at 0x00007FFED7060000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-02-22 21:38:14,965 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:14,992 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\Cache_Data\data_0
2026-02-22 21:38:15,013 [root] DEBUG: 6836: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5001
2026-02-22 21:38:15,034 [root] DEBUG: 6836: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5001
2026-02-22 21:38:15,052 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\Trust Tokens
2026-02-22 21:38:15,055 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE0500000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-02-22 21:38:15,092 [root] DEBUG: 6836: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5003
2026-02-22 21:38:15,110 [root] DEBUG: 6836: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5002
2026-02-22 21:38:15,121 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:15,127 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\Cache_Data\data_1
2026-02-22 21:38:15,130 [root] DEBUG: 8412: DLL loaded at 0x00007FFED87C0000: C:\Windows\System32\rasadhlp (0xa000 bytes).
2026-02-22 21:38:15,192 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDE960000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-02-22 21:38:15,343 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\Cache_Data\data_2
2026-02-22 21:38:15,441 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDEC70000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-02-22 21:38:15,631 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\Cache_Data\data_3
2026-02-22 21:38:16,034 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDF450000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-02-22 21:38:16,262 [root] DEBUG: 7768: DLL loaded at 0x00007FFECF5A0000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-02-22 21:38:16,317 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDCFB0000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-02-22 21:38:16,323 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:38:16,411 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDD7E0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-02-22 21:38:16,430 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:38:16,430 [root] DEBUG: 7708: DLL loaded at 0x00007FFECDEE0000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-02-22 21:38:16,858 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:38:18,887 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Dictionaries\ru-RU-3-0.bdic
2026-02-22 21:38:19,057 [root] DEBUG: 7708: CreateProcessHandler: Injection info set for new process 10432: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:38:19,064 [root] DEBUG: 7708: DLL loaded at 0x00007FFED9880000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-02-22 21:38:19,068 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:38:19,084 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Session Storage\MANIFEST-000001
2026-02-22 21:38:19,317 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 10432
2026-02-22 21:38:19,335 [root] DEBUG: 7708: DLL loaded at 0x00007FFEC3CA0000: C:\Windows\System32\MsSpellCheckingFacility (0xed000 bytes).
2026-02-22 21:38:19,336 [lib.api.process] INFO: Monitor config for <Process 10432 astrsk.exe>: C:\wla960fi\dll\10432.ini
2026-02-22 21:38:19,379 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:19,390 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Session Storage\000001.dbtmp
2026-02-22 21:38:19,438 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:38:19,634 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:19,721 [root] DEBUG: 7708: DLL loaded at 0x00007FFED97F0000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-02-22 21:38:19,730 [root] DEBUG: 7708: api-rate-cap: memcpy hook disabled due to rate
2026-02-22 21:38:19,839 [root] DEBUG: 7708: DLL loaded at 0x00007FFED6750000: C:\Windows\System32\Windows.Globalization (0x1a6000 bytes).
2026-02-22 21:38:20,234 [root] DEBUG: 6836: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:20,383 [root] DEBUG: Loader: Injecting process 9588 (thread 9592) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:20,628 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDE0B0000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-02-22 21:38:20,753 [root] DEBUG: 6836: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:20,799 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:38:20,806 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDA360000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-02-22 21:38:20,917 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDC8A0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-02-22 21:38:20,948 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:20,968 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\No_Vary_Search\snapshot-new.baf
2026-02-22 21:38:21,115 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Session Storage\LOCK
2026-02-22 21:38:21,116 [lib.api.process] INFO: Injected into 64-bit <Process 9588 astrsk.exe>
2026-02-22 21:38:21,633 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDDD50000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-02-22 21:38:21,663 [root] DEBUG: 7708: DLL loaded at 0x00007FFECFB70000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-02-22 21:38:21,917 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:21,920 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:22,111 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 9588
2026-02-22 21:38:22,116 [lib.api.process] INFO: Monitor config for <Process 9588 astrsk.exe>: C:\wla960fi\dll\9588.ini
2026-02-22 21:38:22,120 [root] DEBUG: 8580: api-cap: timeGetTime hook disabled due to count: 5000
2026-02-22 21:38:22,324 [root] DEBUG: 7768: DLL loaded at 0x00007FFED8F50000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-02-22 21:38:22,799 [root] DEBUG: Loader: Injecting process 9724 (thread 9728) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:22,818 [root] DEBUG: 7708: DLL loaded at 0x00007FFEC96D0000: C:\Windows\SYSTEM32\atlthunk (0xd000 bytes).
2026-02-22 21:38:23,142 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Session Storage\LOG
2026-02-22 21:38:23,143 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDB970000: C:\Windows\SYSTEM32\twinapi.appcore (0x203000 bytes).
2026-02-22 21:38:23,312 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:38:23,382 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:23,423 [lib.api.process] INFO: Injected into 64-bit <Process 9724 astrsk.exe>
2026-02-22 21:38:23,434 [root] DEBUG: 7708: DLL loaded at 0x00007FFECDE70000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-02-22 21:38:23,645 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDBB90000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-02-22 21:38:23,694 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 9724
2026-02-22 21:38:23,695 [lib.api.process] INFO: Monitor config for <Process 9724 astrsk.exe>: C:\wla960fi\dll\9724.ini
2026-02-22 21:38:23,743 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDC720000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-02-22 21:38:23,820 [root] DEBUG: 7708: DLL loaded at 0x00007FFED5E60000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-02-22 21:38:26,637 [root] DEBUG: 7768: DLL loaded at 0x00007FFED8DF0000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-02-22 21:38:26,702 [root] DEBUG: 8412: api-cap: timeGetTime hook disabled due to count: 5000
2026-02-22 21:38:26,997 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Cache\Cache_Data\f_000001
2026-02-22 21:38:27,333 [root] DEBUG: 8412: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:38:27,384 [root] DEBUG: 7708: DLL loaded at 0x00007FFEE0450000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-02-22 21:38:27,420 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDFB90000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-02-22 21:38:27,454 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:38:28,054 [root] DEBUG: 7768: DLL loaded at 0x00007FFED9050000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-02-22 21:38:28,122 [root] DEBUG: 268: DLL loaded at 0x00007FFED5F50000: C:\Windows\system32\es (0x6c000 bytes).
