diff --git a/analyzer/windows/dll/capemon.dll b/analyzer/windows/dll/capemon.dll
index 545c5eec6eb..a1208a0d2dd 100755
Binary files a/analyzer/windows/dll/capemon.dll and b/analyzer/windows/dll/capemon.dll differ
diff --git a/analyzer/windows/dll/capemon_x64.dll b/analyzer/windows/dll/capemon_x64.dll
index 19ece530d26..c07524773ad 100755
Binary files a/analyzer/windows/dll/capemon_x64.dll and b/analyzer/windows/dll/capemon_x64.dll differ
diff --git a/changelog.md b/changelog.md
index c5fbf673e94..ea700bd1605 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,3 +1,6 @@
+### [15.07.2026]
+* Monitor update: Fix issue with NtWriteFile hook causing detonation failures (e.g. 9b1717eb154011b52aa24e4d6848976a9aafff2665f3171265aa767d5951be6c)
+
 ### [07.07.2026]
 * Monitor updates:
     * New hooks for SystemFunction036, SystemFunction040, SystemFunction041 (RtlGenRandom, RtlEncryptMemory, RtlDecryptMemory), Thread32First, Thread32Next, clipboard functions
diff --git a/installer/kvm-qemu.sh b/installer/kvm-qemu.sh
index f4f7af63908..23b7eaa30bd 100755
--- a/installer/kvm-qemu.sh
+++ b/installer/kvm-qemu.sh
@@ -115,6 +115,14 @@ src_fw_smbios_date="11\/03\/2018"
 # what to use as a replacement for QEMU in the tablet info (e.g., 'Wacom', 'Synaptics')
 PEN_REPLACER='<WOOT>'
 
+# fake PCI vendor ID to replace Red Hat's 0x1b36 (VEN_1B36) in include/hw/pci/pci.h
+# e.g.
+#   0x8086 = Intel
+#   0x1022 = AMD
+#   0x10de = NVIDIA
+PCI_VENDOR_ID_REPLACEMENT='0x8086'
+
+
 # what to use as a replacement for QEMU in the scsi disk info (e.g., 'Samsung', 'Seagate', 'WD')
 SCSI_REPLACER='<WOOT>'
 
@@ -782,6 +790,7 @@ function replace_qemu_clues_public() {
     _sed_aux 's/"BOCHS "/"ALASKA"/g' qemu*/include/hw/acpi/aml-build.h 'BOCHS was not replaced in block/bochs.c'
     _sed_aux 's/Bochs Pseudo/Intel RealTime/g' qemu*/roms/ipxe/src/drivers/net/pnic.c 'Bochs Pseudo was not replaced in roms/ipxe/src/drivers/net/pnic.c'
     _sed_aux 's/BXPC/'"$BXPC_REPLACER"'/g' qemu*/include/hw/acpi/aml-build.h 'BXPC was not replaced in include/hw/acpi/aml-build.h'
+    _sed_aux 's/define PCI_VENDOR_ID_REDHAT.*0x1b36/define PCI_VENDOR_ID_REDHAT             '"$PCI_VENDOR_ID_REPLACEMENT"'/' qemu*/include/hw/pci/pci.h 'PCI_VENDOR_ID_REDHAT was not replaced in include/hw/pci/pci.h'
 }
 
 function replace_seabios_clues_public() {