Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- usvfs dll 0.5.6.1 initialized in process 18276
- remove from process 18276
- create config in 18276
- 0 processes
- mod_organizer_instance_1 created in process 18276
- attached to mod_organizer_instance_1 with 1 nodes, size 4,194,304 B
- inv_mod_organizer_instance_1 created in process 18276
- attached to inv_mod_organizer_instance_1 with 1 nodes, size 131,072 B
- context current shm: mod_organizer_instance (now 2 connections)
- clearing blacklist
- blacklisting 'Chrome.exe'
- blacklisting 'Firefox.exe'
- blacklisting 'TSVNCache.exe'
- blacklisting 'TGitCache.exe'
- blacklisting 'Steam.exe'
- blacklisting 'GameOverlayUI.exe'
- blacklisting 'Discord.exe'
- blacklisting 'GalaxyClient.exe'
- blacklisting 'Spotify.exe'
- blacklisting 'Brave.exe'
- clearing skip file suffixes
- added skip file suffix '.mohidden'
- clearing skip directories
- added skip directory '.git'
- clearing forced libraries
- ran out of memory in tree mod_organizer_instance_1, will create another one
- creating mod_organizer_instance_2
- mod_organizer_instance_2 created, activating
- will destroy mod_organizer_instance_1
- tree mod_organizer_instance_2 size now 8,388,608 B
- destroying mod_organizer_instance_1
- ran out of memory in tree mod_organizer_instance_2, will create another one
- creating mod_organizer_instance_3
- mod_organizer_instance_3 created, activating
- will destroy mod_organizer_instance_2
- tree mod_organizer_instance_3 size now 16,777,216 B
- destroying mod_organizer_instance_2
- file 'mod_system_visbody_decals.ltx.mohidden' should be skipped, matches file suffix '.mohidden'
- directory '.git' should be skipped
- ran out of memory in tree mod_organizer_instance_3, will create another one
- creating mod_organizer_instance_4
- mod_organizer_instance_4 created, activating
- will destroy mod_organizer_instance_3
- tree mod_organizer_instance_4 size now 33,554,432 B
- destroying mod_organizer_instance_3
- file 'paw_mcm_ext.script.mohidden' should be skipped, matches file suffix '.mohidden'
- file 'dedal.dds.mohidden' should be skipped, matches file suffix '.mohidden'
- clearing forced libraries
- injecting to process 3588 with same bitness
- dll path: G:\GAMMA\usvfs_x64.dll
- injection to same bitness process 3588 successful
- usvfs dll 0.5.6.1 initialized in process 3588
- inithooks called mod_organizer_instance in process G:\Anomaly\AnomalyLauncher.exe:3588 (log level 1, dump type 1, dump path G:/GAMMA/crashDumps)
- access existing config in 3588
- 0 processes
- mod_organizer_instance_4 opened in process 3588
- attached to mod_organizer_instance_4 with 89191 nodes, size 33,554,432 B
- inv_mod_organizer_instance_1 opened in process 3588
- attached to inv_mod_organizer_instance_1 with 133 nodes, size 131,072 B
- Process registered in shared process list : 3588
- Windows version 10.0.26100 sp 0 platform 2 (26100.1.amd64fre.ge_release.240331-1435)
- hooked GetFileAttributesExW (0x7ffebb360a00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFileAttributesW (0x7ffebb37def0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- existing hook to 7ffebb3d44d0 in C:\WINDOWS\System32\KERNELBASE.dll
- hooked SetFileAttributesW (0x7ffebc7476a0) in C:\WINDOWS\System32\KERNEL32.dll type chained patch
- hooked CreateDirectoryW (0x7ffebb3d2ae0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked RemoveDirectoryW (0x7ffebb44aa80) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked DeleteFileW (0x7ffebb4187b0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryA (0x7ffebb44f730) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryW (0x7ffebb4308c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryA (0x7ffebb45ab00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryW (0x7ffebb44a9f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked ExitProcess (0x7ffebdaa8e40) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CreateProcessInternalW (0x7ffebb3d4eb0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileA (0x7ffebc75ea20) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileW (0x7ffebc72e4e0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileExA (0x7ffebc6facf0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileExW (0x7ffebb4311a0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileWithProgressA (0x7ffebc742890) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileWithProgressW (0x7ffebb4311f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFileExW (0x7ffebb43e660) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFile2 (0x7ffebb43df30) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetPrivateProfileStringA (0x7ffebc730040) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetPrivateProfileStringW (0x7ffebc72ae10) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetPrivateProfileSectionA (0x7ffebc733710) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetPrivateProfileSectionW (0x7ffebc6ff0b0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked WritePrivateProfileStringA (0x7ffebc7332e0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked WritePrivateProfileStringW (0x7ffebc6fd2f0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetFullPathNameA (0x7ffebb434c90) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFullPathNameW (0x7ffebb35f950) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked FindFirstFileExW (0x7ffebb37d5c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked NtQueryFullAttributesFile (0x7ffebdc05c30) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryAttributesFile (0x7ffebdc039c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFile (0x7ffebdc038c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFileEx (0x7ffebdc05bb0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtOpenFile (0x7ffebdc03880) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtCreateFile (0x7ffebdc03cc0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtClose (0x7ffebdc03400) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtTerminateProcess (0x7ffebdc037a0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked LoadLibraryExW (0x7ffebb35dc10) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetModuleFileNameW (0x7ffebb3f78c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- inithooks in process 3588 successful
- injecting to process 19492 with same bitness
- dll path: G:\GAMMA\usvfs_x64.dll
- injection to same bitness process 19492 successful
- usvfs dll 0.5.6.1 initialized in process 19492
- inithooks called mod_organizer_instance in process G:\Anomaly\bin\AnomalyDX11AVX.exe:19492 (log level 1, dump type 1, dump path G:/GAMMA/crashDumps)
- access existing config in 19492
- 1 processes
- mod_organizer_instance_4 opened in process 19492
- attached to mod_organizer_instance_4 with 89191 nodes, size 33,554,432 B
- inv_mod_organizer_instance_1 opened in process 19492
- attached to inv_mod_organizer_instance_1 with 133 nodes, size 131,072 B
- Process registered in shared process list : 19492
- Windows version 10.0.26100 sp 0 platform 2 (26100.1.amd64fre.ge_release.240331-1435)
- hooked GetFileAttributesExW (0x7ffebb360a00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFileAttributesW (0x7ffebb37def0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- existing hook to 7ffebb3d44d0 in C:\WINDOWS\System32\KERNELBASE.dll
- hooked SetFileAttributesW (0x7ffebc7476a0) in C:\WINDOWS\System32\KERNEL32.DLL type chained patch
- hooked CreateDirectoryW (0x7ffebb3d2ae0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked RemoveDirectoryW (0x7ffebb44aa80) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked DeleteFileW (0x7ffebb4187b0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryA (0x7ffebb44f730) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryW (0x7ffebb4308c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryA (0x7ffebb45ab00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryW (0x7ffebb44a9f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked ExitProcess (0x7ffebdaa8e40) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CreateProcessInternalW (0x7ffebb3d4eb0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileA (0x7ffebc75ea20) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileW (0x7ffebc72e4e0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileExA (0x7ffebc6facf0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileExW (0x7ffebb4311a0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileWithProgressA (0x7ffebc742890) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileWithProgressW (0x7ffebb4311f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFileExW (0x7ffebb43e660) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFile2 (0x7ffebb43df30) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetPrivateProfileStringA (0x7ffebc730040) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetPrivateProfileStringW (0x7ffebc72ae10) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetPrivateProfileSectionA (0x7ffebc733710) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetPrivateProfileSectionW (0x7ffebc6ff0b0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked WritePrivateProfileStringA (0x7ffebc7332e0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked WritePrivateProfileStringW (0x7ffebc6fd2f0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetFullPathNameA (0x7ffebb434c90) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFullPathNameW (0x7ffebb35f950) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked FindFirstFileExW (0x7ffebb37d5c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked NtQueryFullAttributesFile (0x7ffebdc05c30) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryAttributesFile (0x7ffebdc039c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFile (0x7ffebdc038c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFileEx (0x7ffebdc05bb0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtOpenFile (0x7ffebdc03880) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtCreateFile (0x7ffebdc03cc0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtClose (0x7ffebdc03400) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtTerminateProcess (0x7ffebdc037a0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked LoadLibraryExW (0x7ffebb35dc10) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetModuleFileNameW (0x7ffebb3f78c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- inithooks in process 19492 successful