2026-02-22 21:38:28,305 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:38:28,481 [root] DEBUG: 7708: DLL loaded at 0x00007FFEDF420000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-02-22 21:38:29,006 [root] DEBUG: 7708: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:38:29,391 [root] DEBUG: 8580: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:38:29,452 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE0AC0000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-02-22 21:38:29,455 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:38:29,999 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDC880000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-02-22 21:38:30,124 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE0970000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-02-22 21:38:30,234 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE1420000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-02-22 21:38:30,618 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE0870000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-02-22 21:38:30,995 [root] DEBUG: 7768: CreateProcessHandler: Injection info set for new process 11036: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:38:31,060 [root] DEBUG: 8580: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:38:31,221 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:31,232 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:31,292 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDABE0000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-02-22 21:38:31,930 [root] DEBUG: 8412: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:38:32,047 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 11036
2026-02-22 21:38:32,048 [lib.api.process] INFO: Monitor config for <Process 11036 astrsk.exe>: C:\wla960fi\dll\11036.ini
2026-02-22 21:38:32,059 [root] DEBUG: Loader: Injecting process 3548 (thread 3132) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:32,075 [root] DEBUG: 8580: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:38:32,181 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDB400000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-02-22 21:38:32,226 [root] DEBUG: 8412: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:38:32,390 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:38:32,578 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDB440000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-02-22 21:38:32,886 [root] DEBUG: 8580: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:38:33,150 [root] DEBUG: 8412: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:38:33,374 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:33,446 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\9b46c6a8-8ecb-4a23-b81d-c43b470edc0e.tmp
2026-02-22 21:38:33,584 [lib.api.process] INFO: Injected into 64-bit <Process 3548 astrsk.exe>
2026-02-22 21:38:33,758 [root] DEBUG: 7768: DLL loaded at 0x00007FFED5000000: C:\Windows\system32\IconCodecService (0x9000 bytes).
2026-02-22 21:38:34,072 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 3548
2026-02-22 21:38:34,073 [lib.api.process] INFO: Monitor config for <Process 3548 astrsk.exe>: C:\wla960fi\dll\3548.ini
2026-02-22 21:38:34,257 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDB5D0000: C:\Windows\SYSTEM32\WindowsCodecs (0x1b4000 bytes).
2026-02-22 21:38:34,773 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\f88fe97f-46a0-4651-93b9-3056d42dece1.tmp
2026-02-22 21:38:34,805 [root] DEBUG: 7768: DLL loaded at 0x00007FFED7060000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-02-22 21:38:35,021 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDE960000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-02-22 21:38:35,248 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDF450000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-02-22 21:38:35,310 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDCFB0000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-02-22 21:38:35,348 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:35,373 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:35,384 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDD7E0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-02-22 21:38:35,452 [root] DEBUG: 7768: DLL loaded at 0x00007FFECDEE0000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-02-22 21:38:35,475 [root] DEBUG: Loader: Injecting process 10432 (thread 10436) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:35,612 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:38:35,633 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\4be668e5-a9d9-4858-a10e-a65f2dc8d962.tmp
2026-02-22 21:38:35,733 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:35,834 [lib.api.process] INFO: Injected into 64-bit <Process 10432 astrsk.exe>
2026-02-22 21:38:36,893 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 10432
2026-02-22 21:38:36,895 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\Network Persistent State~RF6cc2c.TMP to files\226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974; Size is 59; Max size: 100000000
2026-02-22 21:38:36,905 [root] DEBUG: 7768: CreateProcessHandler: Injection info set for new process 10644: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:38:36,913 [lib.api.process] INFO: Monitor config for <Process 10432 astrsk.exe>: C:\wla960fi\dll\10432.ini
2026-02-22 21:38:36,914 [root] DEBUG: 7768: DLL loaded at 0x00007FFED9880000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-02-22 21:38:36,924 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 10644
2026-02-22 21:38:36,924 [lib.api.process] INFO: Monitor config for <Process 10644 astrsk.exe>: C:\wla960fi\dll\10644.ini
2026-02-22 21:38:36,955 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\17301c6e-58e4-41e4-8fa2-a90899414158.tmp
2026-02-22 21:38:37,042 [root] DEBUG: 7768: DLL loaded at 0x00007FFED97F0000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-02-22 21:38:37,146 [root] INFO: Error dumping file from path "C:\Users\Admin\AppData\Roaming\astrsk_ai\Preferences~RF6d227.TMP": [Errno 13] Permission denied: 'C:\\Users\\Admin\\AppData\\Roaming\\astrsk_ai\\Preferences~RF6d227.TMP'
2026-02-22 21:38:37,237 [root] DEBUG: 7768: DLL loaded at 0x00007FFED6750000: C:\Windows\System32\Windows.Globalization (0x1a6000 bytes).
2026-02-22 21:38:37,690 [root] DEBUG: 7768: DLL loaded at 0x00007FFEC3CA0000: C:\Windows\System32\MsSpellCheckingFacility (0xed000 bytes).
2026-02-22 21:38:38,265 [root] DEBUG: 7768: api-rate-cap: memcpy hook disabled due to rate
2026-02-22 21:38:38,427 [root] DEBUG: 7768: DLL loaded at 0x00007FFECFB70000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-02-22 21:38:38,728 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDA360000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-02-22 21:38:38,916 [root] DEBUG: 7768: DLL loaded at 0x00007FFEC96D0000: C:\Windows\SYSTEM32\atlthunk (0xd000 bytes).
2026-02-22 21:38:38,986 [root] DEBUG: 7768: DLL loaded at 0x00007FFECDE70000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-02-22 21:38:38,994 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:39,035 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:39,324 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:39,337 [root] DEBUG: Loader: Injecting process 9724 (thread 9728) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:39,341 [root] DEBUG: 7768: DLL loaded at 0x00007FFED5E60000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-02-22 21:38:39,377 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:39,386 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:38:39,458 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:39,499 [root] DEBUG: Loader: Injecting process 9588 (thread 9592) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:39,518 [lib.api.process] INFO: Injected into 64-bit <Process 9724 astrsk.exe>
2026-02-22 21:38:39,586 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:38:39,707 [root] DEBUG: 6836: WriteMemoryHandler: shellcode at 0x00004DEC000A65F0 (size 0x68) injected into process 7360 at 0x000002BA29D20000.
2026-02-22 21:38:39,794 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:39,897 [root] DEBUG: 9724: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:38:39,948 [lib.api.process] INFO: Injected into 64-bit <Process 9588 astrsk.exe>
2026-02-22 21:38:40,073 [root] DEBUG: 9724: Dropped file limit defaulting to 100.
