Claim
A legitimate Vba32 AntiRootkit Scanner binary was used in the DLL side-loading mechanism and connected to command-and-control infrastructure.
“The name of the process was vba32arkit.exe”
“turned out to be a legitimate software called Vba32 AntiRootkit Scanner”
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:19:40.896704+00:00
claim:ep103:a53e00fd89dc