- remove from tree xray_pierc.bkp
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.bkp
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.bkp
- remove from tree xray_pierc.log
- mapping file in vfs: g:\anomaly\appdata\logs\xray_pierc.bkp, G:\Anomaly\appdata\logs\xray_pierc.bkp
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.log
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.log
- mapping file in vfs: g:\anomaly\appdata\logs\xray_pierc.log, G:\Anomaly\appdata\logs\xray_pierc.log
- mapping file in vfs: g:\anomaly\appdata\logs\xray_pierc_08-30-25_22-08-31.mdmp, G:\Anomaly\appdata\logs\xray_pierc_08-30-25_22-08-31.mdmp
- releasing hook context
- 3 users left
- releasing hook context
- 2 users left
- file 'mod_system_visbody_decals.ltx.mohidden' should be skipped, matches file suffix '.mohidden'
- directory '.git' should be skipped
- file 'paw_mcm_ext.script.mohidden' should be skipped, matches file suffix '.mohidden'
- file 'dedal.dds.mohidden' should be skipped, matches file suffix '.mohidden'
- clearing forced libraries
- injecting to process 16780 with same bitness
- dll path: G:\GAMMA\usvfs_x64.dll
- injection to same bitness process 16780 successful
- usvfs dll 0.5.6.1 initialized in process 16780
- inithooks called mod_organizer_instance in process G:\Anomaly\AnomalyLauncher.exe:16780 (log level 1, dump type 1, dump path G:/GAMMA/crashDumps)
- access existing config in 16780
- 0 processes
- mod_organizer_instance_4 opened in process 16780
- attached to mod_organizer_instance_4 with 89193 nodes, size 33,554,432 B
- inv_mod_organizer_instance_1 opened in process 16780
- attached to inv_mod_organizer_instance_1 with 133 nodes, size 131,072 B
- Process registered in shared process list : 16780
- Windows version 10.0.26100 sp 0 platform 2 (26100.1.amd64fre.ge_release.240331-1435)
- hooked GetFileAttributesExW (0x7ffebb360a00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFileAttributesW (0x7ffebb37def0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- existing hook to 7ffebb3d44d0 in C:\WINDOWS\System32\KERNELBASE.dll
- hooked SetFileAttributesW (0x7ffebc7476a0) in C:\WINDOWS\System32\KERNEL32.dll type chained patch
- hooked CreateDirectoryW (0x7ffebb3d2ae0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked RemoveDirectoryW (0x7ffebb44aa80) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked DeleteFileW (0x7ffebb4187b0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryA (0x7ffebb44f730) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryW (0x7ffebb4308c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryA (0x7ffebb45ab00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryW (0x7ffebb44a9f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked ExitProcess (0x7ffebdaa8e40) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CreateProcessInternalW (0x7ffebb3d4eb0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileA (0x7ffebc75ea20) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileW (0x7ffebc72e4e0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileExA (0x7ffebc6facf0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileExW (0x7ffebb4311a0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileWithProgressA (0x7ffebc742890) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked MoveFileWithProgressW (0x7ffebb4311f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFileExW (0x7ffebb43e660) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFile2 (0x7ffebb43df30) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetPrivateProfileStringA (0x7ffebc730040) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetPrivateProfileStringW (0x7ffebc72ae10) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetPrivateProfileSectionA (0x7ffebc733710) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetPrivateProfileSectionW (0x7ffebc6ff0b0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked WritePrivateProfileStringA (0x7ffebc7332e0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked WritePrivateProfileStringW (0x7ffebc6fd2f0) in C:\WINDOWS\System32\KERNEL32.dll type overwrite
- hooked GetFullPathNameA (0x7ffebb434c90) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFullPathNameW (0x7ffebb35f950) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked FindFirstFileExW (0x7ffebb37d5c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked NtQueryFullAttributesFile (0x7ffebdc05c30) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryAttributesFile (0x7ffebdc039c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFile (0x7ffebdc038c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFileEx (0x7ffebdc05bb0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtOpenFile (0x7ffebdc03880) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtCreateFile (0x7ffebdc03cc0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtClose (0x7ffebdc03400) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtTerminateProcess (0x7ffebdc037a0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked LoadLibraryExW (0x7ffebb35dc10) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetModuleFileNameW (0x7ffebb3f78c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- inithooks in process 16780 successful