2026-02-22 21:38:40,081 [root] DEBUG: 9588: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:38:40,161 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\6836_2853639381822022026 to CAPE\fda772a9878f477e34c141bf5fe9fce4e1daad4efc446c1e0be374440fa07c14; Size is 97; Max size: 100000000
2026-02-22 21:38:40,162 [root] DEBUG: 6792: WriteMemoryHandler: shellcode at 0x000061BC000A6510 (size 0x68) injected into process 8324 at 0x000001C81C690000.
2026-02-22 21:38:40,220 [root] DEBUG: 9588: Dropped file limit defaulting to 100.
2026-02-22 21:38:40,226 [root] DEBUG: 9724: Disabling sleep skipping.
2026-02-22 21:38:40,626 [root] DEBUG: 6836: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\6836_2853639381822022026 (size 97 bytes)
2026-02-22 21:38:42,283 [root] DEBUG: 9724: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:38:42,324 [root] DEBUG: 6836: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:38:42,334 [root] DEBUG: 9588: Disabling sleep skipping.
2026-02-22 21:38:42,348 [root] DEBUG: 9724: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:38:42,354 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\6792_738040381822022026 to CAPE\7caf50e3edebeacc012a217b5f63a0fe4c16c6be703e4d58247b535ddc5b857c; Size is 97; Max size: 100000000
2026-02-22 21:38:42,376 [root] DEBUG: 9588: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:38:42,379 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:42,573 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:38:42,575 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:38:42,588 [root] DEBUG: 9588: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:38:42,623 [root] DEBUG: 6792: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\6792_738040381822022026 (size 97 bytes)
2026-02-22 21:38:42,628 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:38:42,846 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:42,940 [root] DEBUG: 7768: DLL loaded at 0x00007FFEE0450000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-02-22 21:38:43,278 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\Preferences~RF6e6b9.TMP to files\2b71b6187f43507cab9a2b6603e219f5db21726129447c3afb657e70a08280e3; Size is 90; Max size: 100000000
2026-02-22 21:38:43,723 [root] DEBUG: 6792: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:38:43,874 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:43,884 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:43,896 [root] DEBUG: 7768: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:38:43,900 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:38:43,923 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:38:43,929 [root] DEBUG: 9724: Monitor initialised: 64-bit capemon loaded in process 9724 at 0x00007FFEB5DB0000, thread 9728, image base 0x00007FF7778F0000, stack from 0x0000009E41FF5000-0x0000009E42000000
2026-02-22 21:38:43,968 [root] DEBUG: 9588: Monitor initialised: 64-bit capemon loaded in process 9588 at 0x00007FFEB5DB0000, thread 9592, image base 0x00007FF7778F0000, stack from 0x00000004BBDF5000-0x00000004BBE00000
2026-02-22 21:38:44,138 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDFB90000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-02-22 21:38:44,140 [root] DEBUG: 9724: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --app-user-model-id=com.astrsk.ai-app --app-path="C:\Users\Admin\AppData\Local\Programs\electron\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1.5 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1771785069905326 --launch-time-
2026-02-22 21:38:44,183 [root] DEBUG: 9588: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --app-user-model-id=com.astrsk.ai-app --app-path="C:\Users\Admin\AppData\Local\Programs\electron\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1.5 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1884,i,3550053115993098354,12756643441
2026-02-22 21:38:44,234 [root] DEBUG: 9724: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:38:44,286 [root] DEBUG: 9588: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:38:44,361 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:38:44,458 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:38:44,480 [root] DEBUG: 9724: set_hooks: Unable to hook LockResource
2026-02-22 21:38:44,558 [root] DEBUG: 9724: Hooked 619 out of 620 functions
2026-02-22 21:38:44,650 [root] DEBUG: 9588: set_hooks: Unable to hook LockResource
2026-02-22 21:38:45,060 [root] DEBUG: 7768: DLL loaded at 0x00007FFEDF420000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-02-22 21:38:45,083 [root] DEBUG: 9588: Hooked 619 out of 620 functions
2026-02-22 21:38:45,587 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:45,591 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:45,603 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:45,604 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:45,618 [root] DEBUG: 6792: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:38:45,974 [root] DEBUG: Loader: Injecting process 11036 (thread 11040) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:45,996 [root] DEBUG: 9724: Syscall hook installed, syscall logging level 1
2026-02-22 21:38:46,086 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:38:46,092 [root] DEBUG: 9724: RestoreHeaders: Restored original import table.
2026-02-22 21:38:46,129 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:46,173 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:46,178 [root] INFO: Loaded monitor into process with pid 9724
2026-02-22 21:38:46,180 [root] DEBUG: 9588: Syscall hook installed, syscall logging level 1
2026-02-22 21:38:46,197 [lib.api.process] INFO: Injected into 64-bit <Process 11036 astrsk.exe>
2026-02-22 21:38:46,203 [root] DEBUG: 9588: RestoreHeaders: Restored original import table.
2026-02-22 21:38:46,209 [root] DEBUG: 9724: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:38:46,225 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 11036
2026-02-22 21:38:46,238 [root] INFO: Loaded monitor into process with pid 9588
2026-02-22 21:38:46,246 [lib.api.process] INFO: Monitor config for <Process 11036 astrsk.exe>: C:\wla960fi\dll\11036.ini
2026-02-22 21:38:46,251 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:46,280 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:46,282 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:46,334 [root] DEBUG: 9588: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:38:46,418 [root] DEBUG: Loader: Injecting process 3548 (thread 3132) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:46,426 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:46,733 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:38:46,996 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:47,512 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:47,538 [lib.api.process] INFO: Injected into 64-bit <Process 3548 astrsk.exe>
2026-02-22 21:38:47,574 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:47,627 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:47,771 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:47,895 [root] DEBUG: 6792: api-cap: MsgWaitForMultipleObjectsEx hook disabled due to count: 5000
2026-02-22 21:38:47,978 [root] DEBUG: 6792: api-cap: MsgWaitForMultipleObjectsEx hook disabled due to count: 5001
2026-02-22 21:38:48,560 [root] DEBUG: 6792: api-cap: NtWaitForSingleObject hook disabled due to count: 5000
2026-02-22 21:38:48,673 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:48,674 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:48,710 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:48,739 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:48,797 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:48,809 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:48,821 [root] DEBUG: Loader: Injecting process 10644 (thread 4008) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:48,828 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:48,831 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:38:48,833 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:48,916 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:48,918 [root] DEBUG: Loader: Injecting process 10432 (thread 10436) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:48,978 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:38:49,007 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:49,010 [lib.api.process] INFO: Injected into 64-bit <Process 10644 astrsk.exe>
2026-02-22 21:38:49,019 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 10644
2026-02-22 21:38:49,019 [lib.api.process] INFO: Monitor config for <Process 10644 astrsk.exe>: C:\wla960fi\dll\10644.ini
2026-02-22 21:38:49,045 [lib.api.process] INFO: Injected into 64-bit <Process 10432 astrsk.exe>
2026-02-22 21:38:49,164 [root] DEBUG: 10432: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:38:49,167 [root] DEBUG: 7708: CreateProcessHandler: Injection info set for new process 11956: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:38:49,182 [root] DEBUG: 10432: Dropped file limit defaulting to 100.
2026-02-22 21:38:49,193 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 11956
2026-02-22 21:38:49,194 [lib.api.process] INFO: Monitor config for <Process 11956 astrsk.exe>: C:\wla960fi\dll\11956.ini
2026-02-22 21:38:49,213 [root] DEBUG: 10432: Disabling sleep skipping.
2026-02-22 21:38:49,241 [root] DEBUG: 10432: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:38:49,286 [root] DEBUG: 10432: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:38:49,314 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:49,733 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:49,873 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:49,903 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:49,919 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:50,325 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:50,335 [root] DEBUG: 10432: Monitor initialised: 64-bit capemon loaded in process 10432 at 0x00007FFEB5DB0000, thread 10436, image base 0x00007FF7778F0000, stack from 0x00000014D27F5000-0x00000014D2800000
2026-02-22 21:38:50,338 [root] DEBUG: 10432: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --field-trial-handle=1880,i,4921960834647096635,7588346304938389498,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessC
2026-02-22 21:38:50,368 [root] DEBUG: 10432: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:38:50,446 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:38:50,468 [root] DEBUG: 10432: set_hooks: Unable to hook LockResource
2026-02-22 21:38:50,495 [root] DEBUG: 10432: Hooked 619 out of 620 functions
2026-02-22 21:38:50,924 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:50,964 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:50,968 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:51,022 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:51,506 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:51,524 [root] DEBUG: 10432: Syscall hook installed, syscall logging level 1
2026-02-22 21:38:51,549 [root] DEBUG: 10432: RestoreHeaders: Restored original import table.
2026-02-22 21:38:51,583 [root] INFO: Loaded monitor into process with pid 10432
2026-02-22 21:38:51,631 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:38:51,667 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:52,050 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:52,089 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:52,098 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:52,123 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:52,675 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:52,695 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:53,102 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:38:53,189 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:53,224 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:53,230 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:53,233 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:38:53,235 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:53,465 [root] DEBUG: Loader: Injecting process 7360 (thread 3888) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:53,698 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:38:53,732 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:38:53,744 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:53,778 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:53,825 [lib.api.process] INFO: Injected into 64-bit <Process 7360 astrsk.exe>
2026-02-22 21:38:53,997 [root] DEBUG: 6836: WriteMemoryHandler: shellcode at 0x00004DEC00BD64C0 (size 0x20) injected into process 7360 at 0x000002BA29D3B420.
2026-02-22 21:38:54,326 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:54,342 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\6836_1837466553381822022026 to CAPE\fcf5763a24f7bf207baebc870c0c60931c39636582e0697e55266b98a8e33e08; Size is 27; Max size: 100000000
2026-02-22 21:38:54,371 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:54,578 [root] DEBUG: 9588: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:38:54,624 [root] DEBUG: 6836: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\6836_1837466553381822022026 (size 27 bytes)
2026-02-22 21:38:54,632 [root] DEBUG: 9724: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:38:54,651 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:54,651 [root] DEBUG: 9588: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 9592).
2026-02-22 21:38:54,731 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:54,789 [root] DEBUG: 9724: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 9728).
2026-02-22 21:38:54,799 [root] DEBUG: 9588: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:54,799 [root] DEBUG: 6836: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:38:55,113 [root] DEBUG: 9724: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:55,757 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:55,859 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:38:55,860 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:38:55,877 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:55,889 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:56,136 [root] DEBUG: 9588: Yara error: Scanning timed out
2026-02-22 21:38:56,142 [root] DEBUG: 9724: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:38:56,151 [root] DEBUG: 9724: Yara error: Scanning timed out
2026-02-22 21:38:56,171 [root] DEBUG: 9588: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:38:56,400 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:56,412 [root] DEBUG: 9588: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 8.192596e-05)
2026-02-22 21:38:56,431 [root] DEBUG: 9724: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:38:56,553 [root] DEBUG: 9588: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:38:56,560 [root] DEBUG: 9588: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:38:56,593 [root] DEBUG: 9588: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:38:56,617 [root] DEBUG: 9588: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:38:56,793 [root] DEBUG: 9588: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:38:56,794 [root] DEBUG: 9724: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:38:56,837 [root] DEBUG: 9724: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:38:56,866 [root] DEBUG: 9724: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:38:56,892 [root] DEBUG: 9724: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:38:56,908 [root] DEBUG: 9588: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:38:57,148 [root] DEBUG: 9724: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:38:57,308 [root] DEBUG: 9724: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:38:57,450 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:57,471 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:58,523 [root] INFO: Added new file to list with pid None and path C:\Temp\158049f3-4fa7-4b03-997a-59fd6f2cf096.tmp
2026-02-22 21:38:58,642 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:38:58,779 [root] DEBUG: 9588: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:38:59,184 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:38:59,189 [root] INFO: Added new file to list with pid None and path C:\Temp\9a134021-5ca3-4d3b-aa6b-361f4f2d4106.tmp
2026-02-22 21:38:59,304 [root] DEBUG: 9588: DLL loaded at 0x00007FFEC2CD0000: C:\Users\Admin\AppData\Local\Programs\electron\ffmpeg (0x3cf000 bytes).
2026-02-22 21:38:59,444 [root] DEBUG: 9724: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:38:59,829 [root] DEBUG: 9724: DLL loaded at 0x00007FFEC2CD0000: C:\Users\Admin\AppData\Local\Programs\electron\ffmpeg (0x3cf000 bytes).
2026-02-22 21:39:03,094 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:39:03,200 [root] DEBUG: 9588: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:39:03,207 [root] DEBUG: 9724: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC0C0000.
2026-02-22 21:39:03,248 [root] DEBUG: 6792: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5000
2026-02-22 21:39:04,131 [root] DEBUG: 9724: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:39:04,324 [root] DEBUG: 7768: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:05,240 [root] DEBUG: 9588: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:39:05,313 [root] DEBUG: 9724: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:05,491 [root] DEBUG: 9724: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:39:05,805 [root] DEBUG: 9588: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC100000.