- injecting to process 12000 with same bitness
- dll path: G:\GAMMA\usvfs_x64.dll
- injection to same bitness process 12000 successful
- usvfs dll 0.5.6.1 initialized in process 12000
- inithooks called mod_organizer_instance in process G:\Anomaly\bin\AnomalyDX11AVX.exe:12000 (log level 1, dump type 1, dump path G:/GAMMA/crashDumps)
- access existing config in 12000
- 1 processes
- mod_organizer_instance_4 opened in process 12000
- attached to mod_organizer_instance_4 with 89193 nodes, size 33,554,432 B
- inv_mod_organizer_instance_1 opened in process 12000
- attached to inv_mod_organizer_instance_1 with 133 nodes, size 131,072 B
- Process registered in shared process list : 12000
- Windows version 10.0.26100 sp 0 platform 2 (26100.1.amd64fre.ge_release.240331-1435)
- hooked GetFileAttributesExW (0x7ffebb360a00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFileAttributesW (0x7ffebb37def0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- existing hook to 7ffebb3d44d0 in C:\WINDOWS\System32\KERNELBASE.dll
- hooked SetFileAttributesW (0x7ffebc7476a0) in C:\WINDOWS\System32\KERNEL32.DLL type chained patch
- hooked CreateDirectoryW (0x7ffebb3d2ae0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked RemoveDirectoryW (0x7ffebb44aa80) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked DeleteFileW (0x7ffebb4187b0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryA (0x7ffebb44f730) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetCurrentDirectoryW (0x7ffebb4308c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryA (0x7ffebb45ab00) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked SetCurrentDirectoryW (0x7ffebb44a9f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked ExitProcess (0x7ffebdaa8e40) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CreateProcessInternalW (0x7ffebb3d4eb0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileA (0x7ffebc75ea20) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileW (0x7ffebc72e4e0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileExA (0x7ffebc6facf0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileExW (0x7ffebb4311a0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked MoveFileWithProgressA (0x7ffebc742890) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked MoveFileWithProgressW (0x7ffebb4311f0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFileExW (0x7ffebb43e660) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked CopyFile2 (0x7ffebb43df30) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetPrivateProfileStringA (0x7ffebc730040) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetPrivateProfileStringW (0x7ffebc72ae10) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetPrivateProfileSectionA (0x7ffebc733710) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetPrivateProfileSectionW (0x7ffebc6ff0b0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked WritePrivateProfileStringA (0x7ffebc7332e0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked WritePrivateProfileStringW (0x7ffebc6fd2f0) in C:\WINDOWS\System32\KERNEL32.DLL type overwrite
- hooked GetFullPathNameA (0x7ffebb434c90) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetFullPathNameW (0x7ffebb35f950) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked FindFirstFileExW (0x7ffebb37d5c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked NtQueryFullAttributesFile (0x7ffebdc05c30) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryAttributesFile (0x7ffebdc039c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFile (0x7ffebdc038c0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtQueryDirectoryFileEx (0x7ffebdc05bb0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtOpenFile (0x7ffebdc03880) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtCreateFile (0x7ffebdc03cc0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtClose (0x7ffebdc03400) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked NtTerminateProcess (0x7ffebdc037a0) in C:\WINDOWS\SYSTEM32\ntdll.dll type overwrite
- hooked LoadLibraryExW (0x7ffebb35dc10) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- hooked GetModuleFileNameW (0x7ffebb3f78c0) in C:\WINDOWS\System32\KERNELBASE.dll type overwrite
- inithooks in process 12000 successful
- remove from tree xray_pierc.bkp
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.bkp
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.bkp
- remove from tree xray_pierc.log
- mapping file in vfs: g:\anomaly\appdata\logs\xray_pierc.bkp, G:\Anomaly\appdata\logs\xray_pierc.bkp
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.log
- Rerouting file open to location of deleted file: G:\Anomaly\appdata\logs\xray_pierc.log
- mapping file in vfs: g:\anomaly\appdata\logs\xray_pierc.log, G:\Anomaly\appdata\logs\xray_pierc.log
- mapping file in vfs: g:\anomaly\appdata\logs\xray_pierc_08-30-25_22-12-33.mdmp, G:\Anomaly\appdata\logs\xray_pierc_08-30-25_22-12-33.mdmp
- releasing hook context
- 3 users left
- releasing hook context
- 2 users left
Advertisement
Add Comment
Please, Sign In to add comment