2026-02-22 21:39:05,903 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:05,940 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:06,163 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:07,822 [root] DEBUG: 9588: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:08,269 [root] DEBUG: Loader: Injecting process 8324 (thread 8328) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:08,592 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:39:09,234 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:09,383 [root] DEBUG: 10432: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:39:09,595 [root] DEBUG: 10432: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 10436).
2026-02-22 21:39:09,604 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:09,632 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:09,636 [root] DEBUG: 10432: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:09,639 [root] DEBUG: 9588: api-cap: memcpy hook disabled due to count: 5000
2026-02-22 21:39:09,705 [root] DEBUG: 9724: api-cap: memcpy hook disabled due to count: 5000
2026-02-22 21:39:10,206 [lib.api.process] INFO: Injected into 64-bit <Process 8324 astrsk.exe>
2026-02-22 21:39:10,254 [root] DEBUG: 6792: WriteMemoryHandler: shellcode at 0x000061BC00B86D90 (size 0x20) injected into process 8324 at 0x000001C81C6ADC20.
2026-02-22 21:39:10,269 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\6792_448748110391822022026 to CAPE\fcf5763a24f7bf207baebc870c0c60931c39636582e0697e55266b98a8e33e08; Size is 27; Max size: 100000000
2026-02-22 21:39:10,278 [root] DEBUG: 6792: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\6792_448748110391822022026 (size 27 bytes)
2026-02-22 21:39:10,283 [root] DEBUG: 6792: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:39:10,290 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:39:10,291 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:39:10,608 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:39:10,683 [root] DEBUG: 10432: Yara error: Scanning timed out
2026-02-22 21:39:10,844 [root] DEBUG: 10432: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:39:10,860 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:10,881 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:10,919 [root] DEBUG: 10432: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:39:10,929 [root] DEBUG: Loader: Injecting process 11036 (thread 11040) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:10,940 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:10,941 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:10,950 [lib.api.process] INFO: Injected into 64-bit <Process 11036 astrsk.exe>
2026-02-22 21:39:11,094 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:11,105 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:11,121 [root] DEBUG: Loader: Injecting process 11956 (thread 11960) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:11,124 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:39:11,127 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:11,136 [lib.api.process] INFO: Injected into 64-bit <Process 11956 astrsk.exe>
2026-02-22 21:39:11,147 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 11956
2026-02-22 21:39:11,155 [lib.api.process] INFO: Monitor config for <Process 11956 astrsk.exe>: C:\wla960fi\dll\11956.ini
2026-02-22 21:39:11,201 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:11,220 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:11,240 [root] DEBUG: Loader: Injecting process 10644 (thread 4008) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:11,246 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:11,288 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:11,345 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:39:11,349 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:39:11,350 [lib.api.process] INFO: Injected into 64-bit <Process 10644 astrsk.exe>
2026-02-22 21:39:11,433 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:39:11,434 [root] DEBUG: 10644: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:39:11,440 [root] DEBUG: 7768: CreateProcessHandler: Injection info set for new process 12580: C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe, ImageBase: 0x00007FF7778F0000
2026-02-22 21:39:11,443 [root] DEBUG: 10644: Dropped file limit defaulting to 100.
2026-02-22 21:39:11,450 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 12580
2026-02-22 21:39:11,452 [root] DEBUG: 10644: Disabling sleep skipping.
2026-02-22 21:39:11,453 [lib.api.process] INFO: Monitor config for <Process 12580 astrsk.exe>: C:\wla960fi\dll\12580.ini
2026-02-22 21:39:11,456 [root] DEBUG: 10644: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:39:11,457 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:39:11,483 [root] DEBUG: 10644: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:39:11,490 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:11,612 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:39:11,717 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:39:11,720 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:11,735 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:11,891 [root] DEBUG: Loader: Injecting process 7360 (thread 3888) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:11,955 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:12,044 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:12,080 [lib.api.process] INFO: Injected into 64-bit <Process 7360 astrsk.exe>
2026-02-22 21:39:12,105 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:39:12,107 [root] DEBUG: 10432: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:39:12,117 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:39:12,509 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:12,513 [root] DEBUG: 10644: Monitor initialised: 64-bit capemon loaded in process 10644 at 0x00007FFEB5DB0000, thread 4008, image base 0x00007FF7778F0000, stack from 0x000000E51EDF5000-0x000000E51EE00000
2026-02-22 21:39:12,515 [root] DEBUG: 10644: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --field-trial-handle=1876,i,7099550206353611405,18203981066235433385,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcess
2026-02-22 21:39:12,564 [root] DEBUG: 10644: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:39:12,700 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:39:12,708 [root] DEBUG: 10644: set_hooks: Unable to hook LockResource
2026-02-22 21:39:12,732 [root] DEBUG: 10644: Hooked 619 out of 620 functions
2026-02-22 21:39:12,884 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:39:12,986 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:39:13,102 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:39:13,165 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:39:13,797 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:13,930 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:13,942 [root] DEBUG: 10644: Syscall hook installed, syscall logging level 1
2026-02-22 21:39:13,946 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:13,975 [root] DEBUG: 10432: DLL loaded at 0x00007FFED87C0000: C:\Windows\System32\rasadhlp (0xa000 bytes).
2026-02-22 21:39:14,026 [root] DEBUG: 10644: RestoreHeaders: Restored original import table.
2026-02-22 21:39:14,030 [root] DEBUG: Loader: Injecting process 8324 (thread 8328) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:14,039 [root] INFO: Loaded monitor into process with pid 10644
2026-02-22 21:39:14,064 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:14,067 [root] DEBUG: 10644: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:39:14,145 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:14,176 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:14,182 [lib.api.process] INFO: Injected into 64-bit <Process 8324 astrsk.exe>
2026-02-22 21:39:14,352 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:39:14,356 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:39:14,450 [root] DEBUG: 7708: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5000
2026-02-22 21:39:14,460 [root] DEBUG: 7708: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5001
2026-02-22 21:39:15,180 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:15,187 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:15,329 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:15,350 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:15,350 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:15,368 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:15,401 [root] DEBUG: Loader: Injecting process 12580 (thread 12584) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:15,425 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-02-22 21:39:15,433 [root] DEBUG: Loader: Injecting process 11956 (thread 11960) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:15,433 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:15,435 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:15,439 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:15,442 [lib.api.process] INFO: Injected into 64-bit <Process 12580 astrsk.exe>
2026-02-22 21:39:15,450 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 12580
2026-02-22 21:39:15,461 [lib.api.process] INFO: Monitor config for <Process 12580 astrsk.exe>: C:\wla960fi\dll\12580.ini
2026-02-22 21:39:15,473 [lib.api.process] INFO: Injected into 64-bit <Process 11956 astrsk.exe>
2026-02-22 21:39:15,511 [root] DEBUG: 11956: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:39:15,521 [root] DEBUG: 7708: WriteMemoryHandler: shellcode at 0x000047F400086510 (size 0x68) injected into process 3548 at 0x000001FC43F10000.
2026-02-22 21:39:15,525 [root] DEBUG: 11956: Dropped file limit defaulting to 100.
2026-02-22 21:39:15,543 [root] DEBUG: 11956: Disabling sleep skipping.
2026-02-22 21:39:15,553 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\7708_2123815391822022026 to CAPE\f9669a13b37817f5fa11847d1fb773c0fad0446ed99fdd0080daf7bac9bd588e; Size is 97; Max size: 100000000
2026-02-22 21:39:15,557 [root] DEBUG: 11956: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:39:15,559 [root] DEBUG: 7708: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\7708_2123815391822022026 (size 97 bytes)
2026-02-22 21:39:15,576 [root] DEBUG: 7708: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:39:15,586 [root] DEBUG: 11956: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:39:15,592 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 3548
2026-02-22 21:39:15,594 [lib.api.process] INFO: Monitor config for <Process 3548 astrsk.exe>: C:\wla960fi\dll\3548.ini
2026-02-22 21:39:15,597 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:16,329 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:16,406 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:16,906 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:16,909 [root] DEBUG: 7708: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:16,925 [root] DEBUG: 11956: Monitor initialised: 64-bit capemon loaded in process 11956 at 0x00007FFEB5DB0000, thread 11960, image base 0x00007FF7778F0000, stack from 0x000000229F1F5000-0x000000229F200000
2026-02-22 21:39:16,928 [root] DEBUG: 11956: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --app-user-model-id=com.astrsk.ai-app --app-path="C:\Users\Admin\AppData\Local\Programs\electron\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1.5 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1771785069904985 --launch-time
2026-02-22 21:39:16,996 [root] DEBUG: 11956: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:39:17,050 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:39:17,063 [root] DEBUG: 11956: set_hooks: Unable to hook LockResource
2026-02-22 21:39:17,078 [root] DEBUG: 11956: Hooked 619 out of 620 functions
2026-02-22 21:39:17,558 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:17,621 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:18,137 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:18,176 [root] DEBUG: 11956: Syscall hook installed, syscall logging level 1
2026-02-22 21:39:18,188 [root] DEBUG: 11956: RestoreHeaders: Restored original import table.
2026-02-22 21:39:18,208 [root] INFO: Loaded monitor into process with pid 11956
2026-02-22 21:39:18,304 [root] DEBUG: 11956: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:39:18,362 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:18,622 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:18,626 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:18,638 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:18,656 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:18,739 [root] DEBUG: Loader: Injecting process 7360 (thread 3888) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:18,744 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:19,200 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:19,250 [lib.api.process] INFO: Injected into 64-bit <Process 7360 astrsk.exe>
2026-02-22 21:39:19,333 [root] DEBUG: 6836: WriteMemoryHandler: shellcode at 0x00004DEC011602D0 (size 0x20) injected into process 7360 at 0x000002BA29D3B460.
2026-02-22 21:39:19,343 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\6836_205221619391822022026 to CAPE\6dec76456924fe70b1cb79f3e9e16228c40a708547a87d5b75a1ed8d7e88a1fb; Size is 27; Max size: 100000000
2026-02-22 21:39:19,351 [root] DEBUG: 6836: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\6836_205221619391822022026 (size 27 bytes)
2026-02-22 21:39:19,386 [root] DEBUG: 6836: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:39:19,407 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:19,417 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:39:19,428 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:39:19,428 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:19,650 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:19,663 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:20,437 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:20,444 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:20,667 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:20,674 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:20,845 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:20,865 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:20,926 [root] DEBUG: Loader: Injecting process 8324 (thread 8328) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:20,953 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:21,052 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:21,128 [lib.api.process] INFO: Injected into 64-bit <Process 8324 astrsk.exe>
2026-02-22 21:39:21,155 [root] DEBUG: 6792: WriteMemoryHandler: shellcode at 0x000061BC009A9330 (size 0x20) injected into process 8324 at 0x000001C81C6ADC60.
2026-02-22 21:39:21,188 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\6792_95643421391822022026 to CAPE\6dec76456924fe70b1cb79f3e9e16228c40a708547a87d5b75a1ed8d7e88a1fb; Size is 27; Max size: 100000000
2026-02-22 21:39:21,197 [root] DEBUG: 6792: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\6792_95643421391822022026 (size 27 bytes)
2026-02-22 21:39:21,219 [root] DEBUG: 6792: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:39:21,227 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:39:21,229 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:39:21,510 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:21,519 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:21,696 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:21,704 [root] DEBUG: 10644: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:39:21,746 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:21,950 [root] DEBUG: 10644: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 4008).
2026-02-22 21:39:21,982 [root] DEBUG: 10644: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:22,609 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:22,680 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:22,789 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:23,035 [root] DEBUG: 10644: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:39:23,036 [root] DEBUG: 10644: Yara error: Scanning timed out
2026-02-22 21:39:23,274 [root] DEBUG: 10644: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 1.492949e-07)
2026-02-22 21:39:23,637 [root] DEBUG: 10644: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:39:23,641 [root] DEBUG: 10644: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:39:23,667 [root] DEBUG: 10644: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:39:23,687 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:23,694 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:23,694 [root] DEBUG: 10644: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:39:23,701 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:23,740 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:23,743 [root] DEBUG: 7708: Dropped file limit reached.
2026-02-22 21:39:23,777 [root] DEBUG: Loader: Injecting process 3548 (thread 3132) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:23,787 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:23,791 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:23,823 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:23,835 [lib.api.process] INFO: Injected into 64-bit <Process 3548 astrsk.exe>
2026-02-22 21:39:23,852 [root] DEBUG: 7708: WriteMemoryHandler: shellcode at 0x000047F400BF1590 (size 0x20) injected into process 3548 at 0x000001FC43F2BC20.
2026-02-22 21:39:23,859 [root] DEBUG: 10644: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:39:23,866 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\7708_1553074723391822022026 to CAPE\fcf5763a24f7bf207baebc870c0c60931c39636582e0697e55266b98a8e33e08; Size is 27; Max size: 100000000
2026-02-22 21:39:23,869 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:23,871 [root] DEBUG: 7708: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\7708_1553074723391822022026 (size 27 bytes)
2026-02-22 21:39:23,914 [root] DEBUG: 7708: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:39:23,916 [root] DEBUG: Loader: Injecting process 12580 (thread 12584) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:23,919 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 3548
2026-02-22 21:39:23,928 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:23,929 [lib.api.process] INFO: Monitor config for <Process 3548 astrsk.exe>: C:\wla960fi\dll\3548.ini
2026-02-22 21:39:23,930 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:23,964 [lib.api.process] INFO: Injected into 64-bit <Process 12580 astrsk.exe>
2026-02-22 21:39:23,965 [root] DEBUG: 10644: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:39:24,529 [root] DEBUG: 12580: Python path set to 'C:\Users\Admin\AppData\Local\Programs\Python\Python313-32'.
2026-02-22 21:39:24,572 [root] DEBUG: 7768: WriteMemoryHandler: shellcode at 0x0000292C000A6510 (size 0x68) injected into process 11036 at 0x00000254470E0000.
2026-02-22 21:39:24,585 [root] DEBUG: 12580: Dropped file limit defaulting to 100.
2026-02-22 21:39:24,596 [root] DEBUG: 10644: DLL loaded at 0x00007FFED0960000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-02-22 21:39:24,639 [lib.common.results] INFO: Uploading file C:\ADDMiu\CAPE\7768_2300124391822022026 to CAPE\f9669a13b37817f5fa11847d1fb773c0fad0446ed99fdd0080daf7bac9bd588e; Size is 97; Max size: 100000000
2026-02-22 21:39:24,649 [root] DEBUG: 7768: DumpMemory: Payload successfully created: C:\ADDMiu\CAPE\7768_2300124391822022026 (size 97 bytes)
2026-02-22 21:39:24,649 [root] DEBUG: 12580: Disabling sleep skipping.
2026-02-22 21:39:24,659 [root] DEBUG: 7768: WriteMemoryHandler: Dumped injected code/data from buffer.
2026-02-22 21:39:24,666 [root] DEBUG: 12580: YaraInit: Compiled rules loaded from existing file C:\wla960fi\data\yara\capemon.yac
2026-02-22 21:39:24,697 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 11036
2026-02-22 21:39:24,698 [lib.api.process] INFO: Monitor config for <Process 11036 astrsk.exe>: C:\wla960fi\dll\11036.ini
2026-02-22 21:39:24,710 [root] DEBUG: 12580: RtlInsertInvertedFunctionTable 0x00007FFEE348090E, LdrpInvertedFunctionTableSRWLock 0x00007FFEE35DD4F0
2026-02-22 21:39:24,721 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:24,726 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:24,754 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:25,763 [root] DEBUG: 10644: DLL loaded at 0x00007FFEDC5B0000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-02-22 21:39:25,861 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:25,870 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:25,889 [root] DEBUG: 12580: Monitor initialised: 64-bit capemon loaded in process 12580 at 0x00007FFEB5DB0000, thread 12584, image base 0x00007FF7778F0000, stack from 0x0000003561BF5000-0x0000003561C00000
2026-02-22 21:39:25,894 [root] DEBUG: 12580: Commandline: "C:\Users\Admin\AppData\Local\Programs\electron\astrsk.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\astrsk_ai" --app-user-model-id=com.astrsk.ai-app --app-path="C:\Users\Admin\AppData\Local\Programs\electron\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1.5 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1771785069905608 --launch-time
2026-02-22 21:39:25,917 [root] DEBUG: 11956: caller_dispatch: Scanning calling region at 0x00007FF7778F0000...
2026-02-22 21:39:25,928 [root] DEBUG: 12580: hook_api: LdrpCallInitRoutine export address 0x00007FFEE34899BC obtained via GetFunctionAddress
2026-02-22 21:39:25,987 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:26,017 [root] WARNING: b'Unable to place hook on LockResource'
2026-02-22 21:39:26,043 [root] DEBUG: 10644: DLL loaded at 0x00007FFEE2110000: C:\Windows\System32\NSI (0x8000 bytes).
2026-02-22 21:39:26,163 [root] DEBUG: 12580: set_hooks: Unable to hook LockResource
2026-02-22 21:39:26,182 [root] DEBUG: 11956: caller_dispatch: Added region at 0x00007FF7778F0000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x00007FF77C9F1FB3, thread 11960).
2026-02-22 21:39:26,182 [root] DEBUG: 10644: DLL loaded at 0x00007FFEDADE0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-02-22 21:39:26,196 [root] DEBUG: 12580: Hooked 619 out of 620 functions
2026-02-22 21:39:26,201 [root] DEBUG: 11956: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:26,600 [root] DEBUG: 10644: DLL loaded at 0x00007FFEDFF90000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-02-22 21:39:27,425 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:27,437 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:27,448 [root] DEBUG: 11956: Yara error: Scanning timed out
2026-02-22 21:39:27,587 [root] DEBUG: 10644: DLL loaded at 0x00007FFED87C0000: C:\Windows\System32\rasadhlp (0xa000 bytes).
2026-02-22 21:39:27,691 [root] DEBUG: 12580: Syscall hook installed, syscall logging level 1
2026-02-22 21:39:27,710 [root] DEBUG: 11956: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:39:27,736 [root] DEBUG: 11956: ProcessImageBase: Main module image at 0x00007FF7778F0000 unmodified (entropy change 0.000000e+00)
2026-02-22 21:39:27,769 [root] DEBUG: 7768: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5001
2026-02-22 21:39:27,889 [root] DEBUG: 12580: RestoreHeaders: Restored original import table.
2026-02-22 21:39:27,910 [root] INFO: Loaded monitor into process with pid 12580
2026-02-22 21:39:27,937 [root] DEBUG: 7768: api-cap: NtQueryPerformanceCounter hook disabled due to count: 5001
2026-02-22 21:39:27,974 [root] DEBUG: 12580: DLL loaded at 0x00007FFEE1390000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-02-22 21:39:28,108 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:28,187 [root] DEBUG: 11956: DLL loaded at 0x00007FFEE09F0000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-02-22 21:39:28,231 [root] DEBUG: 11956: DLL loaded at 0x00007FFEE09D0000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-02-22 21:39:28,297 [root] DEBUG: 11956: DLL loaded at 0x00007FFEDE5B0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-02-22 21:39:28,427 [root] DEBUG: 11956: DLL loaded at 0x00007FFEE0260000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-02-22 21:39:28,720 [root] DEBUG: 11956: DLL loaded at 0x00007FFEE2330000: C:\Windows\System32\SHELL32 (0x745000 bytes).
2026-02-22 21:39:28,763 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:28,765 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:28,871 [root] DEBUG: 11956: DLL loaded at 0x00007FFEDFCB0000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-02-22 21:39:28,897 [root] DEBUG: Loader: Injecting process 7360 (thread 3888) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:28,906 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:28,909 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:28,948 [lib.api.process] INFO: Injected into 64-bit <Process 7360 astrsk.exe>
2026-02-22 21:39:28,966 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 7360
2026-02-22 21:39:28,968 [lib.api.process] INFO: Monitor config for <Process 7360 astrsk.exe>: C:\wla960fi\dll\7360.ini
2026-02-22 21:39:29,111 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:29,118 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:30,806 [root] DEBUG: 7768: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:30,816 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:30,975 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:30,978 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\SharedStorage-journal
2026-02-22 21:39:30,982 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:31,034 [root] DEBUG: 11956: ProtectionHandler: Adding region at 0x00007FF7DC080000 to tracked regions.
2026-02-22 21:39:31,064 [root] DEBUG: 7768: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:31,075 [lib.common.results] INFO: Uploading file C:\Users\Admin\AppData\Roaming\astrsk_ai\SharedStorage-journal to files\d0a35a5d98d9a268b84da2852be75229e36f6245f1b18f16f1e51d12a8793c44; Size is 512; Max size: 100000000
2026-02-22 21:39:31,131 [root] DEBUG: Loader: Injecting process 8324 (thread 8328) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:31,142 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:31,150 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:31,159 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:31,418 [lib.api.process] INFO: Injected into 64-bit <Process 8324 astrsk.exe>
2026-02-22 21:39:31,418 [root] DEBUG: 11956: DLL loaded at 0x00007FFEC2CD0000: C:\Users\Admin\AppData\Local\Programs\electron\ffmpeg (0x3cf000 bytes).
2026-02-22 21:39:31,447 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 8324
2026-02-22 21:39:31,449 [lib.api.process] INFO: Monitor config for <Process 8324 astrsk.exe>: C:\wla960fi\dll\8324.ini
2026-02-22 21:39:34,055 [root] DEBUG: 10432: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:39:34,083 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:34,108 [root] DEBUG: 11956: set_hooks_by_export_directory: Hooked 0 out of 620 functions
2026-02-22 21:39:34,119 [root] DEBUG: 11956: AllocationHandler: Previously reserved region at 0x00007FF7DC080000, committing at: 0x00007FF7DC0C0000.
2026-02-22 21:39:34,160 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\06864001-ab3e-4537-9e58-490e8f2cdc10.tmp
2026-02-22 21:39:34,367 [root] INFO: Added new file to list with pid None and path C:\Users\Admin\AppData\Roaming\astrsk_ai\Network\cdbfd1c6-043b-447f-a70f-e6ca3659939c.tmp
2026-02-22 21:39:34,368 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:39:34,438 [root] DEBUG: 11956: DLL loaded at 0x00007FFEDEA70000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-02-22 21:39:34,454 [root] DEBUG: 11956: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:34,476 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:35,626 [root] DEBUG: 11956: AllocationHandler: Allocation already in tracked region list: 0x00007FF7DC080000.
2026-02-22 21:39:36,029 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:36,151 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:37,484 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:37,682 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:39,015 [root] DEBUG: 2552: DLL loaded at 0x00007FFED2240000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-02-22 21:39:39,118 [root] DEBUG: 10432: DLL loaded at 0x00007FFEE2C20000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-02-22 21:39:39,208 [root] DEBUG: 10432: DLL loaded at 0x00007FFEDC240000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-02-22 21:39:39,276 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-02-22 21:39:39,279 [lib.api.process] INFO: 64-bit DLL to inject is C:\wla960fi\dll\YQEfXz.dll, loader C:\wla960fi\bin\SkziWjPL.exe
2026-02-22 21:39:39,381 [root] DEBUG: 10432: DLL loaded at 0x00007FFED74C0000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-02-22 21:39:39,618 [root] DEBUG: 12580: Yara error: Scanning timed out
2026-02-22 21:39:39,659 [root] DEBUG: Loader: Injecting process 3548 (thread 3132) with C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:39,676 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-02-22 21:39:39,719 [root] DEBUG: Successfully injected DLL C:\wla960fi\dll\YQEfXz.dll.
2026-02-22 21:39:39,788 [root] DEBUG: 12580: YaraScan: Scanning 0x00007FF7778F0000, size 0xccd22e6
2026-02-22 21:39:40,011 [lib.api.process] INFO: Injected into 64-bit <Process 3548 astrsk.exe>
2026-02-22 21:39:40,686 [root] INFO: Announced 64-bit process name: astrsk.exe pid: 3548
2026-02-22 21:39:40,686 [lib.api.process] INFO: Monitor config for <Process 3548 astrsk.exe>: C:\wla960fi\dll\3548.ini
2026-02-22 21:39:40,715 [root] INFO: Received shutdown request
| Name | Label | Manager | Started On | Shutdown On | Route |
|---|---|---|---|---|---|
| MalwareGuest | MalwareGuest | Proxmox | 2026-02-22 21:36:25 | 2026-02-22 21:41:18 | none |
| File Name |
astrsk-3.5.4.exe
|
|---|---|
| File Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| File Size | 179014024 bytes |
| MD5 | e6df4d90275b767117bb83da6c31263d |
| SHA1 | b7ec103ca12d515360de708ec83721654fa4588d |
| SHA256 | c0947f6599692c576fb86ff3a3c6956734990b7fb938a4817a3a86a8955fffc4 [VT] [MWDB] [Bazaar] |
| SHA3-384 | 7724c850131bdc08ab2cafd53ac090793f9cb8487d0ad4eca79b9698460a466d7816824e46a968d46ae0d3cbbeafca76 |
| CRC32 | 5C5CFCB0 |
| TLSH | T13D883347C12C622BC1E53E3395D0EF351F4F059B5C82088A8BA6BCF8AE51499A7D9FD1 |
| Ssdeep | 3145728:VCwJoK/iBCT71MT9kCUVEPWzsucGFwJoKx9Qny4RExQVQJ2wcVNqKSXT:wgoyiBSB4AIWjfgoo9MTREvJOVN5ET |
| File Strings BinGraph Vba2Graph |
No hosts contacted.
No domains contacted.
No hosts contacted.
No TCP connections recorded.
No UDP connections recorded.
No domains contacted.
No HTTP(s) requests performed.
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP